refactor(relay): route auth through admissions

[kixelated]

Problem

Auth::admit had separate server, public, embedded, and refusal paths, so admission behavior could diverge by configuration.

Approach

• Make every Auth clone send an Admission and await its answer.
• Run server, public, and refusal policies as deciders on the shared queue.
• Spawn each auth-server request independently so one slow decision cannot serialize connects.
• Map an embedded empty grant to Error::Refused, matching the auth-server path.
• Cover runtime requirements, queue lifetime, public grants, embedded decisions, empty grants, and refusal.

Impact

• Public API: auth::Config::init and Auth::refuse now require an active Tokio runtime. The auth module is unpublished.
• Behavior: an empty grant from an embedded decider is classified as refused rather than unavailable, matching an empty grant returned by the auth server.
• Wire: none.

Alternatives

Keeping direct Mode dispatch would preserve multiple admission implementations and the duplication this quest removes.

Testing

• just check
• just rs test -p moq-relay: 216 passed, 2 skipped

Follow-ups

None.

(written by GPT-5)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a629c025-d420-4492-af26-a89859ec5168

📥 Commits

Reviewing files that changed from the base of the PR and between 990a96a and 9a887e1.

📒 Files selected for processing (4)

• quest/m1/README.md
• quest/m1/auth-one-path.md
• quest/m2/auth-embedder.md
• rs/moq-relay/src/auth.rs

💤 Files with no reviewable changes (2)

• quest/m1/README.md
• quest/m1/auth-one-path.md

Included review availability: Your plan provides up to 4 included reviews per hour; 1 remains after this review.

---

Walkthrough

The relay auth implementation replaces mode-based admission handling with queued admissions and spawned Decider tasks. Config::init and Auth::refuse now require a Tokio runtime. Auth::admit always sends through the admission queue and validates the response. Refusal error mapping and async tests were updated. The completed auth-path quest documentation and related references were removed.

Priority: ⬇️ Low

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 86.67% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 1 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: routing relay authentication through the shared admissions path.
Description check	✅ Passed	The description directly explains the authentication refactor, runtime requirements, behavior changes, testing, and lack of wire changes.

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[moq-bot]

1. Embedder empty grant returns Unavailable but server empty grant returns Refused (rs/moq-relay/src/auth.rs:384, empty Grant via Admissions vs moq_auth::Client::post mapping UselessGrant to Refused). Map UselessGrant to Error::Refused in admit like the client does and update the an_embedded_auth_admits_what_the_embedder_answers expectation.
   Verdict: request changes
   (Written by Muse Spark)

opencode session  |  github run

[moq-bot]

No issues found.
Verdict: approve
(Written by Muse Spark)

opencode session  |  github run