feat(protocol): bind the MNP token to the node it is for (E10)

The audience split stopped a member's node credential from opening the hub API.
It did not stop the credential being *replayed to another node*: the MNP token
carried the member's whole group set and named no node, so a token handed to
node A's operator could be presented to node B the member also belongs to. That
does not read content on B — the handshake still requires proving node B's group
key, which the operator lacks — but it reaches B's pre-proof window and fetches
the member's *encrypted* keypair bundle for B (offline-attackable, bounded,
audited): a disclosure §2.4 says should not follow from hosting a member on A.

The token now names the node it is minted for (a `node` claim = that node's
Ed25519 key), and authorize_token refuses one that names a different key. The
client already knows the target node's key (from /v1/groups/{id}/nodes) and asks
for a token bound to it: POST /v1/nodes/mnp-token takes node_pk, and
transport.connect threads it (group-page, the connection pool and rewrap pass
n.pk_node; reconnect preserves it). A token that names no node is still
accepted, because the hub only mints one for the authenticated requester, so an
unbound token grants nothing across accounts — which also keeps non-binding
callers working with no churn.

Done before deploy, so it folds into the MNP 4.0 flag day rather than needing
its own. Docs: §5.2, register E10, MESHBAY_NODE_PROTOCOL.md §6.3.
test_handshake.py and test_mnp_token.py hold the binding (a token for node A is
refused by node B, accepted by node A; an unbound token still works); red
before, green after. common/node/hub suites green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 7 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/auth.py b/packages/meshbay-hub/src/meshbay_hub/auth.py
index e182ba0..0d0fd95 100644
--- a/packages/meshbay-hub/src/meshbay_hub/auth.py
+++ b/packages/meshbay-hub/src/meshbay_hub/auth.py
@@ -241,7 +241,7 @@ def issue_access_token(
 
 
 def issue_mnp_token(user_id: str, groups: list[str] | None = None,
-                    ttl: int = 900) -> str:
+                    node_pk: str | None = None, ttl: int = 900) -> str:
     """Issue the short-lived token a member presents to a node in the handshake.
 
     `aud=MNP_AUD`, so it is accepted by `authorize_token` and refused by the hub
@@ -249,6 +249,11 @@ def issue_mnp_token(user_id: str, groups: list[str] | None = None,
     lifetime does not interrupt a long transfer or a film already playing; only a
     fresh connection or a reconnect needs a fresh one. It carries the same
     `sub`/`groups`/`jti` the node authorises and denylists on.
+
+    `node` names the node this token is for (its base64 Ed25519 key), so it
+    cannot be replayed to another node the member also belongs to — the node
+    checks it in `authorize_token` (E10). The client knows the target node's key
+    before it connects and asks for a token bound to it.
     """
     if _hub_sk_pem is None:
         raise RuntimeError("Hub keypair not loaded")
@@ -260,6 +265,7 @@ def issue_mnp_token(user_id: str, groups: list[str] | None = None,
         "iat":    now,
         "exp":    now + ttl,
         "groups": groups or [],
+        "node":   node_pk or "",
         "scope":  "user",
         "aud":    MNP_AUD,
     }