From 413837a0845240241ed7e9d9ac1f3b1dc45a2f40 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Sun, 13 Sep 2026 22:14:47 +0200 Subject: fix(hub): federation is closed until two hubs have run it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every MHP route answers a stated 503. `federation.FEDERATION_ENABLED` is the only thing that decides it, applied as a dependency on the router so the six routes that exist and any added later are covered by construction — a gate you have to remember to write in each handler is the shape C6 is the standing lesson about. The protocol is not what is wrong with it. What is wrong is that nothing has ever run it: two hubs have never completed one authenticated request between them. AV14 was two defects in the same path — an issuer signing with a key bound before it was loaded, naming itself after the reference deployment whatever the instance was called, and a verifier naming no audience for the `aud` the issuer sets, which PyJWT refuses outright. Both stood for a month behind a green suite, and both were found by reading rather than by running, because a second implementation of a peer proves the protocol and nothing about two machines. Four of the six routes carry no authentication of their own — the MHP token is the authentication — and two of those write, a directory push and a revocation. That is the surface being closed until somebody stands up a second hub. A constant and not a `hub_settings` row, deliberately: a switch in the admin panel invites an operator to turn on a feature that has never worked between two machines, where this takes an edit, a deploy, and reading the comment above it. `/v1/hub/info` reports the state, because the `mhp_version` beside it would otherwise be a claim the hub does not honour. The protocol tests open the gate for their own duration and say why; the one that runs with the flag as it ships asserts all six routes refuse. §7.6 states the closure, §15.2 carries federation between two hubs as not built. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01UMxEQadpzPkYLFf5CYKhpW --- packages/meshbay-hub/tests/test_federation.py | 41 ++++++++++++++++++++++ .../meshbay-hub/tests/test_public_groups_toggle.py | 13 ++++++- 2 files changed, 53 insertions(+), 1 deletion(-) (limited to 'packages/meshbay-hub/tests') diff --git a/packages/meshbay-hub/tests/test_federation.py b/packages/meshbay-hub/tests/test_federation.py index 54f86a7..17d4161 100644 --- a/packages/meshbay-hub/tests/test_federation.py +++ b/packages/meshbay-hub/tests/test_federation.py @@ -4,6 +4,17 @@ MHP federation — what a registered peer hub may and may not do. A peer is trusted enough to advertise its own public groups into our directory and to withdraw them. It is not trusted to speak for a third hub, to shadow a local group, to revoke our users, or to replay a state-changing request. + +**Federation is switched off in the code** (`federation.FEDERATION_ENABLED`), +so every route answers 503 as the hub ships. These tests open it for their own +duration and exercise the protocol underneath, which is what will be wanted the +day it is re-opened — and they are also the reason it is closed. They pass, and +they passed while two hubs could not complete one authenticated request between +them: a second implementation of a peer proves the protocol and nothing about +two machines, which is the same sentence this repo already writes about a +second implementation of the client. + +The one test that runs with the gate as it ships is the first one below. """ import base64 @@ -18,6 +29,36 @@ from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey from meshbay_hub.api.deps import set_admin_usernames +@pytest.fixture(autouse=True) +def _federation_open(monkeypatch): + """Open the gate for the protocol tests, and only for them.""" + from meshbay_hub.api import federation + monkeypatch.setattr(federation, "FEDERATION_ENABLED", True) + + +async def test_every_mhp_route_is_closed_as_the_hub_ships(client, monkeypatch): + """The gate itself, with the flag as it ships. + + Four of these six take no authentication of their own — the MHP token is + the authentication — and two of them write. A refusal that has to be + written into each handler is one somebody adds a route without; this is a + dependency on the router, so a route added later is closed before it is + written. + """ + from meshbay_hub.api import federation + monkeypatch.setattr(federation, "FEDERATION_ENABLED", False) + + for method, path in (("get", "/mhp/info"), + ("get", "/mhp/directory"), + ("post", "/mhp/directory"), + ("post", "/mhp/revoke"), + ("get", "/mhp/peers"), + ("post", "/mhp/peers")): + r = await getattr(client, method)(path, **({} if method == "get" else {"json": {}})) + assert r.status_code == 503, f"{method.upper()} {path}: {r.status_code}" + assert "not enabled" in r.text + + def _auth_key(password: str, username: str) -> str: salt = hashlib.sha256(f"meshbay:auth:v1:{username}".encode()).digest() return base64.b64encode( diff --git a/packages/meshbay-hub/tests/test_public_groups_toggle.py b/packages/meshbay-hub/tests/test_public_groups_toggle.py index e52fa85..2a57429 100644 --- a/packages/meshbay-hub/tests/test_public_groups_toggle.py +++ b/packages/meshbay-hub/tests/test_public_groups_toggle.py @@ -228,7 +228,18 @@ def _mhp_token(hub_id): @pytest.mark.asyncio -async def test_disabled_empties_the_federation_export(client): +async def test_disabled_empties_the_federation_export(client, monkeypatch): + """What the export advertises, for the day federation re-opens. + + MHP is switched off in the code and every route answers 503 + (`federation.FEDERATION_ENABLED`, §7.6), so this opens the gate for its own + duration. The subject is the public-groups switch, not federation: with + public groups off, the export must advertise nothing, and that has to stay + true whether the door is open today or not. + """ + from meshbay_hub.api import federation + monkeypatch.setattr(federation, "FEDERATION_ENABLED", True) + admin = await _admin(client) owner = await _user(client, "ivan") await _create_public(client, owner, "exported-square") -- cgit v1.2.3