Skip to content

Add @web-moq/cat token library with standards-compliant CAT/COSE/CWT auth - #27

Merged
suhasHere merged 43 commits into
mainfrom
cat
Jul 7, 2026
Merged

Add @web-moq/cat token library with standards-compliant CAT/COSE/CWT auth#27
suhasHere merged 43 commits into
mainfrom
cat

Conversation

@suhasHere

Copy link
Copy Markdown
Contributor

Summary

  • New packages/cat/ (@web-moq/cat) — standalone CAT (Common Access Token) library implementing CBOR (RFC 8949), COSE_Sign1 (RFC 9052), COSE_Mac0 (RFC 9052), and CWT (RFC 8392)
  • Supports ES256/ES384/ES512 (ECDSA) and HMAC-SHA256 (alg 5) with correct IANA algorithm IDs
  • CatTokenBuilder fluent API for token creation, CatTokenDecoder for decode + full validation (signature, expiration, nbf, audience, algorithm enforcement)
  • Fixes binary corruption bug in message-codec.ts where AUTHORIZATION_TOKEN parameter was decoded as UTF-8
  • Adds MessageCodec.encodeAuthorizationToken() / decodeAuthorizationToken() with alias type support (0/1/2/3)
  • Per-request AUTHORIZATION_TOKEN support in SUBSCRIBE and PUBLISH messages via authToken option
  • Replaces inline CBOR/token code in auth-demo with library imports; fake tokens now use proper CWT/COSE format
  • 168 tests in cat package (unit, fuzz, performance, catapult cross-implementation test vectors), 357 in core
  • Security hardened: signature verified before claims, algorithm confusion prevention, duplicate CBOR key rejection, input size limits, frozen algorithm params

Test plan

suhasHere added 30 commits June 8, 2026 15:38
MediaSession can now accept an existing MOQTSession to reuse a connection.
Session uses longest-prefix matching for namespace subscriptions and sends
PUBLISH_DONE on unpublish. Video sends are serialized to prevent GOP corruption.
Handle trackAlias reuse by removing old subscription instead of erroring.
Clean up existing decode pipeline when same track re-publishes.
@suhasHere
suhasHere merged commit 46b73f7 into main Jul 7, 2026
3 checks passed
@suhasHere
suhasHere deleted the cat branch July 7, 2026 23:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant