From 1dcedc77083b908b7b3b431bad679a4813884355 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 10 Sep 2026 17:23:40 +0200 Subject: refactor(mnp)!: one answer to "may this member write", and it is the root MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The group-wide `member_upload` switch is gone: the message, the signed operation, the field on the handshake ack, the `upload` alias on every root in the index payload, and the client's fallback path to it. Whether a member may write has been a property of each root for a while, and that is the model that survives: a single flag over the group cannot express "this library is published read-only and that folder is a drop box", which is the ordinary arrangement. What was left of the switch was a handler that logged a deprecation and acted on nothing, and a client that read `ack.member_upload` whenever the roots carried no `writable` — a second source for one question, with whichever the code consulted first deciding it. `roots.describe()` drops `upload` for the same reason: it was `writable` under an older name, and two names for one boolean is one too many. The paperclip now says "nowhere to write" rather than picking a root, in a group that has none writable. That is the honest answer; the fallback picked whatever came first and failed at send time. Node suite 1215 passed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01AsoWC3GmhNdwVFomW3QjH3 --- .../tests/test_root_writable_policy.py | 36 +++++++++++++--------- 1 file changed, 22 insertions(+), 14 deletions(-) (limited to 'packages/meshbay-node/tests/test_root_writable_policy.py') diff --git a/packages/meshbay-node/tests/test_root_writable_policy.py b/packages/meshbay-node/tests/test_root_writable_policy.py index 8345880..730e636 100644 --- a/packages/meshbay-node/tests/test_root_writable_policy.py +++ b/packages/meshbay-node/tests/test_root_writable_policy.py @@ -1,10 +1,11 @@ """ Who may write to the operator's disk, now that RO/RW on the root decides it. -This replaces `test_member_upload_policy.py`. The old model had two orthogonal -controls — one root designated as the upload target, and a group-wide -`member_upload` switch — and collapsed into one property per root: `writable`. -The properties worth keeping from the old file survive the change unaltered: +One property per root — `writable` — and no second control anywhere: not a +group-wide switch, not a designated upload target. Two controls for one question +is a question answered differently depending on which is read first. + +The properties this holds: * the interface hiding a control is a courtesy to the people who are not trying; **the node refusing is the part that holds** against someone who is. @@ -220,25 +221,32 @@ async def test_a_request_with_nobody_to_authorize_it_is_refused(tmp_path): assert [m for m in session.sent if m.get("type") == "error"] -# ── The deprecated message must not still work ─────────────────────────────── +# ── There is no group-wide upload switch ───────────────────────────────────── -async def test_the_old_member_upload_message_changes_nothing(tmp_path): +async def test_no_message_can_reopen_uploads_for_a_whole_group(tmp_path): """ - MNP still parses `member_upload` so an old client gets an answer instead of - a dropped request. What it must not do is act: this instruction could - reopen uploads for a whole group, and a client old enough to send it is - exactly one that knows nothing about read-only roots. + Whether a member may write is a property of each root, and there is no + second way to say it. + + A group-wide switch is the thing this model replaced, and it cannot come + back by accident: the type does not exist, so a peer asking for it is a peer + the dispatcher logs and ignores. What must never happen is what a switch + would have allowed — one instruction turning a published, read-only library + into a writable one. """ + assert not hasattr(MNP, "MEMBER_UPLOAD"), ( + "a group-wide upload switch is back in the protocol") + session = _session(tmp_path, "member-1", writable=False) session._has_admin_authority = lambda: True issued = _capture_challenges(session) - session._do_member_upload({"allowed": True}) + session._dispatch_message({"type": "member_upload", "allowed": True}) - assert issued == [], "a deprecated instruction asked to be signed" + assert issued == [], "an unknown instruction asked to be signed" assert session._ctx["roots"].roots[0].writable is False - acks = [m for m in session.sent if m.get("type") == MNP.MEMBER_UPLOAD_ACK] - assert acks and acks[0].get("deprecated") is True + assert not [m for m in session.sent if "upload" in str(m.get("type"))], ( + "the node answered an instruction it does not implement") # And the door is still shut. _upload(session) -- cgit v1.2.3