hivemind-http-protocol 0.0.7a3__tar.gz → 0.0.8a2__tar.gz

{hivemind_http_protocol-0.0.7a3 → hivemind_http_protocol-0.0.8a2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hivemind-http-protocol
-Version: 0.0.7a3
+Version: 0.0.8a2
 Summary: http network protocol for hivemind-core
 Author-email: jarbasAi <jarbasai@mailfence.com>
 License-Expression: Apache-2.0

{hivemind_http_protocol-0.0.7a3 → hivemind_http_protocol-0.0.8a2}/hivemind_http_protocol/__init__.py

@@ -582,6 +582,15 @@ class HiveMindHttpHandler(web.RequestHandler):
         client.name = f"{useragent}::{user.client_id}::{user.name}"
         client.crypto_key = user.crypto_key
         client.allowed_types = user.allowed_types
+        # The WebSocket transport copies this too. Leaving it out let the
+        # dataclass default (True) stand, so `hivemind-core blacklist-broadcast`
+        # — a command whose only purpose is to set it False — was silently a
+        # no-op over HTTP while being enforced over WebSocket. Two transports
+        # into one node must reach the same admission decision for the same
+        # database row.
+        client.can_broadcast = user.can_broadcast
+        client.intent_blacklist = user.intent_blacklist
+        client.skill_blacklist = user.skill_blacklist
         client.can_propagate = user.can_propagate
         client.can_escalate = user.can_escalate
         client.is_admin = user.is_admin

{hivemind_http_protocol-0.0.7a3 → hivemind_http_protocol-0.0.8a2}/hivemind_http_protocol/version.py

@@ -1,8 +1,8 @@
 # START_VERSION_BLOCK
 VERSION_MAJOR = 0
 VERSION_MINOR = 0
-VERSION_BUILD = 7
-VERSION_ALPHA = 3
+VERSION_BUILD = 8
+VERSION_ALPHA = 2
 # END_VERSION_BLOCK
 
 __version__ = f"{VERSION_MAJOR}.{VERSION_MINOR}.{VERSION_BUILD}" + (f"a{VERSION_ALPHA}" if VERSION_ALPHA else "")

{hivemind_http_protocol-0.0.7a3 → hivemind_http_protocol-0.0.8a2}/hivemind_http_protocol.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hivemind-http-protocol
-Version: 0.0.7a3
+Version: 0.0.8a2
 Summary: http network protocol for hivemind-core
 Author-email: jarbasAi <jarbasai@mailfence.com>
 License-Expression: Apache-2.0

{hivemind_http_protocol-0.0.7a3 → hivemind_http_protocol-0.0.8a2}/hivemind_http_protocol.egg-info/SOURCES.txt

@@ -9,6 +9,7 @@ hivemind_http_protocol.egg-info/dependency_links.txt
 hivemind_http_protocol.egg-info/entry_points.txt
 hivemind_http_protocol.egg-info/requires.txt
 hivemind_http_protocol.egg-info/top_level.txt
+tests/test_acl_parity.py
 tests/test_client_lifecycle.py
 tests/test_decode_auth.py
 tests/test_handlers.py

hivemind_http_protocol-0.0.8a2/tests/test_acl_parity.py

@@ -0,0 +1,47 @@
+"""Both transports must reach the same admission decision for one DB row.
+
+A node accepts clients over WebSocket and over HTTP, and each builds its
+connection object from the same database record. Any ACL field one transport
+copies and the other does not is a weaker door into the same node: the
+`hivemind-core` command that sets it appears to work and is enforced on one
+transport only.
+"""
+import inspect
+import re
+
+import hivemind_http_protocol
+
+#: Every ACL field a transport must carry from the database row onto the
+#: connection. Listed explicitly rather than derived from the other transport
+#: at runtime, so the check does not depend on which version happens to be
+#: installed. When a new ACL field is added, add it here.
+REQUIRED_ACL_FIELDS = {
+    "crypto_key",
+    "allowed_types",
+    "can_broadcast",
+    "can_propagate",
+    "can_escalate",
+    "is_admin",
+    "intent_blacklist",
+    "skill_blacklist",
+}
+
+
+def _copied_fields() -> set:
+    src = inspect.getsource(hivemind_http_protocol)
+    return {m.group(1)
+            for m in re.finditer(r"client\.(\w+)\s*=\s*user\.(\w+)", src)}
+
+
+def test_every_acl_field_is_carried_from_the_database():
+    missing = REQUIRED_ACL_FIELDS - _copied_fields()
+
+    assert not missing, (
+        f"HTTP clients silently keep the permissive dataclass default for: "
+        f"{sorted(missing)}")
+
+
+def test_broadcast_permission_is_among_them():
+    """`hivemind-core blacklist-broadcast` exists to set this False; without
+    the copy it was a no-op over HTTP while being enforced over WebSocket."""
+    assert "can_broadcast" in _copied_fields()

{hivemind_http_protocol-0.0.7a3 → hivemind_http_protocol-0.0.8a2}/tests/test_client_lifecycle.py

@@ -36,6 +36,7 @@ class _DB:
             client_id=1, name="node", crypto_key=None, password=None,
             skill_blacklist=[], intent_blacklist=[], allowed_types=["speak"],
             can_propagate=True, can_escalate=True, is_admin=False,
+            can_broadcast=True,
         )