[codex] Backport relay web embedding

[kixelated]

Summary

• Add Web::routes() and Web::serve(app) so embedders can mount extra axum routes on the relay web listener.
• Expose MtlsPeer and add Auth::verify_mtls(path) so embedded HTTPS handlers can use the relay's mTLS alias resolution and internal-tier decision.
• Route built-in mTLS paths through the new helper and add smoke coverage for serving merged routes.

Validation

• cargo fmt -p moq-relay
• cargo check -p moq-relay
• cargo test -p moq-relay

(Written by Claude)

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9c9d3cd7-e5d1-493e-ace4-b45509a7ed0d

📥 Commits

Reviewing files that changed from the base of the PR and between 41e2c75 and 41b4947.

📒 Files selected for processing (1)

• rs/moq-relay/tests/smoke.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• rs/moq-relay/tests/smoke.rs

---

Walkthrough

Added a shared Auth::verify_mtls helper that resolves an mTLS peer to a canonical root and internal flag, then updated connection, WebSocket, and web request handlers to use it. The relay Web type now stores state in Arc<WebState> and exposes from_parts, state, routes, and serve, with MtlsPeer made public. Smoke tests now build the web stack with configurable WebSocket support and verify merged routes through web.serve.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the main change: adding relay web embedding support.
Description check	✅ Passed	The description accurately summarizes the added web embedding and mTLS verification changes.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch codex/backport-relay-web-embedding-main

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@rs/moq-relay/tests/smoke.rs`:
- Around line 109-112: The server startup task in the smoke tests is swallowing
early failures by discarding the result of web.run() (and the related
web.serve(app) path), which can make later wait_for_http timeouts hide the real
error. Update the tokio::spawn block(s) in the smoke test helpers to capture the
run/serve result and surface any startup failure explicitly through the test
flow, using the existing web.run and web.serve(app) call sites so the task does
not silently exit on error.
- Around line 203-215: The smoke test relay_web_serves_merged_routes relies on
wait_for_http(), which uses sleep, so it should start with tokio::time::pause()
to make the async timing deterministic. Update this test near the tokio::test
setup so paused time is enabled before spawning the server or calling
wait_for_http(), keeping the rest of the flow unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d506d5d3-9e69-4658-8a97-f390fa373f20

📥 Commits

Reviewing files that changed from the base of the PR and between 3ce0331 and 41e2c75.

📒 Files selected for processing (5)

• rs/moq-relay/src/auth.rs
• rs/moq-relay/src/connection.rs
• rs/moq-relay/src/web.rs
• rs/moq-relay/src/websocket.rs
• rs/moq-relay/tests/smoke.rs