open-standards/joule-code/joule-code-rs/crates/joule-moq-web/web/moq/session.test.mjs
Transaction Science 6250fa5a4e
Some checks failed
joule-moq-remote host agent / joule-moq-remote · does this change touch it (push) Successful in 33s
WAI operation catalogue / does this change touch it (push) Successful in 28s
wai-app and Create / wai-app · does this change touch it (push) Successful in 29s
joule-moq-room room service / joule-moq-room · does this change touch it (push) Successful in 30s
WAI Studio / does this change touch it (push) Successful in 16s
wai-sink-swift native sink package / does this change touch it (push) Successful in 1m32s
wai-quantum studio and desktop / does this change touch it (push) Successful in 1m34s
wai-fleet service / does this change touch it (push) Successful in 1m40s
wai-audit collector and player integration / does this change touch it (push) Successful in 1m39s
wai-ledger service / does this change touch it (push) Successful in 1m37s
wai-quantum for JavaScript / does this change touch it (push) Successful in 1m34s
joule-moq-web browser client / joule-moq-web · does this change touch it (push) Successful in 1m41s
wai-sink-android native sink library / does this change touch it (push) Successful in 1m35s
joule-moq-remote host agent / joule-moq-remote, every target (linux-arm64) (push) Successful in 2m11s
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (push) Failing after 4m29s
joule-code conformance gate / joule-moq-relay, every target (push) Successful in 7m32s
joule-code conformance gate / joule-moq-ingest, every target (push) Successful in 9m9s
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (push) Successful in 6m1s
joule-moq-room room service / joule-moq-room, every target (push) Successful in 8m1s
WAI breaking changes and the conformance runner / WAI breaking · does this change touch WAI (push) Successful in 11s
wai-app and Create / wai-app · tests, clippy, the line language's verifier (linux) (push) Successful in 45s
WAI Studio / the catalogue's actions, the unit tests and the core · linux (push) Successful in 1m22s
joule-code conformance gate / Build + round-trip C1-C4 vectors (push) Successful in 2m54s
WAI operation catalogue / the catalogue and every door · linux (push) Failing after 2m27s
wai-audit collector and player integration / collector · linux (push) Successful in 2m23s
wai-ledger service / service · linux (push) Successful in 3m55s
wai-fleet service / service · linux (push) Successful in 4m31s
wai-quantum for JavaScript / javascript · linux (push) Successful in 6m17s
wai-quantum studio and desktop / studio · browser (push) Successful in 7m43s
wai-quantum studio and desktop / desktop app · linux (push) Successful in 10m31s
WAI Studio / Studio in WebKit · linux (push) Successful in 22m31s
WAI breaking changes and the conformance runner / WAI breaking and conform · their tests, and the independent verifiers through wai conform · linux (push) Failing after 1m31s
WAI breaking changes and the conformance runner / WAI breaking · wire, record and API against main · linux (push) Successful in 3m35s
wai release binaries build on Windows / the seven release binaries · windows (push) Successful in 18m5s
wai-quantum studio and desktop / desktop app · windows (push) Successful in 10m46s
joule-code conformance gate / joule-moq-relay, its own energy on a counter (macos) (push) Successful in 1m3s
joule-moq-remote host agent / joule-moq-remote, every target (macos) (push) Successful in 56s
wai-app and Create / wai-app · Create, browser end-to-end (macos) (push) Successful in 7m44s
WAI Studio / Studio in Chromium and Firefox · macos (push) Successful in 9m17s
wai-fleet service / service · macos (push) Successful in 1m4s
wai-quantum studio and desktop / desktop app · macos (push) Successful in 4m41s
wai-ledger service / service · macos (push) Successful in 1m7s
wai-audit collector and player integration / collector, player integration and the browser end to end · macos (push) Successful in 2m35s
wai-sink-android native sink library / every ABI, the AAR, and the instrumented tests in a headless emulator · macos (push) Successful in 7m17s
wai-sink-swift native sink package / libwai slices, desktop tests, simulator tests · macos (push) Successful in 15m0s
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (push) Successful in 15m50s
The relay reads the client's SETUP first (Privacy Pass auth -04), and what the draft-23 package left
SETUP order. draft-ietf-moq-privacy-pass-auth-04 §3.5.1 has a relay that
authenticates SETUP process the client's SETUP before it sends its own; WAI
age-assurance §5.1 and live-rooms §10.5.2 had the relay send first. The decision
was to follow -04, and the texts, the relay, the clients and the corpora do.

The relay's SETUP used to carry the challenge the client's SETUP then proved its
grant over, which the new order cannot do in one session. It is now -04's own
flow (§3.5.6.1, Figure 4), and live-rooms §10.5.3's over HTTP: every SETUP a
relay sends carries a fresh GRANT_CHALLENGE, good for the proofs of one later
SETUP at that relay for limits.grant_challenge_ms (60 s), kept by the relay
(src/challenge.rs) and consumed by the SETUP it admits. A client that holds none
presents its grant unproved, is refused pop_missing with a challenge, and proves
on a second session; one that holds the challenge of the relay's last SETUP to
it proves on its first. A refused SETUP is answered with the relay's SETUP
carrying a new Setup Option, GRANT_REFUSED (0x3A53, the reason's code), and the
session is closed UNAUTHORIZED once the client has left or
limits.setup_refusal_wait_ms (2 s) has passed: a close carries nothing sent
before it, which -04 notes of its own challenge, so the refusal is said in the
SETUP and the client that reads it leaves at once. A consumed challenge is
pop_replayed; one never issued, another relay's, or too old, pop_wrong_challenge.

The clients: joule_moq_relay::client (Client::open, connect_proving, challenge;
its SETUP always first), the room service's clock and participants, the remote
host agent, relay-to-relay links (a link's first SETUP is refused
relay_id_unproved and it dials again at once with its proof), and the browser
(MoqSession.connect's redial, SetupRefused). The interop client and the ingest
gateway already sent first and present no grant. The order is the same at every
draft; grants are proved at -23, -22, -18 and -16 in the relay's test. Not
interoperable with the order before where a grant is presented: a client that
waits for the relay's SETUP is sent none, and relays that peer change together.
Sessions that present no grant are unaffected.

What the draft-23 package left:
- A -23 session's subgroup streams and datagrams are read by -23's object rules
  (a supported property outside its scope or repeated makes the track malformed;
  a grease value in the Mandatory Track Property range is no Mandatory Track
  Property); a -22 session keeps -22's reading.
- Relays peer at -23: RELAY_PATH in the -23 codec and its bridge, a relay id
  taken at -23, links offering -23 and -22. An unnegotiated path closes a -23
  session INVALID_PARAMETER. The -23 corpus gains 6 vectors (125, 70 negative)
  and moqt23_check.py reads the extension.
- A grant that expires ends its subscriptions, each with PUBLISH_DONE
  EXPIRED_AUTH_TOKEN, and not the session, at -23; a -23 session that publishes
  by the grant, and every session at the older drafts, is closed as before.
- LARGEST_OBJECT against -23 §7.5: confirmed but for one source, a publisher's
  PUBLISH_STATE_NOTIFY, which is taken now; held by a vector of six steps. Kept
  and stated: an object counts once whole, not from its first byte.

Tests, each against planted faults: grant_proof (the relay sends nothing before
the client's SETUP; the second session; seven refusals, each with its reason),
room_authority (expiry at -23 beside -22), draft23 (the object rules against the
same objects at -22; the LARGEST_OBJECT vector), cascade and control_sessions
(a link at -23, opened on its second dial; the path at -23), the browser
session's unit tests. Falsified: twelve of the changes reverted in turn, each
failing a test.

live-rooms §10.5.2, §10.5.4, §10.7 and §13, and age-assurance §5.1 and §5.5,
say the order and what a challenge is bound to now. The rooms corpus renames one
proof vector (acknowledged in the change note); the registry lists
GRANT_REFUSED.

Co-Authored-By: Claude <[email protected]>
2026-11-10 17:22:02 -05:00

166 lines
8.3 KiB
JavaScript

// How long a request waits for its answer (`node --test web/moq/session.test.mjs`), over a
// transport and a codec of the test's own, the clock mocked.
import test from "node:test";
import assert from "node:assert/strict";
import { MoqSession, RequestRefused, SetupRefused } from "./session.js";
const enc = new TextEncoder();
const hex = (s) => [...enc.encode(s)].map((b) => b.toString(16).padStart(2, "0")).join("");
// Control messages as JSON text, one per read.
const moq = {
encodeControl: (s) => enc.encode(s),
MessageStream: class {
constructor() { this.q = []; }
push(v) { this.q.push(new TextDecoder().decode(v)); }
next() { return this.q.shift(); }
free() {}
},
};
// Each request stream's reader gives what `answer(i, message)` hands it, and nothing before.
function transport() {
const answers = [];
return {
kind: "test",
closed: new Promise(() => {}),
async openBidi() {
let give;
const first = new Promise((r) => { give = r; });
let read = 0;
answers.push(give);
return {
writer: { async write() {}, reset() {} },
reader: { read: () => (read++ === 0 ? first : new Promise(() => {})) },
};
},
answer(i, message) { answers[i]({ value: enc.encode(JSON.stringify(message)), done: false }); },
};
}
const settle = async () => { for (let i = 0; i < 8; i++) await new Promise((r) => setImmediate(r)); };
const refused = { message: "REQUEST_ERROR", request_id: 0, code: 2, reason: hex("no publisher within RENDEZVOUS_TIMEOUT") };
test("a SUBSCRIBE that asks for a rendezvous takes the relay's answer when the rendezvous ends", async (t) => {
t.mock.timers.enable({ apis: ["setTimeout"] });
const tr = transport();
const s = new MoqSession(tr, moq);
const p = s.subscribe(["room", "a", "world"], "0", { rendezvous_timeout: 10000 }, {});
p.catch(() => {});
await settle();
// The relay holds the request for the whole rendezvous, and its answer arrives after it.
t.mock.timers.tick(10_500);
await settle();
tr.answer(0, refused);
await assert.rejects(p, (e) => e instanceof RequestRefused && /REQUEST_ERROR 2 no publisher within RENDEZVOUS_TIMEOUT/.test(e.message));
});
test("a SUBSCRIBE that asks for a rendezvous waits no longer than the step past it", async (t) => {
t.mock.timers.enable({ apis: ["setTimeout"] });
const s = new MoqSession(transport(), moq);
const p = s.subscribe(["room", "a", "world"], "0", { rendezvous_timeout: 10000 }, {});
p.catch(() => {});
await settle();
t.mock.timers.tick(20_000);
await assert.rejects(p, (e) => !(e instanceof RequestRefused) && /SUBSCRIBE: no answer in 20000 ms/.test(e.message));
});
test("a SUBSCRIBE without a rendezvous waits one step for its answer", async (t) => {
t.mock.timers.enable({ apis: ["setTimeout"] });
const s = new MoqSession(transport(), moq);
const p = s.subscribe(["room", "a", "world"], "0", { forward: true }, {});
p.catch(() => {});
await settle();
t.mock.timers.tick(10_000);
await assert.rejects(p, /SUBSCRIBE: no answer in 10000 ms/);
});
// ---- SETUP: this end's first, and a grant proved on a second session (live-rooms §10.5.2) ----
const CHALLENGE = 0x3a47;
const REFUSED = 0x3a53;
const bytesHex = (b) => [...b].map((x) => x.toString(16).padStart(2, "0")).join("");
// A codec that writes a SETUP as JSON text saying what it presents, and reads a control
// stream's items as JSON text.
const setupMoq = {
...moq,
setDraft() {},
grantChallengeOption: () => BigInt(CHALLENGE),
grantRefusedOption: () => BigInt(REFUSED),
clientSetup: (token) => enc.encode(JSON.stringify({ presents: token ? "token" : "nothing", token: token ? bytesHex(token) : null })),
clientSetupWithGrant: (record, seed, challenge, target) => enc.encode(JSON.stringify({ presents: "grant+proof", over: bytesHex(challenge), target })),
UniDecoder: class {
constructor() { this.q = []; }
push(v) { this.q.push(new TextDecoder().decode(v)); }
next() { const m = this.q.shift(); return m ? { kind: "control", json: JSON.stringify({ control: JSON.parse(m) }), free() {} } : null; }
finish() {}
},
};
// A relay that reads the client's SETUP before it sends its own: its control stream gives
// `relaySetup` only once this end has written. A session that waited for the relay's SETUP
// first would wait for ever.
function relayTransport(relaySetup) {
const t = { kind: "test", url: "https://relay.example/moq", written: [], closedBy: null };
let wrote;
const written = new Promise((r) => { wrote = r; });
let gave = false;
t.closed = new Promise(() => {});
t.close = (code, reason) => { t.closedBy = { code, reason }; };
t.openUni = async () => ({ async write(b) { t.written.push(JSON.parse(new TextDecoder().decode(b))); wrote(); } });
t.acceptBidi = () => new Promise(() => {});
let streams = 0;
t.acceptUni = () => (streams++ === 0
? Promise.resolve({ read: async () => { if (gave) return new Promise(() => {}); await written; gave = true; return { value: enc.encode(JSON.stringify(relaySetup)), done: false }; }, cancel() {} })
: new Promise(() => {}));
return t;
}
const relaySays = (challenge, refused) => ({
message: "SETUP",
options: [{ type: CHALLENGE, bytes: challenge }, ...(refused ? [{ type: REFUSED, bytes: hex(refused) }] : [])],
});
const record = new Uint8Array([1, 2, 3]);
const grant = { record, seed: new Uint8Array(32) };
test("a page that holds no challenge presents its grant unproved, is given one, and proves on a second session", async () => {
const first = relayTransport(relaySays("aa".repeat(32), "pop_missing"));
const second = relayTransport(relaySays("bb".repeat(32)));
let redials = 0;
const s = await MoqSession.connect(first, setupMoq, { grant, redial: async () => { redials++; return second; } });
assert.deepEqual(first.written, [{ presents: "token", token: "010203" }], "the grant with no proof, sent before the relay's SETUP is read");
assert.deepEqual(first.closedBy, { code: 0, reason: "refused at SETUP" }, "this end leaves a session the relay refused");
assert.deepEqual(second.written, [{ presents: "grant+proof", over: "aa".repeat(32), target: "//relay.example/moq" }], "the proof over the challenge the first SETUP gave");
assert.equal(redials, 1);
assert.equal(s.sessionsToAdmit, 2);
assert.equal(bytesHex(s.nextChallenge), "bb".repeat(32), "the admitting SETUP gives the next challenge");
});
test("a refusal no proof answers is thrown with its reason, and no second session is opened", async () => {
let redials = 0;
const redial = async () => { redials++; return relayTransport(relaySays("cc".repeat(32))); };
// A proof by another key: the relay says so, and a proof over a new challenge changes nothing.
const wrongKey = relayTransport(relaySays("aa".repeat(32), "pop_wrong_key"));
await assert.rejects(MoqSession.connect(wrongKey, setupMoq, { grant, challenge: new Uint8Array(32), redial }), (e) => e instanceof SetupRefused && e.reason === "pop_wrong_key" && !e.asksForProof);
// A second refusal is the last: the second session's is thrown as it is.
const again = relayTransport(relaySays("dd".repeat(32), "pop_wrong_challenge"));
await assert.rejects(
MoqSession.connect(relayTransport(relaySays("aa".repeat(32), "pop_missing")), setupMoq, { grant, redial: async () => { redials++; return again; } }),
(e) => e instanceof SetupRefused && e.reason === "pop_wrong_challenge",
);
assert.equal(redials, 1, "one second session, and no third");
// With no way to open another session, the refusal is the caller's.
await assert.rejects(MoqSession.connect(relayTransport(relaySays("aa".repeat(32), "pop_missing")), setupMoq, { grant }), (e) => e instanceof SetupRefused && e.asksForProof && bytesHex(e.challenge) === "aa".repeat(32));
// A token, not a grant: refused is refused.
await assert.rejects(MoqSession.connect(relayTransport(relaySays("aa".repeat(32), "pop_missing")), setupMoq, { token: record, redial }), (e) => e instanceof SetupRefused && e.reason === "pop_missing");
assert.equal(redials, 1);
});
test("a session that presents no grant sends its SETUP first and is admitted on its first session", async () => {
const t = relayTransport(relaySays("aa".repeat(32)));
const s = await MoqSession.connect(t, setupMoq, {});
assert.deepEqual(t.written, [{ presents: "nothing", token: null }]);
assert.equal(s.sessionsToAdmit, 1);
assert.equal(t.closedBy, null);
});