From f0248975908ad670fa8a820f865bf22ea8d0172d Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 13 Aug 2026 03:56:30 +0200 Subject: feat: Phase 12 — P2P crypto material, password split, node Ed25519 auth MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Baseline commit capturing in-progress Phase 12 work that was already present in the working tree (uncommitted) before the Phase 11.5 security remediation begins. Committed as-is, without review or modification, so that remediation changes arrive as a separable diff. Contents: BundleStore (P2P GEK + keypair bundles), password split (auth_key / bundle_key), node Ed25519 auth (POST /v1/nodes/auth, node-scoped JWT), GEK-HMAC handshake proof with DTLS channel binding, Ed25519 admin challenge-response, node local admin UI rewrite, browser key persistence. Not authored in this session — captured to establish a baseline. Co-Authored-By: Claude Opus 5 --- packages/meshbay-hub/src/meshbay_hub/auth.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/auth.py') diff --git a/packages/meshbay-hub/src/meshbay_hub/auth.py b/packages/meshbay-hub/src/meshbay_hub/auth.py index 11ad112..563a1eb 100644 --- a/packages/meshbay-hub/src/meshbay_hub/auth.py +++ b/packages/meshbay-hub/src/meshbay_hub/auth.py @@ -30,8 +30,9 @@ _ARGON2_KEY_LEN = 32 _ARGON2_VERSIONS = { 1: {"iterations": 3, "memory_cost": 65536}, # 64 MB — initial 2: {"iterations": 3, "memory_cost": 262144}, # 256 MB — production target + 3: {"iterations": 3, "memory_cost": 262144}, # 256 MB — auth_key input (password split) } -_ARGON2_CURRENT_VERSION = 2 +_ARGON2_CURRENT_VERSION = 3 # Module-level hub keypair (loaded once at startup) _hub_sk_pem: bytes | None = None @@ -133,11 +134,13 @@ def issue_access_token( pk_user: str, ttl: int = 3600, groups: list[str] | None = None, + scope: str = "user", ) -> str: """ Issue a signed JWT access token. Includes jti (UUID4) — required to prevent replay and enable revocation. Includes groups — list of group_ids the user is a member of (node-side authz). + scope: "user" (browser, full access) or "node" (daemon, restricted). """ if _hub_sk_pem is None: raise RuntimeError("Hub keypair not loaded") @@ -151,6 +154,7 @@ def issue_access_token( "iat": now, "exp": now + ttl, "groups": groups or [], + "scope": scope, } return jwt.encode(payload, _hub_sk_pem, algorithm="EdDSA") -- cgit v1.2.3