Module admission 

Admitting a subscription session, whatever carries it (docs/design/subscriptions-websocket.md §6.3): the first frame must be Init, its headers stand in for the handshake’s when present, and a refusal’s close code follows the error’s status.

Structs

Handshake

What the handshake (WebTransport CONNECT, WebSocket upgrade) carried that authentication needs later.

Functions

authenticate_session

Runs the app’s AuthProvider over the handshake request. Init headers, when present, stand in for the handshake’s: that is how a browser, which cannot set headers on new WebTransport(url) or new WebSocket(url), presents credentials. A native client sends them on the handshake and an empty Init.

init_headers

The first frame must be Init: its headers, else None.

refusal_close_code

The close code a refusal ends the session with, from the error’s HTTP status: 401 → 4401 and 403 → 4403, as on REST; a malformed Init → 4400; and a provider that could not decide (5xx: a key server down) → 4500, which is not a verdict on the credentials — a client must retry later rather than sign the user out.