1 files changed, 22 insertions, 1 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/deps.py b/packages/meshbay-hub/src/meshbay_hub/api/deps.py
index 56af023..36c3c64 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/deps.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/deps.py
@@ -16,7 +16,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from meshbay_hub.auth import decode_access_token
 from meshbay_hub.db.engine import get_db
-from meshbay_hub.db.models import AdminPin, User
+from meshbay_hub.db.models import AdminPin, NodeKey, User
 
 log = logging.getLogger(__name__)
 
@@ -106,10 +106,31 @@ async def get_current_user(
     if user.status != "active":
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN,
                             detail=f"Account {user.status}")
+    if not await node_token_key_linked(db, payload):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED,
+                            detail="Node key no longer linked to this account",
+                            headers={"WWW-Authenticate": "Bearer"})
     await _pin_if_listed(db, user)
     return user
 
 
+async def node_token_key_linked(db: AsyncSession, payload: dict) -> bool:
+    """False for a node token whose key the account has since unlinked.
+
+    A node token names the key that signed in (`nk`), so unlinking one machine
+    ends that machine's tokens at once and no other. A node token without `nk`
+    predates the claim; none outlives the hour `/v1/nodes/auth` gives it, and
+    refusing it would strand every node mid-hour on the deploy that adds this,
+    since a node only signs in again when its token is about to expire.
+    """
+    if payload.get("scope") != "node" or "nk" not in payload:
+        return True
+    row = await db.execute(
+        select(NodeKey.id).where(NodeKey.user_id == payload.get("sub", ""),
+                                 NodeKey.pk_node_ed25519 == payload["nk"]))
+    return row.first() is not None
+
+
 def _reject_node_scope(payload: dict) -> None:
     """Refuse a node-scoped daemon token on a route meant for a person.