@moqtap/codec 0.9.0 → 0.11.0

package/src/drafts/draft11/codec.ts

@@ -1,3 +1,4 @@
+import { type AuthRedaction, recordAuthValueSpan, redactWith } from '../../core/auth-redaction.js'
 import { BufferReader } from '../../core/buffer-reader.js'
 import { BufferWriter } from '../../core/buffer-writer.js'
 import { bytesToHex, hexToBytes } from '../../core/hex.js'
@@ -146,15 +147,15 @@ function decodeSetupParams(r: BufferReader): Draft11SetupParams {
 
 function encodeParams(params: Draft11Params, w: BufferWriter): void {
   let count = params.unknown ? params.unknown.length : 0
-  if (params.authorization_token !== undefined) count++
+  count += params.authorization_token?.length ?? 0
   if (params.delivery_timeout !== undefined) count++
   if (params.max_cache_duration !== undefined) count++
   w.writeVarInt(count)
 
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     // AUTHORIZATION_TOKEN = 0x01 (odd → length-prefixed)
     w.writeVarInt(PARAM_AUTHORIZATION_TOKEN)
-    const at = params.authorization_token
+    const at = token
     const tmpW = new BufferWriter(64)
     tmpW.writeVarInt(at.alias_type)
     tmpW.writeVarInt(at.token_type)
@@ -227,11 +228,15 @@ function decodeParams(r: BufferReader): Draft11Params {
         const token_type = r.readVarInt()
         const tokenBytesLen = length - (r.offset - startOff)
         const tokenBytes = r.readBytes(tokenBytesLen)
-        result.authorization_token = {
-          alias_type,
-          token_type,
-          token_value: tokenBytes,
-        }
+        noteAuthTokenValue(startOff, length, tokenBytes)
+        result.authorization_token = [
+          ...(result.authorization_token ?? []),
+          {
+            alias_type,
+            token_type,
+            token_value: tokenBytes,
+          },
+        ]
       } else {
         const bytes = r.readBytes(length)
         unknown.push({
@@ -1051,3 +1056,61 @@ export function createDraft11Codec(): Draft11Codec {
     createStreamDecoder,
   }
 }
+
+/**
+ * Record where a Token Value sits, so it can be overwritten before the frame
+ * reaches anything that keeps it.
+ *
+ * The span falls out of the decode with no second walk. The Token Value is the
+ * last field of the Token structure, so its start is the parameter value's end
+ * minus the value's own length. The fields before it are left alone
+ * deliberately: Alias Type, Token Alias and Token Type are structure rather
+ * than secret, and they are what distinguishes a session that failed to
+ * authenticate from one that never tried.
+ *
+ * A token carrying no value at all -- DELETE and USE_ALIAS -- records nothing,
+ * and its frame passes through untouched.
+ */
+function noteAuthTokenValue(
+  valueStart: number,
+  valueLength: number,
+  value: Uint8Array | undefined,
+): void {
+  if (value === undefined || value.byteLength === 0) return
+  recordAuthValueSpan(valueStart + valueLength - value.byteLength, value.byteLength)
+}
+
+/**
+ * Overwrite every Authorization Token value in a draft-11 control frame.
+ *
+ * One decode, whose *output is discarded*: the point is not to read the
+ * message, it is to learn where the credentials were so the caller never has to
+ * hold a frame that contains one. A caller that also wants the message should
+ * decode the **redacted** frame with {@link decodeMessage}, which then cannot
+ * produce a value because there is no longer one in the bytes.
+ *
+ * A frame that fails to decode is still redacted as far as the decode got. That
+ * is the useful direction to fail in: a value that was read is a value that was
+ * exposed, whatever went wrong after it.
+ *
+ * See {@link AuthRedaction.incomplete} for the one result a caller must not
+ * treat as clean, and {@link AuthRedaction.decoded} for the residual it cannot
+ * close.
+ */
+export function redactAuthTokens(bytes: Uint8Array): AuthRedaction {
+  let payloadStart: number
+  try {
+    const probe = new BufferReader(bytes)
+    probe.readVarInt()
+    probe.readUint8()
+    probe.readUint8()
+    payloadStart = probe.offset
+  } catch {
+    // Too short to carry a message header, and so too short for the parameters
+    // that carry a credential. Reported as not decoded rather than as clean: a
+    // framer only ever emits complete frames, so a caller that gets here is
+    // holding something this function did not check.
+    return { bytes, redacted: 0, incomplete: false, decoded: false }
+  }
+  return redactWith(bytes, payloadStart, () => decodeMessage(bytes).ok)
+}

package/src/drafts/draft11/error-codes.ts

@@ -0,0 +1,106 @@
+// Draft-11 error, status and termination code registries.
+
+export const SessionErrorCode = {
+  NoError: 0x0n,
+  InternalError: 0x1n,
+  Unauthorized: 0x2n,
+  ProtocolViolation: 0x3n,
+  InvalidRequestId: 0x4n,
+  DuplicateTrackAlias: 0x5n,
+  KeyValueFormattingError: 0x6n,
+  TooManyRequests: 0x7n,
+  InvalidPath: 0x8n,
+  MalformedPath: 0x9n,
+  GoawayTimeout: 0x10n,
+  ControlMessageTimeout: 0x11n,
+  DataStreamTimeout: 0x12n,
+  AuthTokenCacheOverflow: 0x13n,
+  DuplicateAuthTokenAlias: 0x14n,
+  VersionNegotiationFailed: 0x15n,
+} as const
+export type SessionErrorCodeValue = (typeof SessionErrorCode)[keyof typeof SessionErrorCode]
+
+export const SubscribeErrorCode = {
+  InternalError: 0x0n,
+  Unauthorized: 0x1n,
+  Timeout: 0x2n,
+  NotSupported: 0x3n,
+  TrackDoesNotExist: 0x4n,
+  InvalidRange: 0x5n,
+  RetryTrackAlias: 0x6n,
+  MalformedAuthToken: 0x10n,
+  UnknownAuthTokenAlias: 0x11n,
+  ExpiredAuthToken: 0x12n,
+} as const
+export type SubscribeErrorCodeValue = (typeof SubscribeErrorCode)[keyof typeof SubscribeErrorCode]
+
+export const SubscribeDoneStatusCode = {
+  InternalError: 0x0n,
+  Unauthorized: 0x1n,
+  TrackEnded: 0x2n,
+  SubscriptionEnded: 0x3n,
+  GoingAway: 0x4n,
+  Expired: 0x5n,
+  TooFarBehind: 0x6n,
+} as const
+export type SubscribeDoneStatusCodeValue =
+  (typeof SubscribeDoneStatusCode)[keyof typeof SubscribeDoneStatusCode]
+
+export const FetchErrorCode = {
+  InternalError: 0x0n,
+  Unauthorized: 0x1n,
+  Timeout: 0x2n,
+  NotSupported: 0x3n,
+  TrackDoesNotExist: 0x4n,
+  InvalidRange: 0x5n,
+  NoObjects: 0x6n,
+  InvalidJoiningSubscribeId: 0x7n,
+  MalformedAuthToken: 0x10n,
+  UnknownAuthTokenAlias: 0x11n,
+  ExpiredAuthToken: 0x12n,
+} as const
+export type FetchErrorCodeValue = (typeof FetchErrorCode)[keyof typeof FetchErrorCode]
+
+export const AnnounceErrorCode = {
+  InternalError: 0x0n,
+  Unauthorized: 0x1n,
+  Timeout: 0x2n,
+  NotSupported: 0x3n,
+  Uninterested: 0x4n,
+  MalformedAuthToken: 0x10n,
+  UnknownAuthTokenAlias: 0x11n,
+  ExpiredAuthToken: 0x12n,
+} as const
+export type AnnounceErrorCodeValue = (typeof AnnounceErrorCode)[keyof typeof AnnounceErrorCode]
+
+export const SubscribeAnnouncesErrorCode = {
+  InternalError: 0x0n,
+  Unauthorized: 0x1n,
+  Timeout: 0x2n,
+  NotSupported: 0x3n,
+  NamespacePrefixUnknown: 0x4n,
+  NamespacePrefixOverlap: 0x5n,
+  MalformedAuthToken: 0x10n,
+  UnknownAuthTokenAlias: 0x11n,
+  ExpiredAuthToken: 0x12n,
+} as const
+export type SubscribeAnnouncesErrorCodeValue =
+  (typeof SubscribeAnnouncesErrorCode)[keyof typeof SubscribeAnnouncesErrorCode]
+
+export const TrackStatusCode = {
+  InProgress: 0x00n,
+  TrackDoesNotExist: 0x01n,
+  NotYetBegun: 0x02n,
+  Finished: 0x03n,
+  RelayStatusUnavailable: 0x04n,
+} as const
+export type TrackStatusCodeValue = (typeof TrackStatusCode)[keyof typeof TrackStatusCode]
+
+export const StreamResetErrorCode = {
+  InternalError: 0x0n,
+  Cancelled: 0x1n,
+  DeliveryTimeout: 0x2n,
+  SessionClosed: 0x3n,
+} as const
+export type StreamResetErrorCodeValue =
+  (typeof StreamResetErrorCode)[keyof typeof StreamResetErrorCode]

package/src/drafts/draft11/index.ts

@@ -1,5 +1,7 @@
 export const DRAFT_VERSION = 0xff00000bn
 
+export type { AuthRedaction } from '../../core/auth-redaction.js'
+export { REDACTION_FILL } from '../../core/auth-redaction.js'
 export type { Draft11Codec } from './codec.js'
 export {
   createDraft11Codec,
@@ -13,7 +15,28 @@ export {
   encodeFetchStream,
   encodeMessage,
   encodeSubgroupStream,
+  redactAuthTokens,
 } from './codec.js'
+export type {
+  AnnounceErrorCodeValue,
+  FetchErrorCodeValue,
+  SessionErrorCodeValue,
+  StreamResetErrorCodeValue,
+  SubscribeAnnouncesErrorCodeValue,
+  SubscribeDoneStatusCodeValue,
+  SubscribeErrorCodeValue,
+  TrackStatusCodeValue,
+} from './error-codes.js'
+export {
+  AnnounceErrorCode,
+  FetchErrorCode,
+  SessionErrorCode,
+  StreamResetErrorCode,
+  SubscribeAnnouncesErrorCode,
+  SubscribeDoneStatusCode,
+  SubscribeErrorCode,
+  TrackStatusCode,
+} from './error-codes.js'
 export {
   MESSAGE_ID_MAP,
   MESSAGE_TYPE_MAP,

package/src/drafts/draft11/types.ts

@@ -24,7 +24,7 @@ export interface Draft11SetupParams {
 
 // Version-specific parameters — even/odd convention
 export interface Draft11Params {
-  authorization_token?: AuthorizationToken // 0x01 odd
+  authorization_token?: readonly AuthorizationToken[] // 0x01 odd
   delivery_timeout?: bigint // 0x02 even
   max_cache_duration?: bigint // 0x04 even
   unknown?: UnknownParam[]

package/src/drafts/draft12/codec.ts

@@ -1,3 +1,4 @@
+import { type AuthRedaction, recordAuthValueSpan, redactWith } from '../../core/auth-redaction.js'
 import { BufferReader } from '../../core/buffer-reader.js'
 import { BufferWriter } from '../../core/buffer-writer.js'
 import { bytesToHex, hexToBytes } from '../../core/hex.js'
@@ -73,7 +74,7 @@ function encodeSetupParams(params: Draft12SetupParams, w: BufferWriter): void {
   let count = 0
   if (params.path !== undefined) count++
   if (params.max_request_id !== undefined) count++
-  if (params.authorization_token !== undefined) count++
+  count += params.authorization_token?.length ?? 0
   if (params.unknown) count += params.unknown.length
 
   w.writeVarInt(count)
@@ -88,9 +89,9 @@ function encodeSetupParams(params: Draft12SetupParams, w: BufferWriter): void {
     w.writeVarInt(SETUP_PARAM_MAX_REQUEST_ID)
     w.writeVarInt(params.max_request_id)
   }
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     w.writeVarInt(PARAM_AUTHORIZATION_TOKEN)
-    const at = params.authorization_token
+    const at = token
     const tmpW = new BufferWriter(64)
     tmpW.writeVarInt(at.alias_type)
     tmpW.writeVarInt(at.token_type)
@@ -148,11 +149,15 @@ function decodeSetupParams(r: BufferReader): Draft12SetupParams {
         const token_type = r.readVarInt()
         const tokenBytesLen = length - (r.offset - startOff)
         const tokenBytes = r.readBytes(tokenBytesLen)
-        result.authorization_token = {
-          alias_type,
-          token_type,
-          token_value: tokenBytes,
-        }
+        noteAuthTokenValue(startOff, length, tokenBytes)
+        result.authorization_token = [
+          ...(result.authorization_token ?? []),
+          {
+            alias_type,
+            token_type,
+            token_value: tokenBytes,
+          },
+        ]
       } else {
         const bytes = r.readBytes(length)
         unknown.push({
@@ -174,7 +179,7 @@ function decodeSetupParams(r: BufferReader): Draft12SetupParams {
 function encodeParams(params: Draft12Params, w: BufferWriter): void {
   let count = params.unknown ? params.unknown.length : 0
   if (params.delivery_timeout !== undefined) count++
-  if (params.authorization_token !== undefined) count++
+  count += params.authorization_token?.length ?? 0
   if (params.max_cache_duration !== undefined) count++
   w.writeVarInt(count)
 
@@ -183,10 +188,10 @@ function encodeParams(params: Draft12Params, w: BufferWriter): void {
     w.writeVarInt(PARAM_DELIVERY_TIMEOUT)
     w.writeVarInt(params.delivery_timeout)
   }
-  if (params.authorization_token !== undefined) {
+  for (const token of params.authorization_token ?? []) {
     // AUTHORIZATION_TOKEN = 0x03 (odd → length-prefixed)
     w.writeVarInt(PARAM_AUTHORIZATION_TOKEN)
-    const at = params.authorization_token
+    const at = token
     const tmpW = new BufferWriter(64)
     tmpW.writeVarInt(at.alias_type)
     tmpW.writeVarInt(at.token_type)
@@ -254,11 +259,15 @@ function decodeParams(r: BufferReader): Draft12Params {
         const token_type = r.readVarInt()
         const tokenBytesLen = length - (r.offset - startOff)
         const tokenBytes = r.readBytes(tokenBytesLen)
-        result.authorization_token = {
-          alias_type,
-          token_type,
-          token_value: tokenBytes,
-        }
+        noteAuthTokenValue(startOff, length, tokenBytes)
+        result.authorization_token = [
+          ...(result.authorization_token ?? []),
+          {
+            alias_type,
+            token_type,
+            token_value: tokenBytes,
+          },
+        ]
       } else {
         const bytes = r.readBytes(length)
         unknown.push({
@@ -1199,3 +1208,61 @@ export function createDraft12Codec(): Draft12Codec {
     createStreamDecoder,
   }
 }
+
+/**
+ * Record where a Token Value sits, so it can be overwritten before the frame
+ * reaches anything that keeps it.
+ *
+ * The span falls out of the decode with no second walk. The Token Value is the
+ * last field of the Token structure, so its start is the parameter value's end
+ * minus the value's own length. The fields before it are left alone
+ * deliberately: Alias Type, Token Alias and Token Type are structure rather
+ * than secret, and they are what distinguishes a session that failed to
+ * authenticate from one that never tried.
+ *
+ * A token carrying no value at all -- DELETE and USE_ALIAS -- records nothing,
+ * and its frame passes through untouched.
+ */
+function noteAuthTokenValue(
+  valueStart: number,
+  valueLength: number,
+  value: Uint8Array | undefined,
+): void {
+  if (value === undefined || value.byteLength === 0) return
+  recordAuthValueSpan(valueStart + valueLength - value.byteLength, value.byteLength)
+}
+
+/**
+ * Overwrite every Authorization Token value in a draft-12 control frame.
+ *
+ * One decode, whose *output is discarded*: the point is not to read the
+ * message, it is to learn where the credentials were so the caller never has to
+ * hold a frame that contains one. A caller that also wants the message should
+ * decode the **redacted** frame with {@link decodeMessage}, which then cannot
+ * produce a value because there is no longer one in the bytes.
+ *
+ * A frame that fails to decode is still redacted as far as the decode got. That
+ * is the useful direction to fail in: a value that was read is a value that was
+ * exposed, whatever went wrong after it.
+ *
+ * See {@link AuthRedaction.incomplete} for the one result a caller must not
+ * treat as clean, and {@link AuthRedaction.decoded} for the residual it cannot
+ * close.
+ */
+export function redactAuthTokens(bytes: Uint8Array): AuthRedaction {
+  let payloadStart: number
+  try {
+    const probe = new BufferReader(bytes)
+    probe.readVarInt()
+    probe.readUint8()
+    probe.readUint8()
+    payloadStart = probe.offset
+  } catch {
+    // Too short to carry a message header, and so too short for the parameters
+    // that carry a credential. Reported as not decoded rather than as clean: a
+    // framer only ever emits complete frames, so a caller that gets here is
+    // holding something this function did not check.
+    return { bytes, redacted: 0, incomplete: false, decoded: false }
+  }
+  return redactWith(bytes, payloadStart, () => decodeMessage(bytes).ok)
+}

package/src/drafts/draft12/error-codes.ts

@@ -0,0 +1,116 @@
+// Draft-12 error, status and termination code registries.
+
+export const SessionErrorCode = {
+  NoError: 0x0n,
+  InternalError: 0x1n,
+  Unauthorized: 0x2n,
+  ProtocolViolation: 0x3n,
+  InvalidRequestId: 0x4n,
+  DuplicateTrackAlias: 0x5n,
+  KeyValueFormattingError: 0x6n,
+  TooManyRequests: 0x7n,
+  InvalidPath: 0x8n,
+  MalformedPath: 0x9n,
+  GoawayTimeout: 0x10n,
+  ControlMessageTimeout: 0x11n,
+  DataStreamTimeout: 0x12n,
+  AuthTokenCacheOverflow: 0x13n,
+  DuplicateAuthTokenAlias: 0x14n,
+  VersionNegotiationFailed: 0x15n,
+  MalformedAuthToken: 0x16n,
+  UnknownAuthTokenAlias: 0x17n,
+  ExpiredAuthToken: 0x18n,
+} as const
+export type SessionErrorCodeValue = (typeof SessionErrorCode)[keyof typeof SessionErrorCode]
+
+export const SubscribeErrorCode = {
+  InternalError: 0x0n,
+  Unauthorized: 0x1n,
+  Timeout: 0x2n,
+  NotSupported: 0x3n,
+  TrackDoesNotExist: 0x4n,
+  InvalidRange: 0x5n,
+  MalformedAuthToken: 0x10n,
+  ExpiredAuthToken: 0x12n,
+} as const
+export type SubscribeErrorCodeValue = (typeof SubscribeErrorCode)[keyof typeof SubscribeErrorCode]
+
+export const SubscribeDoneStatusCode = {
+  InternalError: 0x0n,
+  Unauthorized: 0x1n,
+  TrackEnded: 0x2n,
+  SubscriptionEnded: 0x3n,
+  GoingAway: 0x4n,
+  Expired: 0x5n,
+  TooFarBehind: 0x6n,
+  MalformedTrack: 0x7n,
+} as const
+export type SubscribeDoneStatusCodeValue =
+  (typeof SubscribeDoneStatusCode)[keyof typeof SubscribeDoneStatusCode]
+
+export const PublishErrorCode = {
+  InternalError: 0x0n,
+  Unauthorized: 0x1n,
+  Timeout: 0x2n,
+  NotSupported: 0x3n,
+  Uninterested: 0x4n,
+} as const
+export type PublishErrorCodeValue = (typeof PublishErrorCode)[keyof typeof PublishErrorCode]
+
+export const FetchErrorCode = {
+  InternalError: 0x0n,
+  Unauthorized: 0x1n,
+  Timeout: 0x2n,
+  NotSupported: 0x3n,
+  TrackDoesNotExist: 0x4n,
+  InvalidRange: 0x5n,
+  NoObjects: 0x6n,
+  InvalidJoiningRequestId: 0x7n,
+  UnknownStatusInRange: 0x8n,
+  MalformedTrack: 0x9n,
+  MalformedAuthToken: 0x10n,
+  ExpiredAuthToken: 0x12n,
+} as const
+export type FetchErrorCodeValue = (typeof FetchErrorCode)[keyof typeof FetchErrorCode]
+
+export const AnnounceErrorCode = {
+  InternalError: 0x0n,
+  Unauthorized: 0x1n,
+  Timeout: 0x2n,
+  NotSupported: 0x3n,
+  Uninterested: 0x4n,
+  MalformedAuthToken: 0x10n,
+  ExpiredAuthToken: 0x12n,
+} as const
+export type AnnounceErrorCodeValue = (typeof AnnounceErrorCode)[keyof typeof AnnounceErrorCode]
+
+export const SubscribeAnnouncesErrorCode = {
+  InternalError: 0x0n,
+  Unauthorized: 0x1n,
+  Timeout: 0x2n,
+  NotSupported: 0x3n,
+  NamespacePrefixUnknown: 0x4n,
+  NamespacePrefixOverlap: 0x5n,
+  MalformedAuthToken: 0x10n,
+  ExpiredAuthToken: 0x12n,
+} as const
+export type SubscribeAnnouncesErrorCodeValue =
+  (typeof SubscribeAnnouncesErrorCode)[keyof typeof SubscribeAnnouncesErrorCode]
+
+export const StreamResetErrorCode = {
+  InternalError: 0x0n,
+  Cancelled: 0x1n,
+  DeliveryTimeout: 0x2n,
+  SessionClosed: 0x3n,
+} as const
+export type StreamResetErrorCodeValue =
+  (typeof StreamResetErrorCode)[keyof typeof StreamResetErrorCode]
+
+export const TrackStatusCode = {
+  InProgress: 0x00n,
+  TrackDoesNotExist: 0x01n,
+  NotYetBegun: 0x02n,
+  Finished: 0x03n,
+  RelayStatusUnavailable: 0x04n,
+} as const
+export type TrackStatusCodeValue = (typeof TrackStatusCode)[keyof typeof TrackStatusCode]

package/src/drafts/draft12/index.ts

@@ -1,5 +1,7 @@
 export const DRAFT_VERSION = 0xff00000cn
 
+export type { AuthRedaction } from '../../core/auth-redaction.js'
+export { REDACTION_FILL } from '../../core/auth-redaction.js'
 export type { Draft12Codec } from './codec.js'
 export {
   createDraft12Codec,
@@ -13,7 +15,30 @@ export {
   encodeFetchStream,
   encodeMessage,
   encodeSubgroupStream,
+  redactAuthTokens,
 } from './codec.js'
+export type {
+  AnnounceErrorCodeValue,
+  FetchErrorCodeValue,
+  PublishErrorCodeValue,
+  SessionErrorCodeValue,
+  StreamResetErrorCodeValue,
+  SubscribeAnnouncesErrorCodeValue,
+  SubscribeDoneStatusCodeValue,
+  SubscribeErrorCodeValue,
+  TrackStatusCodeValue,
+} from './error-codes.js'
+export {
+  AnnounceErrorCode,
+  FetchErrorCode,
+  PublishErrorCode,
+  SessionErrorCode,
+  StreamResetErrorCode,
+  SubscribeAnnouncesErrorCode,
+  SubscribeDoneStatusCode,
+  SubscribeErrorCode,
+  TrackStatusCode,
+} from './error-codes.js'
 export {
   MESSAGE_ID_MAP,
   MESSAGE_TYPE_MAP,

package/src/drafts/draft12/types.ts

@@ -19,14 +19,14 @@ export interface AuthorizationToken {
 export interface Draft12SetupParams {
   path?: string // 0x01 odd
   max_request_id?: bigint // 0x02 even
-  authorization_token?: AuthorizationToken // 0x03 odd
+  authorization_token?: readonly AuthorizationToken[] // 0x03 odd
   unknown?: UnknownParam[]
 }
 
 // Version-specific parameters — even/odd convention
 export interface Draft12Params {
   delivery_timeout?: bigint // 0x02 even
-  authorization_token?: AuthorizationToken // 0x03 odd
+  authorization_token?: readonly AuthorizationToken[] // 0x03 odd
   max_cache_duration?: bigint // 0x04 even
   unknown?: UnknownParam[]
 }