From 6b838593d975792ac4fcbd49176089aecc7512e9 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Fri, 28 Aug 2026 11:32:40 +0200 Subject: fix(node): a pinned device can be invited to a further invite-only group MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Regression from device linking (Stage C, 2026-08-18). Once a device is pinned on a node — as a member of one group, or an operator pairing — the `known` fast-path in `_do_join_request` dropped straight into `_join_ok`. For any *other* invite-only group it had no roster row for, that answered `not_authorized_for_group` and stopped there: the client never got `code_required`, so the pairing-code form never appeared and a legitimately invited member could not join. The `known` branch now, when there is no membership for the group being opened: - with a valid code → consumes the invite and admits (as the unknown- device path already does); - with no code but an invite waiting for this user here → `code_required`, so the client prompts; - with no code and nothing inviting them → `not_authorized_for_group`, unchanged, so the H3 guarantee (a hub-invented pin gets no key) holds. Also fixed: the group's own roster row is now consulted first, so an existing member opening their group is never mistaken for a stranger. Tests in test_roster_pairing.py cover all three branches plus the H3 guard. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_018gKJ85aZyvEwarXMFzFEwi --- .../src/meshbay_node/transport/webrtc_server.py | 41 +++++++++- packages/meshbay-node/tests/test_roster_pairing.py | 88 +++++++++++++++++++++- 2 files changed, 123 insertions(+), 6 deletions(-) (limited to 'packages') diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py index 4958b92..dfa775e 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py +++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py @@ -1039,10 +1039,11 @@ class WebRTCPeerSession: f"paired with this node") return if known: - # An operator's row is node-wide (empty group), so a lookup for the - # group they happen to be opening finds nothing. Fall back to it, or - # the client is told it has no role on a node it administers. - member = (await roster.get_member(group_id, user_id) + # This group's own row first; then the join message's group_id (empty + # on the node-wide first connect); then the operator's node-wide row, + # which is where an operator opening any group finds their authority. + member = (await roster.get_member(session_group, user_id) + or await roster.get_member(group_id, user_id) or await roster.get_member("", user_id)) if not member and self._group_join_policy(session_group) == "open": await roster.set_member( @@ -1050,6 +1051,38 @@ class WebRTCPeerSession: status="active", approved_by="open-join", ) member = await roster.get_member(session_group, user_id) + if not member: + # A device this node already pinned — for another group, or an + # operator pairing — opening an invite-only group it has no row + # for. The device-linking `known` fast-path used to drop straight + # into `_join_ok`, which answered `not_authorized_for_group` and + # left a real invitee with no way to redeem the code they were + # sent. Tell them to enter it *only* when one is actually + # waiting for them here; a bare hub-invented pin, with nothing + # inviting it, still gets the flat refusal H3 relies on. + if not code: + invited = any( + i["user_id"] == user_id + and i["group_id"] in (session_group, "") + for i in await roster.list_invites()) + self._join_refuse( + "code_required" if invited else "not_authorized_for_group") + return + invite = await roster.consume_invite(code, user_id) + if not invite: + self._join_refuse("code_invalid") + return + await roster.set_member( + group_id=invite["group_id"], user_id=user_id, + role=invite["role"], status="active", + approved_by=invite["created_by"], + ) + self._audit_join( + "join_pinned", + f"group={invite['group_id'][:8]} role={invite['role']} " + "via=code (device already known)") + member = (await roster.get_member(session_group, user_id) + or await roster.get_member(invite["group_id"], user_id)) await self._join_ok( user_id, pk_x_raw, session_group, role=member["role"] if member else "", diff --git a/packages/meshbay-node/tests/test_roster_pairing.py b/packages/meshbay-node/tests/test_roster_pairing.py index 7eb436c..e1b8a38 100644 --- a/packages/meshbay-node/tests/test_roster_pairing.py +++ b/packages/meshbay-node/tests/test_roster_pairing.py @@ -56,6 +56,14 @@ def _keypair(): return sk_ed, pk_ed_b64, pk_x_b64 +def _x_raw(sk_x, pk_x_b64): + """(sk_x_raw, pk_x_raw) — what unwrap_gek_aes wants.""" + return (sk_x.private_bytes(serialization.Encoding.Raw, + serialization.PrivateFormat.Raw, + serialization.NoEncryption()), + base64.b64decode(pk_x_b64)) + + def _session(tmp_path: Path, roster, user_id: str = "grenet", group_id: str | None = None, gek: bytes | None = None, join_policy: str = "invite") -> WebRTCPeerSession: @@ -383,7 +391,8 @@ async def test_hub_membership_alone_yields_no_key(tmp_path, roster): session = _session(tmp_path, roster, user_id="eve", group_id=GROUP, gek=gek) sk_ed, pk_ed_b64, pk_x_b64 = _keypair() - # Pinned on this node (say, for another group) but never admitted to this one. + # Pinned on this node (say, for another group) but never admitted to this + # one, and with no invite waiting for it here. await roster.pin_identity("eve", "eve", pk_ed_b64, pk_x_b64, "code") await session._do_join_request( @@ -391,7 +400,8 @@ async def test_hub_membership_alone_yields_no_key(tmp_path, roster): user_id="eve", group_id=GROUP)) reply = _last(session) - assert reply.get("gek") is False + assert reply.get("ok") is False + assert not reply.get("gek") assert reply.get("reason") == "not_authorized_for_group" assert "wrapped_b64" not in reply @@ -428,6 +438,80 @@ async def test_invite_only_group_still_demands_a_code(tmp_path, roster): assert await roster.get_identity("newcomer") is None +async def test_known_device_can_still_be_invited_to_another_group(tmp_path, roster): + """ + The regression: grenet's device is pinned here as a member of group A. cbesson + invites grenet to invite-only group B; grenet opens B. This used to answer + `not_authorized_for_group` with no way back — the device-linking `known` + fast-path dropped straight into `_join_ok` and never looked at a code. With a + real invite waiting it must ask for the code, and a valid one must admit. + """ + GROUP_A = "a" * 32 + GROUP_B = "b" * 32 + gek_b = generate_gek() + sk_ed, pk_ed_b64, pk_x_b64, sk_x = _keypair_full() + + await roster.pin_identity("grenet", "grenet", pk_ed_b64, pk_x_b64, "code") + await roster.set_member(GROUP_A, "grenet", ROLE_MEMBER, "active", "cbesson") + code = await roster.create_invite(GROUP_B, "grenet", ROLE_MEMBER, "cbesson") + + session = _session(tmp_path, roster, user_id="grenet", group_id=GROUP_B, + gek=gek_b, join_policy="invite") + + # First connect (node-wide group_id=""), no code: prompt for it, do not refuse. + await session._do_join_request( + _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, + user_id="grenet", group_id="")) + assert _last(session).get("reason") == "code_required" + assert await roster.get_member(GROUP_B, "grenet") is None + + # grenet enters the code cbesson sent through another channel. + await session._do_join_request( + _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, + code=code, user_id="grenet", group_id=GROUP_B)) + + reply = _last(session) + assert reply["ok"] is True and reply["gek"] is True + assert unwrap_gek_aes(reply, *_x_raw(sk_x, pk_x_b64)) == gek_b + member = await roster.get_member(GROUP_B, "grenet") + assert member and member["role"] == ROLE_MEMBER and member["status"] == "active" + + +async def test_known_pin_with_no_invite_still_gets_the_flat_refusal(tmp_path, roster): + """H3 guard: a pinned identity with no membership and no invite waiting for + it here gets `not_authorized_for_group`, not a code prompt.""" + GROUP_B = "b" * 32 + sk_ed, pk_ed_b64, pk_x_b64 = _keypair() + await roster.pin_identity("eve", "eve", pk_ed_b64, pk_x_b64, "code") + await roster.set_member("a" * 32, "eve", ROLE_MEMBER, "active", "cbesson") + + session = _session(tmp_path, roster, user_id="eve", group_id=GROUP_B, + gek=generate_gek(), join_policy="invite") + await session._do_join_request( + _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, + user_id="eve", group_id="")) + assert _last(session).get("reason") == "not_authorized_for_group" + + +async def test_known_device_already_a_member_still_needs_no_code(tmp_path, roster): + """Guard for the fix above: an existing member of B joins B with no code.""" + GROUP_B = "b" * 32 + gek_b = generate_gek() + sk_ed, pk_ed_b64, pk_x_b64, sk_x = _keypair_full() + await roster.pin_identity("grenet", "grenet", pk_ed_b64, pk_x_b64, "code") + await roster.set_member(GROUP_B, "grenet", ROLE_MEMBER, "active", "cbesson") + + session = _session(tmp_path, roster, user_id="grenet", group_id=GROUP_B, + gek=gek_b, join_policy="invite") + await session._do_join_request( + _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, + user_id="grenet", group_id="")) + + reply = _last(session) + assert reply["ok"] is True and reply["gek"] is True + assert unwrap_gek_aes(reply, *_x_raw(sk_x, pk_x_b64)) == gek_b + + async def test_unknown_group_is_invite_only(tmp_path, roster): """ Fail closed: a group whose policy the node cannot read is treated as -- cgit v1.2.3