Repository navigation
quest: origin narrowing joins auth, drop relay peer set, plan hop-list routing #4158
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| # [M] A live origin grant narrows in place | ||
|
|
||
| ## Goal | ||
|
|
||
| A `moq-net` session's grant can be replaced by a narrower pattern union | ||
| while the session is live: announce cursors retract the patterns that fell | ||
| outside, resolution refuses them, subscriptions under them reset with | ||
| `UNAUTHORIZED`, and broadcasts the session published under them abort. The | ||
| relay uses it on revalidation so a moderation decision (a deafened user's | ||
| audio path) takes effect on the session it targets, which a forked client | ||
| cannot bypass. This is the per-subscriber exclusion | ||
| [#2714](https://github.com/moq-dev/moq/issues/2714) asked for; the scope and | ||
| match half already landed in #3672 and #3746. | ||
|
|
||
| A narrowing always succeeds. A changed root still closes the session. | ||
|
|
||
| ## Plan | ||
|
|
||
| - Enforce per session, not per handout. The line's session gate for received | ||
| grants (`auth::Gate`, the lite publisher resetting subscriptions it denies, | ||
| `regrant` retracting announces no longer covered, and the IETF equivalent) | ||
| is the same mechanism pointed at the relay's own grant. Reuse it rather than | ||
| building a second one. Readers that bypass the session publisher (HTTP | ||
| `/fetch` holds its own lease and closes on it; moq-hls and WHEP enforce no | ||
| per-user grant today) are out of scope. | ||
| - #3971 built narrowing alone and was closed: it refused whenever anything | ||
| live sat in the removed part, which is exactly when a grant narrows, and it | ||
| kept the ceiling in a side map. Scopes today are copied by value into every | ||
| handle and cursor (`OriginScope` in `rs/moq-net/src/model/origin.rs`), so | ||
| narrowing needs shared state. If handles need a tree to share it, keep the | ||
| ceiling on the grant node itself (an `Arc` shared by clones and children). | ||
| - Publish side: routes and broadcasts the session published outside the | ||
| narrowed grant abort, so consumers see `Unauthorized` just as the subscribe | ||
| side does. Draining is not an option: a group may stay open as long as its | ||
| track. | ||
| - Relay revalidation uses it: a re-checked grant with the same root narrows | ||
| the session instead of closing it (`Lease::ended` reporting "grant | ||
| narrowed" in `rs/moq-relay/src/auth.rs`), on every accept path: native, | ||
| io_uring, and `moq --listen` share `connection::supervise`, while WebSocket | ||
| has its own copy of the loop. | ||
| - Prove the deafen case end to end: subscribe under a room prefix, narrow | ||
| with a grant that excludes that audio path, and assert the subscription | ||
| resets with `UNAUTHORIZED` and no further objects arrive, while a sibling | ||
| path under the same prefix keeps flowing. | ||
| - Benchmark the narrowing and per-session gate cost in | ||
| `rs/moq-net/benches/origin.rs`, swept over routes and subscribers, with a | ||
| session that never narrows as the baseline. | ||
|
|
||
| Public API: additive on moq-net and on moq-relay's revalidate path. Wire: | ||
| none beyond the UNAUTHORIZED code the required quest adds. | ||
|
|
||
| ## Required | ||
|
|
||
| - [Unauthorized reset](/quest/m1/auth/unauthorized.md) - the stream code a narrowed subscription resets with | ||
|
|
||
| ## Closes | ||
|
|
||
| - [#2714](https://github.com/moq-dev/moq/issues/2714) - close this issue when the quest finishes | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| # [M] Plan: routing without a hop list | ||
|
|
||
| ## Goal | ||
|
|
||
| Decide whether moq-lite announcements can drop the full hop list and still | ||
| route loop-free, then write the decision into quests. Today every | ||
| announcement carries the Hop IDs it traversed. That path does three jobs: | ||
| loop prevention (a relay discards a path containing itself), request | ||
| exclusion (never serve a request back through the peer that made it), and | ||
| route identity (the first hop decides whether a failover may stitch | ||
| seamlessly). The hop list was designed before prefix claims, and once the Spread quest in | ||
| [Wildcard advertisements](/quest/m1/wildcard/README.md) moves stitching | ||
| identity onto the subscribe reply, only the first two jobs remain. | ||
|
Comment on lines
+11
to
+13
There was a problem hiding this comment.
When routes have equal costs, including common Useful? React with 👍 / 👎. |
||
|
|
||
| ## Plan | ||
|
|
||
| Open questions, to settle with the maintainer: | ||
|
|
||
| - Loop freedom without a path. Rising cost alone ("cost + 1, never | ||
| advertise lower") counts to infinity after a withdrawal, as two relays | ||
| offer each other the stale route at ever higher cost. Remembering each | ||
| route's immediate neighbor and never echoing a route back to it (split | ||
| horizon) stops two-relay loops, but not three-relay loops. It also hides | ||
| backups: a relay never learns an alternative that passes back through the | ||
| neighbor it came from. Babel's feasibility condition (RFC 8966: a | ||
| per-origin sequence number; a route is feasible when its sequence number is | ||
| newer, at any cost, or equal and cheaper than the best seen for it) is | ||
| loop-free with only the origin on the wire. Weigh it and | ||
| any simpler scheme against what the relay cluster actually needs. | ||
| - What replaces request exclusion, and whether it still matters once | ||
| announcements are loop-free. | ||
| - What the stats and sidecar consumers lose without a path, and whether | ||
| anything besides the origin must stay on the wire. | ||
| - The version it lands in (lite-07 is `moq-lite-07-wip` today) and the | ||
| bridge to versions that still carry a hop list. lite-07 already compresses | ||
| each announcement's hop chain against a live base (#4196, | ||
| `rs/moq-net/src/lite/compress.rs`); dropping the hop list removes that too. | ||
|
|
||
| ## Related | ||
|
|
||
| - [Wildcard advertisements](/quest/m1/wildcard/README.md) - its Spread quest moves stitching identity to the subscribe reply, which this builds on | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Moving this quest leaves
rs/moq-relay/src/auth.rs:277pointing to the deletedquest/m1/origin-narrowing.md; a repo-widegit grepfinds this as the only remaining old-path reference. Update it toquest/m1/auth/narrowing.mdso readers ofLease::endedcan still reach the plan.AGENTS.md reference: AGENTS.md:L27-L27
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fixed in 6b8d1be (also updated the new
quest/m1/auth/request-token.mdreference that arrived with main).(Written by Claude Opus 5.5)