diff options
Diffstat (limited to 'packages/meshbay-hub/src/meshbay_hub/auth.py')
| -rw-r--r-- | packages/meshbay-hub/src/meshbay_hub/auth.py | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/auth.py b/packages/meshbay-hub/src/meshbay_hub/auth.py index 41fb159..8cdfee0 100644 --- a/packages/meshbay-hub/src/meshbay_hub/auth.py +++ b/packages/meshbay-hub/src/meshbay_hub/auth.py @@ -208,6 +208,7 @@ def issue_access_token( ttl: int = 3600, groups: list[str] | None = None, scope: str = "user", + node_key: str = "", ) -> str: """ Issue a signed JWT access token. @@ -219,6 +220,8 @@ def issue_access_token( Includes jti (UUID4) — required to prevent replay and enable revocation. Includes groups — list of group_ids the user is a member of (node-side authz). scope: "user" (browser, full access) or "node" (daemon, restricted). + node_key: for a node token, the linked key that signed in (`nk`). The hub + refuses the token as soon as that key is unlinked (`api/deps.py`). """ if _hub_sk_pem is None: raise RuntimeError("Hub keypair not loaded") @@ -237,6 +240,8 @@ def issue_access_token( # the hub (see meshbay_common.tokens). "aud": HUB_API_AUD, } + if node_key: + payload["nk"] = node_key return jwt.encode(payload, _hub_sk_pem, algorithm="EdDSA") |