diff options
Diffstat (limited to 'packages/meshbay-common/src/meshbay_common/tokens.py')
| -rw-r--r-- | packages/meshbay-common/src/meshbay_common/tokens.py | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/packages/meshbay-common/src/meshbay_common/tokens.py b/packages/meshbay-common/src/meshbay_common/tokens.py new file mode 100644 index 0000000..c393be5 --- /dev/null +++ b/packages/meshbay-common/src/meshbay_common/tokens.py @@ -0,0 +1,28 @@ +"""Token audiences — one hub key, two purposes, never interchangeable. + +The hub signs everything with one Ed25519 key, but a token has to say what it is +*for*, or a credential minted for one purpose is honoured for another. Two +audiences settle it: + +- ``HUB_API_AUD`` — a session token, presented to the **hub API** (``hubFetch``, + signaling). Carried by the browser and the desktop client, and by a node for + its own hub calls. +- ``MNP_AUD`` — a short-lived token a member presents to a **node** in the MNP + handshake, and to nothing else. It authorises the member to that node + (``sub``, ``groups``, ``jti``) and is **useless at the hub API**. + +The reason this exists: a member hands whatever token it holds to every node it +connects to (the handshake authenticates with it). If that were the session +token, a node operator — who is in the threat model — would hold a live hub +credential for the member and could act as them at the hub. Separating the +audiences means the credential a node receives opens nothing at the hub, and the +credential the hub API accepts is never disclosed to a node. + +The hub API decode (:func:`meshbay_hub.auth.decode_access_token`) binds +``HUB_API_AUD``; the node handshake decode +(:func:`meshbay_common.handshake.authorize_token`) binds ``MNP_AUD``. Each +rejects the other's audience. +""" + +HUB_API_AUD = "meshbay:hub-api" +MNP_AUD = "meshbay:mnp" |