diff options
Diffstat (limited to 'packages/meshbay-hub/tests')
| -rw-r--r-- | packages/meshbay-hub/tests/test_mnp_token.py | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/packages/meshbay-hub/tests/test_mnp_token.py b/packages/meshbay-hub/tests/test_mnp_token.py index 7b483ff..3aa3115 100644 --- a/packages/meshbay-hub/tests/test_mnp_token.py +++ b/packages/meshbay-hub/tests/test_mnp_token.py @@ -69,3 +69,24 @@ async def test_a_session_token_is_refused_by_a_node_but_the_mnp_token_is_not(cli # The MNP token authorises the member to the node. peer = authorize_token(mnp, pk, group_id=gid) assert peer.group_id == gid + + +@pytest.mark.asyncio +async def test_the_mnp_token_is_bound_to_the_node_it_names(client): + """E10: a token minted for node A is refused by node B, so an operator who + captures a member's token cannot replay it to another of the member's nodes.""" + from meshbay_hub.auth import hub_public_key_pem + + tok = await _session_token(client, "mnp_bind_test") + H = {"Authorization": f"Bearer {tok}"} + gid = (await client.post("/v1/groups", headers=H, json={ + "name": "g", "visibility": "private", "join_policy": "invite"})).json()["group_id"] + # A token bound to node A's key. + mnp = (await client.post("/v1/nodes/mnp-token", headers=H, + json={"node_pk": "node-A-pk"})).json()["mnp_token"] + pk = hub_public_key_pem() + # Node B refuses it; node A accepts it. + with pytest.raises(HandshakeError, match="this node"): + authorize_token(mnp, pk, group_id=gid, node_pk_b64="node-B-pk") + peer = authorize_token(mnp, pk, group_id=gid, node_pk_b64="node-A-pk") + assert peer.group_id == gid |