Repository navigation
quest: lite drops per-request auth; plan the request-behind-its-token race - #5972
Conversation
… race Rewrites quest/m1/auth/request-auth-id.md as quest/m1/auth/request-race.md after the maintainer closed #5927: lite AUTH gets no ID and lite requests no Auth field, so lite requests are judged by the session union alone. The remaining race, a request sent right behind the token it relies on, gets options (acceptor waits, AUTH_WAIT, presenter waits) with a recommendation. The auth README, request-update and token-in-band follow: moq-transport per-request tokens stay acceptor-side, and the first token stays in the CONNECT request. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
3408498 to
04576ec
Compare
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 7 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 04576ec65d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review (Written by Claude Opus 5.5) |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 10be3b0c7d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review (Written by Claude Opus 5.5) |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fddd31d630
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…re the session is published Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review (Written by Claude Opus 5.5) |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Problem
The maintainer closed moq-dev/moq#5927 (lite-07 AUTH IDs and a per-request
Authfield): no per-request auth on moq-lite, and no byte spent on every request.quest/m1/auth/request-auth-id.mdand the auth README still plan that design, andrequest-update.mdandtoken-in-band.mddepend on it.One problem survives: a presenter sends AUTH, then right away a request that only the new token admits, and the acceptor can judge the request before the AUTH settles.
Approach
request-auth-id.mdtoquest/m1/auth/request-race.md, [S] A request right behind its token is admitted. The new name says what the quest does now; the old one described the dropped design.mainhas today (checked): no Auth ID or per-request field in the lite draft,rs/moq-netorjs/net, so nothing needs removing. A lite acceptor judges SUBSCRIBE and FETCH against its scope when it decodes them. The presenter's gate refuses a request its known union does not cover before sending it.add()in Rust and JS resolves only after AUTH_OK. Announcements already recover: a withheld broadcast comes back when the scope widens.auth=id) is dropped. Step 3 is moq-transport only, throughRoute::auth.request-update.md: on lite,Route::authputs nothing on the wire, and lite renews through the union.token-in-band.md: the first token rides SETUP (a new lite-07-wip SETUP parameter, or moq-transport's existing option), with the URL as the fallback. The relay's admission deadline goes away.doc/concept/moq-lite.md: "no per-request token yet" becomes "no per-request token".Decisions
stats::Sessioncounter (maintainer: "don't add to stats::Session"). It costs one RTT, only on the first request relying on a new token. No wire bytes, no acceptor state. Abuse: an acceptor that never answers stalls only our own requests. Revisit (b) only if the log shows the wait firing.Server::accept_request_litepauses there), and a lite client never waits on the server's SETUP before sending requests.Path.namedbench. ✅ Nothing names the old token under the union. Renewal is: present the new token, await its AUTH_OK, drop the old one.request-race.md. The name describes the work.Shared::connectedpublishes a new session before its replay tasks reachadd(), so the wait could see nothing pending. The quest now registers (queues) every replayed token on the new session's handle before publishing the session;issuer.mddoes this by construction later. With the first token in SETUP, only the extra tokens need this.Impact
request-race.mdis lite-07-wip draft text only.token-in-band.mdadds one lite-07-wip SETUP parameter. Published versions are unchanged.Alternatives
Keep the named design from #5927 (rejected by the maintainer). Also: do nothing and let apps retry on UNAUTHORIZED. That is a retry workaround.
Follow-ups
quest check(438 documents ok) andjust checkboth pass.(Written by Claude Opus 5.5)
🤖 Generated with Claude Code