feat(auth): a token on a request authorizes that request

[kixelated]

Implements quest/m1/auth/request-token (scope restored in #5104). This carries @ksletmoe-aws's #4675 forward: his fork does not allow maintainer edits, so the work moved to this branch. Every commit credits Kyle as co-author.

Stacked on #5106 (Extensions) and #5107 (request-token decode). Both are merged into this branch, so the diff includes them until they land on the line. The commits to review here start at 7277e5df3.

Summary

A request is authorized by the session's grant first. If that does not cover it, the AUTHORIZATION TOKEN on the request authorizes it, and with neither the request is refused UNAUTHORIZED. The token is honored on SUBSCRIBE and PUBLISH_NAMESPACE.

• The token's grant covers only the request it rode on, never joins the session union, and ends with that request.
• A REQUEST_UPDATE carrying a new token renews it. A refused renewal ends only that request (drafts 16 section 9.11.1 / 18 section 10.9.1).
• On the client, auth::Handle::set_request_token presents the token, and moq-tokio's Connection::auth() keeps it across reconnects.

The decisions from #4675's review (10/1 Q1-Q4, 10/5) are recorded in the quest and unchanged.

Commits

• 7277e5df3: port of feat(net): a token on a request authorizes that request #4675's remaining behavior onto the current line. It drops what feat(net): declare the offered Setup extensions with setup::Extensions #5106, feat(net): decode a request's AUTHORIZATION TOKEN by the SETUP rules #5107, and fix(net): route draft 14-16 updates to their target #4961 already carry.
• 1d34a0e4b: updates behind a pending renewal are answered in arrival order. Before this, a token-less update could be answered ahead of the renewal, so on draft-17+ the unkeyed answers went out of order.
• 2737117b9: one admission helper (auth::Handle::admit_request) and one renewal queue (request_update::Renewal), replacing four and two copies.
• 536f27bb3: auth::Request::{path, kind, token_kind} become scope() -> Option<&auth::Scope>.
• 210742ebf: a moq-lite session refuses set_request_token with Unsupported instead of ignoring it.
• e26a4e5f0: the outbound update sniffer is gone. A legacy update's answer is routed by the ID the sender already holds.
• 311a73c8e: a failed update ends through its own Served::UpdateFailed path instead of overloading Error::Unsupported.

Public API and wire impact

• moq-net: adds auth::RequestKind, auth::Scope, auth::Request::scope(), auth::Handle::set_request_token(setup::Token) -> Result<()>, and SessionError::TooManyRequestUpdates.
• moq-tokio: adds Auth, Connection::auth(), connect::Config::with_request_token(setup::Token), and server::Request::auth().
• js/net: adds SessionCode.TooManyRequestUpdates.
• Wire:
  • MAX_REQUEST_UPDATES (0x08) is advertised on draft-19+. Exceeding it closes with TOO_MANY_REQUEST_UPDATES (0x1B), which is added to the lite draft's table. Earlier drafts keep a local guard that ends only the request.
  • Requests carry 0x03 when a token is set. A renewal goes out as a token-only update.
  • A token-bearing SUBSCRIBE outside the session grant is refused NOT_SUPPORTED when nothing verifies request tokens.

Testing

just check passes. just test interop --all passes everything except the C++ cells, which could not build here because uniffi-bindgen-cpp is missing.

Each fix's regression test fails with the fix reverted, except where noted:

• an_update_behind_a_pending_renewal_is_answered_in_order
• a_moq_lite_session_refuses_a_request_token
• a_session_that_cannot_carry_the_token_refuses_it
• a_legacy_renewal_answer_reaches_its_subscription (drafts 15 and 16)
• an_unsupported_track_error_is_not_a_failed_update, which pins the new path; the old return type could not express the difference.

For review

1. When a request repeats 0x03, every instance is decoded and the first is the credential.
2. The name and shape of auth::Scope.
3. moq-tokio: a dial fails if the session cannot carry the configured token. Auth::set_request_token returns the live session's refusal but keeps the token for later sessions.
4. A token-bearing update on a subscription the session grant already covers is acknowledged and ignored. Before, it was answered UPDATE_FAILED.
5. Namespace renewal works on draft-17+ only. On draft-16, a token-bearing REQUEST_UPDATE for a PUBLISH_NAMESPACE is still ignored, as on the base.
6. Refusal reason phrases are now the error's text.
7. Added beyond feat(net): a token on a request authorizes that request #4675: when a QUIC upgrade fails, moq-tokio re-attaches the token to the WebSocket session that stayed up.
8. Still open from the quest: one requests() consumer receives both session and request tokens. requests() also stays open on sessions without the Auth extension.

Follow-ups: a JS request-token setter and accept-side requests(), a moq-cli --request-token, the setter through moq-ffi, and the relay lease (quest/m1/auth/request-lease).

Supersedes #4675.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code