From 90c69477d5f701158112b3c294eff26312f89da6 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Fri, 25 Sep 2026 17:10:15 +0200 Subject: feat: invitation links no longer bound to an e-mail address MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A link is redeemable by whoever opens it first, so it can be sent by any messaging app. The address is optional (mail + label only); a link lives 7 days, fixed. Adds a Share button; see MESHBAY_DESIGN.md §3.4. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-node/src/meshbay_node/roster.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'packages/meshbay-node/src/meshbay_node/roster.py') diff --git a/packages/meshbay-node/src/meshbay_node/roster.py b/packages/meshbay-node/src/meshbay_node/roster.py index 80bf16d..8144373 100644 --- a/packages/meshbay-node/src/meshbay_node/roster.py +++ b/packages/meshbay-node/src/meshbay_node/roster.py @@ -54,6 +54,10 @@ CODE_LEN = 8 # 8 × 5 bits = 40 bits of entropy # node-wide lockout. DEFAULT_INVITE_TTL = 7 * 24 * 3600 # seconds — member invitations DEFAULT_PAIR_TTL = 24 * 3600 # seconds — operator pairing +# An invitation link is a bearer secret that may travel through any messaging +# service, so its lifetime is fixed rather than the operator's setting: the +# hub clamps its ticket to the same seven days. +LINK_INVITE_TTL = 7 * 24 * 3600 # A device-add code is read off one screen and typed into another, in one # sitting. An hour is comfort, not security: the code is bound to the requesting # keys by its hash, so a longer window widens nothing an attacker can use. @@ -1109,7 +1113,7 @@ class Roster: return code async def create_link_invite( - self, group_id: str, created_by: str, ttl: int = DEFAULT_INVITE_TTL, + self, group_id: str, created_by: str, ttl: int = LINK_INVITE_TTL, ) -> tuple[str, str, str]: """ Issue a code bound to no account: `(code, invite_id, expires_at)`. -- cgit v1.2.3