feat(hub): one account, several linked nodes

An account links up to MAX_NODES_PER_ACCOUNT node keys (node_keys table)
instead of the one users.pk_node_ed25519; the migration carries each
account's key over and the downgrade keeps the last one linked.
/v1/nodes/auth accepts any linked key, and its token names the key that
won it (nk). PUT /me/node_key adds a key, idempotently, 409 past the
limit; DELETE /me/node_key names the key: a browser session any of its
own, a node only its own. Unlinking a key closes that node's socket and
refuses its tokens at once, on REST and on the socket; the account's other
nodes are untouched. /pubkeys no longer gives a node key to other accounts,
and gives the caller its last linked one, which installed desktop apps read.

The node reports waiting_for_node_key while its key is unlinked and signs
in again as soon as the hub says so, so a key linked again is back within
seconds; unlinking itself signs in first to hold a token naming its key.

Profile -> Linked nodes lists each node (connected, last seen, IP, linked
since, This machine in the desktop app) with Copy and Unlink, and adds a
key by hand. The Node page banner, Create group and the desktop app add
this machine's key instead of replacing another's. Messages that pointed
at Settings -> Link Node point at Profile -> Linked nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 22 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/db/models.py b/packages/meshbay-hub/src/meshbay_hub/db/models.py
index 7291485..e37a479 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/models.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/models.py
@@ -53,7 +53,6 @@ class User(Base):
     # the node does the wrapping, nothing reads a key from this directory. Keys
     # are generated per node and pinned there (meshbay_node/roster.py).
     email_hash:  Mapped[str | None] = mapped_column(String(64), nullable=True)  # HMAC blind index
-    pk_node_ed25519: Mapped[str | None] = mapped_column(String(64), nullable=True)
     hub_id:           Mapped[str] = mapped_column(String(128), nullable=False)
     # user|moderator|admin
     role:             Mapped[str] = mapped_column(String(16), default="user")
@@ -104,6 +103,28 @@ class Node(Base):
     __table_args__ = (Index("ix_nodes_user_id", "user_id"),)
 
 
+class NodeKey(Base):
+    """A node key this account has linked: the key `/v1/nodes/auth` accepts for it.
+
+    One row per machine the person runs a node on. Linking is done from a
+    browser session and nowhere else; a node's own token can neither add nor
+    remove one (`require_user_scope`). Removing the row cuts that node off at
+    once — its socket is closed and the tokens it holds name this key (`nk`),
+    so they stop working — and leaves the account's other nodes alone.
+    """
+
+    __tablename__ = "node_keys"
+
+    id:              Mapped[str] = mapped_column(String(36), primary_key=True, default=_uuid)
+    user_id:         Mapped[str] = mapped_column(ForeignKey("users.id"), nullable=False)
+    pk_node_ed25519: Mapped[str] = mapped_column(String(64), nullable=False)
+    linked_at:       Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now)
+
+    __table_args__ = (
+        Index("uq_node_keys_user_key", "user_id", "pk_node_ed25519", unique=True),
+    )
+
+
 # ── Groups ────────────────────────────────────────────────────────────────────
 
 class Group(Base):