fix(hub): a stranger who knows your name locks only browsers you never used

A sign-in from a browser that presented no token is answered with one
(known_browser, kept hashed, twenty per account); a later sign-in presenting it
counts failures on its own row, which nobody else can spend. Passphrase checks
inside an open session (change, e-mail, deletion, device, pepper) count on the
account's own row, so a locked name no longer stops its owner there either; /me
reports that row. Reset and erasure forget the browsers (F-15).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 82 insertions, 16 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py
index 8e780df..fb53076 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/users.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py
@@ -1,6 +1,7 @@
 """User endpoints — /v1/users/*"""
 
 import base64
+import hashlib
 import logging
 import re
 import secrets
@@ -42,6 +43,7 @@ from meshbay_hub.db.models import (
     GroupInviteLink,
     GroupMember,
     IPLog,
+    KnownBrowser,
     Node,
     Notification,
     RefreshToken,
@@ -161,6 +163,7 @@ class LoginRequest(BaseModel):
     username: str
     password: str | None = None    # legacy (raw password) for migration
     auth_key: str | None = None    # PBKDF2-derived auth key (new scheme)
+    known_browser: str | None = None   # from an earlier sign-in on this browser
 
 
 class RefreshRequest(BaseModel):
@@ -351,6 +354,58 @@ async def _take_login_attempt(db: AsyncSession, username: str) -> None:
                             headers={"Retry-After": str(retry_after)})
 
 
+def _session_counter(user: User) -> str:
+    """The failure counter for a passphrase re-checked inside an open session.
+
+    Its own, not the sign-in one: a stranger who keeps a name locked at sign-in
+    must not also stop its owner changing their passphrase, deleting their
+    account or registering a device from a session they already hold.
+    """
+    return f"\x00session:{user.id}"
+
+
+async def _browser_counter(db: AsyncSession, username: str,
+                           token: str | None) -> tuple[str, "KnownBrowser | None"]:
+    """The failure counter for a sign-in, and the known browser behind it if any.
+
+    A browser that signed in to this account before presents its token and is
+    counted on its own: the username's counter, which anyone can spend, then
+    locks only browsers this account has never used. A token for another
+    account, or none, is the username's counter — the answer is the same either
+    way, so it says nothing about the account (M1).
+    """
+    if token:
+        row = (await db.execute(
+            select(KnownBrowser).join(User, User.id == KnownBrowser.user_id)
+            .where(KnownBrowser.token_hash == _browser_hash(token),
+                   User.username == username))).scalar_one_or_none()
+        if row is not None:
+            return f"{username}\x00browser:{row.id}", row
+    return username, None
+
+
+def _browser_hash(token: str) -> str:
+    return hashlib.sha256(f"meshbay:known_browser:{token}".encode()).hexdigest()
+
+
+# How many browsers one account is remembered on. The oldest goes first; a
+# browser forgotten here is only an unknown one again.
+MAX_KNOWN_BROWSERS = 20
+
+
+async def _remember_browser(db: AsyncSession, user: User) -> str:
+    """A new known-browser token for `user`. The caller commits."""
+    raw = secrets.token_urlsafe(32)
+    rows = (await db.execute(
+        select(KnownBrowser.id).where(KnownBrowser.user_id == user.id)
+        .order_by(KnownBrowser.last_used_at.desc()))).scalars().all()
+    stale = rows[MAX_KNOWN_BROWSERS - 1:]
+    if stale:
+        await db.execute(delete(KnownBrowser).where(KnownBrowser.id.in_(stale)))
+    db.add(KnownBrowser(user_id=user.id, token_hash=_browser_hash(raw)))
+    return raw
+
+
 async def _prove_passphrase(db: AsyncSession, user: User, auth_key: str) -> None:
     """Refuse with 403 unless `auth_key` is this account's, spending an attempt.
 
@@ -358,18 +413,18 @@ async def _prove_passphrase(db: AsyncSession, user: User, auth_key: str) -> None
     refreshed one, or one lifted from a page, and what it would buy here outlives
     the session or reopens the offline search the pepper exists to prevent.
     """
-    await _take_login_attempt(db, user.username)
+    await _take_login_attempt(db, _session_counter(user))
     if not await verify_password_off_loop(auth_key, user.pw_hash, user.pw_salt,
                                           user.pw_version):
         raise HTTPException(status_code=403, detail="Passphrase does not match")
-    await login_throttle.clear(db, user.username)
+    await login_throttle.clear(db, _session_counter(user))
 
 
 async def _login_failed(db: AsyncSession, username: str, ip: str,
-                        user_id: str | None = None) -> None:
+                        user_id: str | None = None, counter: str | None = None) -> None:
     """Record a wrong passphrase and answer 401. Always raises."""
     db.add(IPLog(user_id=user_id, event="login_fail", ip_address=ip, detail=username))
-    if await login_throttle.is_now_locked(db, username):
+    if await login_throttle.is_now_locked(db, counter or username):
         # Once, on the failure that spent the last attempt — so the logs tab
         # shows when a name was locked, not every refusal after it.
         db.add(IPLog(user_id=user_id, event="login_locked", ip_address=ip,
@@ -431,32 +486,33 @@ async def login(
 
     # Before the account is even looked up: an unknown name spends attempts and
     # locks exactly like a real one, so neither answer tells them apart (M1).
-    await _take_login_attempt(db, body.username)
+    counter, browser = await _browser_counter(db, body.username, body.known_browser)
+    await _take_login_attempt(db, counter)
 
     result = await db.execute(
         select(User).where(User.username == body.username))
     user = result.scalar_one_or_none()
 
     if not user:
-        await _login_failed(db, body.username, ip)
+        await _login_failed(db, body.username, ip, counter=counter)
 
     if user.pw_version >= 3:
         # New scheme: verify auth_key
         if not body.auth_key or not await verify_password_off_loop(
             body.auth_key, user.pw_hash, user.pw_salt, version=user.pw_version
         ):
-            await _login_failed(db, body.username, ip, user.id)
+            await _login_failed(db, body.username, ip, user.id, counter)
     else:
         # Legacy scheme: need raw password
         if not body.password:
             # Nothing was checked, so nothing was guessed.
-            await login_throttle.release(db, body.username)
+            await login_throttle.release(db, counter)
             await db.commit()
             raise HTTPException(status_code=401, detail="auth_upgrade_required")
         if not await verify_password_off_loop(
             body.password, user.pw_hash, user.pw_salt, version=user.pw_version
         ):
-            await _login_failed(db, body.username, ip, user.id)
+            await _login_failed(db, body.username, ip, user.id, counter)
         # Migrate to new scheme if auth_key provided alongside password
         if body.auth_key:
             new_hash, new_salt = await hash_password_off_loop(body.auth_key)
@@ -471,6 +527,7 @@ async def login(
             user.pw_version = 2
 
     # The passphrase was right, whatever the account's status turns out to be.
+    await login_throttle.clear(db, counter)
     await login_throttle.clear(db, body.username)
 
     if user.status != "active":
@@ -501,6 +558,11 @@ async def login(
     ))
     db.add(IPLog(user_id=user.id, event="login", ip_address=ip))
     pepper = _bundle_pepper(user)
+    if browser is not None:
+        browser.last_used_at = datetime.now(UTC)
+        known = {}
+    else:
+        known = {"known_browser": await _remember_browser(db, user)}
     await db.commit()
 
     return {
@@ -509,6 +571,7 @@ async def login(
         "token_type":    "bearer",
         "expires_in":    _ttl(),
         **pepper,
+        **known,
     }
 
 
@@ -787,7 +850,8 @@ async def get_current_user_info(
         # A passphrase change re-wraps every node's bundle *before* the hub
         # accepts the new passphrase, and must not start while the hub would
         # then refuse it.
-        "passphrase_locked_for": await login_throttle.locked_for(db, current_user.username),
+        "passphrase_locked_for": await login_throttle.locked_for(
+            db, _session_counter(current_user)),
     }
 
 
@@ -849,13 +913,13 @@ async def update_profile(
             raise HTTPException(
                 status_code=403,
                 detail="Changing your e-mail requires your passphrase.")
-        await _take_login_attempt(db, current_user.username)
+        await _take_login_attempt(db, _session_counter(current_user))
         if not await verify_password_off_loop(
                 body.auth_key, current_user.pw_hash, current_user.pw_salt,
                 current_user.pw_version):
             raise HTTPException(status_code=403,
                                 detail="Passphrase does not match")
-        await login_throttle.clear(db, current_user.username)
+        await login_throttle.clear(db, _session_counter(current_user))
 
         # How often one account may point the hub at a *different* address.
         # Long, because this is the only path where a signed-in account chooses
@@ -1074,12 +1138,12 @@ async def change_password(
     current_user: User = Depends(require_user_scope),
     db: AsyncSession = Depends(get_db),
 ):
-    await _take_login_attempt(db, current_user.username)
+    await _take_login_attempt(db, _session_counter(current_user))
     if not await verify_password_off_loop(body.old_auth_key, current_user.pw_hash,
                            current_user.pw_salt, current_user.pw_version):
         raise HTTPException(status_code=403,
                             detail="Current passphrase does not match")
-    await login_throttle.clear(db, current_user.username)
+    await login_throttle.clear(db, _session_counter(current_user))
     if body.new_auth_key == body.old_auth_key:
         raise HTTPException(status_code=400,
                             detail="New passphrase must differ from the current one")
@@ -1279,6 +1343,7 @@ async def password_reset(
         update(RefreshToken).where(RefreshToken.user_id == user.id)
         .values(revoked=True))
     await db.execute(delete(UserDevice).where(UserDevice.user_id == user.id))
+    await db.execute(delete(KnownBrowser).where(KnownBrowser.user_id == user.id))
     # A code sent to the address on file is a stronger proof than a passphrase,
     # and it is the way out of a lockout somebody else caused.
     await login_throttle.clear(db, user.username)
@@ -1493,6 +1558,7 @@ async def erase_account(db: AsyncSession, user: User, owned_groups: str = "refus
         GroupHost.node_id.in_(select(Node.id).where(Node.user_id == user.id))))
     await db.execute(delete(Node).where(Node.user_id == user.id))
     await db.execute(delete(UserDevice).where(UserDevice.user_id == user.id))
+    await db.execute(delete(KnownBrowser).where(KnownBrowser.user_id == user.id))
     await db.execute(delete(EmailVerification).where(EmailVerification.user_id == user.id))
     # Links this account issued for a group it no longer owns; the ones for its
     # own groups went with them above. A used link keeps pointing at the
@@ -1538,11 +1604,11 @@ async def delete_own_account(
     borrowed laptop or a session left open. Same value as at sign-in, so the hub
     still never sees the passphrase itself.
     """
-    await _take_login_attempt(db, current_user.username)
+    await _take_login_attempt(db, _session_counter(current_user))
     if not await verify_password_off_loop(body.auth_key, current_user.pw_hash, current_user.pw_salt,
                            current_user.pw_version):
         raise HTTPException(status_code=403, detail="Passphrase does not match")
-    await login_throttle.clear(db, current_user.username)
+    await login_throttle.clear(db, _session_counter(current_user))
     return await erase_account(db, current_user)