Today a service is either authorization-less or token-required.
The only exception is require_setup_token: false
There's a use case for allowing specific operations token-less on an otherwise token-protected service. e.g. anonymous subscribe/fetch for anyone, while publishing still requires a valid token.
Defining what's allowed may be complex. For CAT-based auth, I propose an "anonymous claim": a statically-defined moqt claim in the config that is applied to requests without a token.
Details TODO. e.g. should this apply only to requests with no token, or also to requests whose token is invalid? And is "valid" meant as decidable, or as claim-satisfying?
Today a service is either authorization-less or token-required.
The only exception is
require_setup_token: falseThere's a use case for allowing specific operations token-less on an otherwise token-protected service. e.g. anonymous subscribe/fetch for anyone, while publishing still requires a valid token.
Defining what's allowed may be complex. For CAT-based auth, I propose an "anonymous claim": a statically-defined moqt claim in the config that is applied to requests without a token.
Details TODO. e.g. should this apply only to requests with no token, or also to requests whose token is invalid? And is "valid" meant as decidable, or as claim-satisfying?