1 files changed, 23 insertions, 1 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
index 2499374..c03d582 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
@@ -39,7 +39,7 @@ from pydantic import BaseModel
 from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from meshbay_hub.api.deps import get_current_user, require_admin
+from meshbay_hub.api.deps import get_current_user, node_token_key_linked, require_admin
 from meshbay_hub.auth import decode_access_token
 from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import Group, GroupMember, IPLog, Node, User
@@ -116,6 +116,18 @@ def forget_node(node_id: str) -> None:
     _node_users.pop(node_id, None)
 
 
+async def disconnect_node(node_id: str, detail: str) -> None:
+    """Close a node's live socket now, with the reason it is given."""
+    ws = _connected_nodes.get(node_id)
+    if ws is None:
+        return
+    forget_node(node_id)
+    try:
+        await _reject(ws, detail, 4003)
+    except Exception:
+        pass  # already gone; it is forgotten either way
+
+
 def _spend(window: dict[str, tuple[float, int]], node_id: str, burst: int) -> bool:
     """True if this node may send one more message of a budgeted kind now."""
     now = time.monotonic()
@@ -429,6 +441,16 @@ async def _authorize_node_ws(token: str, claimed_id: str, claimed_groups) -> tup
         if user is None or user.status != "active":
             return None, "Account not active"
 
+        # The token names the key that signed in (`nk`): it registers that
+        # machine's node and no other, and only while the key is still linked.
+        # A token from before the claim names no key, so the node's own key is
+        # checked instead: unlinking a node closes its socket for good, not
+        # until a token issued before the upgrade runs out.
+        if "nk" in decoded and node.pk_node != decoded["nk"]:
+            return None, "node_id is not the node this token was issued to"
+        if not await node_token_key_linked(db, {**decoded, "nk": node.pk_node}):
+            return None, "Node key no longer linked to this account"
+
     # Groups come from the database. The node may narrow the set to what it
     # actually hosts, but it cannot widen it past what its account belongs to
     # (C2) — nor, within that, past what its account owns or the owner approved.