Skip to content

pubsub: test side agents, document server token auth, drop deprecated leftovers - #722

Merged
sacOO7 merged 4 commits into
integration/v2from
v2/review-followups-agents-auth-cleanup
Oct 28, 2026
Merged

sacOO7 merged 4 commits into
integration/v2from
v2/review-followups-agents-auth-cleanup

Conversation

@sacOO7

@sacOO7 sacOO7 commented Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Follow-up to the review of #712. This PR resolves the open review points that don't depend on a pending decision:

# Change #712 / #718 thread
1 Drop the stale deprecation leftovers: the wrong Deprecated: marker on Message.ConnectionKey, and the dead TimeoutConnect option Deprecated API
2 Test the side agents on every entry point, plus WithAgents merging and the header format WithAgents, agent tests
3 Document token auth on server clients (error 40167) Token auth, UPDATING.md note
4 Stop claiming the two entry points differ only by import path #718 README comment

Base: integration/v2. 4 commits, 9 files. The only production-code change is deleting dead code; everything else is tests and docs. Each choice follows ably-java's integration/v2, cited below.

Changes

1. ably: drop the stale deprecation leftovers

What Why Evidence
Message.ConnectionKey: replace // Deprecated: … will be removed with the TM2h description Spec TM2h keeps the field; PublishWithConnectionKey depends on it ably-java keeps it undeprecated (Message.java:43-48, "Spec: TM2h")
Delete clientOptions.TimeoutConnect and timeoutConnect() Deprecated in favour of RealtimeRequestTimeout. No With… option sets the field and nothing calls the method, so it was never public API. ably-java never had an equivalent

There's no UPDATING.md entry, since nothing public was removed.

2. pubsub: test the side agents and WithAgents merging

Test File Asserts
TestNewRealtimeClient_DeclaresServerAgent server/pubsub/server_test.go The Ably-Agent header of the WebSocket handshake carries ably-pubsub-server
TestNewHTTPClient_UserCannotOverrideSideAgent server/pubsub/server_test.go A user WithAgents({"ably-pubsub-server": "9.9"}) still leaves the bare flag
TestNewClient_MergesUserAgents device/pubsub/device_test.go The header ends with ably-pubsub-device foo/1.2.3
TestWithAgents_FromNil, …_AccumulatesAcrossCalls, …_SameKeyOverrides, …_DoesNotAliasCallersMap internal/ably/options_test.go The merge semantics of WithAgents
TestAblyAgentIdentifier_SortedAndBareFlag internal/ably/options_test.go Products in alphabetical order; an empty version is a bare name

Also, a short comment on both agentName constants explaining that Ably recognises the client's side by the -server/-device ending, so the ending must be kept if the constant is renamed. The same point is made in ably-java's Side.java.

These mirror ably-java's PubSubServerTest/PubSubDeviceTest. The WithAgents unit tests are extra Go-side coverage.

3. docs: document token auth on server clients and the entry-point differences

Token auth (40167): server clients declare themselves as servers, and Ably rejects one that authenticates with a token lacking the signed x-ably-clientType=server claim, with error 40167 ("Client type declaration not signed by token", registered in ably/ably-common#355). Today only a JWT can carry that claim.

  • Changed: the server/pubsub package doc (previously "typically authenticate with an API key"), the server rows of the README and UPDATING.md tables, and a new "Server clients and token authentication" section in UPDATING.md.
  • Document only, with no warning or fail-fast, as ably-java does. It has no product-level handling of 40167. The SDK also can't see what an auth callback or auth URL returns, and a JWT with the claim is valid.

Entry-point differences: the README and UPDATING.md said only the import path differs. Now they say most call sites read the same, but the constructors differ (NewHTTPClient/NewRealtimeClient vs NewClient) and the device package has no HTTP-only API.

4. pubsub: reword the agentName and token-auth comments

Comments only, no code changes: the agentName, token-auth package doc and new test comments are reworded in plain language after review.

Validation

All run locally before pushing:

Check Result
go build ./...; go vet with default, unit and integration tags; gofmt -l ✅
go test -tags=unit ./... ✅ all packages
New tests ×20 with -race ✅ (the realtime test completes in about 0 s each; no hangs)
Mutation checks: each guarded behaviour broken on purpose, then restored:
• remove the sort → sorted/merge tests fail
• WithAgents assigns without merging → WithAgents and merge tests fail
• rename agentName → all 4 server agent tests fail
✅ every new test fails when its behaviour breaks
Re-export completeness test ✅
No remaining TimeoutConnect references; ConnectionKey still used by PublishWithConnectionKey ✅
go generate ./... drift check, go build ./examples/... ✅
Sandbox integration (json): TestHTTP_RSC7_AblyAgent, TestRealtime_RSC7_AblyAgent, TestRSC7, TestHTTPChannel*, PublishWithConnectionKey ✅ all passed on the first run
40167 wording matches ably-common's registered entry; the constructor names quoted exist; tables keep one row each ✅
Each commit builds and passes the affected tests on its own ✅

Not in this PR

These are waiting on decisions in #712:

Also deferred: the errors generator, which can't parse the current errors.json format and would change user-visible error strings if fixed. That belongs in a separate PR.

Summary by CodeRabbit

  • Documentation
    • Clarified the different constructors available in the server and device packages, and noted that the device package does not provide HTTP-only APIs.
    • Explained that server clients can authenticate with an API key or a token carrying the signed server claim. Tokens without the required claim may be rejected with error 40167.
    • Added migration guidance on server and device client identification and how server identification affects monthly active user counting.

Message.ConnectionKey was marked deprecated, but spec TM2h keeps it: it
is what PublishWithConnectionKey sends when one client publishes on
behalf of another, and ably-java keeps the field undeprecated. Replace
the marker with the TM2h description.

clientOptions.TimeoutConnect and timeoutConnect() were deprecated in
favour of RealtimeRequestTimeout. No ClientOption sets the field and
nothing calls the method, so delete both.
The entry points' side agent was only tested on the HTTP client. Add
tests that the realtime client sends ably-pubsub-server in the Ably-Agent
header of its WebSocket handshake, that a user-supplied
ably-pubsub-server entry cannot replace the bare flag, and that a
device client merges user agents after its side flag.

WithAgents now merges instead of replacing, with no unit tests. Cover
a nil start, accumulation across calls, same-key overrides, and that
neither the options nor the caller's map aliases the other. Also pin
the header format: products in alphabetical order, and an empty
version rendered as a bare name.

Note on both agentName constants that the -server and -device suffixes
decide how Ably classifies a client, as ably-java's Side.java does.
…rences

Clients from server/pubsub declare themselves as servers, and Ably
rejects such a client with error 40167 when it authenticates with a
token that lacks the signed x-ably-clientType=server claim (today only
a JWT can carry it). The package doc said server clients "typically"
use an API key. Say what is required instead, in the package doc, the
README and UPDATING.md table rows, and a new UPDATING.md section.

The README and UPDATING.md also said only the import path differs
between the two entry points. The constructors differ and the device
package has no HTTP-only API, so say that most call sites read the
same instead.
@coderabbitai

coderabbitai Bot commented Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 47 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: e1e3b572-dfcb-4fbd-8579-475392077c38
📥 Commits

Reviewing files that changed from the base of the PR and between 371ff42 and e8785b7.

📒 Files selected for processing: 4
  • device/pubsub/device.go
  • internal/ably/options_test.go
  • server/pubsub/server.go
  • server/pubsub/server_test.go

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 20274f2e-d663-400b-8c68-7d432c29b2fa
📥 Commits

Reviewing files that changed from the base of the PR and between b47a147 and 371ff42.

📒 Files selected for processing: 9
  • README.md
  • UPDATING.md
  • device/pubsub/device.go
  • device/pubsub/device_test.go
  • internal/ably/options.go
  • internal/ably/options_test.go
  • internal/ably/proto_message.go
  • server/pubsub/server.go
  • server/pubsub/server_test.go
💤 Files with no reviewable changes: 1
  • internal/ably/options.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The changes clarify server and device package constructors, server token authentication requirements, and the client-side identifiers in agent headers. Tests cover agent identifier formatting and HTTP and realtime headers. The deprecated connection timeout option is removed, and the ConnectionKey documentation is updated.

Changes

Client identity and API guidance

Layer / File(s) Summary
Authentication and client identity guidance
README.md, UPDATING.md, server/pubsub/server.go, device/pubsub/device.go
Documentation describes server token authentication with the signed server claim, the server and device constructors, and the classification suffixes.
Agent identifier and header validation
internal/ably/options_test.go, device/pubsub/device_test.go, server/pubsub/server_test.go
Tests cover WithAgents map behavior and AgentIdentifier formatting. Device and server client tests check the resulting Ably-Agent values.
Option and message documentation cleanup
internal/ably/options.go, internal/ably/proto_message.go
The deprecated TimeoutConnect field and timeoutConnect() helper are removed. The ConnectionKey documentation now describes its use for publishing on behalf of another client.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: ttypic

Merge Risk: ⚪ Minimal · up to 371ff

No merge-blocking issue is identified; the change is ready for normal merge checks.

Pre-merge checks: Passed 4 · Failed 1

Failed Failed checks: 1 warning

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 6 files. (2 skipped: 2… Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed Passed checks: 4 passed
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title accurately summarizes the main changes: adding side-agent tests, documenting server token authentication, and removing deprecated leftovers. It is concise and specific.
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 6 files. (2 skipped: 2 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

✨ Finishing Touches: 💡 1
📝 Generate docstrings: 💡
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks the agent string,
Then tests the headers as they spring.
The server claim is noted clear,
The device suffix stays in gear.
Old timeout notes hop out of sight,
And ConnectionKey is set right.

Comment @coderabbitai help to get the list of available commands.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

The comments on agentName and the token-auth package doc used jargon
that made them hard to follow. Say plainly what the agent name does,
why its "-server" or "-device" ending must be kept, and what token
authentication needs. Shorten the new test comments the same way.
Comments only; no code changes.

@ttypic ttypic left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sacOO7
sacOO7 merged commit a129bc0 into integration/v2 Oct 28, 2026
8 checks passed
@sacOO7
sacOO7 deleted the v2/review-followups-agents-auth-cleanup branch October 28, 2026 08:42

This branch was successfully deployed

1 active deployment
staging/pull/722/godoc — e8785b74 Deployed Oct 23, 2026 by github-actions[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants