fix(hub): refuse node-scoped tokens on the admin and moderator API

A node's authority and a hub role are different notions: what a node may do
is decided by its operator's roster pin on the node (NS4), while admin and
moderator are hub roles on a person's account, exercised from a browser with
a user-scoped token. The scope refusal was wired only onto require_user_scope
(group mutation), so require_admin and require_moderator accepted a
scope:"node" daemon token whenever the underlying account also held a hub
role. On a deployment where the operator is a hub admin and runs a node, the
daemon's in-memory token was therefore a full hub-admin credential — able to
revoke accounts and groups (signed, broadcast to every node), change instance
policy, and read the IP audit log.

Factor the refusal into _reject_node_scope(payload) and call it from
require_user_scope, require_moderator and require_admin alike, so a
node-scoped token is turned away with 403 on every privileged route.

test_node_scope_not_admin.py holds seven refusals, each asserting the same
account's user-scoped token still gets in; verified red against the pre-fix
deps.py and green after.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 33 insertions, 5 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/deps.py b/packages/meshbay-hub/src/meshbay_hub/api/deps.py
index 501be9d..42f4101 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/deps.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/deps.py
@@ -59,16 +59,34 @@ async def get_current_user(
     return user
 
 
-async def require_user_scope(
-    payload: dict = Depends(_decode_token),
-    current_user: User = Depends(get_current_user),
-) -> User:
-    """Reject node-scoped tokens — only browser (user-scope) can mutate groups."""
+def _reject_node_scope(payload: dict) -> None:
+    """Refuse a node-scoped daemon token on a route meant for a person.
+
+    A node's authority and a hub role are **different notions**. What a node may
+    do is decided by its operator's roster pin on the node itself (NS4) and by
+    the node scope's deliberately narrow reach; being an admin or a moderator is
+    a hub role attached to a person's account. A node daemon authenticates with
+    the node key and receives a `scope:"node"` token so that the machine can
+    register, signal and host — never so that it can act as its operator on the
+    hub. When the operator's account happens to also hold a hub role, that role
+    is the *person's*, exercised from a browser with a user-scoped token, and
+    must not be reachable by a token the daemon holds in memory. So the scope
+    gate lives in one place and fronts every privileged dependency, not only
+    group mutation.
+    """
     if payload.get("scope") == "node":
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="Node-scoped token cannot perform this operation — use browser",
         )
+
+
+async def require_user_scope(
+    payload: dict = Depends(_decode_token),
+    current_user: User = Depends(get_current_user),
+) -> User:
+    """Reject node-scoped tokens — only browser (user-scope) can mutate groups."""
+    _reject_node_scope(payload)
     return current_user
 
 
@@ -84,8 +102,13 @@ def user_is_moderator(user: User) -> bool:
 
 
 async def require_moderator(
+    payload: dict = Depends(_decode_token),
     current_user: User = Depends(get_current_user),
 ) -> User:
+    # A node-scoped daemon token is refused here even for a moderator's own
+    # account: the hub moderation surface (suspending accounts, reading the IP
+    # audit log, listing nodes) is the person's, not the machine's.
+    _reject_node_scope(payload)
     if not user_is_moderator(current_user):
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN,
                             detail="Moderator access required")
@@ -93,8 +116,13 @@ async def require_moderator(
 
 
 async def require_admin(
+    payload: dict = Depends(_decode_token),
     current_user: User = Depends(get_current_user),
 ) -> User:
+    # Likewise: revoking accounts and groups (signed, broadcast to every node)
+    # and changing instance policy are administrative acts a person performs
+    # from a browser, never something a node token may reach.
+    _reject_node_scope(payload)
     if not user_is_admin(current_user):
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN,
                             detail="Admin access required")