feat(hub): one account, several linked nodes

An account links up to MAX_NODES_PER_ACCOUNT node keys (node_keys table)
instead of the one users.pk_node_ed25519; the migration carries each
account's key over and the downgrade keeps the last one linked.
/v1/nodes/auth accepts any linked key, and its token names the key that
won it (nk). PUT /me/node_key adds a key, idempotently, 409 past the
limit; DELETE /me/node_key names the key: a browser session any of its
own, a node only its own. Unlinking a key closes that node's socket and
refuses its tokens at once, on REST and on the socket; the account's other
nodes are untouched. /pubkeys no longer gives a node key to other accounts,
and gives the caller its last linked one, which installed desktop apps read.

The node reports waiting_for_node_key while its key is unlinked and signs
in again as soon as the hub says so, so a key linked again is back within
seconds; unlinking itself signs in first to hold a token naming its key.

Profile -> Linked nodes lists each node (connected, last seen, IP, linked
since, This machine in the desktop app) with Copy and Unlink, and adds a
key by hand. The Node page banner, Create group and the desktop app add
this machine's key instead of replacing another's. Messages that pointed
at Settings -> Link Node point at Profile -> Linked nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 30 insertions, 10 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
index b35f11e..367b37f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
@@ -16,7 +16,7 @@ from meshbay_hub.api.middleware import limiter
 from meshbay_hub.api.netutil import client_ip
 from meshbay_hub.auth import issue_access_token, issue_mnp_token
 from meshbay_hub.db.engine import get_db
-from meshbay_hub.db.models import GroupMember, IPLog, Node, User
+from meshbay_hub.db.models import GroupMember, IPLog, Node, NodeKey, User
 
 router = APIRouter(prefix="/v1/nodes", tags=["nodes"])
 
@@ -72,6 +72,21 @@ async def mnp_token(
 NODE_AUTH_TIMESTAMP_WINDOW = 60  # seconds
 
 
+def _signing_key(linked: list[str], message: bytes, signature_b64: str) -> str | None:
+    """The linked key that signed `message`, or None."""
+    try:
+        sig = base64.b64decode(signature_b64)
+    except Exception:
+        return None
+    for pk_b64 in linked:
+        try:
+            Ed25519PublicKey.from_public_bytes(base64.b64decode(pk_b64)).verify(sig, message)
+            return pk_b64
+        except (InvalidSignature, ValueError):
+            continue
+    return None
+
+
 class NodeAuthRequest(BaseModel):
     username:  str
     timestamp: int       # unix epoch seconds
@@ -97,29 +112,34 @@ async def node_auth(
     if user.status != "active":
         raise HTTPException(status_code=403, detail=f"Account {user.status}")
 
-    if not user.pk_node_ed25519:
+    linked = (await db.execute(
+        select(NodeKey.pk_node_ed25519).where(NodeKey.user_id == user.id))).scalars().all()
+    if not linked:
         raise HTTPException(
             status_code=401,
             detail="No node key registered — link your node from the browser first",
         )
 
+    # Whichever linked key signed it: one per machine the person runs a node on.
+    # A key that is not linked gets the same "No node key" answer as an account
+    # with none, which is what the daemon reads to wait for its link
+    # (`daemon._login_with_retry`) rather than for an account.
     message = f"meshbay:node_auth:{body.username}:{body.timestamp}".encode()
-    try:
-        pk_raw = base64.b64decode(user.pk_node_ed25519)
-        pk = Ed25519PublicKey.from_public_bytes(pk_raw)
-        sig = base64.b64decode(body.signature)
-        pk.verify(sig, message)
-    except (InvalidSignature, Exception):
+    signer = _signing_key(linked, message, body.signature)
+    if signer is None:
         db.add(IPLog(event="node_auth_fail", ip_address=client_ip(request), detail=body.username))
         await db.commit()
-        raise HTTPException(status_code=401, detail="Invalid signature")
+        raise HTTPException(
+            status_code=401,
+            detail="No node key registered for this node — link it from the browser first",
+        )
 
     memberships = await db.execute(
         select(GroupMember.group_id).where(GroupMember.user_id == user.id))
     group_ids = [gid for (gid,) in memberships.all()]
 
     access_token = issue_access_token(
-        user.id, ttl=3600, groups=group_ids, scope="node")
+        user.id, ttl=3600, groups=group_ids, scope="node", node_key=signer)
 
     db.add(IPLog(user_id=user.id, event="node_auth", ip_address=client_ip(request)))
     await db.commit()