Crate moq_auth 

The authorization contract for Media over QUIC.

A relay asks one question per session, “may this connect?”, and this crate holds every piece of the answer:

• Request and Grant: the JSON a relay POSTs to an auth server on Event::Connect, Event::Revalidate, and Event::End, and what comes back.
• lease::Producer / lease::Consumer: the handle a session holds for its grant, so whoever runs the accept loop decides how, in process or over HTTP.
• Client: the HTTP implementation that drives a lease against --auth-url.
• [serve::Server]: the reference server behind moq auth serve, holding the policy a relay used to: keys, public rules, an mTLS grant, tiers, and limits.
• Claims, Key, and KeySet: the JWT a client presents in its query, with the keys that sign and verify it. moq auth generate|sign|verify is the CLI.

Grants and claims name paths with Patterns from moq-pattern, re-exported here: foo is one broadcast, foo/** is a subtree, ** is everything.

Modules

lease

The handle a session holds for the grant that admitted it.

Structs

Bytes

Byte totals for a session, both directions from the relay’s point of view.

Claims

The payload of a token: a root, plus the publish/subscribe patterns granted beneath it.

Client

The HTTP side of the contract: one JSON POST per event to an auth server.

Grant

What a session may do, as the auth server answered.

Jwk

JWK, almost to spec (https://datatracker.ietf.org/doc/html/rfc7517) but not quite the same because it’s annoying to implement.

Key

A validated key, ready to sign and verify tokens.

KeyId

A validated key identifier (kid) that is safe for use in file paths and URLs.

KeySet

JWK Set to spec https://datatracker.ietf.org/doc/html/rfc7517#section-5

Pattern

A pattern over broadcast paths: literal segments, * for one segment, prefix*suffix for one segment with a known start and end, and at most one ** for any run of segments. Every segment kind matches whole segments, and a pattern is exact: foo matches only foo, and a subtree is foo/**.

Patterns

A union of patterns, reduced so no member is contained by another.

Peer

The verified client certificate a session presented, as facts for the server to decide on. Presenting one admits nothing by itself.

Permissions

The access a Claims grants at a specific path, with every pattern rebased so it is relative to that path.

Request

Everything a relay knows about a session, sent to the auth server on every event.

RsaAdditionalPrime

Additional prime information for multi-prime RSA keys.

RsaPrivateKey

RSA private key parameters.

RsaPublicKey

RSA public key parameters.

Scope

The immutable ceiling on what a key may grant, embedded in its JWK.

Specificity

How much of a path a pattern pins down, for ranking the patterns that match one path.

Enums

Algorithm

A subset of jsonwebtoken algorithms.

EllipticCurve

Supported elliptic curves for EC and OKP key types.

Error

Top-level error type for moq-auth.

Event

The lifecycle moment a Request reports.

InvalidPattern

Why a string or a segment list is not a valid Pattern.

KeyError

Errors related to key configuration and cryptographic operations.

KeyIdError

KeyMaterial

https://datatracker.ietf.org/doc/html/rfc7518#section-6

KeyOperation

Cryptographic operations that a key can perform.

Role

The single direction a client declared at SETUP.

Segment

One segment of a Pattern.

Transport

How a session reached the relay. The names match moq_tokio::server::Transport, plus http for the relay’s one-shot HTTP routes.

Type Aliases

Result