fix(moq-relay): allow connecting to parent of token root

[kixelated]

Summary

• Allow clients to connect to a parent path of their token's root (e.g., connect to / with token root demo). Permissions are automatically scoped to the token's root.
• Simplify permission scoping logic by extracting a shared scope closure for subscribe/publish filtering.
• Update boy service to use /bin/bash -c for shell expansion in ExecStart (systemd doesn't expand $(cmd)).
• Document the new connection path behavior in auth docs.

Test plan

• 44 unit tests pass (4 new tests for parent-path connections)
• Deploy and verify boy services connect successfully
• Verify existing JWT-authenticated clients still work

🤖 Generated with Claude Code

[coderabbitai]

Walkthrough

This PR updates relay JWT authorization to allow bidirectional overlap between connection paths and token roots and centralizes permission scoping logic; adds async tests for the new cases. Documentation for connection-path semantics and key resolution was revised. Service and deployment artifacts were changed: the moq-boy systemd ExecStart and URL/path arguments were modified; several Justfiles now auto-generate tokens before deploy; README token instructions were simplified. CDN health/monitor scripts were changed to remove JWT-based query authentication and perform unauthenticated fetches.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix(moq-relay): allow connecting to parent of token root' directly describes the main change in the changeset—enabling clients to connect to parent paths of their token root, which is the primary objective of the PR.
Description check	✅ Passed	The description is related to the changeset, covering the main feature (connecting to parent paths with scoped permissions), code simplification, systemd configuration fix, and documentation updates that align with the file modifications.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/relay-parent-root

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/relay-parent-root

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@cdn/boy/boy.service.tftpl`:
- Line 14: Change the template so the raw JWT is no longer appended to the --url
query string; instead read the token from /var/lib/moq/demo-boy.jwt and send it
via an Authorization header or an env var (e.g. set BOY_JWT and use a --header
"Authorization: Bearer $(cat /var/lib/moq/demo-boy.jwt)" or add a --jwt-file
flag the binary can read) rather than embedding it in --url, and also update the
moq-boy connect logging (the code that currently logs %config.url) to redact or
strip query parameters before logging; specifically replace the usage of --url
with a header/env/jwt-file approach and sanitize %config.url in the logger.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c2bf51bd-90b9-4831-a8b1-35a5c9bf091b

📥 Commits

Reviewing files that changed from the base of the PR and between a012adc and ffff0b7.

📒 Files selected for processing (7)

• cdn/README.md
• cdn/boy/boy.service.tftpl
• cdn/boy/justfile
• cdn/common/monitor.sh
• cdn/health.sh
• cdn/pub/justfile
• cdn/relay/justfile

✅ Files skipped from review due to trivial changes (1)

• cdn/README.md

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Avoid embedding raw JWT in the URL query string.

Line 14 injects the token into --url, which exposes it in process arguments and, with current moq-boy connect logging (rs/moq-boy/src/main.rs Line 249-255 logs %config.url), can leak the credential into journald. Please switch to a non-URL auth path (or minimally redact URL query in logs immediately).

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@cdn/boy/boy.service.tftpl` at line 14, Change the template so the raw JWT is
no longer appended to the --url query string; instead read the token from
/var/lib/moq/demo-boy.jwt and send it via an Authorization header or an env var
(e.g. set BOY_JWT and use a --header "Authorization: Bearer $(cat
/var/lib/moq/demo-boy.jwt)" or add a --jwt-file flag the binary can read) rather
than embedding it in --url, and also update the moq-boy connect logging (the
code that currently logs %config.url) to redact or strip query parameters before
logging; specifically replace the usage of --url with a header/env/jwt-file
approach and sanitize %config.url in the logger.