From 0443cf8aaab58a54c73d28cafca5d5d8a52605e6 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 1 Sep 2026 11:07:05 +0200 Subject: fix(node): CLI member invite now registers hub membership and enforces code Two bugs fixed: 1. `meshbay-node member invite ` created a local roster invite but never told the hub to add the user to group_members, so the group was invisible in the SPA. The node now calls POST /v1/groups/{id}/members/{username} after creating the invite, and the hub endpoint accepts node-scoped tokens (the admin_id check is the real authorization guard). 2. The WebRTC handshake let a previously-pinned user reconnect without a code even when a new invite was pending (e.g. after leave + re-invite). Now any pending invite forces code entry, regardless of existing member/pin status. Co-Authored-By: Claude Opus 4.6 --- packages/meshbay-node/src/meshbay_node/hub_client.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'packages/meshbay-node/src/meshbay_node/hub_client.py') diff --git a/packages/meshbay-node/src/meshbay_node/hub_client.py b/packages/meshbay-node/src/meshbay_node/hub_client.py index 1a746bd..1ed1662 100644 --- a/packages/meshbay-node/src/meshbay_node/hub_client.py +++ b/packages/meshbay-node/src/meshbay_node/hub_client.py @@ -240,6 +240,21 @@ class HubClient: r.raise_for_status() return r.json() + # ── Group membership ─────────────────────────────────────────────────── + + async def add_group_member(self, group_id: str, username: str) -> dict: + """Register a user as a hub member of a group (admin only).""" + if self._session is None: + raise RuntimeError("Not logged in") + await self.ensure_fresh_token() + + r = await self._http.post( + f"/v1/groups/{group_id}/members/{username}", + headers=self._session.auth_headers, + ) + r.raise_for_status() + return r.json() + # ── Persistent WebSocket (signaling + revocations) ────────────────────── async def send_ws(self, data: str) -> None: -- cgit v1.2.3