1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
|
"""
An admin can turn off public groups for the whole hub.
The control is server-side and covers every hub-mediated path, not just
creation:
* `create_group` refuses `visibility=public`
* `list_public_groups` (the directory) returns nothing
* `join_group` refuses open joining of a public group
* `group_online_nodes` hands a non-member no node to connect to
* `signaling.webrtc_offer` drops the "node hosts an open group" fallback
* `federation.export_directory` advertises nothing to peers
Existing members of a group that predates the switch keep their membership row
and their access — plan A, not a purge.
"""
import base64
import hashlib
from datetime import datetime, timezone
import pytest
from meshbay_hub.api.deps import set_admin_usernames
from meshbay_hub.db.models import Group
def _auth_key(password: str, username: str) -> str:
salt = hashlib.sha256(f"meshbay:auth:v1:{username}".encode()).digest()
return base64.b64encode(
hashlib.pbkdf2_hmac("sha512", password.encode(), salt, 600_000, 32)).decode()
async def _user(client, username, password="a-long-enough-passphrase"):
await client.post("/v1/users/register", json={
"username": username, "email": f"{username}@example.com",
"auth_key": _auth_key(password, username)})
r = await client.post("/v1/users/login", json={
"username": username, "auth_key": _auth_key(password, username)})
return {"Authorization": f"Bearer {r.json()['access_token']}"}
async def _admin(client, username="root"):
await _user(client, username)
set_admin_usernames([username])
# re-login so the token is minted with the admin role in context
r = await client.post("/v1/users/login", json={
"username": username, "auth_key": _auth_key("a-long-enough-passphrase", username)})
return {"Authorization": f"Bearer {r.json()['access_token']}"}
def _public(name):
return {"name": name, "visibility": "public", "join_policy": "open"}
async def _create_public(client, owner, name):
r = await client.post("/v1/groups", json=_public(name), headers=owner)
assert r.status_code == 201, r.text
return r.json()["group_id"]
async def _mark_hosted(db_session, *group_ids):
"""Pretend a node announced these groups, as /v1/nodes/ws would."""
for gid in group_ids:
(await db_session.get(Group, gid)).hosted_at = datetime.now(timezone.utc)
await db_session.commit()
async def _set_public_groups(client, admin, allowed):
r = await client.patch("/v1/admin/settings",
json={"allow_public_groups": allowed}, headers=admin)
assert r.status_code == 200
assert r.json()["allow_public_groups"] is allowed
@pytest.mark.asyncio
async def test_public_groups_are_allowed_by_default(client):
owner = await _user(client, "alice")
r = await client.get("/v1/hub/info")
assert r.json()["allow_public_groups"] is True
r = await client.post("/v1/groups", json=_public("open-house"), headers=owner)
assert r.status_code == 201, r.text
@pytest.mark.asyncio
async def test_a_normal_member_cannot_change_the_setting(client):
member = await _user(client, "mallory")
r = await client.patch("/v1/admin/settings",
json={"allow_public_groups": False}, headers=member)
assert r.status_code == 403
@pytest.mark.asyncio
async def test_admin_disables_public_groups_end_to_end(client):
admin = await _admin(client)
owner = await _user(client, "bob")
r = await client.patch("/v1/admin/settings",
json={"allow_public_groups": False}, headers=admin)
assert r.status_code == 200
assert r.json()["allow_public_groups"] is False
# Reflected on both the admin read and the unauthenticated hub info.
assert (await client.get("/v1/admin/settings", headers=admin)
).json()["allow_public_groups"] is False
assert (await client.get("/v1/hub/info")).json()["allow_public_groups"] is False
# A member is refused a public group...
r = await client.post("/v1/groups", json=_public("nope"), headers=owner)
assert r.status_code == 403
assert "public" in r.json()["detail"].lower()
# ...and so is the admin: the way back is to re-enable it, not slip past.
r = await client.post("/v1/groups", json=_public("admin-nope"), headers=admin)
assert r.status_code == 403
# Private groups are unaffected.
r = await client.post("/v1/groups",
json={"name": "still-fine", "visibility": "private"},
headers=owner)
assert r.status_code == 201, r.text
@pytest.mark.asyncio
async def test_re_enabling_restores_public_creation(client):
admin = await _admin(client, "chief")
owner = await _user(client, "carol")
await client.patch("/v1/admin/settings",
json={"allow_public_groups": False}, headers=admin)
r = await client.post("/v1/groups", json=_public("first-try"), headers=owner)
assert r.status_code == 403
await client.patch("/v1/admin/settings",
json={"allow_public_groups": True}, headers=admin)
r = await client.post("/v1/groups", json=_public("second-try"), headers=owner)
assert r.status_code == 201, r.text
@pytest.mark.asyncio
async def test_a_patch_without_the_field_is_a_no_op(client):
admin = await _admin(client, "keeper")
await client.patch("/v1/admin/settings",
json={"allow_public_groups": False}, headers=admin)
r = await client.patch("/v1/admin/settings", json={}, headers=admin)
assert r.status_code == 200
assert r.json()["allow_public_groups"] is False
# ── plan A: existing public groups when the switch is off ────────────────────
@pytest.mark.asyncio
async def test_disabled_empties_the_public_directory(client, db_session):
admin = await _admin(client)
owner = await _user(client, "dora")
gid = await _create_public(client, owner, "town-square")
await _mark_hosted(db_session, gid)
listed = await client.get("/v1/groups")
assert any(g["id"] == gid for g in listed.json()["groups"])
await _set_public_groups(client, admin, False)
listed = await client.get("/v1/groups")
body = listed.json()
assert body["groups"] == [] and body["total"] == 0
@pytest.mark.asyncio
async def test_disabled_refuses_open_join_of_a_public_group(client, db_session):
admin = await _admin(client, "chief")
owner = await _user(client, "erin")
early = await _user(client, "early-bird")
late = await _user(client, "late-comer")
gid = await _create_public(client, owner, "commons")
await _mark_hosted(db_session, gid)
assert (await client.post(f"/v1/groups/{gid}/join", headers=early)).status_code == 200
await _set_public_groups(client, admin, False)
r = await client.post(f"/v1/groups/{gid}/join", headers=late)
assert r.status_code == 403
# The person who joined while it was allowed is still a member.
mine = await client.get("/v1/groups/mine", headers=early)
assert any(g["id"] == gid for g in mine.json()["groups"])
@pytest.mark.asyncio
async def test_disabled_hands_a_non_member_no_node(client, db_session):
admin = await _admin(client, "chief")
owner = await _user(client, "frank")
member = await _user(client, "grace")
stranger = await _user(client, "heidi")
gid = await _create_public(client, owner, "atrium")
await _mark_hosted(db_session, gid)
assert (await client.post(f"/v1/groups/{gid}/join", headers=member)).status_code == 200
# While allowed, anyone may ask which nodes serve a public group.
assert (await client.get(f"/v1/groups/{gid}/nodes", headers=stranger)
).status_code == 200
await _set_public_groups(client, admin, False)
assert (await client.get(f"/v1/groups/{gid}/nodes", headers=stranger)
).status_code == 403
# Members and the owner still get an answer (no nodes online here, but 200).
assert (await client.get(f"/v1/groups/{gid}/nodes", headers=member)
).status_code == 200
assert (await client.get(f"/v1/groups/{gid}/nodes", headers=owner)
).status_code == 200
def _mhp_token(hub_id):
"""A peer-hub JWT — from the hub's own issuer, which is the point.
This used to sign by hand, and its two comments recorded, accurately, the
reasons it had to: `_issue_mhp_token` bound `_hub_sk_pem` at import, before
the lifespan loads it, so it signed with `None`; and it sets an `aud` that
the verifier named no audience for, which PyJWT refuses outright. Both were
written down here as facts to route around rather than as the defects they
were — between them MHP could not complete one authenticated request
between two real hubs. Fixed at the source, so this can call it.
"""
from meshbay_hub.api.federation import _issue_mhp_token
return _issue_mhp_token(hub_id)
@pytest.mark.asyncio
async def test_disabled_empties_the_federation_export(client):
admin = await _admin(client)
owner = await _user(client, "ivan")
await _create_public(client, owner, "exported-square")
info = (await client.get("/mhp/info")).json()
await client.post("/mhp/peers", headers=admin, json={
"hub_id": info["hub_id"], "hub_url": "https://peer.example",
"pk_hub_pem": info["pk_hub_pem"],
})
tok = _mhp_token(info["hub_id"])
r = await client.get("/mhp/directory", headers={"Authorization": f"Bearer {tok}"})
assert r.status_code == 200 and len(r.json()["groups"]) == 1
await _set_public_groups(client, admin, False)
r = await client.get("/mhp/directory", headers={"Authorization": f"Bearer {tok}"})
assert r.status_code == 200 and r.json()["groups"] == []
@pytest.mark.asyncio
async def test_re_enabling_brings_the_directory_back(client, db_session):
admin = await _admin(client, "chief")
owner = await _user(client, "judy")
gid = await _create_public(client, owner, "reopened")
await _mark_hosted(db_session, gid)
await _set_public_groups(client, admin, False)
assert (await client.get("/v1/groups")).json()["groups"] == []
await _set_public_groups(client, admin, True)
listed = await client.get("/v1/groups")
assert any(g["id"] == gid for g in listed.json()["groups"])
|