feat(quest): token auth on the Quest shim over a shared auth core (#158 G)

[thesprockee]

Refs #158 (package G: token auth on the Quest shim). Tip caba8cb955ef66478fb658e99fdc22e918603d3f.

What it is

• src/core/: platform-neutral token model, refresh handling, device-code loop, injected HTTP/clock/log. The Windows token_auth module, RefreshAuthToken and auth_token.h call them.
• src/quest/auth/: Android adapters and Session. Not linked into the sentinel yet; nothing hands the token to the login path (ADR 0003 gate).
  • HTTP: libcurl (>= 7.87, checked at configure; resolved 8.18.0) over OpenSSL. Trust anchors come from the Android CA directories, each certificate parsed and re-encoded, passed as CAINFO_BLOB (CAPATH cannot find Android's old-hash names). Fails closed. https only, no redirects, no proxy env, capped response, interruptible (progress callback + CURLOPT_QUICK_EXIT).
  • Credentials: /data/user/<uid/100000>/<package>/files (package from /proc/self/cmdline); exclusive 0600 temp + fsync + rename + dir fsync; O_NOFOLLOW read. Only the login link is on /sdcard.
  • Public calls of QuestTokenAuth are noexcept; the worker thread is named nevr-auth.
• Merges origin/claude-quest-hooks (d96bb82), conflict only in the ADR.

Failure policy (what the code does, and the tests pin)

Situation	Behaviour
No cache, expired refresh token, or the server refuses the token (400/401/403 whose JSON message is exactly one of the refresh RPC's own errors)	device-code login (Refreshing -> AwaitingUser)
Transient: no connection, 5xx, 408, 429, unreadable body (cached refresh or device-code request)	retried after 5/15/45/135/300 s; cache kept; player not prompted
Any other 4xx: bare 401/403 (nakama's wrong-http_key answer), 400 missing payload, 404	one attempt, no backoff; cache kept; player not prompted; Error logged with status (not body); Failed until the next recovery attempt
Failed and not final	one request every 5 min for the life of the process; one Warning per failure class
Final: device code expired/timed out, link undeliverable, poll refused with a 4xx	Failed, no recovery (the player was involved)
Poll transient while the player holds a link	waited out until the code's own 5-minute deadline
After login: refresh token expired or refused	Expired published, one log line, new device login

PC comparison: PC runs the device flow after one failed refresh and aborts a login on the first failed poll; Quest keeps the cache and does not prompt on transient or held failures.

Differences from the previous Windows behaviour

• RefreshAuthToken (also called from src/runtime/server/gameserver.cpp) catches every nlohmann::json::exception (was parse_error only); valid JSON of the wrong shape logs "valid JSON of an unexpected shape".
• The "token refresh rejected" line gains refresh_token_named=0|1; the device-flow log says open_result= (was shellexecute_result=) on every platform.
• kRefreshLeadSec = kFallbackAccessTokenLifetimeSec = 300; comments now state the equality; static_assert is <=.
• fix/202-token-refresh (4bdc761) is not in origin/main, not merged.

Gates on tip caba8cb955ef66478fb658e99fdc22e918603d3f (hash is line 1 of each log; /var/tmp/work-nevr-runtime/claude-main/tokenauth/)

flock <build.lock> systemd-run --user --scope -p MemoryMax=12G -- env CMAKE_BUILD_PARALLEL_LEVEL=6 NINJA_JOBS=6 just verify         verify4.log      rc=0  ("verify: OK (mingw-release)")
... just build-android                                                                                                             android4.log     rc=0
... just test-android   (Go ELF tests on the merged tip, incl. the sentinel export allowlist)                                      testandroid4.log rc=0  ("ok github.com/EchoTools/nevr-runtime/tests/quest")

Inside verify4.log: 57 tests, 0 failed checks (auth_core_test), 17 tests, 0 failed checks (tls_ca_test). Standalone host runs under the 4G cap before the gates: host7.log, tls7.log.

Mutation proof (host; each restored afterwards; logs mut3-*.run.log)

Mutant	Failing test
other 4xx treated as transient	session_a_missing_rpc_or_rejected_payload_holds_the_login_after_one_attempt_and_recovers
recovery loop removed	session_an_outage_longer_than_the_backoff_ends_failed_then_recovers_with_the_cached_login (aborts)
bare 401/403 at boot prompts	session_a_bare_403_at_boot_does_not_prompt_or_overwrite_the_cache
5xx while polling ends the login	session_an_outage_while_polling_is_waited_out_until_the_codes_own_deadline
Denied by substring over the body	refresh_denied_needs_the_body_to_name_the_refresh_token_a_bare_401_is_not_that (echoed body)
per-file size checked after reading	a_huge_file_is_rejected_from_its_size_without_being_read
first corrupt PEM block stops the loop	a_corrupt_pem_block_does_not_hide_the_blocks_around_it
blocking open	entries_that_are_not_regular_files_are_skipped_counted_and_never_block (30 s harness timeout)
Token() not noexcept	static_assert in the_calls_a_hook_will_make_into_questtokenauth_cannot_throw (build fails)
Earlier rounds' mutants (CAPATH, progress callback, Stop paths, link file, uid, retry bound, ...) are in the commit history of this PR; those logs are mut2-/mut3-R.

The sensor for linking token auth into the sentinel is only exercised on its not-linked path by just verify; a replay of its condition against scratch files (sensor-demo.sh) rejects "linked, flag missing" and "linked, allowlist test missing".

OpenSSL in the sentinel (ADR 0003)

Token auth is not linked into the sentinel. Linking it would bring OpenSSL/libcurl (about 35 MB unstripped vs 1.8 MB). The game's libraries export about 2411 OpenSSL/curl symbols (OpenSSL 3.0.0-dev, libcurl 7.68.0) and have the sentinel as DT_NEEDED, so the sentinel keeps --exclude-libs,ALL and TestExportAllowlist; just verify fails if the sentinel links nevr_quest_token_auth without them. The "keeps calls from binding to the game's copy" effect is an inference from a probe, not run on a device.

Not verified

• Anything on a headset: the CA directories, the libcurl/OpenSSL stack on Quest, that the process name equals the package name, write access to /data/user/<n>/<package>/files, Quest multi-user, Bionic behaviour. auth_core_test is compiled for arm64, not run there.
• TLS handling is tested against host libcurl 8.22.0 / OpenSSL 3.6.4, not the NDK build.
• A std::thread constructor failure in Start() (caught; not testable here).
• How the player sees the login link (device_login.txt is a placeholder) and the hook that hands the token to the login path.
• ./launch-client.sh was not run.

Process note: in this round a mutation script restored a file with git checkout and discarded two uncommitted source files; I re-applied them and committed before mutating again. The pushed history is unaffected.

Update: delta review and the login file (tip 58a1acd8c31ee4048d1ed4ed1df7c71650c1abea)

Host tests only on this tip (auth_core_test 69 tests, tls_ca_test 20 tests, 0 failed checks, under a 4G cap; the Android sources also pass clang++ --target=aarch64-linux-android26 -fsyntax-only -Werror). just verify / just build-android / just test-android were last run on caba8cb, not on this tip.

• Login file /sdcard/Android/data/com.readyatdawn.r15/files/device_login.txt, four lines: URL: <verification page>, Code: <code>, one instruction line that also carries the direct link with the code filled in, Expires: <UTC ISO time> (unix <seconds>). Written atomically for every new code (a stale file is replaced and is also cleared when the worker starts), removed when the login ends. One Info line says it was written and where (no code). If the directory is not writable: an Error, then an Info line with the direct link; the login continues.
• A 200 device-code response without a usable code is transient (retry on the backoff, then recovery), not final.
• A corrupt or unterminated PEM block no longer hides the good certificate after it.
• A 200 poll body that cannot be read (captive portal) is waited out until the code deadline; the server's own {"error":..} is still final. The shared parser, and so the Windows module, is unchanged.
• QuestTokenAuth::Create is a noexcept factory returning nullptr with a logged reason; the worker's failure report, ~Session and a failing join() are guarded.
• SystemClock waits on a CLOCK_MONOTONIC pthread condition variable; SteadyNow reads CLOCK_BOOTTIME so a headset sleep ends the old device-code poll instead of polling a dead code.
• Held 4xx refreshes in the background follow the 5-minute recovery cadence with one Warning per class; the OpenSSL-in-sentinel guard is now a CMake link-graph tool plus a build.ninja link-line test (TestSentinelLinkLineGuard).
• Correction: a held 4xx logs the HTTP status on the core's "token refresh rejected" Warning line; the Error line that follows carries only the outcome name.

🤖 Generated with Claude Code

[thesprockee]

Landed via #326.