From 07ff8b4f6143039fcc74b8cf7c423282bce093c1 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 10 Sep 2026 17:49:58 +0200 Subject: refactor(mnp)!: one operation for an app's folders, not one per app MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `video_root`, `audio_root` and `photo_roots` are gone — the messages, the signed operations, the handlers, the `ops` wrappers, the three scalars on the handshake ack, and the client's handlers for their acks. `app_directories` does the same thing for every application, keyed by the app's own registry name, and it is what the SPA has been sending. The three were the same instruction three times, differing only in the key they wrote and whether they carried a string or a list. That shape is what made adding an application mean adding a message type, an op, a handler and a widget; it also meant three validation paths, and the older ones validated nothing — a typo was stored and then quietly matched no entry, an app showing an empty tab with no way to tell "misconfigured" from "no files yet". **What stays, and why.** `Roster.LEGACY_DIR_KEYS` still reads `video_root` and friends out of `group_settings`: that is a key on an operator's disk, not on the wire, and a node upgraded into this must find its own configuration. The Search page still reads its own older cache keys, for the same reason — the cache outlives a deploy. `CTX_ALIASES` keeps only `chat`, which is the one app whose second name something still reads. The two per-app policy test files go with the messages. What only they held — the real challenge/response path from message to database, which no other test exercises — is retargeted at `app_directories` in `test_app_directories_signed.py`, and the handler's own refusals (unknown app, malformed `directories`, nobody to authorize it) join `test_app_directories.py`. Node and common suites 1368 passed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01AsoWC3GmhNdwVFomW3QjH3 --- .../meshbay-node/tests/test_app_directories.py | 104 ++++++++- .../tests/test_app_directories_signed.py | 148 ++++++++++++ .../tests/test_audio_root_gates_enrichment.py | 5 +- .../meshbay-node/tests/test_audio_root_policy.py | 260 --------------------- .../tests/test_video_root_gates_enrichment.py | 5 +- .../meshbay-node/tests/test_video_root_policy.py | 144 ------------ 6 files changed, 246 insertions(+), 420 deletions(-) create mode 100644 packages/meshbay-node/tests/test_app_directories_signed.py delete mode 100644 packages/meshbay-node/tests/test_audio_root_policy.py delete mode 100644 packages/meshbay-node/tests/test_video_root_policy.py (limited to 'packages/meshbay-node/tests') diff --git a/packages/meshbay-node/tests/test_app_directories.py b/packages/meshbay-node/tests/test_app_directories.py index 3ede1b6..69b3be5 100644 --- a/packages/meshbay-node/tests/test_app_directories.py +++ b/packages/meshbay-node/tests/test_app_directories.py @@ -26,10 +26,14 @@ from types import SimpleNamespace import pytest from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey +from meshbay_common.adminop import OP_APP_DIRECTORIES from meshbay_node import ops from meshbay_node.indexer.group_index import GroupIndex from meshbay_node.roots import RootSet from meshbay_node.roster import Roster +from meshbay_node.transport.webrtc_server import WebRTCPeerSession + +from conftest import one_root pytestmark = pytest.mark.asyncio @@ -157,11 +161,11 @@ async def test_a_directory_on_an_unplugged_drive_can_still_be_configured(tmp_pat # ── The derived scalar ─────────────────────────────────────────────────────── -async def test_the_legacy_scalar_follows_the_list_in_the_live_context(tmp_path): +async def test_the_list_is_what_the_live_context_carries(tmp_path): """ - `video_root` rides on the handshake ack for MNP 1.0 clients and is read - from the group context. Left behind by a save, it would disagree with the - list until the next restart. + One name per app in the group context, and it is the list. A second name + for the same idea is a second thing a save has to update, and the one it + forgets disagrees until the next restart. """ state, roster = await _state(tmp_path) ctx = state["groups_ctx"][GROUP] @@ -169,26 +173,33 @@ async def test_the_legacy_scalar_follows_the_list_in_the_live_context(tmp_path): await ops.set_app_directories(state, GROUP, "video", ["Media/Films", "Media/Albums"]) assert ctx["video_directories"] == ["Media/Albums", "Media/Films"] - assert ctx["video_root"] == "Media/Albums", ( - "the scalar must be the first of the list, not a stale value") + assert "video_root" not in ctx, ( + "a scalar nothing reads is a scalar that can go stale unnoticed") await ops.set_app_directories(state, GROUP, "video", []) - assert ctx["video_root"] == "" + assert ctx["video_directories"] == [] finally: await roster.close() -async def test_the_photo_alias_stays_a_list_and_chat_stays_a_string(tmp_path): - """The alias table has to carry the shape, not just the name.""" +async def test_chat_is_also_published_under_the_name_the_ack_uses(tmp_path): + """ + Chat has one destination and the handshake ack publishes it as + `chat_directory`, which the paperclip reads. That second name is derived + from the list on every save, never stored beside it. + """ state, roster = await _state(tmp_path) ctx = state["groups_ctx"][GROUP] try: - await ops.set_app_directories(state, GROUP, "photo", - ["Media/Films", "Media/Albums"]) - assert ctx["photo_roots"] == ["Media/Albums", "Media/Films"] await ops.set_app_directory(state, GROUP, "chat", "Media", require_writable=True) assert ctx["chat_directory"] == "Media" + assert ctx["chat_directories"] == ["Media"] + + await ops.set_app_directories(state, GROUP, "photo", + ["Media/Films", "Media/Albums"]) + assert ctx["photo_directories"] == ["Media/Albums", "Media/Films"] + assert "photo_roots" not in ctx finally: await roster.close() @@ -290,3 +301,72 @@ async def test_setting_link_previews_updates_the_live_context(tmp_path): assert state["groups_ctx"][GROUP]["chat_link_preview"] is False finally: await roster.close() + + +# ── The handler, before any signature ──────────────────────────────────────── +# +# `_do_app_directories` refuses three things up front and asks for a signature +# for everything else. The paths are not among the three: `_validate_app_dirs` +# checks those after the signature, deliberately (a settings change is not a +# capability), and `test_app_directories_signed.py` drives that whole path. + +def _handler_session(tmp_path, *, authorized: bool) -> WebRTCPeerSession: + shared = tmp_path / "shared" + (shared / "Films").mkdir(parents=True, exist_ok=True) + index = GroupIndex(group_id=GROUP, sk_node=Ed25519PrivateKey.generate()) + session = WebRTCPeerSession.__new__(WebRTCPeerSession) + session._ctx = {"roots": one_root(shared), "index": index, + "sk_node": index.sk_node} + session._group_id = GROUP + session._user_id = "op" + session.sent = [] + session._send = session.sent.append + session._audit = lambda *a, **k: None + session._has_admin_authority = lambda: authorized + session.issued = [] + session._issue_admin_challenge = lambda op, subject: session.issued.append( + (op, subject)) + return session + + +async def test_an_app_this_node_does_not_know_is_refused(tmp_path): + """A client-supplied key is otherwise a way to write arbitrary rows into + `group_settings`.""" + session = _handler_session(tmp_path, authorized=True) + session._do_app_directories({"app": "../etc", "directories": ["shared"]}) + assert session.issued == [] + assert [m for m in session.sent if m.get("type") == "error"] + + +@pytest.mark.parametrize("dirs", [None, "shared/Films", [1], {"a": 1}]) +async def test_directories_that_are_not_a_list_of_strings_are_refused(tmp_path, dirs): + session = _handler_session(tmp_path, authorized=True) + session._do_app_directories({"app": "video", "directories": dirs}) + assert session.issued == [] + assert [m for m in session.sent if m.get("type") == "error"] + + +async def test_a_request_with_nobody_to_authorize_it_is_refused(tmp_path): + """No operator key on this node's roster means no signature can ever + arrive, so asking for one would be a dialog that cannot be completed.""" + session = _handler_session(tmp_path, authorized=False) + session._do_app_directories({"app": "video", "directories": ["shared/Films"]}) + assert session.issued == [] + assert [m for m in session.sent if m.get("type") == "error"] + + +async def test_the_subject_names_the_app_and_the_cleaned_paths(tmp_path): + """What the operator is shown before signing has to say which application + is about to be pointed where — two apps' challenges are otherwise + indistinguishable — and it must match what the node will store.""" + session = _handler_session(tmp_path, authorized=True) + session._do_app_directories( + {"app": "video", "directories": ["/b/", "a", "a", ""]}) + assert session.issued == [(OP_APP_DIRECTORIES, "video:a,b")] + + +async def test_an_empty_set_is_signable(tmp_path): + """Clearing an app's folders is an instruction like any other.""" + session = _handler_session(tmp_path, authorized=True) + session._do_app_directories({"app": "video", "directories": []}) + assert session.issued == [(OP_APP_DIRECTORIES, "video:")] diff --git a/packages/meshbay-node/tests/test_app_directories_signed.py b/packages/meshbay-node/tests/test_app_directories_signed.py new file mode 100644 index 0000000..eda09d8 --- /dev/null +++ b/packages/meshbay-node/tests/test_app_directories_signed.py @@ -0,0 +1,148 @@ +""" +Pointing an application at folders, through the real signed-op path. + +`app_directories` is one operator instruction for every application, keyed by +the app's own name. What only this file can check is the path from the message +to the database: everything else either calls `ops.set_app_directories` +directly or mocks out `_issue_admin_challenge`, and neither one exercises real +signature verification (`_verify_admin_sig`, `_do_admin_response`) or the shared +groups_ctx/roster wiring `_run_op` depends on. + +Found live, on the per-app op this replaced: a save that looked like it worked — +the Music tab showed content right afterwards — did not survive a reload. Worth +ruling out a break in that real path specifically, and not just in the setter. + +Note what is deliberately *not* checked before the challenge: whether the path +exists. `_do_app_directories` validates the app name and the shape of +`directories`, then asks for a signature; `ops._validate_app_dirs` refuses a +path outside the group's roots afterwards. A settings change is not a +capability, so refusing after the signature costs a round trip and nothing else. +""" + +import base64 +from pathlib import Path + +import pytest +from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey + +from meshbay_common.adminop import OP_APP_DIRECTORIES, admin_transcript +from meshbay_common.crypto import pk_to_b64 +from meshbay_common.join import ROLE_OPERATOR +from meshbay_node.indexer.group_index import GroupIndex +from meshbay_node.roster import open_roster +from meshbay_node.transport.webrtc_server import WebRTCPeerSession + +from conftest import one_root + +pytestmark = pytest.mark.asyncio + +# Session shape mirrors test_admin_ops_mnp.py's _session helper. + +GROUP = "g" * 32 + + +def _keypair(): + sk = Ed25519PrivateKey.generate() + return sk, pk_to_b64(sk.public_key()) + + +async def _full_session(tmp_path: Path, roster) -> tuple[WebRTCPeerSession, Ed25519PrivateKey]: + shared = tmp_path / "shared" + (shared / "Music").mkdir(parents=True) + index = GroupIndex(group_id=GROUP, sk_node=Ed25519PrivateKey.generate()) + roots = one_root(shared) + + sk_op, pk_op = _keypair() + await roster.pin_identity("grenet", "grenet", pk_op, pk_op, "code") + await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli") + + group_ctx = {"gek": b"\x01" * 32, "roots": roots, "index": index, + "join_policy": "invite", "music_directories": []} + state = { + "groups_ctx": {GROUP: group_ctx}, + "roster": roster, + "node_user_id": "node-user", + } + + session = WebRTCPeerSession.__new__(WebRTCPeerSession) + session._ctx = { + "roots": roots, "index": index, "sk_node": index.sk_node, + "roster": roster, "groups": {GROUP: group_ctx}, + "has_admin_authority": True, + "daemon_state": state, + } + session._group_id = GROUP + session._user_id = "grenet" + session._pk_user = "" + session._admin_ops = {} + session.sent = [] + session._send = session.sent.append + session._audit = lambda *a, **k: None + session.spawned = [] + session._spawn = session.spawned.append + # A real session registers itself here on handshake completion + # (`self._peer_registry()[self._user_id] = self`) — without it, the + # broadcast loop in _admin_exec_audio_root (and every other admin op) + # has nobody to send the final ack to, including the requester itself. + group_ctx["_peers"] = {"grenet": session} + session._peer_registry = lambda: group_ctx["_peers"] + return session, sk_op + + +async def _drain(session): + for coro in session.spawned: + await coro + session.spawned.clear() + + +async def test_a_real_signed_save_persists_and_survives_a_fresh_roster_read(tmp_path): + """ + The exact question a "worked, then reverted after reload" report raises: + does the value set through the real challenge/response path actually + land in the database, in a form any later connection — this one, or a + freshly-opened Roster after a restart — reads back correctly? + """ + roster = await open_roster(tmp_path) + try: + session, sk_op = await _full_session(tmp_path, roster) + + session._do_app_directories( + {"app": "music", "directories": ["shared/Music"]}) + challenge = session.sent[-1] + assert challenge["type"] == "admin_challenge", challenge + + transcript = admin_transcript( + op=OP_APP_DIRECTORIES, node_pk_b64=session._node_pk_b64(), + group_id=GROUP, subject="music:shared/Music", + nonce=base64.b64decode(challenge["nonce"]), + ts=challenge["ts"]) + session._do_admin_response({ + "op_id": challenge["op_id"], + "signature": base64.b64encode(sk_op.sign(transcript)).decode(), + }) + await _drain(session) + + ack = session.sent[-1] + assert ack["type"] == "app_directories_ack", ack + assert ack["app"] == "music" + assert ack["directories"] == ["shared/Music"] + + assert (session._ctx["groups"][GROUP]["music_directories"] + == ["shared/Music"]), ( + "the live in-memory context must reflect the new folder at once") + assert await roster.app_directories(GROUP, "music") == ["shared/Music"], ( + "the same Roster instance must read back what it just wrote") + finally: + await roster.close() + + # A fresh connection (or a restarted daemon) never touches the Roster + # instance above at all — it opens its own. This is the check that + # actually answers "does it survive a reload". + reopened = await open_roster(tmp_path) + try: + assert await reopened.app_directories(GROUP, "music") == ["shared/Music"], ( + "a freshly-opened Roster against the same db file must see the " + "committed value — anything else means the write was never " + "durable in the first place") + finally: + await reopened.close() diff --git a/packages/meshbay-node/tests/test_audio_root_gates_enrichment.py b/packages/meshbay-node/tests/test_audio_root_gates_enrichment.py index 5a8f9b1..d353d27 100644 --- a/packages/meshbay-node/tests/test_audio_root_gates_enrichment.py +++ b/packages/meshbay-node/tests/test_audio_root_gates_enrichment.py @@ -8,7 +8,7 @@ against a real messy library, where everything under every shared folder got mixed together with no way to scope Music down to just the actual music library. -Setting or changing the root (ops.set_audio_root) fires a one-off sweep +Setting or changing the folder (ops.set_app_directory) fires a one-off sweep (_enrich_audio_root_now) of whatever it already contains — same shape as _enrich_video_root_now. """ @@ -147,7 +147,8 @@ async def test_setting_the_audio_root_sweeps_what_it_already_contains(tmp_path): "groups_ctx": {group_id: {"roots": one_root(shared)}}, "enrich_app_dirs_fns": {"music": daemon._enrich_audio_root_now}, } - await ops.set_audio_root(state, group_id, "shared/Music") + await ops.set_app_directory(state, group_id, "music", + "shared/Music") await asyncio.sleep(0.05) # let the fire-and-forget sweep actually run entry = next(iter(indexer.index.entries)) diff --git a/packages/meshbay-node/tests/test_audio_root_policy.py b/packages/meshbay-node/tests/test_audio_root_policy.py deleted file mode 100644 index e2e9254..0000000 --- a/packages/meshbay-node/tests/test_audio_root_policy.py +++ /dev/null @@ -1,260 +0,0 @@ -""" -Which folder (possibly a subfolder of a shared root) is the Music app's -entry point for a group. Same shape as test_video_root_policy.py — a -signed operator instruction, per-group, stored via roster.py's -group_settings table, added later once a real messy library showed -musicbay.md's original "no root, whole shared tree" call was wrong. -""" - -import base64 -from pathlib import Path - -import pytest -from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey - -from meshbay_common.adminop import OP_AUDIO_ROOT, admin_transcript -from meshbay_common.crypto import pk_to_b64 -from meshbay_common.join import ROLE_OPERATOR -from meshbay_node.indexer.group_index import GroupIndex -from meshbay_node.roster import Roster, open_roster -from meshbay_node.transport.webrtc_server import WebRTCPeerSession - -from conftest import one_root - -pytestmark = pytest.mark.asyncio - - -def _session(tmp_path: Path, user_id: str, *, operator: str | None = None) -> WebRTCPeerSession: - shared_root = tmp_path / "shared" - shared_root.mkdir(exist_ok=True) - (shared_root / "Music").mkdir() - (shared_root / "Podcasts").mkdir() - index = GroupIndex(group_id="g" * 32, sk_node=Ed25519PrivateKey.generate()) - ctx = { - "roots": one_root(shared_root), - "index": index, - "sk_node": index.sk_node, - "node_user_id": operator, - } - session = WebRTCPeerSession.__new__(WebRTCPeerSession) - session._ctx = ctx - session._group_id = None - session._user_id = user_id - session._pk_user = "" - session.sent = [] - session._send = session.sent.append - session._audit = lambda *a, **k: None - return session - - -# ── Refused before a challenge is even issued ─────────────────────────────── - -async def test_missing_path_is_refused(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_audio_root({}) - - assert not issued - assert [m for m in session.sent if m.get("type") == "error"] - - -async def test_a_nonexistent_folder_is_refused(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_audio_root({"path": "shared/Nonexistent"}) - - assert not issued, "a mistyped path must be refused before a signature round trip" - assert [m for m in session.sent if m.get("type") == "error"] - - -async def test_path_traversal_is_refused(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_audio_root({"path": "../../etc"}) - - assert not issued - assert [m for m in session.sent if m.get("type") == "error"] - - -async def test_a_request_with_nobody_to_authorize_it_is_refused(tmp_path): - session = _session(tmp_path, "member-1", operator="the-operator") - session._has_admin_authority = lambda: False - - session._do_audio_root({"path": "shared/Music"}) - - assert [m for m in session.sent if m.get("type") == "error"] - - -# ── Accepted cases ─────────────────────────────────────────────────────────── - -async def test_an_empty_path_is_always_accepted(tmp_path): - """Empty means 'unset' — Music shows nothing yet, always valid to clear.""" - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_audio_root({"path": ""}) - - assert issued == [(OP_AUDIO_ROOT, "")] - - -async def test_a_real_subfolder_is_accepted_and_signed(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_audio_root({"path": "shared/Music"}) - - assert issued == [(OP_AUDIO_ROOT, "shared/Music")] - - -# ── Where it is stored ────────────────────────────────────────────────────── - -async def test_the_setting_lives_on_the_node_and_survives_a_restart(tmp_path): - roster = Roster(db_path=tmp_path / "roster.db") - await roster.open() - try: - assert await roster.app_directories("g1", "music") == [], ( - "absent must mean unset") - await roster.set_app_directories("g1", "music", ["shared/Music"], - set_by="op") - assert await roster.app_directories("g1", "music") == ["shared/Music"] - finally: - await roster.close() - - reopened = Roster(db_path=tmp_path / "roster.db") - await reopened.open() - try: - assert await reopened.app_directories("g1", "music") == ["shared/Music"] - assert await reopened.app_directories("g2", "music") == [], ( - "one group's setting must not answer for another") - finally: - await reopened.close() - - -# ── End to end through the real signed-op path ────────────────────────────── -# -# Everything above either calls ops.set_audio_root directly or mocks out -# _issue_admin_challenge — neither one ever exercises real signature -# verification (_verify_admin_sig, _do_admin_response) or the shared -# groups_ctx/roster wiring _run_op depends on. Found live: a save that -# looked like it worked (the Music tab showed content right afterward) did -# not survive a reload — worth ruling out a break somewhere in that real -# path specifically, not just in the pure-Python setter. Session shape -# mirrors test_admin_ops_mnp.py's _session helper. - -GROUP = "g" * 32 - - -def _keypair(): - sk = Ed25519PrivateKey.generate() - return sk, pk_to_b64(sk.public_key()) - - -async def _full_session(tmp_path: Path, roster) -> tuple[WebRTCPeerSession, Ed25519PrivateKey]: - shared = tmp_path / "shared" - (shared / "Music").mkdir(parents=True) - index = GroupIndex(group_id=GROUP, sk_node=Ed25519PrivateKey.generate()) - roots = one_root(shared) - - sk_op, pk_op = _keypair() - await roster.pin_identity("grenet", "grenet", pk_op, pk_op, "code") - await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli") - - group_ctx = {"gek": b"\x01" * 32, "roots": roots, "index": index, - "join_policy": "invite", "audio_root": ""} - state = { - "groups_ctx": {GROUP: group_ctx}, - "roster": roster, - "node_user_id": "node-user", - } - - session = WebRTCPeerSession.__new__(WebRTCPeerSession) - session._ctx = { - "roots": roots, "index": index, "sk_node": index.sk_node, - "roster": roster, "groups": {GROUP: group_ctx}, - "has_admin_authority": True, - "daemon_state": state, - } - session._group_id = GROUP - session._user_id = "grenet" - session._pk_user = "" - session._admin_ops = {} - session.sent = [] - session._send = session.sent.append - session._audit = lambda *a, **k: None - session.spawned = [] - session._spawn = session.spawned.append - # A real session registers itself here on handshake completion - # (`self._peer_registry()[self._user_id] = self`) — without it, the - # broadcast loop in _admin_exec_audio_root (and every other admin op) - # has nobody to send the final ack to, including the requester itself. - group_ctx["_peers"] = {"grenet": session} - session._peer_registry = lambda: group_ctx["_peers"] - return session, sk_op - - -async def _drain(session): - for coro in session.spawned: - await coro - session.spawned.clear() - - -async def test_a_real_signed_save_persists_and_survives_a_fresh_roster_read(tmp_path): - """ - The exact question a "worked, then reverted after reload" report raises: - does the value set through the real challenge/response path actually - land in the database, in a form any later connection — this one, or a - freshly-opened Roster after a restart — reads back correctly? - """ - roster = await open_roster(tmp_path) - try: - session, sk_op = await _full_session(tmp_path, roster) - - session._do_audio_root({"path": "shared/Music"}) - challenge = session.sent[-1] - assert challenge["type"] == "admin_challenge", challenge - - transcript = admin_transcript( - op=OP_AUDIO_ROOT, node_pk_b64=session._node_pk_b64(), group_id=GROUP, - subject="shared/Music", nonce=base64.b64decode(challenge["nonce"]), - ts=challenge["ts"]) - session._do_admin_response({ - "op_id": challenge["op_id"], - "signature": base64.b64encode(sk_op.sign(transcript)).decode(), - }) - await _drain(session) - - ack = session.sent[-1] - assert ack["type"] == "audio_root_ack", ack - assert ack["path"] == "shared/Music" - - assert session._ctx["groups"][GROUP]["audio_root"] == "shared/Music", ( - "the live in-memory context must reflect the new root immediately") - assert await roster.app_directories(GROUP, "music") == ["shared/Music"], ( - "the same Roster instance must read back what it just wrote") - finally: - await roster.close() - - # A fresh connection (or a restarted daemon) never touches the Roster - # instance above at all — it opens its own. This is the check that - # actually answers "does it survive a reload". - reopened = await open_roster(tmp_path) - try: - assert await reopened.app_directories(GROUP, "music") == ["shared/Music"], ( - "a freshly-opened Roster against the same db file must see the " - "committed value — anything else means the write was never " - "durable in the first place") - finally: - await reopened.close() diff --git a/packages/meshbay-node/tests/test_video_root_gates_enrichment.py b/packages/meshbay-node/tests/test_video_root_gates_enrichment.py index b88ecaf..fd0e040 100644 --- a/packages/meshbay-node/tests/test_video_root_gates_enrichment.py +++ b/packages/meshbay-node/tests/test_video_root_gates_enrichment.py @@ -6,7 +6,7 @@ rate limit and the node's CPU on an operator's whole shared index before they have chosen which folder is actually their media library would be real, ongoing cost for files never meant to be in the Videos app at all. -Setting or changing the root (ops.set_video_root) fires a one-off sweep +Setting or changing the folder (ops.set_app_directory) fires a one-off sweep (_enrich_video_root_now) of whatever it already contains: the ordinary per-broadcast path only ever looks at files new since the last broadcast, so anything already sitting in a folder before it became the video_root @@ -144,7 +144,8 @@ async def test_setting_the_video_root_sweeps_what_it_already_contains(tmp_path): "groups_ctx": {group_id: {"roots": one_root(shared)}}, "enrich_app_dirs_fns": {"video": daemon._enrich_video_root_now}, } - await ops.set_video_root(state, group_id, "shared/Movies") + await ops.set_app_directory(state, group_id, "video", + "shared/Movies") await asyncio.sleep(0.05) # let the fire-and-forget sweep actually run entry = next(iter(indexer.index.entries)) diff --git a/packages/meshbay-node/tests/test_video_root_policy.py b/packages/meshbay-node/tests/test_video_root_policy.py deleted file mode 100644 index 8d8c45a..0000000 --- a/packages/meshbay-node/tests/test_video_root_policy.py +++ /dev/null @@ -1,144 +0,0 @@ -""" -Which folder (possibly a subfolder of a shared root) is the Videos app's -entry point for a group. Same shape as test_apps_enabled_policy.py: a -signed operator instruction, per-group (unlike tmdb_config, which is -node-wide), stored via roster.py's group_settings table. - -Specific to this one: a non-empty path must resolve to a real, readable -directory inside one of the group's own roots before a challenge is ever -issued — refusing a typo up front, the same way an empty apps set is -refused up front rather than round-tripped to the operator's browser. -""" - -from pathlib import Path - -import pytest - -from meshbay_common.adminop import OP_VIDEO_ROOT -from meshbay_node.indexer.group_index import GroupIndex -from meshbay_node.roster import Roster -from meshbay_node.transport.webrtc_server import WebRTCPeerSession -from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey - -from conftest import one_root - -pytestmark = pytest.mark.asyncio - - -def _session(tmp_path: Path, user_id: str, *, operator: str | None = None) -> WebRTCPeerSession: - shared_root = tmp_path / "shared" - shared_root.mkdir(exist_ok=True) - (shared_root / "Movies").mkdir() - (shared_root / "Shows").mkdir() - index = GroupIndex(group_id="g" * 32, sk_node=Ed25519PrivateKey.generate()) - ctx = { - "roots": one_root(shared_root), - "index": index, - "sk_node": index.sk_node, - "node_user_id": operator, - } - session = WebRTCPeerSession.__new__(WebRTCPeerSession) - session._ctx = ctx - session._group_id = None - session._user_id = user_id - session._pk_user = "" - session.sent = [] - session._send = session.sent.append - session._audit = lambda *a, **k: None - return session - - -# ── Refused before a challenge is even issued ─────────────────────────────── - -async def test_missing_path_is_refused(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_video_root({}) - - assert not issued - assert [m for m in session.sent if m.get("type") == "error"] - - -async def test_a_nonexistent_folder_is_refused(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_video_root({"path": "shared/Nonexistent"}) - - assert not issued, "a mistyped path must be refused before a signature round trip" - assert [m for m in session.sent if m.get("type") == "error"] - - -async def test_path_traversal_is_refused(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_video_root({"path": "../../etc"}) - - assert not issued - assert [m for m in session.sent if m.get("type") == "error"] - - -async def test_a_request_with_nobody_to_authorize_it_is_refused(tmp_path): - session = _session(tmp_path, "member-1", operator="the-operator") - session._has_admin_authority = lambda: False - - session._do_video_root({"path": "shared/Movies"}) - - assert [m for m in session.sent if m.get("type") == "error"] - - -# ── Accepted cases ─────────────────────────────────────────────────────────── - -async def test_an_empty_path_is_always_accepted(tmp_path): - """Empty means 'the whole group index' — always valid, nothing to resolve.""" - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_video_root({"path": ""}) - - assert issued == [(OP_VIDEO_ROOT, "")] - - -async def test_a_real_subfolder_is_accepted_and_signed(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_video_root({"path": "shared/Movies"}) - - assert issued == [(OP_VIDEO_ROOT, "shared/Movies")] - - -# ── Where it is stored ────────────────────────────────────────────────────── - -async def test_the_setting_lives_on_the_node_and_survives_a_restart(tmp_path): - roster = Roster(db_path=tmp_path / "roster.db") - await roster.open() - try: - assert await roster.app_directories("g1", "video") == [], ( - "absent must mean nothing configured") - await roster.set_app_directories("g1", "video", ["shared/Movies"], - set_by="op") - assert await roster.app_directories("g1", "video") == ["shared/Movies"] - finally: - await roster.close() - - reopened = Roster(db_path=tmp_path / "roster.db") - await reopened.open() - try: - assert await reopened.app_directories("g1", "video") == ["shared/Movies"] - assert await reopened.app_directories("g2", "video") == [], ( - "one group's setting must not answer for another") - finally: - await reopened.close() -- cgit v1.2.3