From 1e8eae1f3de765fcd8163716de6e5fe5aab5a034 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 09:33:28 +0200 Subject: feat(hub): one account, several linked nodes An account links up to MAX_NODES_PER_ACCOUNT node keys (node_keys table) instead of the one users.pk_node_ed25519; the migration carries each account's key over and the downgrade keeps the last one linked. /v1/nodes/auth accepts any linked key, and its token names the key that won it (nk). PUT /me/node_key adds a key, idempotently, 409 past the limit; DELETE /me/node_key names the key: a browser session any of its own, a node only its own. Unlinking a key closes that node's socket and refuses its tokens at once, on REST and on the socket; the account's other nodes are untouched. /pubkeys no longer gives a node key to other accounts, and gives the caller its last linked one, which installed desktop apps read. The node reports waiting_for_node_key while its key is unlinked and signs in again as soon as the hub says so, so a key linked again is back within seconds; unlinking itself signs in first to hold a token naming its key. Profile -> Linked nodes lists each node (connected, last seen, IP, linked since, This machine in the desktop app) with Copy and Unlink, and adds a key by hand. The Node page banner, Create group and the desktop app add this machine's key instead of replacing another's. Messages that pointed at Settings -> Link Node point at Profile -> Linked nodes. Co-Authored-By: Claude Opus 5.5 --- .../migrations/versions/f8a9b0c1d2e3_node_keys.py | 63 ++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/f8a9b0c1d2e3_node_keys.py (limited to 'packages/meshbay-hub/src/meshbay_hub/db/migrations/versions') diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/f8a9b0c1d2e3_node_keys.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/f8a9b0c1d2e3_node_keys.py new file mode 100644 index 0000000..b02167b --- /dev/null +++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/f8a9b0c1d2e3_node_keys.py @@ -0,0 +1,63 @@ +"""several node keys per account: one per machine the person runs a node on + +Revision ID: f8a9b0c1d2e3 +Revises: e7f8a9b0c1d2 +""" + +import uuid +from collections.abc import Sequence +from datetime import UTC, datetime + +import sqlalchemy as sa +from alembic import op + +revision: str = "f8a9b0c1d2e3" +down_revision: str | Sequence[str] | None = "e7f8a9b0c1d2" +branch_labels: str | Sequence[str] | None = None +depends_on: str | Sequence[str] | None = None + + +def upgrade() -> None: + node_keys = op.create_table( + "node_keys", + sa.Column("id", sa.String(36), primary_key=True), + sa.Column("user_id", sa.String(36), sa.ForeignKey("users.id"), nullable=False), + sa.Column("pk_node_ed25519", sa.String(64), nullable=False), + sa.Column("linked_at", sa.DateTime(timezone=True)), + ) + op.create_index("uq_node_keys_user_key", "node_keys", + ["user_id", "pk_node_ed25519"], unique=True) + + # The key each account had linked keeps working: it becomes that account's + # first row, so no node has to be linked again after the upgrade. + conn = op.get_bind() + linked = conn.execute(sa.text( + "SELECT id, pk_node_ed25519 FROM users WHERE pk_node_ed25519 IS NOT NULL " + "AND pk_node_ed25519 <> ''")).fetchall() + now = datetime.now(UTC) + if linked: + op.bulk_insert(node_keys, [ + {"id": str(uuid.uuid4()), "user_id": uid, "pk_node_ed25519": pk, + "linked_at": now} + for uid, pk in linked]) + + with op.batch_alter_table("users") as batch: + batch.drop_column("pk_node_ed25519") + + +def downgrade() -> None: + with op.batch_alter_table("users") as batch: + batch.add_column(sa.Column("pk_node_ed25519", sa.String(64), nullable=True)) + + # One column holds one key: the most recently linked one is kept, which is + # the node the account would have had linked last before this revision. + conn = op.get_bind() + rows = conn.execute(sa.text( + "SELECT user_id, pk_node_ed25519 FROM node_keys ORDER BY linked_at")).fetchall() + latest = {uid: pk for uid, pk in rows} + for uid, pk in latest.items(): + conn.execute(sa.text("UPDATE users SET pk_node_ed25519 = :pk WHERE id = :uid"), + {"pk": pk, "uid": uid}) + + op.drop_index("uq_node_keys_user_key", table_name="node_keys") + op.drop_table("node_keys") -- cgit v1.2.3