From bce962c39fcb2d124506e33f77c3ca9082f145dd Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Fri, 25 Sep 2026 14:53:42 +0200 Subject: fix(hub): present a node-audience token in the handshake, not the hub session token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A member authenticated to a node in the MNP handshake with its hub *session* token — scope=user, valid at the hub API for hours. A node operator is in the threat model, so this handed them a live hub credential for the member: enough to enumerate the member's other groups, act as them, and (before the previous commit closed it) take the account over. The node genuinely needs a hub-signed membership assertion, so the fix is to make that a separate credential that opens nothing at the hub API. Two audiences signed by the one hub key (meshbay_common/tokens.py): - HUB_API_AUD — session tokens (login, device-auth, node-auth, refresh), used for hub calls and signaling. decode_access_token now binds this audience, so an MNP token cannot be replayed against the hub API. - MNP_AUD — a short-lived token a member presents to a node and nothing else, from POST /v1/nodes/mnp-token. authorize_token now binds this audience, so a session token presented to a node is refused. This closes the disclosure. The node's own self-decode (hub_client.py) reads its node token with audience=HUB_API_AUD. The client fetches the MNP token inside transport.connect() (and on every reconnect) using the session token, so callers are unchanged and signaling keeps using the session token. No regression to a long session: the MNP token is checked once, at the handshake, before any proof — a film already playing is not re-authenticated, so a 15-minute token does not interrupt a 4-hour film; reconnects refetch a fresh one. Denylist and membership checks are unchanged (the MNP token carries sub/jti/groups). Tests: authorize_token refuses a session/no-audience token and accepts an MNP token; the hub API refuses an MNP token; POST /v1/nodes/mnp-token is minted only for a member's own session. Verified red-before/green-after; common, node and hub suites green (the pre-existing test_cli_golden failure is an argparse/pytest prog artifact unrelated to this change). Still to do before deploy (B2): bump the MNP version and client.minimum so a stale desktop client is told to update rather than getting a handshake refusal, update docs/MESHBAY_DESIGN.md and MESHBAY_NODE_PROTOCOL.md, and validate against a real node locally, then deploy hub+node+SPA atomically. Co-Authored-By: Claude Opus 4.8 --- packages/meshbay-hub/tests/test_token_hardening.py | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) (limited to 'packages/meshbay-hub/tests/test_token_hardening.py') diff --git a/packages/meshbay-hub/tests/test_token_hardening.py b/packages/meshbay-hub/tests/test_token_hardening.py index 0835180..f381f69 100644 --- a/packages/meshbay-hub/tests/test_token_hardening.py +++ b/packages/meshbay-hub/tests/test_token_hardening.py @@ -17,6 +17,7 @@ import time import pytest +from meshbay_common.tokens import HUB_API_AUD from meshbay_hub import auth @@ -33,7 +34,7 @@ async def test_token_without_exp_is_refused(client): import jwt assert _sk_pem_loaded() # A hub-signed token with a valid scope and sub but NO exp. - forged = jwt.encode({"sub": "u", "scope": "user"}, + forged = jwt.encode({"sub": "u", "scope": "user", "aud": HUB_API_AUD}, auth.hub_private_key_pem(), algorithm="EdDSA") with pytest.raises(Exception): auth.decode_access_token(forged) @@ -42,7 +43,8 @@ async def test_token_without_exp_is_refused(client): @pytest.mark.asyncio async def test_expired_token_is_refused(client): import jwt - forged = jwt.encode({"sub": "u", "scope": "user", "exp": int(time.time()) - 100}, + forged = jwt.encode({"sub": "u", "scope": "user", "aud": HUB_API_AUD, + "exp": int(time.time()) - 100}, auth.hub_private_key_pem(), algorithm="EdDSA") with pytest.raises(jwt.ExpiredSignatureError): auth.decode_access_token(forged) @@ -51,7 +53,7 @@ async def test_expired_token_is_refused(client): @pytest.mark.asyncio async def test_token_without_scope_is_refused(client): import jwt - forged = jwt.encode({"sub": "u", "exp": int(time.time()) + 3600}, + forged = jwt.encode({"sub": "u", "exp": int(time.time()) + 3600, "aud": HUB_API_AUD}, auth.hub_private_key_pem(), algorithm="EdDSA") with pytest.raises(Exception): auth.decode_access_token(forged) @@ -60,12 +62,24 @@ async def test_token_without_scope_is_refused(client): @pytest.mark.asyncio async def test_unknown_scope_is_refused(client): import jwt - forged = jwt.encode({"sub": "u", "scope": "root", "exp": int(time.time()) + 3600}, + forged = jwt.encode({"sub": "u", "scope": "root", "aud": HUB_API_AUD, + "exp": int(time.time()) + 3600}, auth.hub_private_key_pem(), algorithm="EdDSA") with pytest.raises(jwt.InvalidTokenError): auth.decode_access_token(forged) +@pytest.mark.asyncio +async def test_an_mnp_token_is_refused_at_the_hub_api(client): + """The MNP token (aud=MNP_AUD) authorises a member to a node; it must not be + a session at the hub. A node operator holds one, and this is what stops them + replaying it against the hub API.""" + from meshbay_hub.auth import issue_mnp_token + mnp = issue_mnp_token("some-user", groups=[]) + with pytest.raises(Exception): + auth.decode_access_token(mnp) + + @pytest.mark.asyncio async def test_a_revocation_token_is_not_a_session(client): """The concrete cross-type case: revocation tokens are hub-signed, carry no -- cgit v1.2.3