From 375ad7d0435a176ad593a32045a5f0182a36d505 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Sun, 20 Sep 2026 18:56:58 +0200 Subject: fix: removing someone who never redeemed their invitation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A member row appears only when a code is consumed, so revoking someone invited to the wrong group was refused for having no row — and the node's refusal aborted the browser's removal before its hub half, leaving them a member everywhere with a live code. Revoking now cancels unredeemed codes for that group, and a node refusal no longer cancels the hub removal. Co-Authored-By: Claude Opus 5 --- packages/meshbay-node/tests/test_roster_pairing.py | 104 +++++++++++++++++++++ 1 file changed, 104 insertions(+) (limited to 'packages/meshbay-node/tests/test_roster_pairing.py') diff --git a/packages/meshbay-node/tests/test_roster_pairing.py b/packages/meshbay-node/tests/test_roster_pairing.py index 82336e2..91191c1 100644 --- a/packages/meshbay-node/tests/test_roster_pairing.py +++ b/packages/meshbay-node/tests/test_roster_pairing.py @@ -1160,6 +1160,110 @@ async def test_revoking_is_confined_to_the_group_it_was_asked_for(tmp_path, rost "the pinned identity was dropped; that is `member unpin`, not this") +async def test_revoking_someone_who_never_redeemed_their_code(tmp_path, roster): + """ + An invitation sent to the wrong person is the case removal has to cover. + + A member row exists only once a code is consumed, so until then there is + nothing for `set_status` to update, and this answered "no such member in + that group" — a refusal that stopped the browser before it reached the hub + half, leaving the person a member there and their code live. Nothing else + offered to take either back. + """ + from meshbay_common.adminop import admin_transcript + + sk_op, pk_op, pk_x_op = _keypair() + await roster.pin_identity("grenet", "grenet", pk_op, pk_x_op, "code") + await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli") + + code = await roster.create_invite( + group_id="g1", user_id="misinvited", role=ROLE_MEMBER, + created_by="grenet", username="misinvited") + assert await roster.get_member("g1", "misinvited") is None + + session = _session(tmp_path, roster, group_id="g1", gek=generate_gek()) + session._admin_ops = {} + session._ctx["has_admin_authority"] = True + session._ctx["peers"] = {} + + transcript = admin_transcript( + op="member_revoke", node_pk_b64=session._node_pk_b64(), group_id="g1", + subject="misinvited", nonce=b"\x55" * 32, ts=int(time.time())) + await session._admin_exec_member_revoke( + {"op": "member_revoke", "subject": "misinvited"}, transcript, + sk_op.sign(transcript)) + + assert _last(session)["type"] == "member_revoke_ack", ( + f"the node refused: {_last(session).get('detail')!r}") + # The half that matters: the code that was emailed out no longer works. + assert await roster.consume_invite(code, "misinvited") is None + assert [i for i in await roster.list_invites() + if i["user_id"] == "misinvited"] == [] + + +async def test_revoking_does_not_cancel_their_invitation_to_another_group( + tmp_path, roster): + """ + Inviting somebody to the wrong group and then to the right one is one + errand, not two, and undoing the first must not undo the second — the + second code has usually not been redeemed yet when the mistake is noticed. + """ + from meshbay_common.adminop import admin_transcript + + sk_op, pk_op, pk_x_op = _keypair() + await roster.pin_identity("grenet", "grenet", pk_op, pk_x_op, "code") + await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli") + + await roster.create_invite(group_id="g1", user_id="misinvited", + role=ROLE_MEMBER, created_by="grenet") + keeper = await roster.create_invite(group_id="g2", user_id="misinvited", + role=ROLE_MEMBER, created_by="grenet") + + session = _session(tmp_path, roster, group_id="g1", gek=generate_gek()) + session._admin_ops = {} + session._ctx["has_admin_authority"] = True + session._ctx["peers"] = {} + + transcript = admin_transcript( + op="member_revoke", node_pk_b64=session._node_pk_b64(), group_id="g1", + subject="misinvited", nonce=b"\x66" * 32, ts=int(time.time())) + await session._admin_exec_member_revoke( + {"op": "member_revoke", "subject": "misinvited"}, transcript, + sk_op.sign(transcript)) + + assert _last(session)["type"] == "member_revoke_ack" + assert await roster.consume_invite(keeper, "misinvited") is not None, ( + "the invitation to the other group was cancelled as well") + + +async def test_revoking_a_stranger_is_still_refused(tmp_path, roster): + """ + Neither a member row nor a code: the 404 is what tells an operator they + named the wrong person or the wrong group, and dropping it would make every + typo look like a removal. + """ + from meshbay_common.adminop import admin_transcript + + sk_op, pk_op, pk_x_op = _keypair() + await roster.pin_identity("grenet", "grenet", pk_op, pk_x_op, "code") + await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli") + + session = _session(tmp_path, roster, group_id="g1", gek=generate_gek()) + session._admin_ops = {} + session._ctx["has_admin_authority"] = True + session._ctx["peers"] = {} + + transcript = admin_transcript( + op="member_revoke", node_pk_b64=session._node_pk_b64(), group_id="g1", + subject="nobody", nonce=b"\x77" * 32, ts=int(time.time())) + await session._admin_exec_member_revoke( + {"op": "member_revoke", "subject": "nobody"}, transcript, + sk_op.sign(transcript)) + + assert _last(session)["type"] == "error" + assert "No such member" in _last(session)["detail"] + + async def test_an_operator_cannot_revoke_themselves(tmp_path, roster): """It would leave the group with nobody able to invite or remove.""" session = _session(tmp_path, roster, group_id="g1", gek=generate_gek()) -- cgit v1.2.3