fix(hub): present a node-audience token in the handshake, not the hub session token

A member authenticated to a node in the MNP handshake with its hub *session*
token — scope=user, valid at the hub API for hours. A node operator is in the
threat model, so this handed them a live hub credential for the member: enough
to enumerate the member's other groups, act as them, and (before the previous
commit closed it) take the account over. The node genuinely needs a hub-signed
membership assertion, so the fix is to make that a separate credential that
opens nothing at the hub API.

Two audiences signed by the one hub key (meshbay_common/tokens.py):
- HUB_API_AUD — session tokens (login, device-auth, node-auth, refresh), used
  for hub calls and signaling. decode_access_token now binds this audience, so
  an MNP token cannot be replayed against the hub API.
- MNP_AUD — a short-lived token a member presents to a node and nothing else,
  from POST /v1/nodes/mnp-token. authorize_token now binds this audience, so a
  session token presented to a node is refused. This closes the disclosure.

The node's own self-decode (hub_client.py) reads its node token with
audience=HUB_API_AUD. The client fetches the MNP token inside transport.connect()
(and on every reconnect) using the session token, so callers are unchanged and
signaling keeps using the session token.

No regression to a long session: the MNP token is checked once, at the
handshake, before any proof — a film already playing is not re-authenticated, so
a 15-minute token does not interrupt a 4-hour film; reconnects refetch a fresh
one. Denylist and membership checks are unchanged (the MNP token carries
sub/jti/groups).

Tests: authorize_token refuses a session/no-audience token and accepts an MNP
token; the hub API refuses an MNP token; POST /v1/nodes/mnp-token is minted only
for a member's own session. Verified red-before/green-after; common, node and
hub suites green (the pre-existing test_cli_golden failure is an argparse/pytest
prog artifact unrelated to this change).

Still to do before deploy (B2): bump the MNP version and client.minimum so a
stale desktop client is told to update rather than getting a handshake refusal,
update docs/MESHBAY_DESIGN.md and MESHBAY_NODE_PROTOCOL.md, and validate against
a real node locally, then deploy hub+node+SPA atomically.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

5 files changed, 18 insertions, 6 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/hub_client.py b/packages/meshbay-node/src/meshbay_node/hub_client.py
index 49bb920..346a4cd 100644
--- a/packages/meshbay-node/src/meshbay_node/hub_client.py
+++ b/packages/meshbay-node/src/meshbay_node/hub_client.py
@@ -135,8 +135,14 @@ class HubClient:
         access_token = data["access_token"]
 
         from meshbay_common.handshake import JWT_LEEWAY_SECONDS
+        from meshbay_common.tokens import HUB_API_AUD
+        # This is the node's own hub-API session token (scope=node), so it
+        # carries aud=HUB_API_AUD and must be decoded with that audience — the
+        # node reads its own exp/scope/jti here. It is a different credential
+        # from the MNP token a member presents in the handshake (aud=MNP_AUD),
+        # which authorize_token binds separately.
         decoded = jwt.decode(access_token, hub_pk_pem, algorithms=["EdDSA"],
-                             leeway=JWT_LEEWAY_SECONDS)
+                             leeway=JWT_LEEWAY_SECONDS, audience=HUB_API_AUD)
         # No pk_user claim to check any more: tokens carry no key. What binds this
         # token to this node is the Ed25519 challenge it was issued against.
         assert "jti" in decoded, "Hub token missing jti — hub is outdated"
diff --git a/packages/meshbay-node/tests/test_hub_client.py b/packages/meshbay-node/tests/test_hub_client.py
index e733610..95c93c7 100644
--- a/packages/meshbay-node/tests/test_hub_client.py
+++ b/packages/meshbay-node/tests/test_hub_client.py
@@ -10,6 +10,7 @@ import pytest
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
+from meshbay_common.tokens import HUB_API_AUD
 from meshbay_node.hub_client import HubClient, HubConfig
 from meshbay_node.keystore import NodeKeys
 
@@ -52,7 +53,7 @@ def make_node_token(sk_pem, user_id, pk_user_b64, hub_id="fake-hub", ttl=3600):
     return jwt.encode({
         "iss": hub_id, "sub": user_id, "pk_user": pk_user_b64,
         "hub_id": hub_id, "jti": "test-jti", "scope": "node",
-        "iat": now, "exp": now + ttl,
+        "iat": now, "exp": now + ttl, "aud": HUB_API_AUD,
     }, sk_pem, algorithm="EdDSA")
 
 
@@ -89,7 +90,7 @@ async def test_login_rejects_missing_jti(hub_keys, node_keys, hub_config):
     sk_hub, sk_hub_pem, pk_hub_pem = hub_keys
     bad_token = jwt.encode({
         "iss": "fake-hub", "sub": "uid", "pk_user": node_keys.pk_ed25519_b64,
-        "hub_id": "fake-hub", "scope": "node",
+        "hub_id": "fake-hub", "scope": "node", "aud": HUB_API_AUD,
         "iat": int(time.time()), "exp": int(time.time()) + 3600,
     }, sk_hub_pem, algorithm="EdDSA")
 
diff --git a/packages/meshbay-node/tests/test_multi_group.py b/packages/meshbay-node/tests/test_multi_group.py
index b75bad0..01b2abc 100644
--- a/packages/meshbay-node/tests/test_multi_group.py
+++ b/packages/meshbay-node/tests/test_multi_group.py
@@ -7,6 +7,7 @@ Verifies that:
   - A user in both groups can access both
 """
 
+from meshbay_common.tokens import MNP_AUD
 import time
 
 import jwt
@@ -63,7 +64,7 @@ def make_jwt(sk_hub, pk_node_b64, groups, user_id="user-001", ttl=3600):
         "iss": "test-hub", "sub": user_id,
         "pk_user": pk_node_b64, "hub_id": "test-hub",
         "jti": "test-jti", "iat": now, "exp": now + ttl,
-        "groups": groups,
+        "groups": groups, "scope": "user", "aud": MNP_AUD,
     }, sk_pem, algorithm="EdDSA")
 
 
diff --git a/packages/meshbay-node/tests/test_quic_transport.py b/packages/meshbay-node/tests/test_quic_transport.py
index 8eb0622..a32402a 100644
--- a/packages/meshbay-node/tests/test_quic_transport.py
+++ b/packages/meshbay-node/tests/test_quic_transport.py
@@ -3,6 +3,7 @@ Integration test: QuicChunkServer ↔ QuicChunkClient over QUIC/UDP loopback.
 Same structure as test_transport.py but uses QUIC instead of TCP+TLS.
 """
 
+from meshbay_common.tokens import MNP_AUD
 import asyncio
 import os
 import time
@@ -51,7 +52,8 @@ def make_jwt(sk_hub, pk_node_b64, ttl=3600, groups=None):
         "pk_user": pk_node_b64, "hub_id": "test-hub",
         "jti": "test-jti", "iat": now, "exp": now + ttl,
         # group_id is mandatory (M1), so default tokens are members of "g".
-        "groups": groups if groups is not None else ["g"],
+        "groups": groups if groups is not None else ["g"], "scope": "user",
+        "aud": MNP_AUD,
     }, sk_pem, algorithm="EdDSA")
 
 
diff --git a/packages/meshbay-node/tests/test_webrtc_transport.py b/packages/meshbay-node/tests/test_webrtc_transport.py
index 0245c4e..990b1da 100644
--- a/packages/meshbay-node/tests/test_webrtc_transport.py
+++ b/packages/meshbay-node/tests/test_webrtc_transport.py
@@ -7,6 +7,7 @@ for MNP protocol exchange (handshake, index_sync, file_request, file_chunk).
 Uses local loopback (no STUN/ICE needed for localhost).
 """
 
+from meshbay_common.tokens import MNP_AUD
 import asyncio
 import base64
 import hashlib
@@ -115,6 +116,7 @@ def _make_jwt(sk_hub, groups=None, pk_user="test"):
         "pk_user": pk_user, "hub_id": "test-hub",
         "jti": "test-jti-webrtc", "iat": now, "exp": now + 3600,
         "groups": groups if groups is not None else [TEST_GROUP],
+        "scope": "user", "aud": MNP_AUD,
     }, sk_pem, algorithm="EdDSA")
 
 
@@ -218,7 +220,7 @@ def _token(sk_hub, jwt_sub, peer_id, group_id, pk_user="test"):
         "iss": "test-hub", "sub": jwt_sub,
         "pk_user": pk_user, "hub_id": "test-hub",
         "jti": f"jti-{peer_id}", "iat": now, "exp": now + 3600,
-        "groups": [group_id], "scope": "user",
+        "groups": [group_id], "scope": "user", "aud": MNP_AUD,
     }, sk_h_pem, algorithm="EdDSA")