diff options
Diffstat (limited to 'packages/meshbay-hub/src/meshbay_hub/auth.py')
| -rw-r--r-- | packages/meshbay-hub/src/meshbay_hub/auth.py | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/auth.py b/packages/meshbay-hub/src/meshbay_hub/auth.py index e182ba0..0d0fd95 100644 --- a/packages/meshbay-hub/src/meshbay_hub/auth.py +++ b/packages/meshbay-hub/src/meshbay_hub/auth.py @@ -241,7 +241,7 @@ def issue_access_token( def issue_mnp_token(user_id: str, groups: list[str] | None = None, - ttl: int = 900) -> str: + node_pk: str | None = None, ttl: int = 900) -> str: """Issue the short-lived token a member presents to a node in the handshake. `aud=MNP_AUD`, so it is accepted by `authorize_token` and refused by the hub @@ -249,6 +249,11 @@ def issue_mnp_token(user_id: str, groups: list[str] | None = None, lifetime does not interrupt a long transfer or a film already playing; only a fresh connection or a reconnect needs a fresh one. It carries the same `sub`/`groups`/`jti` the node authorises and denylists on. + + `node` names the node this token is for (its base64 Ed25519 key), so it + cannot be replayed to another node the member also belongs to — the node + checks it in `authorize_token` (E10). The client knows the target node's key + before it connects and asks for a token bound to it. """ if _hub_sk_pem is None: raise RuntimeError("Hub keypair not loaded") @@ -260,6 +265,7 @@ def issue_mnp_token(user_id: str, groups: list[str] | None = None, "iat": now, "exp": now + ttl, "groups": groups or [], + "node": node_pk or "", "scope": "user", "aud": MNP_AUD, } |