From 0443cf8aaab58a54c73d28cafca5d5d8a52605e6 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 1 Sep 2026 11:07:05 +0200 Subject: fix(node): CLI member invite now registers hub membership and enforces code Two bugs fixed: 1. `meshbay-node member invite ` created a local roster invite but never told the hub to add the user to group_members, so the group was invisible in the SPA. The node now calls POST /v1/groups/{id}/members/{username} after creating the invite, and the hub endpoint accepts node-scoped tokens (the admin_id check is the real authorization guard). 2. The WebRTC handshake let a previously-pinned user reconnect without a code even when a new invite was pending (e.g. after leave + re-invite). Now any pending invite forces code entry, regardless of existing member/pin status. Co-Authored-By: Claude Opus 4.6 --- .../src/meshbay_node/transport/webrtc_server.py | 31 +++++++++++----------- 1 file changed, 16 insertions(+), 15 deletions(-) (limited to 'packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py') diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py index 8402633..003cd23 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py +++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py @@ -1063,22 +1063,19 @@ class WebRTCPeerSession: status="active", approved_by="open-join", ) member = await roster.get_member(session_group, user_id) - if not member: - # A device this node already pinned — for another group, or an - # operator pairing — opening an invite-only group it has no row - # for. The device-linking `known` fast-path used to drop straight - # into `_join_ok`, which answered `not_authorized_for_group` and - # left a real invitee with no way to redeem the code they were - # sent. Tell them to enter it *only* when one is actually - # waiting for them here; a bare hub-invented pin, with nothing - # inviting it, still gets the flat refusal H3 relies on. + + # A pending invite means the operator explicitly re-invited this + # person — require the code even if they already have a member + # row (e.g. they left and were re-invited, or were revoked then + # re-invited). Without this gate a stale roster row lets them + # back in without proving they received the new code. + pending_invite = any( + i["user_id"] == user_id + and i["group_id"] in (session_group, "") + for i in await roster.list_invites()) + if pending_invite: if not code: - invited = any( - i["user_id"] == user_id - and i["group_id"] in (session_group, "") - for i in await roster.list_invites()) - self._join_refuse( - "code_required" if invited else "not_authorized_for_group") + self._join_refuse("code_required") return invite = await roster.consume_invite(code, user_id) if not invite: @@ -1095,6 +1092,10 @@ class WebRTCPeerSession: "via=code (device already known)") member = (await roster.get_member(session_group, user_id) or await roster.get_member(invite["group_id"], user_id)) + + if not member: + self._join_refuse("not_authorized_for_group") + return await self._join_ok( user_id, pk_x_raw, session_group, role=member["role"] if member else "", -- cgit v1.2.3