1 files changed, 8 insertions, 4 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index f3683eb..546d01b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -663,21 +663,21 @@ class MeshBayTransport {
         'Content-Type': 'application/json',
         'Authorization': `Bearer ${this._accessToken}`,
       },
-      body: JSON.stringify({}),
+      body: JSON.stringify({ node_pk: this._nodePkTarget || '' }),
     });
     if (!r.ok) throw new Error(`Could not obtain a node token: ${r.status}`);
     return (await r.json()).mnp_token;
   }
 
   async connect(nodeId, jwtToken, groupId, gekRaw, sessionKeys, bundleKey, username,
-                userId, joinCode, recoveryKey, joinNodePk) {
+                userId, joinCode, recoveryKey, joinNodePk, nodePk) {
     // Remembered for _reconnectLoop, which calls connect() again with these
     // same values (plus a freshly-fetched token and the identity connect()
     // itself settles on below) after the WebRTC connection is declared
     // "failed" — see the pc.onconnectionstatechange handler further down.
     this._connectArgs = {
       nodeId, groupId, gekRaw, bundleKey, username, userId, joinCode, recoveryKey,
-      joinNodePk,
+      joinNodePk, nodePk,
     };
     this._lastToken = jwtToken;
     // The constructor sets this once from whatever token the caller had at
@@ -695,6 +695,10 @@ class MeshBayTransport {
     this._recoveryKey = recoveryKey || null;
     this._username = username || null;
     this._userId = userId || null;
+    // The key of the node we mean to reach, from the hub's node list. The MNP
+    // token is bound to it (E10) so it cannot be replayed to another node. It is
+    // the *expected* key; `this.nodePk` below is the one the node then proves.
+    this._nodePkTarget = nodePk || '';
     // The group this connection is for. Kept on the instance because the
     // handshake is not the only thing that needs it any more: device_hello and
     // the chat envelope both bind to it, and both run outside connect()'s scope.
@@ -1321,7 +1325,7 @@ class MeshBayTransport {
           ack = await this.connect(args.nodeId, token, args.groupId, args.gekRaw,
                                    this._sessionKeys, args.bundleKey, args.username,
                                    args.userId, args.joinCode, undefined,
-                                   args.joinNodePk);
+                                   args.joinNodePk, args.nodePk);
         } finally {
           this._inReconnectAttempt = false;
         }