From 876f4a351f859201ca68fbf8d585c86905571686 Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Sat, 10 Oct 2026 09:57:17 +0200
Subject: fix(client): say when the account's node is elsewhere, and let go of
 it

Signing in on a desktop links this machine's node to the account, but never
over a key already linked (that would cut off the user's other machine) nor a
node set up for another account. On a real install both left the node reading
"Running" while the hub refused it in a loop, and nothing said why. And the
only way to unlink was the linked machine's own Node page, of no use once
that machine is gone.

- The Node page works out, from the node and the hub each time it looks,
  whether this node can serve the signed-in account (nodeLinkProblem), and
  says why not: "Link this node instead" (asked first) puts this node's key
  on the account; "Use this node for my account" switches a node set up for
  another account through node:start, which takeOver now lets past a node
  that answers "running". The first version went through node:start for
  both, and clicking it on a real install did nothing: a node signed in
  before the account was linked elsewhere answers "running".
- The Profile page unlinks the account's node (DELETE /v1/users/me/node_key),
  from any machine.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/meshbay_hub/static/profile-page.js         | 24 +++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

(limited to 'packages/meshbay-hub/src/meshbay_hub/static/profile-page.js')

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/profile-page.js b/packages/meshbay-hub/src/meshbay_hub/static/profile-page.js
index aac3c14..b52a8c6 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/profile-page.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/profile-page.js
@@ -370,6 +370,25 @@ export function ProfilePage({ user, onLogout }) {
     }
   }, [nodeKey, user.token]);
 
+  // Unlinking was only on the linked machine's own Node page, so an account
+  // whose node was on a machine since wiped or lost had no way out here; and a
+  // new machine's node will not take over a key that is still linked
+  // (main.js ensureNode). The hub accepts it from any session of the account.
+  const unlinkNodeKey = useCallback(async () => {
+    if (!await ask(t('settings.node_key_unlink_confirm'))) return;
+    setNodeKeyLoading(true);
+    setNodeKeyStatus('');
+    try {
+      await hubFetch('/v1/users/me/node_key', { method: 'DELETE', token: user.token });
+      setCurrentNodeKey(null);
+      setNodeKeyStatus(t('settings.node_key_unlinked'));
+    } catch (e) {
+      setNodeKeyStatus(e.message);
+    } finally {
+      setNodeKeyLoading(false);
+    }
+  }, [user.token]);
+
   return html`
     <div>
       <h2>${t('profile.title')}</h2>
@@ -435,6 +454,9 @@ export function ProfilePage({ user, onLogout }) {
           <div class="settings-row" style="margin-top:8px">
             <span class="settings-label">${t('settings.node_key_current')}</span>
             <code class="settings-value" style="font-size:0.8em;word-break:break-all">${currentNodeKey}</code>
+            <button class="admin-btn" onClick=${unlinkNodeKey} disabled=${nodeKeyLoading}>
+              ${t('settings.node_key_unlink')}
+            </button>
           </div>
         `}
         <div style="display:flex;gap:8px;margin-top:10px;align-items:center">
@@ -448,7 +470,7 @@ export function ProfilePage({ user, onLogout }) {
           </button>
         </div>
         ${nodeKeyStatus && html`
-          <p style="margin-top:6px;font-size:0.85em;color:${nodeKeyStatus === t('settings.node_key_success') ? 'var(--success)' : 'var(--error)'}">
+          <p style="margin-top:6px;font-size:0.85em;color:${[t('settings.node_key_success'), t('settings.node_key_unlinked')].includes(nodeKeyStatus) ? 'var(--success)' : 'var(--error)'}">
             ${nodeKeyStatus}
           </p>
         `}
-- 
cgit v1.2.3