1 files changed, 30 insertions, 10 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
index b35f11e..367b37f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
@@ -16,7 +16,7 @@ from meshbay_hub.api.middleware import limiter
 from meshbay_hub.api.netutil import client_ip
 from meshbay_hub.auth import issue_access_token, issue_mnp_token
 from meshbay_hub.db.engine import get_db
-from meshbay_hub.db.models import GroupMember, IPLog, Node, User
+from meshbay_hub.db.models import GroupMember, IPLog, Node, NodeKey, User
 
 router = APIRouter(prefix="/v1/nodes", tags=["nodes"])
 
@@ -72,6 +72,21 @@ async def mnp_token(
 NODE_AUTH_TIMESTAMP_WINDOW = 60  # seconds
 
 
+def _signing_key(linked: list[str], message: bytes, signature_b64: str) -> str | None:
+    """The linked key that signed `message`, or None."""
+    try:
+        sig = base64.b64decode(signature_b64)
+    except Exception:
+        return None
+    for pk_b64 in linked:
+        try:
+            Ed25519PublicKey.from_public_bytes(base64.b64decode(pk_b64)).verify(sig, message)
+            return pk_b64
+        except (InvalidSignature, ValueError):
+            continue
+    return None
+
+
 class NodeAuthRequest(BaseModel):
     username:  str
     timestamp: int       # unix epoch seconds
@@ -97,29 +112,34 @@ async def node_auth(
     if user.status != "active":
         raise HTTPException(status_code=403, detail=f"Account {user.status}")
 
-    if not user.pk_node_ed25519:
+    linked = (await db.execute(
+        select(NodeKey.pk_node_ed25519).where(NodeKey.user_id == user.id))).scalars().all()
+    if not linked:
         raise HTTPException(
             status_code=401,
             detail="No node key registered — link your node from the browser first",
         )
 
+    # Whichever linked key signed it: one per machine the person runs a node on.
+    # A key that is not linked gets the same "No node key" answer as an account
+    # with none, which is what the daemon reads to wait for its link
+    # (`daemon._login_with_retry`) rather than for an account.
     message = f"meshbay:node_auth:{body.username}:{body.timestamp}".encode()
-    try:
-        pk_raw = base64.b64decode(user.pk_node_ed25519)
-        pk = Ed25519PublicKey.from_public_bytes(pk_raw)
-        sig = base64.b64decode(body.signature)
-        pk.verify(sig, message)
-    except (InvalidSignature, Exception):
+    signer = _signing_key(linked, message, body.signature)
+    if signer is None:
         db.add(IPLog(event="node_auth_fail", ip_address=client_ip(request), detail=body.username))
         await db.commit()
-        raise HTTPException(status_code=401, detail="Invalid signature")
+        raise HTTPException(
+            status_code=401,
+            detail="No node key registered for this node — link it from the browser first",
+        )
 
     memberships = await db.execute(
         select(GroupMember.group_id).where(GroupMember.user_id == user.id))
     group_ids = [gid for (gid,) in memberships.all()]
 
     access_token = issue_access_token(
-        user.id, ttl=3600, groups=group_ids, scope="node")
+        user.id, ttl=3600, groups=group_ids, scope="node", node_key=signer)
 
     db.add(IPLog(user_id=user.id, event="node_auth", ip_address=client_ip(request)))
     await db.commit()