fix(hub): present a node-audience token in the handshake, not the hub session token

A member authenticated to a node in the MNP handshake with its hub *session*
token — scope=user, valid at the hub API for hours. A node operator is in the
threat model, so this handed them a live hub credential for the member: enough
to enumerate the member's other groups, act as them, and (before the previous
commit closed it) take the account over. The node genuinely needs a hub-signed
membership assertion, so the fix is to make that a separate credential that
opens nothing at the hub API.

Two audiences signed by the one hub key (meshbay_common/tokens.py):
- HUB_API_AUD — session tokens (login, device-auth, node-auth, refresh), used
  for hub calls and signaling. decode_access_token now binds this audience, so
  an MNP token cannot be replayed against the hub API.
- MNP_AUD — a short-lived token a member presents to a node and nothing else,
  from POST /v1/nodes/mnp-token. authorize_token now binds this audience, so a
  session token presented to a node is refused. This closes the disclosure.

The node's own self-decode (hub_client.py) reads its node token with
audience=HUB_API_AUD. The client fetches the MNP token inside transport.connect()
(and on every reconnect) using the session token, so callers are unchanged and
signaling keeps using the session token.

No regression to a long session: the MNP token is checked once, at the
handshake, before any proof — a film already playing is not re-authenticated, so
a 15-minute token does not interrupt a 4-hour film; reconnects refetch a fresh
one. Denylist and membership checks are unchanged (the MNP token carries
sub/jti/groups).

Tests: authorize_token refuses a session/no-audience token and accepts an MNP
token; the hub API refuses an MNP token; POST /v1/nodes/mnp-token is minted only
for a member's own session. Verified red-before/green-after; common, node and
hub suites green (the pre-existing test_cli_golden failure is an argparse/pytest
prog artifact unrelated to this change).

Still to do before deploy (B2): bump the MNP version and client.minimum so a
stale desktop client is told to update rather than getting a handshake refusal,
update docs/MESHBAY_DESIGN.md and MESHBAY_NODE_PROTOCOL.md, and validate against
a real node locally, then deploy hub+node+SPA atomically.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 30 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index 202db94..27edc4e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -651,6 +651,25 @@ class MeshBayTransport {
     try { this.onConnectProgress(phase); } catch { /* the caller's problem */ }
   }
 
+  // Fetch the short-lived token presented to a node in the handshake. It is a
+  // different credential from the session token used for hub calls: aud=MNP_AUD,
+  // useless at the hub API, so a node operator who captures it gains nothing
+  // there (see meshbay_common/tokens.py). Uses the session token to ask.
+  async _fetchNodeToken(call) {
+    const doFetch = call
+      || (window.MeshBayPlatform && window.MeshBayPlatform.apiFetch) || fetch;
+    const r = await doFetch(`${this._hubUrl}/v1/nodes/mnp-token`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': `Bearer ${this._accessToken}`,
+      },
+      body: JSON.stringify({}),
+    });
+    if (!r.ok) throw new Error(`Could not obtain a node token: ${r.status}`);
+    return (await r.json()).mnp_token;
+  }
+
   async connect(nodeId, jwtToken, groupId, gekRaw, sessionKeys, bundleKey, username,
                 userId, joinCode, recoveryKey, joinNodePk) {
     // Remembered for _reconnectLoop, which calls connect() again with these
@@ -896,11 +915,21 @@ class MeshBayTransport {
     // recorded handshake_ack could be replayed by an impersonating peer.
     this._nonceClient = crypto.getRandomValues(new Uint8Array(32));
 
+    // The member authenticates to the node with a short-lived MNP token, never
+    // its hub session token. A node operator holds whatever is presented here,
+    // and the session token opens the hub API — so presenting it would hand an
+    // operator a live credential for the member (audience-bound, see
+    // meshbay_common/tokens.py). Fetched per connect and per reconnect with the
+    // session token (`this._accessToken`), so it always carries current group
+    // membership and a fresh expiry. Signaling above still uses the session
+    // token, because that is a hub call.
+    const nodeToken = await this._fetchNodeToken(call);
+
     const reply = await this._sendAndWait({
       type: 'handshake',
       v: MNP_V,
       v_min: MNP_V_MIN,
-      token: jwtToken,
+      token: nodeToken,
       group_id: groupId || '',
       nonce: window.MeshBayCrypto.b64encode(this._nonceClient),
     });