feat(hub): one account, several linked nodes

An account links up to MAX_NODES_PER_ACCOUNT node keys (node_keys table)
instead of the one users.pk_node_ed25519; the migration carries each
account's key over and the downgrade keeps the last one linked.
/v1/nodes/auth accepts any linked key, and its token names the key that
won it (nk). PUT /me/node_key adds a key, idempotently, 409 past the
limit; DELETE /me/node_key names the key: a browser session any of its
own, a node only its own. Unlinking a key closes that node's socket and
refuses its tokens at once, on REST and on the socket; the account's other
nodes are untouched. /pubkeys no longer gives a node key to other accounts,
and gives the caller its last linked one, which installed desktop apps read.

The node reports waiting_for_node_key while its key is unlinked and signs
in again as soon as the hub says so, so a key linked again is back within
seconds; unlinking itself signs in first to hold a token naming its key.

Profile -> Linked nodes lists each node (connected, last seen, IP, linked
since, This machine in the desktop app) with Copy and Unlink, and adds a
key by hand. The Node page banner, Create group and the desktop app add
this machine's key instead of replacing another's. Messages that pointed
at Settings -> Link Node point at Profile -> Linked nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 22 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/deps.py b/packages/meshbay-hub/src/meshbay_hub/api/deps.py
index 56af023..36c3c64 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/deps.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/deps.py
@@ -16,7 +16,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from meshbay_hub.auth import decode_access_token
 from meshbay_hub.db.engine import get_db
-from meshbay_hub.db.models import AdminPin, User
+from meshbay_hub.db.models import AdminPin, NodeKey, User
 
 log = logging.getLogger(__name__)
 
@@ -106,10 +106,31 @@ async def get_current_user(
     if user.status != "active":
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN,
                             detail=f"Account {user.status}")
+    if not await node_token_key_linked(db, payload):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED,
+                            detail="Node key no longer linked to this account",
+                            headers={"WWW-Authenticate": "Bearer"})
     await _pin_if_listed(db, user)
     return user
 
 
+async def node_token_key_linked(db: AsyncSession, payload: dict) -> bool:
+    """False for a node token whose key the account has since unlinked.
+
+    A node token names the key that signed in (`nk`), so unlinking one machine
+    ends that machine's tokens at once and no other. A node token without `nk`
+    predates the claim; none outlives the hour `/v1/nodes/auth` gives it, and
+    refusing it would strand every node mid-hour on the deploy that adds this,
+    since a node only signs in again when its token is about to expire.
+    """
+    if payload.get("scope") != "node" or "nk" not in payload:
+        return True
+    row = await db.execute(
+        select(NodeKey.id).where(NodeKey.user_id == payload.get("sub", ""),
+                                 NodeKey.pk_node_ed25519 == payload["nk"]))
+    return row.first() is not None
+
+
 def _reject_node_scope(payload: dict) -> None:
     """Refuse a node-scoped daemon token on a route meant for a person.