feat(net): a token on a request authorizes that request - #4675

Open

ksletmoe-aws wants to merge 49 commits into

moq-dev:quest/m1/auth/READMEfrom

ksletmoe-aws:quest/m1/auth/request-token

Commits on Oct 1, 2026

feat(net): decode the AUTHORIZATION TOKEN structure on a request parameter

ksletmoe-aws
and
claude
committed
0c50b27
feat(net): authorize a SUBSCRIBE by a token on the request

ksletmoe-aws
and
claude
committed
d4e4dc4
feat(net): carry the AUTHORIZATION TOKEN on REQUEST_UPDATE

ksletmoe-aws
and
claude
committed
5e982b4
feat(net): end a request-token subscription when its grant lapses or is revoked

ksletmoe-aws
and
claude
committed
b216eda
feat(net): renew a request-token subscription from a REQUEST_UPDATE

ksletmoe-aws
and
claude
committed
a7c5329
feat(net): authorize a PUBLISH_NAMESPACE by a token on the request

ksletmoe-aws
and
claude
committed
29fdcbb
feat(net): accept the AUTHORIZATION TOKEN on FETCH, PUBLISH, TRACK_STATUS, SUBSCRIBE_NAMESPACE

ksletmoe-aws
and
claude
committed
52673e0
feat(net): accept the AUTHORIZATION TOKEN message parameter in js/net

ksletmoe-aws
and
claude
committed
f4deb5a
docs(relay): note request-borne AUTHORIZATION TOKENs in auth.md

ksletmoe-aws
and
claude
committed
a26abf6
fix(net): close on an alias request token and race renewal against the deadline

ksletmoe-aws
and
claude
committed
e9a82d2
docs(relay): scope the request-token note to the moq-net seam (part B pending)

ksletmoe-aws
and
claude
committed
9a924d6
fix(net): verify a request token without the MoQ Auth extension

ksletmoe-aws
and
claude
committed
695f7e3
feat(net): let a client present a request token on its own requests

ksletmoe-aws
and
claude
committed
337f3e7
feat(tokio): expose Client::with_request_token on the moq-tokio wrapper

ksletmoe-aws
and
claude
committed
39656a1
fix(net): verify a request token when the union does not cover, not just when it forbids

ksletmoe-aws
and
claude
committed
751f939
test(net): confirm the request token rides PUBLISH_NAMESPACE at every draft

ksletmoe-aws
and
claude
committed
394a2c6
feat(tokio): expose Request::auth() so a QUIC server can answer request tokens

ksletmoe-aws
and
claude
committed
808b601
test(net): a pre-ok requests() consumer governs the session acceptor

ksletmoe-aws
and
claude
committed
6e67893
fix(net): a client presenting a request token bypasses dialing-side grant enforcement

ksletmoe-aws
and
claude
committed
151c478
fix(net): wire the session auth handle into the legacy-draft subscriber and publisher

ksletmoe-aws
and
claude
committed
666293e
feat(net): replace a client's request token on a live request

ksletmoe-aws
and
claude
committed
0bc57ac
fix(net): a token-bearing client authorizes requests outside its connection grant

ksletmoe-aws
and
claude
committed
b1e1ba4
feat(net): let a client decline the MoQ Auth extension

ksletmoe-aws
and
claude
committed
04d7d58
feat(net): let a server decline the MoQ Solicit extension

ksletmoe-aws
and
claude
committed
95db740
style(net): apply rustfmt to the request-token changes

ksletmoe-aws
and
claude
committed
cb06ed1
fix(net): adapt the request-token changes to the moved auth line

ksletmoe-aws
and
claude
committed
0984b23
fix(net): keep the announce grant filter when the token cannot ride

ksletmoe-aws
and
claude
committed
aca5238
fix(net): keep request-token bytes out of message Debug output

ksletmoe-aws
and
claude
committed
742b5f0
fix(net): send a reprice without the unchanged request token

ksletmoe-aws
and
claude
committed
15a502e
fix(net): decide pre-draft-17 subscribe renewals silently

ksletmoe-aws
and
claude
committed
b757d4c
fix(net): scope a request grant to the presenter and its request

ksletmoe-aws
and
claude
committed
bfa458c
fix(net): keep the local limit on the request-token path

ksletmoe-aws
and
claude
committed
149efd4

Commits on Oct 2, 2026

fix(net): keep a subscription's range when renewing its token

ksletmoe-aws
and
claude
committed
c116287
fix(net): end a request whose stream closes during a renewal

ksletmoe-aws
and
claude
committed
e760e7a
feat(net): declare offered extensions with setup::Extensions

ksletmoe-aws
and
claude
committed
e7d93b7
feat(net): present request tokens through the auth handle

ksletmoe-aws
and
claude
committed
22b951f
docs(quest): record the request-token review decisions

ksletmoe-aws
and
claude
committed
03e26c5
test(net): state two request-token invariants explicitly

ksletmoe-aws
and
claude
committed
c6c4530
fix(tokio): gate the client request token on a transport feature

ksletmoe-aws
and
claude
committed
d802ccc
fix(net): answer a pre-draft-17 renewal on draft-15 and draft-16

ksletmoe-aws
and
claude
committed
45a6385
fix(net): refuse inbound AUTH when this endpoint declined the extension

ksletmoe-aws
and
claude
committed
64e2a8d
fix(net): keep detecting a cancellation while a renewal is pending

ksletmoe-aws
and
claude
committed
b86dd4b
fix(net): apply cluster params and a token renewal on the same update

ksletmoe-aws
and
claude
committed
8c9a856
style(docs): format auth.md with the repo markdown formatter

ksletmoe-aws
and
claude
committed
a9883c4
fix(net): answer every buffered REQUEST_UPDATE while a verdict is pending

ksletmoe-aws
and
claude
committed
f7dc815
fix(net): route a pre-draft-17 renewal reply back to its subscription

ksletmoe-aws
and
claude
committed
c51dd18
feat(net): advertise and enforce MAX_REQUEST_UPDATES

ksletmoe-aws
and
claude
committed
fe264a0
feat(net): record the peer's advertised MAX_REQUEST_UPDATES

ksletmoe-aws
and
claude
committed
c2b10b2
fix(net): keep one request-token renewal in flight per subscription

ksletmoe-aws
and
claude
committed
79d21c7