diff options
Diffstat (limited to 'packages/meshbay-hub/src/meshbay_hub/api/nodes.py')
| -rw-r--r-- | packages/meshbay-hub/src/meshbay_hub/api/nodes.py | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py index 403f450..decd20e 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py @@ -26,6 +26,10 @@ class MnpTokenRequest(BaseModel): # to it (E10), so it cannot be replayed to another node. The client knows it # from `/v1/groups/{id}/nodes` before it connects. node_pk: str = "" + # The one group this connection is for. The token names that group and no + # other: it is handed to the node's operator, who has no business learning + # every other group the member belongs to. + group_id: str = "" @router.post("/mnp-token") @@ -50,11 +54,16 @@ async def mnp_token( only *restricts* the token to whatever node holds that key, which is the one the client is connecting to; a wrong key yields a token no node will accept. """ - rows = await db.execute( - select(GroupMember.group_id).where(GroupMember.user_id == current_user.id)) - group_ids = [gid for (gid,) in rows.all()] + group_id = (body.group_id if body else "").strip() + if not group_id: + raise HTTPException(status_code=422, + detail="Name the group this connection is for (group_id)") + member = await db.get(GroupMember, (group_id, current_user.id)) return { - "mnp_token": issue_mnp_token(current_user.id, groups=group_ids, + # Empty when the account is not a member: the node then refuses with + # `not_a_member`, which is the answer that case has always had. + "mnp_token": issue_mnp_token(current_user.id, + groups=[group_id] if member else [], node_pk=(body.node_pk if body else "")), "expires_in": 900, } |