feat(hub): one account, several linked nodes

An account links up to MAX_NODES_PER_ACCOUNT node keys (node_keys table)
instead of the one users.pk_node_ed25519; the migration carries each
account's key over and the downgrade keeps the last one linked.
/v1/nodes/auth accepts any linked key, and its token names the key that
won it (nk). PUT /me/node_key adds a key, idempotently, 409 past the
limit; DELETE /me/node_key names the key: a browser session any of its
own, a node only its own. Unlinking a key closes that node's socket and
refuses its tokens at once, on REST and on the socket; the account's other
nodes are untouched. /pubkeys no longer gives a node key to other accounts,
and gives the caller its last linked one, which installed desktop apps read.

The node reports waiting_for_node_key while its key is unlinked and signs
in again as soon as the hub says so, so a key linked again is back within
seconds; unlinking itself signs in first to hold a token naming its key.

Profile -> Linked nodes lists each node (connected, last seen, IP, linked
since, This machine in the desktop app) with Copy and Unlink, and adds a
key by hand. The Node page banner, Create group and the desktop app add
this machine's key instead of replacing another's. Messages that pointed
at Settings -> Link Node point at Profile -> Linked nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/auth.py b/packages/meshbay-hub/src/meshbay_hub/auth.py
index 41fb159..8cdfee0 100644
--- a/packages/meshbay-hub/src/meshbay_hub/auth.py
+++ b/packages/meshbay-hub/src/meshbay_hub/auth.py
@@ -208,6 +208,7 @@ def issue_access_token(
     ttl: int = 3600,
     groups: list[str] | None = None,
     scope: str = "user",
+    node_key: str = "",
 ) -> str:
     """
     Issue a signed JWT access token.
@@ -219,6 +220,8 @@ def issue_access_token(
     Includes jti (UUID4) — required to prevent replay and enable revocation.
     Includes groups — list of group_ids the user is a member of (node-side authz).
     scope: "user" (browser, full access) or "node" (daemon, restricted).
+    node_key: for a node token, the linked key that signed in (`nk`). The hub
+    refuses the token as soon as that key is unlinked (`api/deps.py`).
     """
     if _hub_sk_pem is None:
         raise RuntimeError("Hub keypair not loaded")
@@ -237,6 +240,8 @@ def issue_access_token(
         # the hub (see meshbay_common.tokens).
         "aud":     HUB_API_AUD,
     }
+    if node_key:
+        payload["nk"] = node_key
     return jwt.encode(payload, _hub_sk_pem, algorithm="EdDSA")