From a55d40b74bda77dff6ec565abdd551607fc665d6 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 30 Sep 2026 13:55:59 +0200 Subject: feat(hub): a bundle pepper per account, handed only to a proven session Sealed at rest and bound to the account; returned by sign-in, device sign-in, a passphrase change and GET /me/bundle-pepper, never by a refresh, to a node token, in a token or in a log. Erasure clears it. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/src/meshbay_hub/db/models.py | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'packages/meshbay-hub/src/meshbay_hub/db/models.py') diff --git a/packages/meshbay-hub/src/meshbay_hub/db/models.py b/packages/meshbay-hub/src/meshbay_hub/db/models.py index 293b940..1e652a6 100644 --- a/packages/meshbay-hub/src/meshbay_hub/db/models.py +++ b/packages/meshbay-hub/src/meshbay_hub/db/models.py @@ -60,6 +60,14 @@ class User(Base): # active|suspended|revoked status: Mapped[str] = mapped_column(String(16), default="active") created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now) + # The second half of what opens this account's keypair bundles on nodes + # (`auth.seal_pepper`, sealed at rest). A bundle is sealed under a key derived + # from the passphrase *and* this, so an operator holding one cannot test + # passphrase guesses offline: the pepper is handed only to a session that + # proved the passphrase or a device key, never to a node. Created the first + # time it is asked for; the version names which pepper sealed a bundle. + bundle_pepper: Mapped[str | None] = mapped_column(String(128), nullable=True) + bundle_pepper_version: Mapped[int] = mapped_column(Integer, default=1, server_default="1") nodes: Mapped[list["Node"]] = relationship(back_populates="user") group_memberships: Mapped[list["GroupMember"]] = relationship(back_populates="user") -- cgit v1.2.3