From bce962c39fcb2d124506e33f77c3ca9082f145dd Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Fri, 25 Sep 2026 14:53:42 +0200 Subject: fix(hub): present a node-audience token in the handshake, not the hub session token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A member authenticated to a node in the MNP handshake with its hub *session* token — scope=user, valid at the hub API for hours. A node operator is in the threat model, so this handed them a live hub credential for the member: enough to enumerate the member's other groups, act as them, and (before the previous commit closed it) take the account over. The node genuinely needs a hub-signed membership assertion, so the fix is to make that a separate credential that opens nothing at the hub API. Two audiences signed by the one hub key (meshbay_common/tokens.py): - HUB_API_AUD — session tokens (login, device-auth, node-auth, refresh), used for hub calls and signaling. decode_access_token now binds this audience, so an MNP token cannot be replayed against the hub API. - MNP_AUD — a short-lived token a member presents to a node and nothing else, from POST /v1/nodes/mnp-token. authorize_token now binds this audience, so a session token presented to a node is refused. This closes the disclosure. The node's own self-decode (hub_client.py) reads its node token with audience=HUB_API_AUD. The client fetches the MNP token inside transport.connect() (and on every reconnect) using the session token, so callers are unchanged and signaling keeps using the session token. No regression to a long session: the MNP token is checked once, at the handshake, before any proof — a film already playing is not re-authenticated, so a 15-minute token does not interrupt a 4-hour film; reconnects refetch a fresh one. Denylist and membership checks are unchanged (the MNP token carries sub/jti/groups). Tests: authorize_token refuses a session/no-audience token and accepts an MNP token; the hub API refuses an MNP token; POST /v1/nodes/mnp-token is minted only for a member's own session. Verified red-before/green-after; common, node and hub suites green (the pre-existing test_cli_golden failure is an argparse/pytest prog artifact unrelated to this change). Still to do before deploy (B2): bump the MNP version and client.minimum so a stale desktop client is told to update rather than getting a handshake refusal, update docs/MESHBAY_DESIGN.md and MESHBAY_NODE_PROTOCOL.md, and validate against a real node locally, then deploy hub+node+SPA atomically. Co-Authored-By: Claude Opus 4.8 --- .../src/meshbay_hub/static/transport.js | 31 +++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/static') diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js index 202db94..27edc4e 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js @@ -651,6 +651,25 @@ class MeshBayTransport { try { this.onConnectProgress(phase); } catch { /* the caller's problem */ } } + // Fetch the short-lived token presented to a node in the handshake. It is a + // different credential from the session token used for hub calls: aud=MNP_AUD, + // useless at the hub API, so a node operator who captures it gains nothing + // there (see meshbay_common/tokens.py). Uses the session token to ask. + async _fetchNodeToken(call) { + const doFetch = call + || (window.MeshBayPlatform && window.MeshBayPlatform.apiFetch) || fetch; + const r = await doFetch(`${this._hubUrl}/v1/nodes/mnp-token`, { + method: 'POST', + headers: { + 'Content-Type': 'application/json', + 'Authorization': `Bearer ${this._accessToken}`, + }, + body: JSON.stringify({}), + }); + if (!r.ok) throw new Error(`Could not obtain a node token: ${r.status}`); + return (await r.json()).mnp_token; + } + async connect(nodeId, jwtToken, groupId, gekRaw, sessionKeys, bundleKey, username, userId, joinCode, recoveryKey, joinNodePk) { // Remembered for _reconnectLoop, which calls connect() again with these @@ -896,11 +915,21 @@ class MeshBayTransport { // recorded handshake_ack could be replayed by an impersonating peer. this._nonceClient = crypto.getRandomValues(new Uint8Array(32)); + // The member authenticates to the node with a short-lived MNP token, never + // its hub session token. A node operator holds whatever is presented here, + // and the session token opens the hub API — so presenting it would hand an + // operator a live credential for the member (audience-bound, see + // meshbay_common/tokens.py). Fetched per connect and per reconnect with the + // session token (`this._accessToken`), so it always carries current group + // membership and a fresh expiry. Signaling above still uses the session + // token, because that is a hub call. + const nodeToken = await this._fetchNodeToken(call); + const reply = await this._sendAndWait({ type: 'handshake', v: MNP_V, v_min: MNP_V_MIN, - token: jwtToken, + token: nodeToken, group_id: groupId || '', nonce: window.MeshBayCrypto.b64encode(this._nonceClient), }); -- cgit v1.2.3