meshsocket 0.3.0__tar.gz → 0.4.1__tar.gz

{meshsocket-0.3.0 → meshsocket-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshsocket
-Version: 0.3.0
+Version: 0.4.1
 Summary: Lightweight WebSocket mesh networking — broadcast, direct routing, and request/response over a simple JSON wire protocol.
 Author: Carter Beaudoin
 License-Expression: MIT

{meshsocket-0.3.0 → meshsocket-0.4.1}/meshsocket/__init__.py

@@ -7,4 +7,4 @@ so existing code keeps running while it migrates to the package name.
 from socketCore import MeshSocket, LogColors, sanitize_identity, valid_ident, IDENT_RE, NAMESPACED_RE
 
 __all__ = ["MeshSocket", "LogColors", "sanitize_identity", "valid_ident", "IDENT_RE", "NAMESPACED_RE"]
-__version__ = "0.3.0"
+__version__ = "0.4.1"

{meshsocket-0.3.0 → meshsocket-0.4.1}/meshsocket.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshsocket
-Version: 0.3.0
+Version: 0.4.1
 Summary: Lightweight WebSocket mesh networking — broadcast, direct routing, and request/response over a simple JSON wire protocol.
 Author: Carter Beaudoin
 License-Expression: MIT

{meshsocket-0.3.0 → meshsocket-0.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshsocket"
-version = "0.3.0"
+version = "0.4.1"
 description = "Lightweight WebSocket mesh networking — broadcast, direct routing, and request/response over a simple JSON wire protocol."
 readme = "README.md"
 requires-python = ">=3.10"

{meshsocket-0.3.0 → meshsocket-0.4.1}/socket_server.py

@@ -19,6 +19,48 @@ class MeshServerConfigError(RuntimeError):
     """The server refused to start because its configuration is unsafe."""
 
 
+# The key the relay writes on every routed payload (0.4.0): the sender's
+# authenticated name, as this relay registered it at identify (through the
+# carter-relay gateway that is the namespaced `<account>.<principal>_<name>`).
+# Peers write `_from` too (on broadcasts, where it is left alone), so a receiver
+# cannot tell this stamp from a peer's claim by the key alone: see RELAY_SENDER_KEY.
+SENDER_KEY = "_from"
+
+# The relay-only sender key (0.4.1). Set beside `_from` on every routed payload,
+# and removed from every payload the relay forwards (routed, routed replies and
+# broadcasts), so a receiver that finds it knows this relay wrote it: no peer can
+# get its own copy through. Broadcasts never carry it (they are not stamped).
+RELAY_SENDER_KEY = "_relayFrom"
+
+
+def stamp_sender(payload: Any, sender_name: str) -> Any:
+    """`payload` with `SENDER_KEY` and `RELAY_SENDER_KEY` set to `sender_name`,
+    overwriting any value the sender wrote. Only a dict payload is stamped. On an
+    E2EE envelope (`{"e2ee": 2, "s", "n", "ct"}`) the keys land on the outer,
+    unsealed object beside the ciphertext, which is where receivers read the
+    relay's stamp; the sealed body is never touched. Other payloads (lists,
+    strings, null) pass unchanged. Returns a copy; the caller's dict is not
+    modified."""
+    if not isinstance(payload, dict):
+        return payload
+    stamped = dict(payload)
+    stamped[SENDER_KEY] = sender_name
+    stamped[RELAY_SENDER_KEY] = sender_name
+    return stamped
+
+
+def strip_relay_sender(payload: Any) -> Any:
+    """`payload` without a peer-written `RELAY_SENDER_KEY` on its outer object.
+    Only a dict payload changes (a copy; the caller's dict is not modified);
+    nested values and an E2EE envelope's sealed body are not touched, and
+    everything else, `_from` included, is delivered as sent."""
+    if not isinstance(payload, dict) or RELAY_SENDER_KEY not in payload:
+        return payload
+    stripped = dict(payload)
+    del stripped[RELAY_SENDER_KEY]
+    return stripped
+
+
 def _env_int(name: str, default: int) -> int:
     raw = os.getenv(name)
     if raw is None or not raw.strip():
@@ -459,7 +501,8 @@ class MeshServer:
                     return {"error": "malformed route", "status": "failed"}
                 target_id = payload.get('target_id')
                 msg_type = payload.get('type')
-                data = payload.get('payload')
+                # The target learns who sent this from the relay, not the sender.
+                data = stamp_sender(payload.get('payload'), client.name)
                 if not isinstance(target_id, str) or not isinstance(msg_type, str):
                     return {"error": "malformed route", "status": "failed"}
 
@@ -482,7 +525,8 @@ class MeshServer:
                     # The target never answered: say so instead of leaving the
                     # requester to wait out its own timeout with no signal.
                     return {"error": "target timeout", "status": "failed"}
-                return response
+                # The target wrote this reply: it may not carry the relay-only key.
+                return strip_relay_sender(response)
 
             @client.on("get_nodes")
             async def on_get_nodes(payload):
@@ -499,7 +543,7 @@ class MeshServer:
                     return {"error": "malformed route", "status": "failed"}
                 target_name = payload.get('target_name')
                 msg_type = payload.get('type')
-                data = payload.get('payload')
+                data = stamp_sender(payload.get('payload'), client.name)
                 if not isinstance(target_name, str) or not isinstance(msg_type, str):
                     return {"error": "malformed route", "status": "failed"}
 
@@ -608,8 +652,17 @@ class MeshServer:
         await self._fan_out(sends, targets, "roster")
 
     async def broadcast(self, type: str, payload: dict, sender: MeshSocket | None = None):
+        # Broadcasts are NOT stamped (only routed payloads are; see stamp_sender).
+        # Peers already put their own `_from` on broadcasts and match replies
+        # against it: CAR-TER writes its bare name on an ack'd command and drops a
+        # `command_ack` whose `to` differs, and carterkit acks to the outer `_from`
+        # of a sealed frame when there is one. Behind the gateway the relay name is
+        # namespaced, so stamping broadcasts would break those acks.
+        # A peer-written RELAY_SENDER_KEY is removed (0.4.1): on a broadcast the
+        # receiver finds none, so it never mistakes a peer's claim for the relay's.
         if not self.clients:
             return
+        payload = strip_relay_sender(payload)
         sends, targets = [], []
         for peer in list(self.clients.values()):
             if sender and not self._can_receive_broadcast(sender, peer):