mirror of
https://github.com/permissionlesstech/bitchat.git
synced 2026-10-18 07:33:46 +00:00
1fd64e9913
When authenticated private media fails local validation, log a structured reason code and post a people-readable system line in the affected DM instead of failing silently. Public mesh transfers keep the existing security-logging path. Decode failures are attacker-triggerable — an authenticated peer can send malformed media as fast as the link allows — so the system lines are rate limited to one per peer per five-minute window. Failures suppressed inside a window are counted and reported on the next line rather than dropped, peers are throttled independently so a flooder cannot silence someone else, and closed windows are pruned so a sender rotating peer IDs cannot grow the throttle's state without bound. A decode failure from a blocked peer posts nothing and reports the payload as handled: blocking is a deliberate drop, not a failure to handle. That return value is currently only observed by tests — handlePrivatePayload is @discardableResult and its one production caller ignores it. Refs #1518