[kixelated]

Finishes quest/m2/auth-listen-public.md (deleted here).

Summary

moq auth serve accepts a non-loopback --listen address whenever --listen-secret is set and refuses it otherwise. --listen-public and its listen_public config key are gone. #8756 had already merged, so the mesh guard no longer needed the flag. The docs in doc/bin/relay/auth.md and the error message match.

Impact

Public API: removes moq auth serve --listen-public and the listen_public config key. A config that still sets the key is refused as an unknown field. Wire: none.

Migration: delete --listen-public and listen_public. A non-loopback --listen now needs only --listen-secret FILE.

Decisions

• The migration note is only in this Impact section: just check (the migrate check) rejects a branch that edits MIGRATE.md, so the release cut writes it. This differs from the quest's Plan, which asked for a MIGRATE.md note.
• The error for a non-loopback address without a secret now names --listen-secret and why it is needed. The old "--listen-public needs --listen-secret" error is gone.
• Marked breaking (!) because release ships the flag.

Validation

• quest gate cargo test -p moq-cli auth passes, with the listener test rewritten for the new rule.
• Built binary: moq auth serve --listen 0.0.0.0:0 is refused naming --listen-secret. --listen-public is an unexpected argument. --listen 0.0.0.0:0 --listen-secret FILE starts listening.
• just check passes on the committed head.

Follow-ups

None.

Models

Size: XS
Implementer: Claude, claude-sonnet-5-5, unknown effort (arm A)

Review

Rewritten by quest review after each round.

• Head: 53b87e1

• Base: origin/main at ca88fc1

• Risk: medium, the base has no RISK.md to name what is always high or customer-facing, so every change is medium

• Classified: medium by default

• Reviewer: Codex, gpt-6.1-sol, medium effort

• Session: 01a1df9d-ca1e-75d0-8492-b9e454757c33, round 1

• Score: 9/10, Source review found no actionable defects and confirmed secret enforcement remains intact before binding non-loopback listeners; builds and tests were not run as instructed.

• Rounds: 1; first round 0; findings 0: fixed 0, refuted 0, open 0

• Findings: none

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 27 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9015bdc2-18bc-4eb0-8b24-d68eba32a093

Commits

Reviewing files that changed from the base of the PR and between 505a86f and 53b87e1.

Files selected for processing: 3

• doc/bin/relay/auth.md
• quest/m2/auth-listen-public.md
• rs/moq-cli/src/auth.rs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[pullfrog]

✅ No new issues found.

Reviewed changes

Reviewed the removal of --listen-public from moq auth serve. The secret alone now decides whether a non-loopback listener is allowed.

• Listener guard: Serve::listener refuses a non-loopback TCP address only when --listen-secret is unset. The unix-socket rule that refuses a secret is unchanged.
• Flag and config removal: listen_public is gone from Serve, ServeSettings, and restart_only. deny_unknown_fields on Serve rejects old configs that still set the key, which matches the PR's Impact note. No listen[-_]public references remain in the repo.
• Docs and tests: doc/bin/relay/auth.md and the listener and config-file tests now follow the new rule. The completed quest file is deleted.

  ^{｜ View workflow run ｜ Using claude-opus-5-5 ｜ 𝕏}