diff options
Diffstat (limited to 'packages/meshbay-node/src/meshbay_node')
| -rw-r--r-- | packages/meshbay-node/src/meshbay_node/hub_client.py | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/packages/meshbay-node/src/meshbay_node/hub_client.py b/packages/meshbay-node/src/meshbay_node/hub_client.py index 49bb920..346a4cd 100644 --- a/packages/meshbay-node/src/meshbay_node/hub_client.py +++ b/packages/meshbay-node/src/meshbay_node/hub_client.py @@ -135,8 +135,14 @@ class HubClient: access_token = data["access_token"] from meshbay_common.handshake import JWT_LEEWAY_SECONDS + from meshbay_common.tokens import HUB_API_AUD + # This is the node's own hub-API session token (scope=node), so it + # carries aud=HUB_API_AUD and must be decoded with that audience — the + # node reads its own exp/scope/jti here. It is a different credential + # from the MNP token a member presents in the handshake (aud=MNP_AUD), + # which authorize_token binds separately. decoded = jwt.decode(access_token, hub_pk_pem, algorithms=["EdDSA"], - leeway=JWT_LEEWAY_SECONDS) + leeway=JWT_LEEWAY_SECONDS, audience=HUB_API_AUD) # No pk_user claim to check any more: tokens carry no key. What binds this # token to this node is the Ed25519 challenge it was issued against. assert "jti" in decoded, "Hub token missing jti — hub is outdated" |