From 1e8eae1f3de765fcd8163716de6e5fe5aab5a034 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 09:33:28 +0200 Subject: feat(hub): one account, several linked nodes An account links up to MAX_NODES_PER_ACCOUNT node keys (node_keys table) instead of the one users.pk_node_ed25519; the migration carries each account's key over and the downgrade keeps the last one linked. /v1/nodes/auth accepts any linked key, and its token names the key that won it (nk). PUT /me/node_key adds a key, idempotently, 409 past the limit; DELETE /me/node_key names the key: a browser session any of its own, a node only its own. Unlinking a key closes that node's socket and refuses its tokens at once, on REST and on the socket; the account's other nodes are untouched. /pubkeys no longer gives a node key to other accounts, and gives the caller its last linked one, which installed desktop apps read. The node reports waiting_for_node_key while its key is unlinked and signs in again as soon as the hub says so, so a key linked again is back within seconds; unlinking itself signs in first to hold a token naming its key. Profile -> Linked nodes lists each node (connected, last seen, IP, linked since, This machine in the desktop app) with Copy and Unlink, and adds a key by hand. The Node page banner, Create group and the desktop app add this machine's key instead of replacing another's. Messages that pointed at Settings -> Link Node point at Profile -> Linked nodes. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/src/meshbay_hub/api/nodes.py | 40 +++++++++++++++++------ 1 file changed, 30 insertions(+), 10 deletions(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/api/nodes.py') diff --git a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py index b35f11e..367b37f 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py @@ -16,7 +16,7 @@ from meshbay_hub.api.middleware import limiter from meshbay_hub.api.netutil import client_ip from meshbay_hub.auth import issue_access_token, issue_mnp_token from meshbay_hub.db.engine import get_db -from meshbay_hub.db.models import GroupMember, IPLog, Node, User +from meshbay_hub.db.models import GroupMember, IPLog, Node, NodeKey, User router = APIRouter(prefix="/v1/nodes", tags=["nodes"]) @@ -72,6 +72,21 @@ async def mnp_token( NODE_AUTH_TIMESTAMP_WINDOW = 60 # seconds +def _signing_key(linked: list[str], message: bytes, signature_b64: str) -> str | None: + """The linked key that signed `message`, or None.""" + try: + sig = base64.b64decode(signature_b64) + except Exception: + return None + for pk_b64 in linked: + try: + Ed25519PublicKey.from_public_bytes(base64.b64decode(pk_b64)).verify(sig, message) + return pk_b64 + except (InvalidSignature, ValueError): + continue + return None + + class NodeAuthRequest(BaseModel): username: str timestamp: int # unix epoch seconds @@ -97,29 +112,34 @@ async def node_auth( if user.status != "active": raise HTTPException(status_code=403, detail=f"Account {user.status}") - if not user.pk_node_ed25519: + linked = (await db.execute( + select(NodeKey.pk_node_ed25519).where(NodeKey.user_id == user.id))).scalars().all() + if not linked: raise HTTPException( status_code=401, detail="No node key registered — link your node from the browser first", ) + # Whichever linked key signed it: one per machine the person runs a node on. + # A key that is not linked gets the same "No node key" answer as an account + # with none, which is what the daemon reads to wait for its link + # (`daemon._login_with_retry`) rather than for an account. message = f"meshbay:node_auth:{body.username}:{body.timestamp}".encode() - try: - pk_raw = base64.b64decode(user.pk_node_ed25519) - pk = Ed25519PublicKey.from_public_bytes(pk_raw) - sig = base64.b64decode(body.signature) - pk.verify(sig, message) - except (InvalidSignature, Exception): + signer = _signing_key(linked, message, body.signature) + if signer is None: db.add(IPLog(event="node_auth_fail", ip_address=client_ip(request), detail=body.username)) await db.commit() - raise HTTPException(status_code=401, detail="Invalid signature") + raise HTTPException( + status_code=401, + detail="No node key registered for this node — link it from the browser first", + ) memberships = await db.execute( select(GroupMember.group_id).where(GroupMember.user_id == user.id)) group_ids = [gid for (gid,) in memberships.all()] access_token = issue_access_token( - user.id, ttl=3600, groups=group_ids, scope="node") + user.id, ttl=3600, groups=group_ids, scope="node", node_key=signer) db.add(IPLog(user_id=user.id, event="node_auth", ip_address=client_ip(request))) await db.commit() -- cgit v1.2.3