Run AuthReauthTest on the server UTS leg via a claim-bearing JWT

The UTS spec authenticates this test with a JWT; the Java port had
substituted a native TokenRequest for convenience. Restoring the JWT
(AblyJwt: HS256 via JDK crypto, no external library) lets the test carry
the signed x-ably-clientType=server claim on the server leg — the only
server-side declaration realtime accepts on token auth — so it now runs
on every leg instead of being skipped. Verified against sandbox: the
claim-bearing JWT connects and re-authenticates where the bare agent
flag was rejected with 40167.

assumeSideSupportsTokenAuth stays for the native-token tests
(TokenRequestTest): the native token format cannot carry the claim yet.

Also drops DR/ticket numbers from code comments in this PR's files;
the behavior is described in place instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: umair-ably

uts/src/test/kotlin/io/ably/lib/uts/infra/integration/AblyJwt.kt

@@ -0,0 +1,48 @@
+package io.ably.lib.uts.infra.integration
+
+import java.util.Base64
+import javax.crypto.Mac
+import javax.crypto.spec.SecretKeySpec
+
+/**
+ * Minimal HS256 Ably JWT signer, built on JDK crypto only (no external JWT library).
+ *
+ * Exists for tests that need token claims the native Ably token format cannot carry —
+ * notably `x-ably-clientType=server`: on token auth the realtime service accepts a
+ * server-side declaration only from that signed claim (a `-server` agent entry alone is
+ * rejected with error 40167), and the native token format cannot carry the claim yet. So a
+ * JWT is the one way a token-authenticated client can declare the server side, and JWT-based
+ * tests can run on the server UTS leg while native-token tests remain skipped (see
+ * assumeSideSupportsTokenAuth).
+ */
+object AblyJwt {
+    /**
+     * Signs a JWT with the given Ably API key (`keyName:keySecret`), valid for [ttlSeconds],
+     * with wildcard capability, and the optional Ably claims.
+     */
+    fun sign(
+        keyStr: String,
+        clientId: String? = null,
+        clientType: String? = null,
+        ttlSeconds: Long = 3600,
+    ): String {
+        val keyName = keyStr.substringBefore(':')
+        val keySecret = keyStr.substringAfter(':')
+        val now = System.currentTimeMillis() / 1000
+        val header = """{"typ":"JWT","alg":"HS256","kid":"$keyName"}"""
+        val claims = buildString {
+            append("""{"iat":$now,"exp":${now + ttlSeconds},"x-ably-capability":"{\"*\":[\"*\"]}"""")
+            if (clientId != null) append(""","x-ably-clientId":"$clientId"""")
+            if (clientType != null) append(""","x-ably-clientType":"$clientType"""")
+            append("}")
+        }
+        val enc = Base64.getUrlEncoder().withoutPadding()
+        val signingInput = enc.encodeToString(header.toByteArray(Charsets.UTF_8)) + "." +
+            enc.encodeToString(claims.toByteArray(Charsets.UTF_8))
+        val mac = Mac.getInstance("HmacSHA256").apply {
+            init(SecretKeySpec(keySecret.toByteArray(Charsets.UTF_8), "HmacSHA256"))
+        }
+        val signature = enc.encodeToString(mac.doFinal(signingInput.toByteArray(Charsets.UTF_8)))
+        return "$signingInput.$signature"
+    }
+}

uts/src/test/kotlin/io/ably/lib/uts/infra/unit/ClientFactories.kt

@@ -38,21 +38,21 @@ class ClientOptionsBuilder : DebugOptions("appId.keyId:keySecret") {
 val utsSide: String = System.getProperty("uts.side").let { if (it.isNullOrEmpty()) "core" else it }
 
 /**
- * Call at the top of any test whose client authenticates with a token.
+ * Call at the top of any test whose client authenticates with a native Ably token.
  *
  * Realtime rejects a token-authenticated connection that declares the server side through the
  * agent entry alone: error 40167, "a connection or request may only declare itself as a server
- * via a signed x-ably-clientType token claim". The signed-claim mechanism is PDR-091's deferred
- * decision D2 and nothing in the test infrastructure can mint such a claim yet, so until D2
- * lands, token-auth conformance runs on the core leg only and is skipped (not failed) on the
- * server leg. Key-auth tests are unaffected — on API-key auth the agent entry is the accepted
- * declaration.
+ * via a signed x-ably-clientType token claim". The native Ably token format cannot carry that
+ * claim yet, so until the platform supports it, native-token conformance runs on the core leg
+ * only and is skipped (not failed) on the server leg. Key-auth tests are unaffected — on
+ * API-key auth the agent entry is the accepted declaration — and JWT-based tests can carry the
+ * claim already (see AblyJwt), so they run on every leg instead of calling this.
  */
 fun assumeSideSupportsTokenAuth() = org.junit.jupiter.api.Assumptions.assumeTrue(
     utsSide == "core",
-    "token-auth conformance is skipped on the '$utsSide' leg: realtime requires a signed " +
+    "native-token conformance is skipped on the '$utsSide' leg: realtime requires a signed " +
         "x-ably-clientType token claim (40167) to declare the server side on token auth, " +
-        "which the test infrastructure cannot mint until PDR-091 D2 lands",
+        "and the native token format cannot carry that claim yet",
 )
 
 fun TestRealtimeClient(block: ClientOptionsBuilder.() -> Unit): AblyRealtime {

uts/src/test/kotlin/io/ably/lib/uts/integration/proxy/realtime/AuthReauthTest.kt

@@ -1,16 +1,16 @@
 package io.ably.lib.uts.integration.proxy.realtime
 
 import io.ably.lib.realtime.ConnectionState
-import io.ably.lib.rest.AblyRest
 import io.ably.lib.rest.Auth
 import io.ably.lib.uts.infra.awaitState
+import io.ably.lib.uts.infra.integration.AblyJwt
 import io.ably.lib.uts.infra.integration.SandboxApp
 import io.ably.lib.uts.infra.integration.proxy.ProxyManager
 import io.ably.lib.uts.infra.integration.proxy.ProxySession
 import io.ably.lib.uts.infra.integration.proxy.connectThroughProxy
 import io.ably.lib.uts.infra.pollUntil
-import io.ably.lib.uts.infra.unit.assumeSideSupportsTokenAuth
 import io.ably.lib.uts.infra.unit.TestRealtimeClient
+import io.ably.lib.uts.infra.unit.utsSide
 import kotlinx.coroutines.runBlocking
 import kotlinx.coroutines.test.runTest
 import org.junit.jupiter.api.AfterAll
@@ -56,19 +56,23 @@ class AuthReauthTest {
      */
     @Test
     fun `RTN22, RTC8a - server-initiated re-authentication`() = runTest {
-        assumeSideSupportsTokenAuth()
         // No proxy rules: the AUTH injection is triggered imperatively after the SDK connects.
         val session = ProxySession.create(rules = emptyList())
 
         // Re-authentication is observed via an authCallback. The spec generates a JWT from the
-        // sandbox key parts; the idiomatic ably-java equivalent is a locally-signed TokenRequest
-        // produced from the same key — no external JWT library required. The realtime client then
-        // exchanges it for a token (through the proxy), satisfying RTC8a.
-        val tokenSigner = AblyRest(app.defaultKey)
+        // sandbox key parts, and so does this test (AblyJwt: HS256 via JDK crypto, no external
+        // library). A JWT rather than a native TokenRequest is load-bearing on the server UTS
+        // leg: a token-authenticated client may declare the server side only via the signed
+        // x-ably-clientType claim, which the native token format cannot carry yet — so the JWT
+        // carries the claim on the server leg, and this test runs on every leg.
         val authCallbackCount = AtomicInteger(0)
         val authCallback = Auth.TokenCallback { params ->
             authCallbackCount.incrementAndGet()
-            tokenSigner.auth.createTokenRequest(params, null)
+            AblyJwt.sign(
+                app.defaultKey,
+                clientId = params.clientId,
+                clientType = if (utsSide == "server") "server" else null,
+            )
         }
 
         // Keep the JSON protocol (ClientOptionsBuilder default): the proxy injects/inspects frames
@@ -130,13 +134,12 @@ class AuthReauthTest {
                 "Expected at least one client-to-server AUTH frame carrying auth details",
             )
         } finally {
-            // Nest teardown so session/tokenSigner are always cleaned up even if close-wait times out.
+            // Nest teardown so the session is always cleaned up even if close-wait times out.
             try {
                 client.close()
                 awaitState(client, ConnectionState.closed, 10.seconds)
             } finally {
                 session.close()
-                runCatching { tokenSigner.close() }
             }
         }
     }

uts/src/test/kotlin/io/ably/lib/uts/unit/SideModesTest.kt

@@ -11,8 +11,9 @@ package io.ably.lib.uts.unit
  * quietly constructs plain core clients, turning the server CI leg into a duplicate of the
  * core leg.
  *
- * The side entry is a versionless flag — a bare token, per ably/ably-common#361 — so the
- * assertions also fail if a `/version` form regresses. Mirrors ably-js's side_modes.test.ts.
+ * The side entry is registered in the ably-common agents registry as a versionless flag — a
+ * bare token — so the assertions also fail if a `/version` form regresses. Mirrors ably-js's
+ * side_modes.test.ts.
  */
 
 import io.ably.lib.rest.AblyBase