From 2ccb6653e8841d4d6f3ab933f84746cce4e2fe2b Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Sat, 26 Sep 2026 02:03:50 +0200 Subject: feat(protocol): bind the MNP token to the node it is for (E10) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The audience split stopped a member's node credential from opening the hub API. It did not stop the credential being *replayed to another node*: the MNP token carried the member's whole group set and named no node, so a token handed to node A's operator could be presented to node B the member also belongs to. That does not read content on B — the handshake still requires proving node B's group key, which the operator lacks — but it reaches B's pre-proof window and fetches the member's *encrypted* keypair bundle for B (offline-attackable, bounded, audited): a disclosure §2.4 says should not follow from hosting a member on A. The token now names the node it is minted for (a `node` claim = that node's Ed25519 key), and authorize_token refuses one that names a different key. The client already knows the target node's key (from /v1/groups/{id}/nodes) and asks for a token bound to it: POST /v1/nodes/mnp-token takes node_pk, and transport.connect threads it (group-page, the connection pool and rewrap pass n.pk_node; reconnect preserves it). A token that names no node is still accepted, because the hub only mints one for the authenticated requester, so an unbound token grants nothing across accounts — which also keeps non-binding callers working with no churn. Done before deploy, so it folds into the MNP 4.0 flag day rather than needing its own. Docs: §5.2, register E10, MESHBAY_NODE_PROTOCOL.md §6.3. test_handshake.py and test_mnp_token.py hold the binding (a token for node A is refused by node B, accepted by node A; an unbound token still works); red before, green after. common/node/hub suites green. Co-Authored-By: Claude Opus 4.8 --- .../meshbay-common/src/meshbay_common/handshake.py | 19 +++++++++++++++++++ packages/meshbay-common/tests/test_handshake.py | 21 +++++++++++++++++++++ 2 files changed, 40 insertions(+) (limited to 'packages/meshbay-common') diff --git a/packages/meshbay-common/src/meshbay_common/handshake.py b/packages/meshbay-common/src/meshbay_common/handshake.py index dedfeb1..992fe8a 100644 --- a/packages/meshbay-common/src/meshbay_common/handshake.py +++ b/packages/meshbay-common/src/meshbay_common/handshake.py @@ -269,6 +269,7 @@ def authorize_token( hosted_groups: Any | None = None, denylist: DenylistLike | None = None, require_scope: str | None = "user", + node_pk_b64: str | None = None, ) -> AuthorizedPeer: """ Everything decided from the JWT, before any proof is exchanged. @@ -276,6 +277,13 @@ def authorize_token( Raises HandshakeError with a peer-safe message. Deliberately strict about `group_id`: it used to be optional, and omitting it skipped the membership check entirely and fell back to the node's first group (M1). + + `node_pk_b64` binds the token to **this** node (E10). The MNP token names + the node it was minted for (`node` claim), so a member's token captured by + the operator of one node cannot be replayed to another node the member also + belongs to — not even to reach the pre-proof window there. A node always + passes its own key; a caller that passes `None` (a unit test not exercising + this) skips the check. """ try: decoded = jwt.decode(token, hub_pk_pem, algorithms=["EdDSA"], @@ -294,6 +302,17 @@ def authorize_token( if require_scope is not None and decoded.get("scope", "user") != require_scope: raise HandshakeError("Wrong token scope") + # The token names the node it was minted for (`node` claim). A member's real + # client always binds it to the node it is reaching, so a token captured by + # that node's operator and replayed to a *second* node the member also uses + # is refused here — before the pre-proof window can serve anything (E10). + # A token that names no node is not refused: the hub only ever mints one for + # the authenticated requester, so an unbound token grants nothing across + # accounts, and this keeps older or non-binding callers working. + node_claim = decoded.get("node", "") + if node_pk_b64 is not None and node_claim and node_claim != node_pk_b64: + raise HandshakeError("Token is not for this node", code="wrong_node") + user_id = decoded.get("sub", "") jti = decoded.get("jti", "") if not user_id: diff --git a/packages/meshbay-common/tests/test_handshake.py b/packages/meshbay-common/tests/test_handshake.py index 8f385bb..f42d597 100644 --- a/packages/meshbay-common/tests/test_handshake.py +++ b/packages/meshbay-common/tests/test_handshake.py @@ -120,6 +120,27 @@ def test_a_token_with_no_audience_is_refused(hub_key): authorize_token(no_aud, pk_pem, group_id=GROUP) +def test_a_token_bound_to_another_node_is_refused(hub_key): + """E10: a token names the node it is for. A member's token captured by one + node's operator cannot be replayed to a second node the member also uses.""" + sk_pem, pk_pem = hub_key + token_for_A = _token(sk_pem, node="node-A-pk") + # Node B (its own key is 'node-B-pk') refuses it. + with pytest.raises(HandshakeError, match="this node"): + authorize_token(token_for_A, pk_pem, group_id=GROUP, node_pk_b64="node-B-pk") + # Node A accepts it. + peer = authorize_token(token_for_A, pk_pem, group_id=GROUP, node_pk_b64="node-A-pk") + assert peer.user_id == "user-1" + + +def test_a_token_naming_no_node_is_still_accepted(hub_key): + """Lenient by design: the hub mints an unbound token only for the requester, + so it grants nothing across accounts, and older callers keep working.""" + sk_pem, pk_pem = hub_key + peer = authorize_token(_token(sk_pem), pk_pem, group_id=GROUP, node_pk_b64="node-B-pk") + assert peer.group_id == GROUP + + def test_unhosted_group_refused(hub_key): sk_pem, pk_pem = hub_key with pytest.raises(HandshakeError, match="not hosted"): -- cgit v1.2.3