From 1e8eae1f3de765fcd8163716de6e5fe5aab5a034 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 09:33:28 +0200 Subject: feat(hub): one account, several linked nodes An account links up to MAX_NODES_PER_ACCOUNT node keys (node_keys table) instead of the one users.pk_node_ed25519; the migration carries each account's key over and the downgrade keeps the last one linked. /v1/nodes/auth accepts any linked key, and its token names the key that won it (nk). PUT /me/node_key adds a key, idempotently, 409 past the limit; DELETE /me/node_key names the key: a browser session any of its own, a node only its own. Unlinking a key closes that node's socket and refuses its tokens at once, on REST and on the socket; the account's other nodes are untouched. /pubkeys no longer gives a node key to other accounts, and gives the caller its last linked one, which installed desktop apps read. The node reports waiting_for_node_key while its key is unlinked and signs in again as soon as the hub says so, so a key linked again is back within seconds; unlinking itself signs in first to hold a token naming its key. Profile -> Linked nodes lists each node (connected, last seen, IP, linked since, This machine in the desktop app) with Copy and Unlink, and adds a key by hand. The Node page banner, Create group and the desktop app add this machine's key instead of replacing another's. Messages that pointed at Settings -> Link Node point at Profile -> Linked nodes. Co-Authored-By: Claude Opus 5.5 --- .../meshbay-hub/src/meshbay_hub/api/revocation.py | 24 +++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/api/revocation.py') diff --git a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py index 2499374..c03d582 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py @@ -39,7 +39,7 @@ from pydantic import BaseModel from sqlalchemy import select, update from sqlalchemy.ext.asyncio import AsyncSession -from meshbay_hub.api.deps import get_current_user, require_admin +from meshbay_hub.api.deps import get_current_user, node_token_key_linked, require_admin from meshbay_hub.auth import decode_access_token from meshbay_hub.db.engine import get_db from meshbay_hub.db.models import Group, GroupMember, IPLog, Node, User @@ -116,6 +116,18 @@ def forget_node(node_id: str) -> None: _node_users.pop(node_id, None) +async def disconnect_node(node_id: str, detail: str) -> None: + """Close a node's live socket now, with the reason it is given.""" + ws = _connected_nodes.get(node_id) + if ws is None: + return + forget_node(node_id) + try: + await _reject(ws, detail, 4003) + except Exception: + pass # already gone; it is forgotten either way + + def _spend(window: dict[str, tuple[float, int]], node_id: str, burst: int) -> bool: """True if this node may send one more message of a budgeted kind now.""" now = time.monotonic() @@ -429,6 +441,16 @@ async def _authorize_node_ws(token: str, claimed_id: str, claimed_groups) -> tup if user is None or user.status != "active": return None, "Account not active" + # The token names the key that signed in (`nk`): it registers that + # machine's node and no other, and only while the key is still linked. + # A token from before the claim names no key, so the node's own key is + # checked instead: unlinking a node closes its socket for good, not + # until a token issued before the upgrade runs out. + if "nk" in decoded and node.pk_node != decoded["nk"]: + return None, "node_id is not the node this token was issued to" + if not await node_token_key_linked(db, {**decoded, "nk": node.pk_node}): + return None, "Node key no longer linked to this account" + # Groups come from the database. The node may narrow the set to what it # actually hosts, but it cannot widen it past what its account belongs to # (C2) — nor, within that, past what its account owns or the owner approved. -- cgit v1.2.3