delta_create_invite: accept optional target_addr for securejoin pre-bind - #41
Open
terafin wants to merge 2 commits into
Open
delta_create_invite: accept optional target_addr for securejoin pre-bind#41terafin wants to merge 2 commits into
terafin wants to merge 2 commits into
Conversation
Extends the bifrost MCP tool delta_create_invite(bot_id, target_addr=None)
to plumb an optional recipient address through to the relay-side
securejoin pre-bind (forward-looking ref: Vikunja #41097 / #41098).
The signed URL itself (i.delta.chat/#...) is locked to the bot's self-
identity by the OpenPGP signature s= — the a=/n= fields cannot be
rewritten post-hoc without invalidating the signature. So target_addr
is metadata forwarded to the relay's PeerMesh for anti-MITM binding
when the recipient later taps the URL and accepts via delta_secure_join.
Plumb path: mcp_tools.DeltaCreateInviteTool.create_invite
-> mcp_server.delta_create_invite
-> relay.Relayer.create_invite
-> relay.Backend.create_invite
-> /invite HTTP route
Bot-author: sindri
Reviewers: @mimir (bifrost correctness), @idunn (merge gate)
Refs: spec relayed by mimir 2026-08-02
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The relay's Relayer.create_invite now forwards target_addr to its backend; update the in-tree FakeBackend to match the new signature so the test_filter tracker records (account_id, target_addr) tuples. Verified: pre-existing 6 failures in test_relay/test_mcp_server are unrelated to this change (confirmed by running on main clean). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Per spec relayed by @mimir (2026-08-02, Justin's standing approval):
extend the bifrost MCP tool
delta_create_invite(bot_id, target_addr=None)to accept an optional expected-recipient address for relay-side securejoin
pre-bind (anti-MITM forward-looking ref: Vikunja #41097 / #41098).
What this PR does
Plumbs a new optional
target_addr: Optional[str] = Noneparameter throughthe entire
delta_create_invitestack:app/mcp_tools.pyDeltaCreateInviteTool.create_inviteaccepts target_addrapp/mcp_server.pydelta_create_invitesignature extendedapp/relay.pyBackend.create_inviteinterface accepts target_addrapp/relay.pyapp/relay.pyRelayer.create_inviteechoes target_addr in responseapp/relay.pyGET /invite?target_addr=...tests/test_mcp_tools.pytests/test_relay.pyREADME.mdWhy target_addr is NOT in the URL
The signed URL (
i.delta.chat/#<fpr>&v=3&i=<invite>&s=<sig>&a=<addr>&n=<name>)is generated by
get_chat_securejoin_qr_code(accid, None). The OpenPGPsignature
s=covers the entire URL string including thea=/n=fields,which are locked to the bot's self-identity (its own fingerprint, address,
display name). Rewriting them post-hoc would invalidate the signature.
Per the spec,
target_addris the inviter-expected recipient address —meta data forwarded to the relay-side PeerMesh for pre-bind (so the
corresponding
delta_secure_joinon the recipient side can cross-checkthe inviter). The URL itself is unchanged.
Acceptance criteria (per Mimir spec)
delta_create_invite(bot_id, target_addr)and get backa URL string
https://i.delta.chat/#...tapped in another Delta client → verified 1:1 chat)
target_addr=Noneproduces identical behaviorto the previous single-arg call
Test results
test_relay_create_invite_routes_and_returns, test_invite_endpoint)
unrelated to this change (confirmed by running on
mainclean)Reviewers
Bot-author: sindri
Refs: Vikunja #17621 (umbrella), Mimir spec 2026-08-02
🤖 Generated with Claude Code