fix(net): send explicit AUTH NOT_SUPPORTED on Lite

[kixelated]

Problem

Lite AUTH reset an unrepresentable grant. After AUTH_OK, that loses the distinction between unsupported credentials and an ordinary stream failure. The original implementation also assigned Lite code 0x30 meaning in the shared session registry, so IETF session aborts could emit it and incoming IETF closes could be misclassified.

Approach

Send Lite AUTH_ERROR NOT_SUPPORTED and FIN for unsupported tokens or grants that cannot fit in one message, including updates. Preserve the historical initial-reset fallback. Keep Lite session code translation at the negotiated protocol boundary, including admission refusals, active-session aborts, stream operations, and supervisor close observation. Shared decoding preserves unregistered 0x30 as unknown; IETF emits its internal-error fallback for a session-level Unsupported condition and retains request NOT_SUPPORTED 0x3.

Add simulated regressions for both outgoing and incoming session closes, admission refusals, explicit Rust/JS AUTH refusals, and the existing CI byte-level Rust/JS AUTH round trip.

Impact

• Rust adds SessionError::Unsupported; JavaScript adds SessionCode.Unsupported and Auth.Unsupported.code. Rust StreamCodes gains a default decode_session_code method. Lite-only mapping helpers and negotiated session encoding stay private.
• SessionError::to_code and from_code describe shared codes. Protocol drivers translate the Lite-only variant at their boundary; the shared enum does not assign Lite semantics to IETF 0x30.
• Lite AUTH carries NOT_SUPPORTED 0x30 in AUTH_ERROR, documented in the Lite draft. IETF request and session registries retain their existing assignments.
• No FFI wrapper or package version changes.

Alternatives

Keeping stream resets loses the explicit error after AUTH_OK. Sharing the Lite session entry with IETF leaks a protocol-specific meaning. The implemented recommendation is AUTH_ERROR plus FIN with negotiated boundary translation, following the quest's selected code and carrier.

Validation

Full Nix just check passes on 8da84fd2f: 5,957 default Rust tests, the required feature configurations, all JavaScript checks including 1,588 networking tests, and draft validation. All four cross-language byte preflights pass, including AUTH Unsupported. The complete interop matrix is still running. Two simulated regressions failed before the review fix on IETF17: active abort emitted Lite 0x30, and incoming 0x30 became Unsupported. Admission coverage caught an additional Lite fallback regression during implementation. All 20 session setup/close cases pass after correction; focused Rust validation passed 1,738 tests with six skips, and JavaScript AUTH/error validation passed 81 tests. Tests use simulated transport/time. Prior oversized-grant/update and cross-language byte-boundary regressions remain in the PR.

Follow-ups

Retires quest/m1/auth/not-supported.md. AUTH protocol-violation handling remains separate work. Relay refresh #5282 will compose this implementation instead of adding a competing reset convention.

(Written by GPT-6 Astra)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 17 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b1f3a1d0-d39e-40f6-975a-621bc6b7f4a5

---

📥 Commits

Reviewing files that changed from the base of the PR and between cabdaf2 and d45b933.

---

📒 Files selected for processing (21)

• drafts/draft-lcurley-moq-lite.md
• js/net/src/auth.test.ts
• js/net/src/auth.ts
• js/net/src/error.test.ts
• js/net/src/error.ts
• js/net/src/ietf/auth.ts
• js/net/src/lite/auth.test.ts
• js/net/src/lite/auth.ts
• quest/m1/auth/README.md
• quest/m1/auth/expired-error.md
• quest/m1/auth/not-supported.md
• rs/moq-net/src/error.rs
• rs/moq-net/src/ietf/error.rs
• rs/moq-net/src/ietf/session.rs
• rs/moq-net/src/lite/publisher.rs
• rs/moq-net/src/lite/session.rs
• rs/moq-net/src/test_interop.rs
• rs/moq-net/tests/auth.rs
• test/interop/README.md
• test/interop/auth-unsupported.ts
• test/justfile

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T22:52:50.621059Z	d45b933	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d45b9337b4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Gate the Lite-only session code by negotiated protocol

When an IETF session is aborted with Error::Unsupported, Session::abort still serializes SessionError::from(&err).to_code(), so this protocol-neutral mapping sends Lite-only code 0x30 on the IETF wire. Conversely, Error::from_transport uses SessionError::from_code, causing an incoming IETF 0x30 to be mislabeled Unsupported instead of Unknown. Encode and decode this code only at Lite-aware boundaries rather than in the shared session table.

AGENTS.md reference: rs/moq-net/AGENTS.md:L8-L8

Useful? React with 👍 / 👎.