From 4b3e8c3b8b9d10c8ac333dd8db614a7569052472 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Mon, 10 Aug 2026 03:07:56 +0200 Subject: feat: Phase 7 — Node v2 (multi-group, Sender Keys, 0-RTT, chat, denylist) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Implements all 8 milestones (7.0-7.7): - 7.0: JWT carries `groups` claim; node verifies group membership at MNP handshake (QUIC + TCP+TLS). Resolves security review C2. - 7.1: QUIC 0-RTT session resumption via stored session tickets (17-21ms reconnect vs 47ms cold). - 7.2: Hub→node WebSocket signaling for NAT punch coordination (`client_incoming`/`punch_ready`) + jti denylist push. Denylist class blocks revoked users/jtis at handshake. - 7.3: Multi-group daemon — one QUIC port serves N groups with per-group GEK, shared_root, and index routing. - 7.4: HLS streaming via QUIC (STREAM_SEGMENT message type, ffmpeg segment extraction). - 7.5: Sender Keys protocol for group chat (Signal Groups approach). Each member has own sending chain key, HKDF chain ratchet, AES-256-GCM encryption, Ed25519 signing. Resolves security review C1. - 7.6: Chat store (SQLite via aiosqlite), CHAT_MESSAGE MNP wire type with peer broadcast, web UI with WebSocket push. - 7.7: Argon2id calibration CLI. First security review included (first-review.md). 109 tests, demo-v3 validated against meshbay.org production hub. Co-Authored-By: Claude Opus 4.6 --- packages/meshbay-node/src/meshbay_node/transport/__init__.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'packages/meshbay-node/src/meshbay_node/transport/__init__.py') diff --git a/packages/meshbay-node/src/meshbay_node/transport/__init__.py b/packages/meshbay-node/src/meshbay_node/transport/__init__.py index b3144a6..5a1b8d7 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/__init__.py +++ b/packages/meshbay-node/src/meshbay_node/transport/__init__.py @@ -6,15 +6,16 @@ from .http_server import create_http_app # QUIC transport (MNP v2) — requires aioquic>=1.0 # Falls back gracefully if not installed; node still works via TCP+TLS and HTTP. try: - from .quic_server import QuicChunkServer + from .quic_server import QuicChunkServer, Denylist from .quic_client import QuicChunkClient QUIC_AVAILABLE = True except ImportError: QuicChunkServer = None # type: ignore[assignment,misc] QuicChunkClient = None # type: ignore[assignment,misc] + Denylist = None # type: ignore[assignment,misc] QUIC_AVAILABLE = False __all__ = [ "ChunkServer", "ChunkClient", "create_http_app", - "QuicChunkServer", "QuicChunkClient", "QUIC_AVAILABLE", + "QuicChunkServer", "QuicChunkClient", "Denylist", "QUIC_AVAILABLE", ] -- cgit v1.2.3