fix(native): surface terminal auth connect errors

rs/libmoq/src/error.rs

@@ -115,6 +115,14 @@ pub enum Error {
 	#[error("offline")]
 	Offline,
 
+	/// Connection was rejected as unauthorized by the server.
+	#[error("unauthorized")]
+	Unauthorized,
+
+	/// Connection was forbidden by the server.
+	#[error("forbidden")]
+	Forbidden,
+
 	/// Error from the hang media layer.
 	#[error("hang error: {0}")]
 	Hang(#[from] hang::Error),
@@ -195,6 +203,8 @@ impl ffi::ReturnCode for Error {
 			Error::Audio(_) => -30,
 			Error::GroupNotFound => -31,
 			Error::Native(_) => -32,
+			Error::Unauthorized => -33,
+			Error::Forbidden => -34,
 		}
 	}
 }

rs/libmoq/src/session.rs

@@ -74,25 +74,24 @@ impl Session {
 			.with_consume(consume)
 			.reconnect(url);
 
-		// report() runs until the reconnect loop gives up; map its terminal error to Connect.
-		Self::report(callback, reconnect)
-			.await
-			.map_err(|err| Error::Connect(Arc::new(err)))
+		Self::report(callback, reconnect).await
 	}
 
 	/// Forward connection epochs to the status callback until the reconnect loop stops.
 	///
 	/// Returns the terminal error via `?`. Disconnects aren't reported: status 0 is reserved for a
 	/// clean close (delivered as the terminal callback once the task ends).
-	async fn report(callback: ffi::OnStatus, mut reconnect: moq_native::Reconnect) -> anyhow::Result<()> {
+	async fn report(callback: ffi::OnStatus, mut reconnect: moq_native::Reconnect) -> Result<(), Error> {
 		let mut connects: u64 = 0;
 		loop {
-			if let moq_native::Status::Connected = reconnect.status().await? {
+			if let moq_native::Status::Connected = reconnect.status().await.map_err(map_connect_error)? {
 				connects += 1;
 				// Positive status carries the connection epoch, so callers can tell a
 				// reconnect (>1) from the first connect (1). No lock is held, so the C
 				// callback is free to re-enter libmoq.
-				let code = i32::try_from(connects).context("connection epoch exceeded i32::MAX")?;
+				let code = i32::try_from(connects)
+					.context("connection epoch exceeded i32::MAX")
+					.map_err(|err| Error::Connect(Arc::new(err)))?;
 				callback.call(code);
 			}
 		}
@@ -110,3 +109,40 @@ impl Session {
 		Ok(())
 	}
 }
+
+fn map_connect_error(err: moq_native::Error) -> Error {
+	match err.connect_error() {
+		Some(moq_native::ConnectError::Unauthorized) => Error::Unauthorized,
+		Some(moq_native::ConnectError::Forbidden) => Error::Forbidden,
+		_ => Error::Connect(Arc::new(err.into())),
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+	use crate::ffi::ReturnCode;
+
+	#[test]
+	fn maps_native_auth_connect_errors() {
+		assert!(matches!(
+			map_connect_error(moq_native::ConnectError::Unauthorized.into()),
+			Error::Unauthorized
+		));
+		assert!(matches!(
+			map_connect_error(moq_native::ConnectError::Forbidden.into()),
+			Error::Forbidden
+		));
+		assert!(matches!(
+			map_connect_error(moq_net::Error::Unauthorized.into()),
+			Error::Unauthorized
+		));
+		assert!(matches!(
+			map_connect_error(moq_native::Error::ConnectFailed),
+			Error::Connect(_)
+		));
+		assert_eq!(Error::Unauthorized.code(), -33);
+		assert_eq!(Error::Forbidden.code(), -34);
+		assert_eq!(map_connect_error(moq_native::Error::ConnectFailed).code(), -5);
+	}
+}

rs/moq-ffi/src/error.rs

@@ -54,6 +54,9 @@ pub enum MoqError {
 	#[error("unauthorized")]
 	Unauthorized,
 
+	#[error("forbidden")]
+	Forbidden,
+
 	#[error("log: {0}")]
 	Log(String),
 }

rs/moq-ffi/src/session.rs

@@ -15,11 +15,7 @@ struct Client {
 
 impl Client {
 	async fn connect(&self, url: Url) -> Result<Arc<MoqSession>, MoqError> {
-		let client = self
-			.config
-			.clone()
-			.init()
-			.map_err(|err| MoqError::Connect(format!("{err}")))?;
+		let client = self.config.clone().init().map_err(map_connect_error)?;
 
 		let publish = self.publish.as_ref().map(|o| o.inner().consume());
 		let consume = self.consume.as_ref().map(|o| o.inner().clone());
@@ -29,12 +25,37 @@ impl Client {
 			.with_consume(consume)
 			.connect(url)
 			.await
-			.map_err(|err| MoqError::Connect(format!("{err}")))?;
+			.map_err(map_connect_error)?;
 
 		Ok(Arc::new(MoqSession::new(session)))
 	}
 }
 
+fn map_connect_error(err: moq_native::Error) -> MoqError {
+	match err.connect_error() {
+		Some(moq_native::ConnectError::Unauthorized) => MoqError::Unauthorized,
+		Some(moq_native::ConnectError::Forbidden) => MoqError::Forbidden,
+		_ => MoqError::Connect(format!("{err}")),
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+
+	#[test]
+	fn maps_native_auth_connect_errors() {
+		assert!(matches!(
+			map_connect_error(moq_native::ConnectError::Unauthorized.into()),
+			MoqError::Unauthorized
+		));
+		assert!(matches!(
+			map_connect_error(moq_native::ConnectError::Forbidden.into()),
+			MoqError::Forbidden
+		));
+	}
+}
+
 #[derive(uniffi::Object)]
 pub struct MoqClient {
 	task: Task<Client>,

rs/moq-native/Cargo.toml

@@ -62,6 +62,7 @@ web-transport-noq = { workspace = true, optional = true }
 web-transport-proto = { workspace = true, optional = true }
 web-transport-quiche = { workspace = true, optional = true }
 web-transport-quinn = { workspace = true, optional = true }
+web-transport-trait = { workspace = true }
 
 [target.'cfg(target_os = "android")'.dependencies]
 tracing-android = { version = "0.2", optional = true }