@milaboratories/pl-client 3.17.0 → 3.17.2

package/dist/test/test_config.cjs

@@ -13,12 +13,16 @@ let node_path = require("node:path");
 node_path = require_runtime.__toESM(node_path, 1);
 //#region src/test/test_config.ts
 var test_config_exports = /* @__PURE__ */ require_runtime.__exportAll({
-	TEST_REQUEST_TIMEOUT: () => 500,
+	TEST_REQUEST_TIMEOUT: () => TEST_REQUEST_TIMEOUT,
+	getTestAdminClient: () => getTestAdminClient,
+	getTestAdminClientConf: () => getTestAdminClientConf,
+	getTestAdminLLClient: () => getTestAdminLLClient,
 	getTestClient: () => getTestClient,
 	getTestClientConf: () => getTestClientConf,
 	getTestConfig: () => getTestConfig,
 	getTestLLClient: () => getTestLLClient,
 	plAddressToTestConfig: () => plAddressToTestConfig,
+	withAdminTempRoot: () => withAdminTempRoot,
 	withTempRoot: () => withTempRoot
 });
 const CONFIG_FILE = "test_config.json";
@@ -34,13 +38,34 @@ function getTestConfig() {
 	if (process.env.PL_TEST_USER !== void 0) conf.test_user = process.env.PL_TEST_USER;
 	if (process.env.PL_TEST_PASSWORD !== void 0) conf.test_password = process.env.PL_TEST_PASSWORD;
 	if (process.env.PL_TEST_PROXY !== void 0) conf.test_proxy = process.env.PL_TEST_PROXY;
+	if (process.env.PL_TEST_ADMIN_USER !== void 0) conf.test_admin_user = process.env.PL_TEST_ADMIN_USER;
+	if (process.env.PL_TEST_ADMIN_PASSWORD !== void 0) conf.test_admin_password = process.env.PL_TEST_ADMIN_PASSWORD;
 	if (conf.address === void 0) throw new Error(`can't resolve platform address (checked ${CONFIG_FILE} file and PL_ADDRESS environment var)`);
 	return conf;
 }
-/** Returns PlClientConfig with reduced timeout for tests */
+/**
+* Default request timeout for tests (ms).
+*
+* Kept short so a hung call fails the test instead of the suite's own budget. A deploy the
+* tests reach over cluster DNS needs more than that on first contact, where the deadline
+* covers name resolution too:
+*
+*   RpcError: Deadline exceeded after 0.500s,waiting for name resolution
+*
+* That call builds the shared client, so the whole file dies with it and retries only
+* repeat the error against an undefined client. PL_TEST_REQUEST_TIMEOUT raises the budget
+* where resolution is slow, and every other environment keeps the short one.
+*/
+const TEST_REQUEST_TIMEOUT = Number(process.env.PL_TEST_REQUEST_TIMEOUT ?? 500);
+/** True when the address carries an explicit `request-timeout` query parameter. */
+function addressStatesRequestTimeout(address) {
+	if (address.indexOf("://") === -1) return false;
+	return new URL(address).searchParams.has("request-timeout");
+}
+/** Returns PlClientConfig with reduced timeout for tests, unless the address sets its own */
 function plAddressToTestConfig(address) {
 	const plConf = require_config.plAddressToConfig(address);
-	plConf.defaultRequestTimeout = 500;
+	if (!addressStatesRequestTimeout(address)) plConf.defaultRequestTimeout = TEST_REQUEST_TIMEOUT;
 	return plConf;
 }
 function saveAuthInfoCallback(tConf, instanceId) {
@@ -100,6 +125,65 @@ async function getTestLLClient(confOverrides = {}) {
 		...confOverrides
 	}, { auth });
 }
+/** Returns a config logged in as the admin test user, or the ordinary test config where no
+* admin credentials are set. A backend that needs no auth, and one whose single test user
+* already holds the admin role, both leave PL_TEST_ADMIN_USER and PL_TEST_ADMIN_PASSWORD
+* unset, and a test that asks for admin must still run there. */
+async function getTestAdminClientConf() {
+	const tConf = getTestConfig();
+	if (tConf.test_admin_user === void 0 || tConf.test_admin_password === void 0) return await getTestClientConf();
+	const plConf = plAddressToTestConfig(tConf.address);
+	return {
+		conf: plConf,
+		auth: {
+			authInformation: await (await require_unauth_client.UnauthenticatedPlClient.build(plConf)).login(tConf.test_admin_user, tConf.test_admin_password),
+			onUpdate: () => {},
+			onAuthError: () => {},
+			onUpdateError: () => {}
+		}
+	};
+}
+async function getTestAdminLLClient(confOverrides = {}) {
+	const { conf, auth } = await getTestAdminClientConf();
+	return await require_ll_client.LLPlClient.build({
+		...conf,
+		...confOverrides
+	}, { auth });
+}
+async function getTestAdminClient(alternativeRoot, confOverrides = {}) {
+	const { conf, auth } = await getTestAdminClientConf();
+	if (alternativeRoot !== void 0 && conf.alternativeRoot !== void 0) throw new Error("test pl address configured with alternative root");
+	return await require_client.PlClient.init({
+		...conf,
+		...confOverrides,
+		alternativeRoot
+	}, auth);
+}
+async function withAdminTempRoot(body) {
+	const alternativeRoot = `test_${Date.now()}_${(0, node_crypto.randomUUID)()}`;
+	let altRootId = "";
+	try {
+		const client = await getTestAdminClient(alternativeRoot);
+		altRootId = client.clientRoot;
+		try {
+			const value = await body(client);
+			const rawClient = await getTestAdminClient();
+			try {
+				await rawClient.deleteAlternativeRoot(alternativeRoot);
+			} catch (cleanupErr) {
+				console.warn(`Failed to clean up alternative root ${alternativeRoot}:`, cleanupErr.message);
+			} finally {
+				await rawClient.close();
+			}
+			return value;
+		} finally {
+			await client.close();
+		}
+	} catch (err) {
+		console.log(`ALTERNATIVE ROOT: ${alternativeRoot} (${require_types.resourceIdToString(altRootId)})`);
+		throw err;
+	}
+}
 async function getTestClient(alternativeRoot, confOverrides = {}) {
 	const { conf, auth } = await getTestClientConf();
 	if (alternativeRoot !== void 0 && conf.alternativeRoot !== void 0) throw new Error("test pl address configured with alternative root");
@@ -162,6 +246,10 @@ async function withTempRoot(body, options = {}) {
 	}
 }
 //#endregion
+exports.TEST_REQUEST_TIMEOUT = TEST_REQUEST_TIMEOUT;
+exports.getTestAdminClient = getTestAdminClient;
+exports.getTestAdminClientConf = getTestAdminClientConf;
+exports.getTestAdminLLClient = getTestAdminLLClient;
 exports.getTestClient = getTestClient;
 exports.getTestClientConf = getTestClientConf;
 exports.getTestConfig = getTestConfig;
@@ -173,6 +261,7 @@ Object.defineProperty(exports, "test_config_exports", {
 		return test_config_exports;
 	}
 });
+exports.withAdminTempRoot = withAdminTempRoot;
 exports.withTempRoot = withTempRoot;
 
 //# sourceMappingURL=test_config.cjs.map

package/dist/test/test_config.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"test_config.cjs","names":["path","fs","plAddressToConfig","inferAuthRefreshTime","UnauthenticatedPlClient","LLPlClient","PlClient","startTcpProxy","resourceIdToString"],"sources":["../../src/test/test_config.ts"],"sourcesContent":["import * as fs from \"node:fs\";\nimport { LLPlClient } from \"../core/ll_client\";\nimport type { AuthInformation, AuthOps, PlClientConfig } from \"../core/config\";\nimport { plAddressToConfig } from \"../core/config\";\nimport { UnauthenticatedPlClient } from \"../core/unauth_client\";\nimport { PlClient } from \"../core/client\";\nimport { randomUUID } from \"node:crypto\";\nimport type { OptionalSignedResourceId } from \"../core/types\";\nimport { NullSignedResourceId, resourceIdToString } from \"../core/types\";\nimport { inferAuthRefreshTime } from \"../core/auth\";\nimport * as path from \"node:path\";\nimport type { TestTcpProxy } from \"./tcp-proxy\";\nimport { startTcpProxy } from \"./tcp-proxy\";\n\nexport { TestTcpProxy };\n\nexport interface TestConfig {\n  address: string;\n  test_proxy?: string;\n  test_user?: string;\n  test_password?: string;\n}\n\nconst CONFIG_FILE = \"test_config.json\";\n// const AUTH_DATA_FILE = '.test_auth.json';\n\nlet authDataFilePath: string | undefined;\n\nfunction getFullAuthDataFilePath() {\n  if (authDataFilePath === undefined) authDataFilePath = path.resolve(\".test_auth.json\");\n  return authDataFilePath;\n}\n\nexport function getTestConfig(): TestConfig {\n  let conf: Partial<TestConfig> = {};\n  if (fs.existsSync(CONFIG_FILE))\n    conf = JSON.parse(fs.readFileSync(CONFIG_FILE, { encoding: \"utf-8\" })) as TestConfig;\n\n  if (process.env.PL_ADDRESS !== undefined) conf.address = process.env.PL_ADDRESS;\n\n  if (process.env.PL_TEST_USER !== undefined) conf.test_user = process.env.PL_TEST_USER;\n\n  if (process.env.PL_TEST_PASSWORD !== undefined) conf.test_password = process.env.PL_TEST_PASSWORD;\n\n  if (process.env.PL_TEST_PROXY !== undefined) conf.test_proxy = process.env.PL_TEST_PROXY;\n\n  if (conf.address === undefined)\n    throw new Error(\n      `can't resolve platform address (checked ${CONFIG_FILE} file and PL_ADDRESS environment var)`,\n    );\n\n  return conf as TestConfig;\n}\n\n/** Default request timeout for tests (ms) */\nexport const TEST_REQUEST_TIMEOUT = 500;\n\n/** Returns PlClientConfig with reduced timeout for tests */\nexport function plAddressToTestConfig(address: string): PlClientConfig {\n  const plConf = plAddressToConfig(address);\n  plConf.defaultRequestTimeout = TEST_REQUEST_TIMEOUT;\n  return plConf;\n}\n\ninterface AuthCache {\n  /** To check if config changed */\n  conf: TestConfig;\n  /** Backend's instance ID at the moment the JWT was issued. Restarts that\n   * reset state rotate this; the JWT's `iss` claim is bound to it and the\n   * backend rejects tokens minted by a different instance. Without this\n   * check, a cached JWT from a previous backend run would silently fail\n   * the first authenticated call after restart. */\n  instanceId: string;\n  expiration: number;\n  authInformation: AuthInformation;\n}\n\nfunction saveAuthInfoCallback(\n  tConf: TestConfig,\n  instanceId: string,\n): (authInformation: AuthInformation) => void {\n  return (authInformation) => {\n    const dst = getFullAuthDataFilePath();\n    const tmpDst = getFullAuthDataFilePath() + randomUUID();\n    fs.writeFileSync(\n      tmpDst,\n      Buffer.from(\n        JSON.stringify({\n          conf: tConf,\n          instanceId,\n          authInformation,\n          expiration: inferAuthRefreshTime(authInformation, 24 * 60 * 60),\n        } as AuthCache),\n      ),\n      \"utf8\",\n    );\n    fs.renameSync(tmpDst, dst);\n  };\n}\n\nconst cleanAuthInfoCallback = () => {\n  const p = getFullAuthDataFilePath();\n  if (fs.existsSync(p)) {\n    console.warn(`Removing: ${p}`);\n    fs.rmSync(p);\n  }\n};\n\nexport async function getTestClientConf(): Promise<{ conf: PlClientConfig; auth: AuthOps }> {\n  const tConf = getTestConfig();\n\n  const plConf = plAddressToTestConfig(tConf.address);\n  const uClient = await UnauthenticatedPlClient.build(plConf);\n  // ll.serverInfo is populated by build()'s ping; instanceId rotates on a\n  // backend restart that drops the persisted state.\n  const instanceId = uClient.ll.serverInfo.instanceId;\n\n  let authInformation: AuthInformation | undefined = undefined;\n\n  // Try recover from cache. The cache is keyed by config AND backend\n  // instanceId — a backend restart that rotates instanceId invalidates the\n  // cached JWT (the token's `iss` claim no longer matches the live\n  // instance), so we re-login instead of carrying the dead token through\n  // to the first authenticated call.\n  if (fs.existsSync(getFullAuthDataFilePath())) {\n    try {\n      const cache: AuthCache = JSON.parse(\n        fs.readFileSync(getFullAuthDataFilePath(), { encoding: \"utf-8\" }),\n      ) as AuthCache; // TODO runtime validation\n      if (\n        cache.conf.address === tConf.address &&\n        cache.conf.test_user === tConf.test_user &&\n        cache.conf.test_password === tConf.test_password &&\n        cache.expiration > Date.now() &&\n        cache.instanceId === instanceId\n      )\n        authInformation = cache.authInformation;\n    } catch {\n      // removing cache file on any error\n      fs.rmSync(getFullAuthDataFilePath());\n    }\n  }\n\n  const requireAuth = await uClient.requireAuth();\n\n  if (!requireAuth && (tConf.test_user !== undefined || tConf.test_password !== undefined))\n    throw new Error(\n      `Server require no auth, but test user name or test password are provided via (${CONFIG_FILE}) or env variables: PL_TEST_USER and PL_TEST_PASSWORD`,\n    );\n\n  if (requireAuth && (tConf.test_user === undefined || tConf.test_password === undefined))\n    throw new Error(\n      `No auth information found in config (${CONFIG_FILE}) or env variables: PL_TEST_USER and PL_TEST_PASSWORD`,\n    );\n\n  if (authInformation === undefined) {\n    if (requireAuth) authInformation = await uClient.login(tConf.test_user!, tConf.test_password!);\n    // No authorization is required\n    else authInformation = {};\n\n    // saving cache\n    saveAuthInfoCallback(tConf, instanceId)(authInformation);\n  }\n\n  return {\n    conf: plConf,\n    auth: {\n      authInformation,\n      onUpdate: saveAuthInfoCallback(tConf, instanceId),\n      onAuthError: cleanAuthInfoCallback,\n      onUpdateError: cleanAuthInfoCallback,\n    },\n  };\n}\n\nexport async function getTestLLClient(confOverrides: Partial<PlClientConfig> = {}) {\n  const { conf, auth } = await getTestClientConf();\n  return await LLPlClient.build({ ...conf, ...confOverrides }, { auth });\n}\n\nexport async function getTestClient(\n  alternativeRoot?: string,\n  confOverrides: Partial<PlClientConfig> = {},\n) {\n  const { conf, auth } = await getTestClientConf();\n  if (alternativeRoot !== undefined && conf.alternativeRoot !== undefined)\n    throw new Error(\"test pl address configured with alternative root\");\n  return await PlClient.init({ ...conf, ...confOverrides, alternativeRoot }, auth);\n}\n\nexport type WithTempRootOptions =\n  | {\n      /** If true and PL_ADDRESS is http://localhost or http://127.0.0.1:<port>,\n       * a TCP proxy will be started and PL client will connect through it. */\n      viaTcpProxy: true;\n      /** Artificial latency for proxy (ms). Default 0 */\n      proxyLatencyMs?: number;\n    }\n  | {\n      viaTcpProxy?: undefined;\n    };\n\nexport async function withTempRoot<T>(body: (pl: PlClient) => Promise<T>): Promise<T | void>;\n\nexport async function withTempRoot<T>(\n  body: (pl: PlClient, proxy: Awaited<ReturnType<typeof startTcpProxy>>) => Promise<T>,\n  options: {\n    viaTcpProxy: true;\n    proxyLatencyMs?: number;\n  },\n): Promise<T>;\n\nexport async function withTempRoot<T>(\n  body: (pl: PlClient, proxy: any) => Promise<T>,\n  options: WithTempRootOptions = {},\n): Promise<T | undefined> {\n  const alternativeRoot = `test_${Date.now()}_${randomUUID()}`;\n  let altRootId: OptionalSignedResourceId = NullSignedResourceId;\n  // Proxy management\n  let proxy: Awaited<ReturnType<typeof startTcpProxy>> | undefined;\n  let confOverrides: Partial<PlClientConfig> = {};\n  try {\n    // Optionally start TCP proxy and rewrite PL_ADDRESS to point to proxy\n    if (options.viaTcpProxy === true && process.env.PL_ADDRESS) {\n      try {\n        const url = new URL(process.env.PL_ADDRESS);\n        const isHttp = url.protocol === \"http:\";\n        const isLocal = url.hostname === \"127.0.0.1\" || url.hostname === \"localhost\";\n        const port = parseInt(url.port);\n        if (isHttp && isLocal && Number.isFinite(port)) {\n          proxy = await startTcpProxy({ targetPort: port, latency: options.proxyLatencyMs ?? 0 });\n          // Override client connection host:port to proxy\n          confOverrides = { hostAndPort: `127.0.0.1:${proxy.port}` } as Partial<PlClientConfig>;\n        } else {\n          console.warn(\n            \"*** skipping proxy-based test, PL_ADDRESS is not localhost\",\n            process.env.PL_ADDRESS,\n          );\n          return;\n        }\n      } catch {\n        // ignore proxy setup errors; tests will run against original address\n      }\n    }\n\n    const client = await getTestClient(alternativeRoot, confOverrides);\n    altRootId = client.clientRoot;\n    try {\n      const value = await body(client, proxy);\n      const rawClient = await getTestClient();\n      try {\n        await rawClient.deleteAlternativeRoot(alternativeRoot);\n      } catch (cleanupErr: any) {\n        // Cleanup may fail if test intentionally deleted resources\n        console.warn(`Failed to clean up alternative root ${alternativeRoot}:`, cleanupErr.message);\n      } finally {\n        // Close the cleanup client to avoid dangling gRPC channels that can cause\n        // segfaults during process exit\n        await rawClient.close();\n      }\n      return value;\n    } finally {\n      // Close the test client to avoid dangling gRPC channels\n      await client.close();\n    }\n  } catch (err: any) {\n    console.log(`ALTERNATIVE ROOT: ${alternativeRoot} (${resourceIdToString(altRootId)})`);\n    throw err;\n    // throw new Error('withTempRoot error: ' + err.message, { cause: err });\n  } finally {\n    // Stop proxy if started\n    if (proxy) {\n      try {\n        await proxy.disconnectAll();\n      } catch {\n        /* ignore */\n      }\n      try {\n        await new Promise<void>((resolve) => proxy!.server.close(() => resolve()));\n      } catch {\n        /* ignore */\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAM,cAAc;AAGpB,IAAI;AAEJ,SAAS,0BAA0B;CACjC,IAAI,qBAAqB,KAAA,GAAW,mBAAmBA,UAAK,QAAQ,iBAAiB;CACrF,OAAO;AACT;AAEA,SAAgB,gBAA4B;CAC1C,IAAI,OAA4B,CAAC;CACjC,IAAIC,QAAG,WAAW,WAAW,GAC3B,OAAO,KAAK,MAAMA,QAAG,aAAa,aAAa,EAAE,UAAU,QAAQ,CAAC,CAAC;CAEvE,IAAI,QAAQ,IAAI,eAAe,KAAA,GAAW,KAAK,UAAU,QAAQ,IAAI;CAErE,IAAI,QAAQ,IAAI,iBAAiB,KAAA,GAAW,KAAK,YAAY,QAAQ,IAAI;CAEzE,IAAI,QAAQ,IAAI,qBAAqB,KAAA,GAAW,KAAK,gBAAgB,QAAQ,IAAI;CAEjF,IAAI,QAAQ,IAAI,kBAAkB,KAAA,GAAW,KAAK,aAAa,QAAQ,IAAI;CAE3E,IAAI,KAAK,YAAY,KAAA,GACnB,MAAM,IAAI,MACR,2CAA2C,YAAY,sCACzD;CAEF,OAAO;AACT;;AAMA,SAAgB,sBAAsB,SAAiC;CACrE,MAAM,SAASC,eAAAA,kBAAkB,OAAO;CACxC,OAAO,wBAAA;CACP,OAAO;AACT;AAeA,SAAS,qBACP,OACA,YAC4C;CAC5C,QAAQ,oBAAoB;EAC1B,MAAM,MAAM,wBAAwB;EACpC,MAAM,SAAS,wBAAwB,KAAA,GAAA,YAAA,WAAA,CAAe;EACtD,QAAG,cACD,QACA,OAAO,KACL,KAAK,UAAU;GACb,MAAM;GACN;GACA;GACA,YAAYC,aAAAA,qBAAqB,iBAAiB,OAAU,EAAE;EAChE,CAAc,CAChB,GACA,MACF;EACA,QAAG,WAAW,QAAQ,GAAG;CAC3B;AACF;AAEA,MAAM,8BAA8B;CAClC,MAAM,IAAI,wBAAwB;CAClC,IAAIF,QAAG,WAAW,CAAC,GAAG;EACpB,QAAQ,KAAK,aAAa,GAAG;EAC7B,QAAG,OAAO,CAAC;CACb;AACF;AAEA,eAAsB,oBAAsE;CAC1F,MAAM,QAAQ,cAAc;CAE5B,MAAM,SAAS,sBAAsB,MAAM,OAAO;CAClD,MAAM,UAAU,MAAMG,sBAAAA,wBAAwB,MAAM,MAAM;CAG1D,MAAM,aAAa,QAAQ,GAAG,WAAW;CAEzC,IAAI,kBAA+C,KAAA;CAOnD,IAAIH,QAAG,WAAW,wBAAwB,CAAC,GACzC,IAAI;EACF,MAAM,QAAmB,KAAK,MAC5BA,QAAG,aAAa,wBAAwB,GAAG,EAAE,UAAU,QAAQ,CAAC,CAClE;EACA,IACE,MAAM,KAAK,YAAY,MAAM,WAC7B,MAAM,KAAK,cAAc,MAAM,aAC/B,MAAM,KAAK,kBAAkB,MAAM,iBACnC,MAAM,aAAa,KAAK,IAAI,KAC5B,MAAM,eAAe,YAErB,kBAAkB,MAAM;CAC5B,QAAQ;EAEN,QAAG,OAAO,wBAAwB,CAAC;CACrC;CAGF,MAAM,cAAc,MAAM,QAAQ,YAAY;CAE9C,IAAI,CAAC,gBAAgB,MAAM,cAAc,KAAA,KAAa,MAAM,kBAAkB,KAAA,IAC5E,MAAM,IAAI,MACR,iFAAiF,YAAY,sDAC/F;CAEF,IAAI,gBAAgB,MAAM,cAAc,KAAA,KAAa,MAAM,kBAAkB,KAAA,IAC3E,MAAM,IAAI,MACR,wCAAwC,YAAY,sDACtD;CAEF,IAAI,oBAAoB,KAAA,GAAW;EACjC,IAAI,aAAa,kBAAkB,MAAM,QAAQ,MAAM,MAAM,WAAY,MAAM,aAAc;OAExF,kBAAkB,CAAC;EAGxB,qBAAqB,OAAO,UAAU,CAAC,CAAC,eAAe;CACzD;CAEA,OAAO;EACL,MAAM;EACN,MAAM;GACJ;GACA,UAAU,qBAAqB,OAAO,UAAU;GAChD,aAAa;GACb,eAAe;EACjB;CACF;AACF;AAEA,eAAsB,gBAAgB,gBAAyC,CAAC,GAAG;CACjF,MAAM,EAAE,MAAM,SAAS,MAAM,kBAAkB;CAC/C,OAAO,MAAMI,kBAAAA,WAAW,MAAM;EAAE,GAAG;EAAM,GAAG;CAAc,GAAG,EAAE,KAAK,CAAC;AACvE;AAEA,eAAsB,cACpB,iBACA,gBAAyC,CAAC,GAC1C;CACA,MAAM,EAAE,MAAM,SAAS,MAAM,kBAAkB;CAC/C,IAAI,oBAAoB,KAAA,KAAa,KAAK,oBAAoB,KAAA,GAC5D,MAAM,IAAI,MAAM,kDAAkD;CACpE,OAAO,MAAMC,eAAAA,SAAS,KAAK;EAAE,GAAG;EAAM,GAAG;EAAe;CAAgB,GAAG,IAAI;AACjF;AAwBA,eAAsB,aACpB,MACA,UAA+B,CAAC,GACR;CACxB,MAAM,kBAAkB,QAAQ,KAAK,IAAI,EAAE,IAAA,GAAA,YAAA,WAAA,CAAc;CACzD,IAAI,YAAA;CAEJ,IAAI;CACJ,IAAI,gBAAyC,CAAC;CAC9C,IAAI;EAEF,IAAI,QAAQ,gBAAgB,QAAQ,QAAQ,IAAI,YAC9C,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI,UAAU;GAC1C,MAAM,SAAS,IAAI,aAAa;GAChC,MAAM,UAAU,IAAI,aAAa,eAAe,IAAI,aAAa;GACjE,MAAM,OAAO,SAAS,IAAI,IAAI;GAC9B,IAAI,UAAU,WAAW,OAAO,SAAS,IAAI,GAAG;IAC9C,QAAQ,MAAMC,kBAAAA,cAAc;KAAE,YAAY;KAAM,SAAS,QAAQ,kBAAkB;IAAE,CAAC;IAEtF,gBAAgB,EAAE,aAAa,aAAa,MAAM,OAAO;GAC3D,OAAO;IACL,QAAQ,KACN,8DACA,QAAQ,IAAI,UACd;IACA;GACF;EACF,QAAQ,CAER;EAGF,MAAM,SAAS,MAAM,cAAc,iBAAiB,aAAa;EACjE,YAAY,OAAO;EACnB,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK;GACtC,MAAM,YAAY,MAAM,cAAc;GACtC,IAAI;IACF,MAAM,UAAU,sBAAsB,eAAe;GACvD,SAAS,YAAiB;IAExB,QAAQ,KAAK,uCAAuC,gBAAgB,IAAI,WAAW,OAAO;GAC5F,UAAU;IAGR,MAAM,UAAU,MAAM;GACxB;GACA,OAAO;EACT,UAAU;GAER,MAAM,OAAO,MAAM;EACrB;CACF,SAAS,KAAU;EACjB,QAAQ,IAAI,qBAAqB,gBAAgB,IAAIC,cAAAA,mBAAmB,SAAS,EAAE,EAAE;EACrF,MAAM;CAER,UAAU;EAER,IAAI,OAAO;GACT,IAAI;IACF,MAAM,MAAM,cAAc;GAC5B,QAAQ,CAER;GACA,IAAI;IACF,MAAM,IAAI,SAAe,YAAY,MAAO,OAAO,YAAY,QAAQ,CAAC,CAAC;GAC3E,QAAQ,CAER;EACF;CACF;AACF"}
+{"version":3,"file":"test_config.cjs","names":["path","fs","plAddressToConfig","inferAuthRefreshTime","UnauthenticatedPlClient","LLPlClient","PlClient","resourceIdToString","startTcpProxy"],"sources":["../../src/test/test_config.ts"],"sourcesContent":["import * as fs from \"node:fs\";\nimport { LLPlClient } from \"../core/ll_client\";\nimport type { AuthInformation, AuthOps, PlClientConfig } from \"../core/config\";\nimport { plAddressToConfig } from \"../core/config\";\nimport { UnauthenticatedPlClient } from \"../core/unauth_client\";\nimport { PlClient } from \"../core/client\";\nimport { randomUUID } from \"node:crypto\";\nimport type { OptionalSignedResourceId } from \"../core/types\";\nimport { NullSignedResourceId, resourceIdToString } from \"../core/types\";\nimport { inferAuthRefreshTime } from \"../core/auth\";\nimport * as path from \"node:path\";\nimport type { TestTcpProxy } from \"./tcp-proxy\";\nimport { startTcpProxy } from \"./tcp-proxy\";\n\nexport { TestTcpProxy };\n\nexport interface TestConfig {\n  address: string;\n  test_proxy?: string;\n  test_user?: string;\n  test_password?: string;\n  test_admin_user?: string;\n  test_admin_password?: string;\n}\n\nconst CONFIG_FILE = \"test_config.json\";\n// const AUTH_DATA_FILE = '.test_auth.json';\n\nlet authDataFilePath: string | undefined;\n\nfunction getFullAuthDataFilePath() {\n  if (authDataFilePath === undefined) authDataFilePath = path.resolve(\".test_auth.json\");\n  return authDataFilePath;\n}\n\nexport function getTestConfig(): TestConfig {\n  let conf: Partial<TestConfig> = {};\n  if (fs.existsSync(CONFIG_FILE))\n    conf = JSON.parse(fs.readFileSync(CONFIG_FILE, { encoding: \"utf-8\" })) as TestConfig;\n\n  if (process.env.PL_ADDRESS !== undefined) conf.address = process.env.PL_ADDRESS;\n\n  if (process.env.PL_TEST_USER !== undefined) conf.test_user = process.env.PL_TEST_USER;\n\n  if (process.env.PL_TEST_PASSWORD !== undefined) conf.test_password = process.env.PL_TEST_PASSWORD;\n\n  if (process.env.PL_TEST_PROXY !== undefined) conf.test_proxy = process.env.PL_TEST_PROXY;\n\n  if (process.env.PL_TEST_ADMIN_USER !== undefined)\n    conf.test_admin_user = process.env.PL_TEST_ADMIN_USER;\n\n  if (process.env.PL_TEST_ADMIN_PASSWORD !== undefined)\n    conf.test_admin_password = process.env.PL_TEST_ADMIN_PASSWORD;\n\n  if (conf.address === undefined)\n    throw new Error(\n      `can't resolve platform address (checked ${CONFIG_FILE} file and PL_ADDRESS environment var)`,\n    );\n\n  return conf as TestConfig;\n}\n\n/**\n * Default request timeout for tests (ms).\n *\n * Kept short so a hung call fails the test instead of the suite's own budget. A deploy the\n * tests reach over cluster DNS needs more than that on first contact, where the deadline\n * covers name resolution too:\n *\n *   RpcError: Deadline exceeded after 0.500s,waiting for name resolution\n *\n * That call builds the shared client, so the whole file dies with it and retries only\n * repeat the error against an undefined client. PL_TEST_REQUEST_TIMEOUT raises the budget\n * where resolution is slow, and every other environment keeps the short one.\n */\nexport const TEST_REQUEST_TIMEOUT = Number(process.env.PL_TEST_REQUEST_TIMEOUT ?? 500);\n\n/** True when the address carries an explicit `request-timeout` query parameter. */\nfunction addressStatesRequestTimeout(address: string): boolean {\n  if (address.indexOf(\"://\") === -1) return false;\n  return new URL(address).searchParams.has(\"request-timeout\");\n}\n\n/** Returns PlClientConfig with reduced timeout for tests, unless the address sets its own */\nexport function plAddressToTestConfig(address: string): PlClientConfig {\n  const plConf = plAddressToConfig(address);\n  // An explicit request-timeout in the address wins over TEST_REQUEST_TIMEOUT. In the k8s e2e\n  // deploy the client dials a cluster service DNS name, and the first call on a cold channel must\n  // finish name resolution and get a load-balancer pick before it is even sent; 500ms does not\n  // cover that, so whichever test happened to open the cold channel died with DEADLINE_EXCEEDED\n  // (\"Waiting for LB pick\") against a healthy backend. Addresses that carry no request-timeout\n  // keep the short default, so local runs still fail fast.\n  if (!addressStatesRequestTimeout(address)) plConf.defaultRequestTimeout = TEST_REQUEST_TIMEOUT;\n  return plConf;\n}\n\ninterface AuthCache {\n  /** To check if config changed */\n  conf: TestConfig;\n  /** Backend's instance ID at the moment the JWT was issued. Restarts that\n   * reset state rotate this; the JWT's `iss` claim is bound to it and the\n   * backend rejects tokens minted by a different instance. Without this\n   * check, a cached JWT from a previous backend run would silently fail\n   * the first authenticated call after restart. */\n  instanceId: string;\n  expiration: number;\n  authInformation: AuthInformation;\n}\n\nfunction saveAuthInfoCallback(\n  tConf: TestConfig,\n  instanceId: string,\n): (authInformation: AuthInformation) => void {\n  return (authInformation) => {\n    const dst = getFullAuthDataFilePath();\n    const tmpDst = getFullAuthDataFilePath() + randomUUID();\n    fs.writeFileSync(\n      tmpDst,\n      Buffer.from(\n        JSON.stringify({\n          conf: tConf,\n          instanceId,\n          authInformation,\n          expiration: inferAuthRefreshTime(authInformation, 24 * 60 * 60),\n        } as AuthCache),\n      ),\n      \"utf8\",\n    );\n    fs.renameSync(tmpDst, dst);\n  };\n}\n\nconst cleanAuthInfoCallback = () => {\n  const p = getFullAuthDataFilePath();\n  if (fs.existsSync(p)) {\n    console.warn(`Removing: ${p}`);\n    fs.rmSync(p);\n  }\n};\n\nexport async function getTestClientConf(): Promise<{ conf: PlClientConfig; auth: AuthOps }> {\n  const tConf = getTestConfig();\n\n  const plConf = plAddressToTestConfig(tConf.address);\n  const uClient = await UnauthenticatedPlClient.build(plConf);\n  // ll.serverInfo is populated by build()'s ping; instanceId rotates on a\n  // backend restart that drops the persisted state.\n  const instanceId = uClient.ll.serverInfo.instanceId;\n\n  let authInformation: AuthInformation | undefined = undefined;\n\n  // Try recover from cache. The cache is keyed by config AND backend\n  // instanceId — a backend restart that rotates instanceId invalidates the\n  // cached JWT (the token's `iss` claim no longer matches the live\n  // instance), so we re-login instead of carrying the dead token through\n  // to the first authenticated call.\n  if (fs.existsSync(getFullAuthDataFilePath())) {\n    try {\n      const cache: AuthCache = JSON.parse(\n        fs.readFileSync(getFullAuthDataFilePath(), { encoding: \"utf-8\" }),\n      ) as AuthCache; // TODO runtime validation\n      if (\n        cache.conf.address === tConf.address &&\n        cache.conf.test_user === tConf.test_user &&\n        cache.conf.test_password === tConf.test_password &&\n        cache.expiration > Date.now() &&\n        cache.instanceId === instanceId\n      )\n        authInformation = cache.authInformation;\n    } catch {\n      // removing cache file on any error\n      fs.rmSync(getFullAuthDataFilePath());\n    }\n  }\n\n  const requireAuth = await uClient.requireAuth();\n\n  if (!requireAuth && (tConf.test_user !== undefined || tConf.test_password !== undefined))\n    throw new Error(\n      `Server require no auth, but test user name or test password are provided via (${CONFIG_FILE}) or env variables: PL_TEST_USER and PL_TEST_PASSWORD`,\n    );\n\n  if (requireAuth && (tConf.test_user === undefined || tConf.test_password === undefined))\n    throw new Error(\n      `No auth information found in config (${CONFIG_FILE}) or env variables: PL_TEST_USER and PL_TEST_PASSWORD`,\n    );\n\n  if (authInformation === undefined) {\n    if (requireAuth) authInformation = await uClient.login(tConf.test_user!, tConf.test_password!);\n    // No authorization is required\n    else authInformation = {};\n\n    // saving cache\n    saveAuthInfoCallback(tConf, instanceId)(authInformation);\n  }\n\n  return {\n    conf: plConf,\n    auth: {\n      authInformation,\n      onUpdate: saveAuthInfoCallback(tConf, instanceId),\n      onAuthError: cleanAuthInfoCallback,\n      onUpdateError: cleanAuthInfoCallback,\n    },\n  };\n}\n\nexport async function getTestLLClient(confOverrides: Partial<PlClientConfig> = {}) {\n  const { conf, auth } = await getTestClientConf();\n  return await LLPlClient.build({ ...conf, ...confOverrides }, { auth });\n}\n\n/** Returns a config logged in as the admin test user, or the ordinary test config where no\n * admin credentials are set. A backend that needs no auth, and one whose single test user\n * already holds the admin role, both leave PL_TEST_ADMIN_USER and PL_TEST_ADMIN_PASSWORD\n * unset, and a test that asks for admin must still run there. */\nexport async function getTestAdminClientConf(): Promise<{ conf: PlClientConfig; auth: AuthOps }> {\n  const tConf = getTestConfig();\n\n  if (tConf.test_admin_user === undefined || tConf.test_admin_password === undefined)\n    return await getTestClientConf();\n\n  const plConf = plAddressToTestConfig(tConf.address);\n  const uClient = await UnauthenticatedPlClient.build(plConf);\n  const authInformation = await uClient.login(tConf.test_admin_user, tConf.test_admin_password);\n\n  return {\n    conf: plConf,\n    auth: {\n      authInformation,\n      onUpdate: () => {},\n      onAuthError: () => {},\n      onUpdateError: () => {},\n    },\n  };\n}\n\nexport async function getTestAdminLLClient(confOverrides: Partial<PlClientConfig> = {}) {\n  const { conf, auth } = await getTestAdminClientConf();\n  return await LLPlClient.build({ ...conf, ...confOverrides }, { auth });\n}\n\nexport async function getTestAdminClient(\n  alternativeRoot?: string,\n  confOverrides: Partial<PlClientConfig> = {},\n) {\n  const { conf, auth } = await getTestAdminClientConf();\n  if (alternativeRoot !== undefined && conf.alternativeRoot !== undefined)\n    throw new Error(\"test pl address configured with alternative root\");\n  return await PlClient.init({ ...conf, ...confOverrides, alternativeRoot }, auth);\n}\n\nexport async function withAdminTempRoot<T>(body: (pl: PlClient) => Promise<T>): Promise<T | void> {\n  const alternativeRoot = `test_${Date.now()}_${randomUUID()}`;\n  let altRootId: OptionalSignedResourceId = NullSignedResourceId;\n  try {\n    const client = await getTestAdminClient(alternativeRoot);\n    altRootId = client.clientRoot;\n    try {\n      const value = await body(client);\n      const rawClient = await getTestAdminClient();\n      try {\n        await rawClient.deleteAlternativeRoot(alternativeRoot);\n      } catch (cleanupErr: any) {\n        console.warn(`Failed to clean up alternative root ${alternativeRoot}:`, cleanupErr.message);\n      } finally {\n        await rawClient.close();\n      }\n      return value;\n    } finally {\n      await client.close();\n    }\n  } catch (err: any) {\n    console.log(`ALTERNATIVE ROOT: ${alternativeRoot} (${resourceIdToString(altRootId)})`);\n    throw err;\n  }\n}\n\nexport async function getTestClient(\n  alternativeRoot?: string,\n  confOverrides: Partial<PlClientConfig> = {},\n) {\n  const { conf, auth } = await getTestClientConf();\n  if (alternativeRoot !== undefined && conf.alternativeRoot !== undefined)\n    throw new Error(\"test pl address configured with alternative root\");\n  return await PlClient.init({ ...conf, ...confOverrides, alternativeRoot }, auth);\n}\n\nexport type WithTempRootOptions =\n  | {\n      /** If true and PL_ADDRESS is http://localhost or http://127.0.0.1:<port>,\n       * a TCP proxy will be started and PL client will connect through it. */\n      viaTcpProxy: true;\n      /** Artificial latency for proxy (ms). Default 0 */\n      proxyLatencyMs?: number;\n    }\n  | {\n      viaTcpProxy?: undefined;\n    };\n\nexport async function withTempRoot<T>(body: (pl: PlClient) => Promise<T>): Promise<T | void>;\n\nexport async function withTempRoot<T>(\n  body: (pl: PlClient, proxy: Awaited<ReturnType<typeof startTcpProxy>>) => Promise<T>,\n  options: {\n    viaTcpProxy: true;\n    proxyLatencyMs?: number;\n  },\n): Promise<T>;\n\nexport async function withTempRoot<T>(\n  body: (pl: PlClient, proxy: any) => Promise<T>,\n  options: WithTempRootOptions = {},\n): Promise<T | undefined> {\n  const alternativeRoot = `test_${Date.now()}_${randomUUID()}`;\n  let altRootId: OptionalSignedResourceId = NullSignedResourceId;\n  // Proxy management\n  let proxy: Awaited<ReturnType<typeof startTcpProxy>> | undefined;\n  let confOverrides: Partial<PlClientConfig> = {};\n  try {\n    // Optionally start TCP proxy and rewrite PL_ADDRESS to point to proxy\n    if (options.viaTcpProxy === true && process.env.PL_ADDRESS) {\n      try {\n        const url = new URL(process.env.PL_ADDRESS);\n        const isHttp = url.protocol === \"http:\";\n        const isLocal = url.hostname === \"127.0.0.1\" || url.hostname === \"localhost\";\n        const port = parseInt(url.port);\n        if (isHttp && isLocal && Number.isFinite(port)) {\n          proxy = await startTcpProxy({ targetPort: port, latency: options.proxyLatencyMs ?? 0 });\n          // Override client connection host:port to proxy\n          confOverrides = { hostAndPort: `127.0.0.1:${proxy.port}` } as Partial<PlClientConfig>;\n        } else {\n          console.warn(\n            \"*** skipping proxy-based test, PL_ADDRESS is not localhost\",\n            process.env.PL_ADDRESS,\n          );\n          return;\n        }\n      } catch {\n        // ignore proxy setup errors; tests will run against original address\n      }\n    }\n\n    const client = await getTestClient(alternativeRoot, confOverrides);\n    altRootId = client.clientRoot;\n    try {\n      const value = await body(client, proxy);\n      const rawClient = await getTestClient();\n      try {\n        await rawClient.deleteAlternativeRoot(alternativeRoot);\n      } catch (cleanupErr: any) {\n        // Cleanup may fail if test intentionally deleted resources\n        console.warn(`Failed to clean up alternative root ${alternativeRoot}:`, cleanupErr.message);\n      } finally {\n        // Close the cleanup client to avoid dangling gRPC channels that can cause\n        // segfaults during process exit\n        await rawClient.close();\n      }\n      return value;\n    } finally {\n      // Close the test client to avoid dangling gRPC channels\n      await client.close();\n    }\n  } catch (err: any) {\n    console.log(`ALTERNATIVE ROOT: ${alternativeRoot} (${resourceIdToString(altRootId)})`);\n    throw err;\n    // throw new Error('withTempRoot error: ' + err.message, { cause: err });\n  } finally {\n    // Stop proxy if started\n    if (proxy) {\n      try {\n        await proxy.disconnectAll();\n      } catch {\n        /* ignore */\n      }\n      try {\n        await new Promise<void>((resolve) => proxy!.server.close(() => resolve()));\n      } catch {\n        /* ignore */\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAM,cAAc;AAGpB,IAAI;AAEJ,SAAS,0BAA0B;CACjC,IAAI,qBAAqB,KAAA,GAAW,mBAAmBA,UAAK,QAAQ,iBAAiB;CACrF,OAAO;AACT;AAEA,SAAgB,gBAA4B;CAC1C,IAAI,OAA4B,CAAC;CACjC,IAAIC,QAAG,WAAW,WAAW,GAC3B,OAAO,KAAK,MAAMA,QAAG,aAAa,aAAa,EAAE,UAAU,QAAQ,CAAC,CAAC;CAEvE,IAAI,QAAQ,IAAI,eAAe,KAAA,GAAW,KAAK,UAAU,QAAQ,IAAI;CAErE,IAAI,QAAQ,IAAI,iBAAiB,KAAA,GAAW,KAAK,YAAY,QAAQ,IAAI;CAEzE,IAAI,QAAQ,IAAI,qBAAqB,KAAA,GAAW,KAAK,gBAAgB,QAAQ,IAAI;CAEjF,IAAI,QAAQ,IAAI,kBAAkB,KAAA,GAAW,KAAK,aAAa,QAAQ,IAAI;CAE3E,IAAI,QAAQ,IAAI,uBAAuB,KAAA,GACrC,KAAK,kBAAkB,QAAQ,IAAI;CAErC,IAAI,QAAQ,IAAI,2BAA2B,KAAA,GACzC,KAAK,sBAAsB,QAAQ,IAAI;CAEzC,IAAI,KAAK,YAAY,KAAA,GACnB,MAAM,IAAI,MACR,2CAA2C,YAAY,sCACzD;CAEF,OAAO;AACT;;;;;;;;;;;;;;AAeA,MAAa,uBAAuB,OAAO,QAAQ,IAAI,2BAA2B,GAAG;;AAGrF,SAAS,4BAA4B,SAA0B;CAC7D,IAAI,QAAQ,QAAQ,KAAK,MAAM,IAAI,OAAO;CAC1C,OAAO,IAAI,IAAI,OAAO,CAAC,CAAC,aAAa,IAAI,iBAAiB;AAC5D;;AAGA,SAAgB,sBAAsB,SAAiC;CACrE,MAAM,SAASC,eAAAA,kBAAkB,OAAO;CAOxC,IAAI,CAAC,4BAA4B,OAAO,GAAG,OAAO,wBAAwB;CAC1E,OAAO;AACT;AAeA,SAAS,qBACP,OACA,YAC4C;CAC5C,QAAQ,oBAAoB;EAC1B,MAAM,MAAM,wBAAwB;EACpC,MAAM,SAAS,wBAAwB,KAAA,GAAA,YAAA,WAAA,CAAe;EACtD,QAAG,cACD,QACA,OAAO,KACL,KAAK,UAAU;GACb,MAAM;GACN;GACA;GACA,YAAYC,aAAAA,qBAAqB,iBAAiB,OAAU,EAAE;EAChE,CAAc,CAChB,GACA,MACF;EACA,QAAG,WAAW,QAAQ,GAAG;CAC3B;AACF;AAEA,MAAM,8BAA8B;CAClC,MAAM,IAAI,wBAAwB;CAClC,IAAIF,QAAG,WAAW,CAAC,GAAG;EACpB,QAAQ,KAAK,aAAa,GAAG;EAC7B,QAAG,OAAO,CAAC;CACb;AACF;AAEA,eAAsB,oBAAsE;CAC1F,MAAM,QAAQ,cAAc;CAE5B,MAAM,SAAS,sBAAsB,MAAM,OAAO;CAClD,MAAM,UAAU,MAAMG,sBAAAA,wBAAwB,MAAM,MAAM;CAG1D,MAAM,aAAa,QAAQ,GAAG,WAAW;CAEzC,IAAI,kBAA+C,KAAA;CAOnD,IAAIH,QAAG,WAAW,wBAAwB,CAAC,GACzC,IAAI;EACF,MAAM,QAAmB,KAAK,MAC5BA,QAAG,aAAa,wBAAwB,GAAG,EAAE,UAAU,QAAQ,CAAC,CAClE;EACA,IACE,MAAM,KAAK,YAAY,MAAM,WAC7B,MAAM,KAAK,cAAc,MAAM,aAC/B,MAAM,KAAK,kBAAkB,MAAM,iBACnC,MAAM,aAAa,KAAK,IAAI,KAC5B,MAAM,eAAe,YAErB,kBAAkB,MAAM;CAC5B,QAAQ;EAEN,QAAG,OAAO,wBAAwB,CAAC;CACrC;CAGF,MAAM,cAAc,MAAM,QAAQ,YAAY;CAE9C,IAAI,CAAC,gBAAgB,MAAM,cAAc,KAAA,KAAa,MAAM,kBAAkB,KAAA,IAC5E,MAAM,IAAI,MACR,iFAAiF,YAAY,sDAC/F;CAEF,IAAI,gBAAgB,MAAM,cAAc,KAAA,KAAa,MAAM,kBAAkB,KAAA,IAC3E,MAAM,IAAI,MACR,wCAAwC,YAAY,sDACtD;CAEF,IAAI,oBAAoB,KAAA,GAAW;EACjC,IAAI,aAAa,kBAAkB,MAAM,QAAQ,MAAM,MAAM,WAAY,MAAM,aAAc;OAExF,kBAAkB,CAAC;EAGxB,qBAAqB,OAAO,UAAU,CAAC,CAAC,eAAe;CACzD;CAEA,OAAO;EACL,MAAM;EACN,MAAM;GACJ;GACA,UAAU,qBAAqB,OAAO,UAAU;GAChD,aAAa;GACb,eAAe;EACjB;CACF;AACF;AAEA,eAAsB,gBAAgB,gBAAyC,CAAC,GAAG;CACjF,MAAM,EAAE,MAAM,SAAS,MAAM,kBAAkB;CAC/C,OAAO,MAAMI,kBAAAA,WAAW,MAAM;EAAE,GAAG;EAAM,GAAG;CAAc,GAAG,EAAE,KAAK,CAAC;AACvE;;;;;AAMA,eAAsB,yBAA2E;CAC/F,MAAM,QAAQ,cAAc;CAE5B,IAAI,MAAM,oBAAoB,KAAA,KAAa,MAAM,wBAAwB,KAAA,GACvE,OAAO,MAAM,kBAAkB;CAEjC,MAAM,SAAS,sBAAsB,MAAM,OAAO;CAIlD,OAAO;EACL,MAAM;EACN,MAAM;GACJ,iBAAA,OAL0B,MADRD,sBAAAA,wBAAwB,MAAM,MAAM,EAAA,CACpB,MAAM,MAAM,iBAAiB,MAAM,mBAAmB;GAMxF,gBAAgB,CAAC;GACjB,mBAAmB,CAAC;GACpB,qBAAqB,CAAC;EACxB;CACF;AACF;AAEA,eAAsB,qBAAqB,gBAAyC,CAAC,GAAG;CACtF,MAAM,EAAE,MAAM,SAAS,MAAM,uBAAuB;CACpD,OAAO,MAAMC,kBAAAA,WAAW,MAAM;EAAE,GAAG;EAAM,GAAG;CAAc,GAAG,EAAE,KAAK,CAAC;AACvE;AAEA,eAAsB,mBACpB,iBACA,gBAAyC,CAAC,GAC1C;CACA,MAAM,EAAE,MAAM,SAAS,MAAM,uBAAuB;CACpD,IAAI,oBAAoB,KAAA,KAAa,KAAK,oBAAoB,KAAA,GAC5D,MAAM,IAAI,MAAM,kDAAkD;CACpE,OAAO,MAAMC,eAAAA,SAAS,KAAK;EAAE,GAAG;EAAM,GAAG;EAAe;CAAgB,GAAG,IAAI;AACjF;AAEA,eAAsB,kBAAqB,MAAuD;CAChG,MAAM,kBAAkB,QAAQ,KAAK,IAAI,EAAE,IAAA,GAAA,YAAA,WAAA,CAAc;CACzD,IAAI,YAAA;CACJ,IAAI;EACF,MAAM,SAAS,MAAM,mBAAmB,eAAe;EACvD,YAAY,OAAO;EACnB,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,MAAM;GAC/B,MAAM,YAAY,MAAM,mBAAmB;GAC3C,IAAI;IACF,MAAM,UAAU,sBAAsB,eAAe;GACvD,SAAS,YAAiB;IACxB,QAAQ,KAAK,uCAAuC,gBAAgB,IAAI,WAAW,OAAO;GAC5F,UAAU;IACR,MAAM,UAAU,MAAM;GACxB;GACA,OAAO;EACT,UAAU;GACR,MAAM,OAAO,MAAM;EACrB;CACF,SAAS,KAAU;EACjB,QAAQ,IAAI,qBAAqB,gBAAgB,IAAIC,cAAAA,mBAAmB,SAAS,EAAE,EAAE;EACrF,MAAM;CACR;AACF;AAEA,eAAsB,cACpB,iBACA,gBAAyC,CAAC,GAC1C;CACA,MAAM,EAAE,MAAM,SAAS,MAAM,kBAAkB;CAC/C,IAAI,oBAAoB,KAAA,KAAa,KAAK,oBAAoB,KAAA,GAC5D,MAAM,IAAI,MAAM,kDAAkD;CACpE,OAAO,MAAMD,eAAAA,SAAS,KAAK;EAAE,GAAG;EAAM,GAAG;EAAe;CAAgB,GAAG,IAAI;AACjF;AAwBA,eAAsB,aACpB,MACA,UAA+B,CAAC,GACR;CACxB,MAAM,kBAAkB,QAAQ,KAAK,IAAI,EAAE,IAAA,GAAA,YAAA,WAAA,CAAc;CACzD,IAAI,YAAA;CAEJ,IAAI;CACJ,IAAI,gBAAyC,CAAC;CAC9C,IAAI;EAEF,IAAI,QAAQ,gBAAgB,QAAQ,QAAQ,IAAI,YAC9C,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI,UAAU;GAC1C,MAAM,SAAS,IAAI,aAAa;GAChC,MAAM,UAAU,IAAI,aAAa,eAAe,IAAI,aAAa;GACjE,MAAM,OAAO,SAAS,IAAI,IAAI;GAC9B,IAAI,UAAU,WAAW,OAAO,SAAS,IAAI,GAAG;IAC9C,QAAQ,MAAME,kBAAAA,cAAc;KAAE,YAAY;KAAM,SAAS,QAAQ,kBAAkB;IAAE,CAAC;IAEtF,gBAAgB,EAAE,aAAa,aAAa,MAAM,OAAO;GAC3D,OAAO;IACL,QAAQ,KACN,8DACA,QAAQ,IAAI,UACd;IACA;GACF;EACF,QAAQ,CAER;EAGF,MAAM,SAAS,MAAM,cAAc,iBAAiB,aAAa;EACjE,YAAY,OAAO;EACnB,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK;GACtC,MAAM,YAAY,MAAM,cAAc;GACtC,IAAI;IACF,MAAM,UAAU,sBAAsB,eAAe;GACvD,SAAS,YAAiB;IAExB,QAAQ,KAAK,uCAAuC,gBAAgB,IAAI,WAAW,OAAO;GAC5F,UAAU;IAGR,MAAM,UAAU,MAAM;GACxB;GACA,OAAO;EACT,UAAU;GAER,MAAM,OAAO,MAAM;EACrB;CACF,SAAS,KAAU;EACjB,QAAQ,IAAI,qBAAqB,gBAAgB,IAAID,cAAAA,mBAAmB,SAAS,EAAE,EAAE;EACrF,MAAM;CAER,UAAU;EAER,IAAI,OAAO;GACT,IAAI;IACF,MAAM,MAAM,cAAc;GAC5B,QAAQ,CAER;GACA,IAAI;IACF,MAAM,IAAI,SAAe,YAAY,MAAO,OAAO,YAAY,QAAQ,CAAC,CAAC;GAC3E,QAAQ,CAER;EACF;CACF;AACF"}

package/dist/test/test_config.d.ts

@@ -3,24 +3,49 @@ import { LLPlClient } from "../core/ll_client.js";
 import { PlClient } from "../core/client.js";
 import { TestTcpProxy, startTcpProxy } from "./tcp-proxy.js";
 declare namespace test_config_d_exports {
-  export { TEST_REQUEST_TIMEOUT, TestConfig, TestTcpProxy, WithTempRootOptions, getTestClient, getTestClientConf, getTestConfig, getTestLLClient, plAddressToTestConfig, withTempRoot };
+  export { TEST_REQUEST_TIMEOUT, TestConfig, TestTcpProxy, WithTempRootOptions, getTestAdminClient, getTestAdminClientConf, getTestAdminLLClient, getTestClient, getTestClientConf, getTestConfig, getTestLLClient, plAddressToTestConfig, withAdminTempRoot, withTempRoot };
 }
 export interface TestConfig {
   address: string;
   test_proxy?: string;
   test_user?: string;
   test_password?: string;
+  test_admin_user?: string;
+  test_admin_password?: string;
 }
 export declare function getTestConfig(): TestConfig;
-/** Default request timeout for tests (ms) */
-export declare const TEST_REQUEST_TIMEOUT = 500;
-/** Returns PlClientConfig with reduced timeout for tests */
+/**
+ * Default request timeout for tests (ms).
+ *
+ * Kept short so a hung call fails the test instead of the suite's own budget. A deploy the
+ * tests reach over cluster DNS needs more than that on first contact, where the deadline
+ * covers name resolution too:
+ *
+ *   RpcError: Deadline exceeded after 0.500s,waiting for name resolution
+ *
+ * That call builds the shared client, so the whole file dies with it and retries only
+ * repeat the error against an undefined client. PL_TEST_REQUEST_TIMEOUT raises the budget
+ * where resolution is slow, and every other environment keeps the short one.
+ */
+export declare const TEST_REQUEST_TIMEOUT: number;
+/** Returns PlClientConfig with reduced timeout for tests, unless the address sets its own */
 export declare function plAddressToTestConfig(address: string): PlClientConfig;
 export declare function getTestClientConf(): Promise<{
   conf: PlClientConfig;
   auth: AuthOps;
 }>;
 export declare function getTestLLClient(confOverrides?: Partial<PlClientConfig>): Promise<LLPlClient>;
+/** Returns a config logged in as the admin test user, or the ordinary test config where no
+ * admin credentials are set. A backend that needs no auth, and one whose single test user
+ * already holds the admin role, both leave PL_TEST_ADMIN_USER and PL_TEST_ADMIN_PASSWORD
+ * unset, and a test that asks for admin must still run there. */
+export declare function getTestAdminClientConf(): Promise<{
+  conf: PlClientConfig;
+  auth: AuthOps;
+}>;
+export declare function getTestAdminLLClient(confOverrides?: Partial<PlClientConfig>): Promise<LLPlClient>;
+export declare function getTestAdminClient(alternativeRoot?: string, confOverrides?: Partial<PlClientConfig>): Promise<PlClient>;
+export declare function withAdminTempRoot<T>(body: (pl: PlClient) => Promise<T>): Promise<T | void>;
 export declare function getTestClient(alternativeRoot?: string, confOverrides?: Partial<PlClientConfig>): Promise<PlClient>;
 export type WithTempRootOptions = {
   /** If true and PL_ADDRESS is http://localhost or http://127.0.0.1:<port>,

package/dist/test/test_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test_config.d.ts","names":[],"sources":["../../src/test/test_config.ts"],"mappings":";;;;;;;iBAgBiB;EACf;EACA;EACA;EACA;;wBAac,iBAAiB;;qBAsBpB;;wBAGG,sBAAsB,kBAAkB;wBAkDlC,qBAAqB;EAAU,MAAM;EAAgB,MAAM;;wBAmE3D,gBAAgB,gBAAe,QAAQ,kBAAoB,QAAA;wBAK3D,cACpB,0BACA,gBAAe,QAAQ,kBAAoB,QAAA;YAQjC;;;EAIN;;EAEA;;EAGA;;wBAGgB,aAAa,GAAG,OAAO,IAAI,aAAa,QAAQ,KAAK,QAAQ;wBAE7D,aAAa,GACjC,OAAO,IAAI,UAAU,OAAO,QAAQ,kBAAkB,oBAAoB,QAAQ,IAClF;EACE;EACA;IAED,QAAQ"}
+{"version":3,"file":"test_config.d.ts","names":[],"sources":["../../src/test/test_config.ts"],"mappings":";;;;;;;iBAgBiB;EACf;EACA;EACA;EACA;EACA;EACA;;wBAac,iBAAiB;;;;;;;;;;;;;;qBAwCpB;;wBASG,sBAAsB,kBAAkB;wBAwDlC,qBAAqB;EAAU,MAAM;EAAgB,MAAM;;wBAmE3D,gBAAgB,gBAAe,QAAQ,kBAAoB,QAAA;;;;;wBAS3D,0BAA0B;EAAU,MAAM;EAAgB,MAAM;;wBAqBhE,qBAAqB,gBAAe,QAAQ,kBAAoB,QAAA;wBAKhE,mBACpB,0BACA,gBAAe,QAAQ,kBAAoB,QAAA;wBAQvB,kBAAkB,GAAG,OAAO,IAAI,aAAa,QAAQ,KAAK,QAAQ;wBA0BlE,cACpB,0BACA,gBAAe,QAAQ,kBAAoB,QAAA;YAQjC;;;EAIN;;EAEA;;EAGA;;wBAGgB,aAAa,GAAG,OAAO,IAAI,aAAa,QAAQ,KAAK,QAAQ;wBAE7D,aAAa,GACjC,OAAO,IAAI,UAAU,OAAO,QAAQ,kBAAkB,oBAAoB,QAAQ,IAClF;EACE;EACA;IAED,QAAQ"}

package/dist/test/test_config.js

@@ -11,12 +11,16 @@ import * as fs$1 from "node:fs";
 import * as path from "node:path";
 //#region src/test/test_config.ts
 var test_config_exports = /* @__PURE__ */ __exportAll({
-	TEST_REQUEST_TIMEOUT: () => 500,
+	TEST_REQUEST_TIMEOUT: () => TEST_REQUEST_TIMEOUT,
+	getTestAdminClient: () => getTestAdminClient,
+	getTestAdminClientConf: () => getTestAdminClientConf,
+	getTestAdminLLClient: () => getTestAdminLLClient,
 	getTestClient: () => getTestClient,
 	getTestClientConf: () => getTestClientConf,
 	getTestConfig: () => getTestConfig,
 	getTestLLClient: () => getTestLLClient,
 	plAddressToTestConfig: () => plAddressToTestConfig,
+	withAdminTempRoot: () => withAdminTempRoot,
 	withTempRoot: () => withTempRoot
 });
 const CONFIG_FILE = "test_config.json";
@@ -32,13 +36,34 @@ function getTestConfig() {
 	if (process.env.PL_TEST_USER !== void 0) conf.test_user = process.env.PL_TEST_USER;
 	if (process.env.PL_TEST_PASSWORD !== void 0) conf.test_password = process.env.PL_TEST_PASSWORD;
 	if (process.env.PL_TEST_PROXY !== void 0) conf.test_proxy = process.env.PL_TEST_PROXY;
+	if (process.env.PL_TEST_ADMIN_USER !== void 0) conf.test_admin_user = process.env.PL_TEST_ADMIN_USER;
+	if (process.env.PL_TEST_ADMIN_PASSWORD !== void 0) conf.test_admin_password = process.env.PL_TEST_ADMIN_PASSWORD;
 	if (conf.address === void 0) throw new Error(`can't resolve platform address (checked ${CONFIG_FILE} file and PL_ADDRESS environment var)`);
 	return conf;
 }
-/** Returns PlClientConfig with reduced timeout for tests */
+/**
+* Default request timeout for tests (ms).
+*
+* Kept short so a hung call fails the test instead of the suite's own budget. A deploy the
+* tests reach over cluster DNS needs more than that on first contact, where the deadline
+* covers name resolution too:
+*
+*   RpcError: Deadline exceeded after 0.500s,waiting for name resolution
+*
+* That call builds the shared client, so the whole file dies with it and retries only
+* repeat the error against an undefined client. PL_TEST_REQUEST_TIMEOUT raises the budget
+* where resolution is slow, and every other environment keeps the short one.
+*/
+const TEST_REQUEST_TIMEOUT = Number(process.env.PL_TEST_REQUEST_TIMEOUT ?? 500);
+/** True when the address carries an explicit `request-timeout` query parameter. */
+function addressStatesRequestTimeout(address) {
+	if (address.indexOf("://") === -1) return false;
+	return new URL(address).searchParams.has("request-timeout");
+}
+/** Returns PlClientConfig with reduced timeout for tests, unless the address sets its own */
 function plAddressToTestConfig(address) {
 	const plConf = plAddressToConfig(address);
-	plConf.defaultRequestTimeout = 500;
+	if (!addressStatesRequestTimeout(address)) plConf.defaultRequestTimeout = TEST_REQUEST_TIMEOUT;
 	return plConf;
 }
 function saveAuthInfoCallback(tConf, instanceId) {
@@ -98,6 +123,65 @@ async function getTestLLClient(confOverrides = {}) {
 		...confOverrides
 	}, { auth });
 }
+/** Returns a config logged in as the admin test user, or the ordinary test config where no
+* admin credentials are set. A backend that needs no auth, and one whose single test user
+* already holds the admin role, both leave PL_TEST_ADMIN_USER and PL_TEST_ADMIN_PASSWORD
+* unset, and a test that asks for admin must still run there. */
+async function getTestAdminClientConf() {
+	const tConf = getTestConfig();
+	if (tConf.test_admin_user === void 0 || tConf.test_admin_password === void 0) return await getTestClientConf();
+	const plConf = plAddressToTestConfig(tConf.address);
+	return {
+		conf: plConf,
+		auth: {
+			authInformation: await (await UnauthenticatedPlClient.build(plConf)).login(tConf.test_admin_user, tConf.test_admin_password),
+			onUpdate: () => {},
+			onAuthError: () => {},
+			onUpdateError: () => {}
+		}
+	};
+}
+async function getTestAdminLLClient(confOverrides = {}) {
+	const { conf, auth } = await getTestAdminClientConf();
+	return await LLPlClient.build({
+		...conf,
+		...confOverrides
+	}, { auth });
+}
+async function getTestAdminClient(alternativeRoot, confOverrides = {}) {
+	const { conf, auth } = await getTestAdminClientConf();
+	if (alternativeRoot !== void 0 && conf.alternativeRoot !== void 0) throw new Error("test pl address configured with alternative root");
+	return await PlClient.init({
+		...conf,
+		...confOverrides,
+		alternativeRoot
+	}, auth);
+}
+async function withAdminTempRoot(body) {
+	const alternativeRoot = `test_${Date.now()}_${randomUUID()}`;
+	let altRootId = "";
+	try {
+		const client = await getTestAdminClient(alternativeRoot);
+		altRootId = client.clientRoot;
+		try {
+			const value = await body(client);
+			const rawClient = await getTestAdminClient();
+			try {
+				await rawClient.deleteAlternativeRoot(alternativeRoot);
+			} catch (cleanupErr) {
+				console.warn(`Failed to clean up alternative root ${alternativeRoot}:`, cleanupErr.message);
+			} finally {
+				await rawClient.close();
+			}
+			return value;
+		} finally {
+			await client.close();
+		}
+	} catch (err) {
+		console.log(`ALTERNATIVE ROOT: ${alternativeRoot} (${resourceIdToString(altRootId)})`);
+		throw err;
+	}
+}
 async function getTestClient(alternativeRoot, confOverrides = {}) {
 	const { conf, auth } = await getTestClientConf();
 	if (alternativeRoot !== void 0 && conf.alternativeRoot !== void 0) throw new Error("test pl address configured with alternative root");
@@ -160,6 +244,6 @@ async function withTempRoot(body, options = {}) {
 	}
 }
 //#endregion
-export { getTestClient, getTestClientConf, getTestConfig, getTestLLClient, plAddressToTestConfig, test_config_exports, withTempRoot };
+export { TEST_REQUEST_TIMEOUT, getTestAdminClient, getTestAdminClientConf, getTestAdminLLClient, getTestClient, getTestClientConf, getTestConfig, getTestLLClient, plAddressToTestConfig, test_config_exports, withAdminTempRoot, withTempRoot };
 
 //# sourceMappingURL=test_config.js.map

package/dist/test/test_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"test_config.js","names":["fs"],"sources":["../../src/test/test_config.ts"],"sourcesContent":["import * as fs from \"node:fs\";\nimport { LLPlClient } from \"../core/ll_client\";\nimport type { AuthInformation, AuthOps, PlClientConfig } from \"../core/config\";\nimport { plAddressToConfig } from \"../core/config\";\nimport { UnauthenticatedPlClient } from \"../core/unauth_client\";\nimport { PlClient } from \"../core/client\";\nimport { randomUUID } from \"node:crypto\";\nimport type { OptionalSignedResourceId } from \"../core/types\";\nimport { NullSignedResourceId, resourceIdToString } from \"../core/types\";\nimport { inferAuthRefreshTime } from \"../core/auth\";\nimport * as path from \"node:path\";\nimport type { TestTcpProxy } from \"./tcp-proxy\";\nimport { startTcpProxy } from \"./tcp-proxy\";\n\nexport { TestTcpProxy };\n\nexport interface TestConfig {\n  address: string;\n  test_proxy?: string;\n  test_user?: string;\n  test_password?: string;\n}\n\nconst CONFIG_FILE = \"test_config.json\";\n// const AUTH_DATA_FILE = '.test_auth.json';\n\nlet authDataFilePath: string | undefined;\n\nfunction getFullAuthDataFilePath() {\n  if (authDataFilePath === undefined) authDataFilePath = path.resolve(\".test_auth.json\");\n  return authDataFilePath;\n}\n\nexport function getTestConfig(): TestConfig {\n  let conf: Partial<TestConfig> = {};\n  if (fs.existsSync(CONFIG_FILE))\n    conf = JSON.parse(fs.readFileSync(CONFIG_FILE, { encoding: \"utf-8\" })) as TestConfig;\n\n  if (process.env.PL_ADDRESS !== undefined) conf.address = process.env.PL_ADDRESS;\n\n  if (process.env.PL_TEST_USER !== undefined) conf.test_user = process.env.PL_TEST_USER;\n\n  if (process.env.PL_TEST_PASSWORD !== undefined) conf.test_password = process.env.PL_TEST_PASSWORD;\n\n  if (process.env.PL_TEST_PROXY !== undefined) conf.test_proxy = process.env.PL_TEST_PROXY;\n\n  if (conf.address === undefined)\n    throw new Error(\n      `can't resolve platform address (checked ${CONFIG_FILE} file and PL_ADDRESS environment var)`,\n    );\n\n  return conf as TestConfig;\n}\n\n/** Default request timeout for tests (ms) */\nexport const TEST_REQUEST_TIMEOUT = 500;\n\n/** Returns PlClientConfig with reduced timeout for tests */\nexport function plAddressToTestConfig(address: string): PlClientConfig {\n  const plConf = plAddressToConfig(address);\n  plConf.defaultRequestTimeout = TEST_REQUEST_TIMEOUT;\n  return plConf;\n}\n\ninterface AuthCache {\n  /** To check if config changed */\n  conf: TestConfig;\n  /** Backend's instance ID at the moment the JWT was issued. Restarts that\n   * reset state rotate this; the JWT's `iss` claim is bound to it and the\n   * backend rejects tokens minted by a different instance. Without this\n   * check, a cached JWT from a previous backend run would silently fail\n   * the first authenticated call after restart. */\n  instanceId: string;\n  expiration: number;\n  authInformation: AuthInformation;\n}\n\nfunction saveAuthInfoCallback(\n  tConf: TestConfig,\n  instanceId: string,\n): (authInformation: AuthInformation) => void {\n  return (authInformation) => {\n    const dst = getFullAuthDataFilePath();\n    const tmpDst = getFullAuthDataFilePath() + randomUUID();\n    fs.writeFileSync(\n      tmpDst,\n      Buffer.from(\n        JSON.stringify({\n          conf: tConf,\n          instanceId,\n          authInformation,\n          expiration: inferAuthRefreshTime(authInformation, 24 * 60 * 60),\n        } as AuthCache),\n      ),\n      \"utf8\",\n    );\n    fs.renameSync(tmpDst, dst);\n  };\n}\n\nconst cleanAuthInfoCallback = () => {\n  const p = getFullAuthDataFilePath();\n  if (fs.existsSync(p)) {\n    console.warn(`Removing: ${p}`);\n    fs.rmSync(p);\n  }\n};\n\nexport async function getTestClientConf(): Promise<{ conf: PlClientConfig; auth: AuthOps }> {\n  const tConf = getTestConfig();\n\n  const plConf = plAddressToTestConfig(tConf.address);\n  const uClient = await UnauthenticatedPlClient.build(plConf);\n  // ll.serverInfo is populated by build()'s ping; instanceId rotates on a\n  // backend restart that drops the persisted state.\n  const instanceId = uClient.ll.serverInfo.instanceId;\n\n  let authInformation: AuthInformation | undefined = undefined;\n\n  // Try recover from cache. The cache is keyed by config AND backend\n  // instanceId — a backend restart that rotates instanceId invalidates the\n  // cached JWT (the token's `iss` claim no longer matches the live\n  // instance), so we re-login instead of carrying the dead token through\n  // to the first authenticated call.\n  if (fs.existsSync(getFullAuthDataFilePath())) {\n    try {\n      const cache: AuthCache = JSON.parse(\n        fs.readFileSync(getFullAuthDataFilePath(), { encoding: \"utf-8\" }),\n      ) as AuthCache; // TODO runtime validation\n      if (\n        cache.conf.address === tConf.address &&\n        cache.conf.test_user === tConf.test_user &&\n        cache.conf.test_password === tConf.test_password &&\n        cache.expiration > Date.now() &&\n        cache.instanceId === instanceId\n      )\n        authInformation = cache.authInformation;\n    } catch {\n      // removing cache file on any error\n      fs.rmSync(getFullAuthDataFilePath());\n    }\n  }\n\n  const requireAuth = await uClient.requireAuth();\n\n  if (!requireAuth && (tConf.test_user !== undefined || tConf.test_password !== undefined))\n    throw new Error(\n      `Server require no auth, but test user name or test password are provided via (${CONFIG_FILE}) or env variables: PL_TEST_USER and PL_TEST_PASSWORD`,\n    );\n\n  if (requireAuth && (tConf.test_user === undefined || tConf.test_password === undefined))\n    throw new Error(\n      `No auth information found in config (${CONFIG_FILE}) or env variables: PL_TEST_USER and PL_TEST_PASSWORD`,\n    );\n\n  if (authInformation === undefined) {\n    if (requireAuth) authInformation = await uClient.login(tConf.test_user!, tConf.test_password!);\n    // No authorization is required\n    else authInformation = {};\n\n    // saving cache\n    saveAuthInfoCallback(tConf, instanceId)(authInformation);\n  }\n\n  return {\n    conf: plConf,\n    auth: {\n      authInformation,\n      onUpdate: saveAuthInfoCallback(tConf, instanceId),\n      onAuthError: cleanAuthInfoCallback,\n      onUpdateError: cleanAuthInfoCallback,\n    },\n  };\n}\n\nexport async function getTestLLClient(confOverrides: Partial<PlClientConfig> = {}) {\n  const { conf, auth } = await getTestClientConf();\n  return await LLPlClient.build({ ...conf, ...confOverrides }, { auth });\n}\n\nexport async function getTestClient(\n  alternativeRoot?: string,\n  confOverrides: Partial<PlClientConfig> = {},\n) {\n  const { conf, auth } = await getTestClientConf();\n  if (alternativeRoot !== undefined && conf.alternativeRoot !== undefined)\n    throw new Error(\"test pl address configured with alternative root\");\n  return await PlClient.init({ ...conf, ...confOverrides, alternativeRoot }, auth);\n}\n\nexport type WithTempRootOptions =\n  | {\n      /** If true and PL_ADDRESS is http://localhost or http://127.0.0.1:<port>,\n       * a TCP proxy will be started and PL client will connect through it. */\n      viaTcpProxy: true;\n      /** Artificial latency for proxy (ms). Default 0 */\n      proxyLatencyMs?: number;\n    }\n  | {\n      viaTcpProxy?: undefined;\n    };\n\nexport async function withTempRoot<T>(body: (pl: PlClient) => Promise<T>): Promise<T | void>;\n\nexport async function withTempRoot<T>(\n  body: (pl: PlClient, proxy: Awaited<ReturnType<typeof startTcpProxy>>) => Promise<T>,\n  options: {\n    viaTcpProxy: true;\n    proxyLatencyMs?: number;\n  },\n): Promise<T>;\n\nexport async function withTempRoot<T>(\n  body: (pl: PlClient, proxy: any) => Promise<T>,\n  options: WithTempRootOptions = {},\n): Promise<T | undefined> {\n  const alternativeRoot = `test_${Date.now()}_${randomUUID()}`;\n  let altRootId: OptionalSignedResourceId = NullSignedResourceId;\n  // Proxy management\n  let proxy: Awaited<ReturnType<typeof startTcpProxy>> | undefined;\n  let confOverrides: Partial<PlClientConfig> = {};\n  try {\n    // Optionally start TCP proxy and rewrite PL_ADDRESS to point to proxy\n    if (options.viaTcpProxy === true && process.env.PL_ADDRESS) {\n      try {\n        const url = new URL(process.env.PL_ADDRESS);\n        const isHttp = url.protocol === \"http:\";\n        const isLocal = url.hostname === \"127.0.0.1\" || url.hostname === \"localhost\";\n        const port = parseInt(url.port);\n        if (isHttp && isLocal && Number.isFinite(port)) {\n          proxy = await startTcpProxy({ targetPort: port, latency: options.proxyLatencyMs ?? 0 });\n          // Override client connection host:port to proxy\n          confOverrides = { hostAndPort: `127.0.0.1:${proxy.port}` } as Partial<PlClientConfig>;\n        } else {\n          console.warn(\n            \"*** skipping proxy-based test, PL_ADDRESS is not localhost\",\n            process.env.PL_ADDRESS,\n          );\n          return;\n        }\n      } catch {\n        // ignore proxy setup errors; tests will run against original address\n      }\n    }\n\n    const client = await getTestClient(alternativeRoot, confOverrides);\n    altRootId = client.clientRoot;\n    try {\n      const value = await body(client, proxy);\n      const rawClient = await getTestClient();\n      try {\n        await rawClient.deleteAlternativeRoot(alternativeRoot);\n      } catch (cleanupErr: any) {\n        // Cleanup may fail if test intentionally deleted resources\n        console.warn(`Failed to clean up alternative root ${alternativeRoot}:`, cleanupErr.message);\n      } finally {\n        // Close the cleanup client to avoid dangling gRPC channels that can cause\n        // segfaults during process exit\n        await rawClient.close();\n      }\n      return value;\n    } finally {\n      // Close the test client to avoid dangling gRPC channels\n      await client.close();\n    }\n  } catch (err: any) {\n    console.log(`ALTERNATIVE ROOT: ${alternativeRoot} (${resourceIdToString(altRootId)})`);\n    throw err;\n    // throw new Error('withTempRoot error: ' + err.message, { cause: err });\n  } finally {\n    // Stop proxy if started\n    if (proxy) {\n      try {\n        await proxy.disconnectAll();\n      } catch {\n        /* ignore */\n      }\n      try {\n        await new Promise<void>((resolve) => proxy!.server.close(() => resolve()));\n      } catch {\n        /* ignore */\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuBA,MAAM,cAAc;AAGpB,IAAI;AAEJ,SAAS,0BAA0B;CACjC,IAAI,qBAAqB,KAAA,GAAW,mBAAmB,KAAK,QAAQ,iBAAiB;CACrF,OAAO;AACT;AAEA,SAAgB,gBAA4B;CAC1C,IAAI,OAA4B,CAAC;CACjC,IAAIA,KAAG,WAAW,WAAW,GAC3B,OAAO,KAAK,MAAMA,KAAG,aAAa,aAAa,EAAE,UAAU,QAAQ,CAAC,CAAC;CAEvE,IAAI,QAAQ,IAAI,eAAe,KAAA,GAAW,KAAK,UAAU,QAAQ,IAAI;CAErE,IAAI,QAAQ,IAAI,iBAAiB,KAAA,GAAW,KAAK,YAAY,QAAQ,IAAI;CAEzE,IAAI,QAAQ,IAAI,qBAAqB,KAAA,GAAW,KAAK,gBAAgB,QAAQ,IAAI;CAEjF,IAAI,QAAQ,IAAI,kBAAkB,KAAA,GAAW,KAAK,aAAa,QAAQ,IAAI;CAE3E,IAAI,KAAK,YAAY,KAAA,GACnB,MAAM,IAAI,MACR,2CAA2C,YAAY,sCACzD;CAEF,OAAO;AACT;;AAMA,SAAgB,sBAAsB,SAAiC;CACrE,MAAM,SAAS,kBAAkB,OAAO;CACxC,OAAO,wBAAA;CACP,OAAO;AACT;AAeA,SAAS,qBACP,OACA,YAC4C;CAC5C,QAAQ,oBAAoB;EAC1B,MAAM,MAAM,wBAAwB;EACpC,MAAM,SAAS,wBAAwB,IAAI,WAAW;EACtD,KAAG,cACD,QACA,OAAO,KACL,KAAK,UAAU;GACb,MAAM;GACN;GACA;GACA,YAAY,qBAAqB,iBAAiB,OAAU,EAAE;EAChE,CAAc,CAChB,GACA,MACF;EACA,KAAG,WAAW,QAAQ,GAAG;CAC3B;AACF;AAEA,MAAM,8BAA8B;CAClC,MAAM,IAAI,wBAAwB;CAClC,IAAIA,KAAG,WAAW,CAAC,GAAG;EACpB,QAAQ,KAAK,aAAa,GAAG;EAC7B,KAAG,OAAO,CAAC;CACb;AACF;AAEA,eAAsB,oBAAsE;CAC1F,MAAM,QAAQ,cAAc;CAE5B,MAAM,SAAS,sBAAsB,MAAM,OAAO;CAClD,MAAM,UAAU,MAAM,wBAAwB,MAAM,MAAM;CAG1D,MAAM,aAAa,QAAQ,GAAG,WAAW;CAEzC,IAAI,kBAA+C,KAAA;CAOnD,IAAIA,KAAG,WAAW,wBAAwB,CAAC,GACzC,IAAI;EACF,MAAM,QAAmB,KAAK,MAC5BA,KAAG,aAAa,wBAAwB,GAAG,EAAE,UAAU,QAAQ,CAAC,CAClE;EACA,IACE,MAAM,KAAK,YAAY,MAAM,WAC7B,MAAM,KAAK,cAAc,MAAM,aAC/B,MAAM,KAAK,kBAAkB,MAAM,iBACnC,MAAM,aAAa,KAAK,IAAI,KAC5B,MAAM,eAAe,YAErB,kBAAkB,MAAM;CAC5B,QAAQ;EAEN,KAAG,OAAO,wBAAwB,CAAC;CACrC;CAGF,MAAM,cAAc,MAAM,QAAQ,YAAY;CAE9C,IAAI,CAAC,gBAAgB,MAAM,cAAc,KAAA,KAAa,MAAM,kBAAkB,KAAA,IAC5E,MAAM,IAAI,MACR,iFAAiF,YAAY,sDAC/F;CAEF,IAAI,gBAAgB,MAAM,cAAc,KAAA,KAAa,MAAM,kBAAkB,KAAA,IAC3E,MAAM,IAAI,MACR,wCAAwC,YAAY,sDACtD;CAEF,IAAI,oBAAoB,KAAA,GAAW;EACjC,IAAI,aAAa,kBAAkB,MAAM,QAAQ,MAAM,MAAM,WAAY,MAAM,aAAc;OAExF,kBAAkB,CAAC;EAGxB,qBAAqB,OAAO,UAAU,CAAC,CAAC,eAAe;CACzD;CAEA,OAAO;EACL,MAAM;EACN,MAAM;GACJ;GACA,UAAU,qBAAqB,OAAO,UAAU;GAChD,aAAa;GACb,eAAe;EACjB;CACF;AACF;AAEA,eAAsB,gBAAgB,gBAAyC,CAAC,GAAG;CACjF,MAAM,EAAE,MAAM,SAAS,MAAM,kBAAkB;CAC/C,OAAO,MAAM,WAAW,MAAM;EAAE,GAAG;EAAM,GAAG;CAAc,GAAG,EAAE,KAAK,CAAC;AACvE;AAEA,eAAsB,cACpB,iBACA,gBAAyC,CAAC,GAC1C;CACA,MAAM,EAAE,MAAM,SAAS,MAAM,kBAAkB;CAC/C,IAAI,oBAAoB,KAAA,KAAa,KAAK,oBAAoB,KAAA,GAC5D,MAAM,IAAI,MAAM,kDAAkD;CACpE,OAAO,MAAM,SAAS,KAAK;EAAE,GAAG;EAAM,GAAG;EAAe;CAAgB,GAAG,IAAI;AACjF;AAwBA,eAAsB,aACpB,MACA,UAA+B,CAAC,GACR;CACxB,MAAM,kBAAkB,QAAQ,KAAK,IAAI,EAAE,GAAG,WAAW;CACzD,IAAI,YAAA;CAEJ,IAAI;CACJ,IAAI,gBAAyC,CAAC;CAC9C,IAAI;EAEF,IAAI,QAAQ,gBAAgB,QAAQ,QAAQ,IAAI,YAC9C,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI,UAAU;GAC1C,MAAM,SAAS,IAAI,aAAa;GAChC,MAAM,UAAU,IAAI,aAAa,eAAe,IAAI,aAAa;GACjE,MAAM,OAAO,SAAS,IAAI,IAAI;GAC9B,IAAI,UAAU,WAAW,OAAO,SAAS,IAAI,GAAG;IAC9C,QAAQ,MAAM,cAAc;KAAE,YAAY;KAAM,SAAS,QAAQ,kBAAkB;IAAE,CAAC;IAEtF,gBAAgB,EAAE,aAAa,aAAa,MAAM,OAAO;GAC3D,OAAO;IACL,QAAQ,KACN,8DACA,QAAQ,IAAI,UACd;IACA;GACF;EACF,QAAQ,CAER;EAGF,MAAM,SAAS,MAAM,cAAc,iBAAiB,aAAa;EACjE,YAAY,OAAO;EACnB,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK;GACtC,MAAM,YAAY,MAAM,cAAc;GACtC,IAAI;IACF,MAAM,UAAU,sBAAsB,eAAe;GACvD,SAAS,YAAiB;IAExB,QAAQ,KAAK,uCAAuC,gBAAgB,IAAI,WAAW,OAAO;GAC5F,UAAU;IAGR,MAAM,UAAU,MAAM;GACxB;GACA,OAAO;EACT,UAAU;GAER,MAAM,OAAO,MAAM;EACrB;CACF,SAAS,KAAU;EACjB,QAAQ,IAAI,qBAAqB,gBAAgB,IAAI,mBAAmB,SAAS,EAAE,EAAE;EACrF,MAAM;CAER,UAAU;EAER,IAAI,OAAO;GACT,IAAI;IACF,MAAM,MAAM,cAAc;GAC5B,QAAQ,CAER;GACA,IAAI;IACF,MAAM,IAAI,SAAe,YAAY,MAAO,OAAO,YAAY,QAAQ,CAAC,CAAC;GAC3E,QAAQ,CAER;EACF;CACF;AACF"}
+{"version":3,"file":"test_config.js","names":["fs"],"sources":["../../src/test/test_config.ts"],"sourcesContent":["import * as fs from \"node:fs\";\nimport { LLPlClient } from \"../core/ll_client\";\nimport type { AuthInformation, AuthOps, PlClientConfig } from \"../core/config\";\nimport { plAddressToConfig } from \"../core/config\";\nimport { UnauthenticatedPlClient } from \"../core/unauth_client\";\nimport { PlClient } from \"../core/client\";\nimport { randomUUID } from \"node:crypto\";\nimport type { OptionalSignedResourceId } from \"../core/types\";\nimport { NullSignedResourceId, resourceIdToString } from \"../core/types\";\nimport { inferAuthRefreshTime } from \"../core/auth\";\nimport * as path from \"node:path\";\nimport type { TestTcpProxy } from \"./tcp-proxy\";\nimport { startTcpProxy } from \"./tcp-proxy\";\n\nexport { TestTcpProxy };\n\nexport interface TestConfig {\n  address: string;\n  test_proxy?: string;\n  test_user?: string;\n  test_password?: string;\n  test_admin_user?: string;\n  test_admin_password?: string;\n}\n\nconst CONFIG_FILE = \"test_config.json\";\n// const AUTH_DATA_FILE = '.test_auth.json';\n\nlet authDataFilePath: string | undefined;\n\nfunction getFullAuthDataFilePath() {\n  if (authDataFilePath === undefined) authDataFilePath = path.resolve(\".test_auth.json\");\n  return authDataFilePath;\n}\n\nexport function getTestConfig(): TestConfig {\n  let conf: Partial<TestConfig> = {};\n  if (fs.existsSync(CONFIG_FILE))\n    conf = JSON.parse(fs.readFileSync(CONFIG_FILE, { encoding: \"utf-8\" })) as TestConfig;\n\n  if (process.env.PL_ADDRESS !== undefined) conf.address = process.env.PL_ADDRESS;\n\n  if (process.env.PL_TEST_USER !== undefined) conf.test_user = process.env.PL_TEST_USER;\n\n  if (process.env.PL_TEST_PASSWORD !== undefined) conf.test_password = process.env.PL_TEST_PASSWORD;\n\n  if (process.env.PL_TEST_PROXY !== undefined) conf.test_proxy = process.env.PL_TEST_PROXY;\n\n  if (process.env.PL_TEST_ADMIN_USER !== undefined)\n    conf.test_admin_user = process.env.PL_TEST_ADMIN_USER;\n\n  if (process.env.PL_TEST_ADMIN_PASSWORD !== undefined)\n    conf.test_admin_password = process.env.PL_TEST_ADMIN_PASSWORD;\n\n  if (conf.address === undefined)\n    throw new Error(\n      `can't resolve platform address (checked ${CONFIG_FILE} file and PL_ADDRESS environment var)`,\n    );\n\n  return conf as TestConfig;\n}\n\n/**\n * Default request timeout for tests (ms).\n *\n * Kept short so a hung call fails the test instead of the suite's own budget. A deploy the\n * tests reach over cluster DNS needs more than that on first contact, where the deadline\n * covers name resolution too:\n *\n *   RpcError: Deadline exceeded after 0.500s,waiting for name resolution\n *\n * That call builds the shared client, so the whole file dies with it and retries only\n * repeat the error against an undefined client. PL_TEST_REQUEST_TIMEOUT raises the budget\n * where resolution is slow, and every other environment keeps the short one.\n */\nexport const TEST_REQUEST_TIMEOUT = Number(process.env.PL_TEST_REQUEST_TIMEOUT ?? 500);\n\n/** True when the address carries an explicit `request-timeout` query parameter. */\nfunction addressStatesRequestTimeout(address: string): boolean {\n  if (address.indexOf(\"://\") === -1) return false;\n  return new URL(address).searchParams.has(\"request-timeout\");\n}\n\n/** Returns PlClientConfig with reduced timeout for tests, unless the address sets its own */\nexport function plAddressToTestConfig(address: string): PlClientConfig {\n  const plConf = plAddressToConfig(address);\n  // An explicit request-timeout in the address wins over TEST_REQUEST_TIMEOUT. In the k8s e2e\n  // deploy the client dials a cluster service DNS name, and the first call on a cold channel must\n  // finish name resolution and get a load-balancer pick before it is even sent; 500ms does not\n  // cover that, so whichever test happened to open the cold channel died with DEADLINE_EXCEEDED\n  // (\"Waiting for LB pick\") against a healthy backend. Addresses that carry no request-timeout\n  // keep the short default, so local runs still fail fast.\n  if (!addressStatesRequestTimeout(address)) plConf.defaultRequestTimeout = TEST_REQUEST_TIMEOUT;\n  return plConf;\n}\n\ninterface AuthCache {\n  /** To check if config changed */\n  conf: TestConfig;\n  /** Backend's instance ID at the moment the JWT was issued. Restarts that\n   * reset state rotate this; the JWT's `iss` claim is bound to it and the\n   * backend rejects tokens minted by a different instance. Without this\n   * check, a cached JWT from a previous backend run would silently fail\n   * the first authenticated call after restart. */\n  instanceId: string;\n  expiration: number;\n  authInformation: AuthInformation;\n}\n\nfunction saveAuthInfoCallback(\n  tConf: TestConfig,\n  instanceId: string,\n): (authInformation: AuthInformation) => void {\n  return (authInformation) => {\n    const dst = getFullAuthDataFilePath();\n    const tmpDst = getFullAuthDataFilePath() + randomUUID();\n    fs.writeFileSync(\n      tmpDst,\n      Buffer.from(\n        JSON.stringify({\n          conf: tConf,\n          instanceId,\n          authInformation,\n          expiration: inferAuthRefreshTime(authInformation, 24 * 60 * 60),\n        } as AuthCache),\n      ),\n      \"utf8\",\n    );\n    fs.renameSync(tmpDst, dst);\n  };\n}\n\nconst cleanAuthInfoCallback = () => {\n  const p = getFullAuthDataFilePath();\n  if (fs.existsSync(p)) {\n    console.warn(`Removing: ${p}`);\n    fs.rmSync(p);\n  }\n};\n\nexport async function getTestClientConf(): Promise<{ conf: PlClientConfig; auth: AuthOps }> {\n  const tConf = getTestConfig();\n\n  const plConf = plAddressToTestConfig(tConf.address);\n  const uClient = await UnauthenticatedPlClient.build(plConf);\n  // ll.serverInfo is populated by build()'s ping; instanceId rotates on a\n  // backend restart that drops the persisted state.\n  const instanceId = uClient.ll.serverInfo.instanceId;\n\n  let authInformation: AuthInformation | undefined = undefined;\n\n  // Try recover from cache. The cache is keyed by config AND backend\n  // instanceId — a backend restart that rotates instanceId invalidates the\n  // cached JWT (the token's `iss` claim no longer matches the live\n  // instance), so we re-login instead of carrying the dead token through\n  // to the first authenticated call.\n  if (fs.existsSync(getFullAuthDataFilePath())) {\n    try {\n      const cache: AuthCache = JSON.parse(\n        fs.readFileSync(getFullAuthDataFilePath(), { encoding: \"utf-8\" }),\n      ) as AuthCache; // TODO runtime validation\n      if (\n        cache.conf.address === tConf.address &&\n        cache.conf.test_user === tConf.test_user &&\n        cache.conf.test_password === tConf.test_password &&\n        cache.expiration > Date.now() &&\n        cache.instanceId === instanceId\n      )\n        authInformation = cache.authInformation;\n    } catch {\n      // removing cache file on any error\n      fs.rmSync(getFullAuthDataFilePath());\n    }\n  }\n\n  const requireAuth = await uClient.requireAuth();\n\n  if (!requireAuth && (tConf.test_user !== undefined || tConf.test_password !== undefined))\n    throw new Error(\n      `Server require no auth, but test user name or test password are provided via (${CONFIG_FILE}) or env variables: PL_TEST_USER and PL_TEST_PASSWORD`,\n    );\n\n  if (requireAuth && (tConf.test_user === undefined || tConf.test_password === undefined))\n    throw new Error(\n      `No auth information found in config (${CONFIG_FILE}) or env variables: PL_TEST_USER and PL_TEST_PASSWORD`,\n    );\n\n  if (authInformation === undefined) {\n    if (requireAuth) authInformation = await uClient.login(tConf.test_user!, tConf.test_password!);\n    // No authorization is required\n    else authInformation = {};\n\n    // saving cache\n    saveAuthInfoCallback(tConf, instanceId)(authInformation);\n  }\n\n  return {\n    conf: plConf,\n    auth: {\n      authInformation,\n      onUpdate: saveAuthInfoCallback(tConf, instanceId),\n      onAuthError: cleanAuthInfoCallback,\n      onUpdateError: cleanAuthInfoCallback,\n    },\n  };\n}\n\nexport async function getTestLLClient(confOverrides: Partial<PlClientConfig> = {}) {\n  const { conf, auth } = await getTestClientConf();\n  return await LLPlClient.build({ ...conf, ...confOverrides }, { auth });\n}\n\n/** Returns a config logged in as the admin test user, or the ordinary test config where no\n * admin credentials are set. A backend that needs no auth, and one whose single test user\n * already holds the admin role, both leave PL_TEST_ADMIN_USER and PL_TEST_ADMIN_PASSWORD\n * unset, and a test that asks for admin must still run there. */\nexport async function getTestAdminClientConf(): Promise<{ conf: PlClientConfig; auth: AuthOps }> {\n  const tConf = getTestConfig();\n\n  if (tConf.test_admin_user === undefined || tConf.test_admin_password === undefined)\n    return await getTestClientConf();\n\n  const plConf = plAddressToTestConfig(tConf.address);\n  const uClient = await UnauthenticatedPlClient.build(plConf);\n  const authInformation = await uClient.login(tConf.test_admin_user, tConf.test_admin_password);\n\n  return {\n    conf: plConf,\n    auth: {\n      authInformation,\n      onUpdate: () => {},\n      onAuthError: () => {},\n      onUpdateError: () => {},\n    },\n  };\n}\n\nexport async function getTestAdminLLClient(confOverrides: Partial<PlClientConfig> = {}) {\n  const { conf, auth } = await getTestAdminClientConf();\n  return await LLPlClient.build({ ...conf, ...confOverrides }, { auth });\n}\n\nexport async function getTestAdminClient(\n  alternativeRoot?: string,\n  confOverrides: Partial<PlClientConfig> = {},\n) {\n  const { conf, auth } = await getTestAdminClientConf();\n  if (alternativeRoot !== undefined && conf.alternativeRoot !== undefined)\n    throw new Error(\"test pl address configured with alternative root\");\n  return await PlClient.init({ ...conf, ...confOverrides, alternativeRoot }, auth);\n}\n\nexport async function withAdminTempRoot<T>(body: (pl: PlClient) => Promise<T>): Promise<T | void> {\n  const alternativeRoot = `test_${Date.now()}_${randomUUID()}`;\n  let altRootId: OptionalSignedResourceId = NullSignedResourceId;\n  try {\n    const client = await getTestAdminClient(alternativeRoot);\n    altRootId = client.clientRoot;\n    try {\n      const value = await body(client);\n      const rawClient = await getTestAdminClient();\n      try {\n        await rawClient.deleteAlternativeRoot(alternativeRoot);\n      } catch (cleanupErr: any) {\n        console.warn(`Failed to clean up alternative root ${alternativeRoot}:`, cleanupErr.message);\n      } finally {\n        await rawClient.close();\n      }\n      return value;\n    } finally {\n      await client.close();\n    }\n  } catch (err: any) {\n    console.log(`ALTERNATIVE ROOT: ${alternativeRoot} (${resourceIdToString(altRootId)})`);\n    throw err;\n  }\n}\n\nexport async function getTestClient(\n  alternativeRoot?: string,\n  confOverrides: Partial<PlClientConfig> = {},\n) {\n  const { conf, auth } = await getTestClientConf();\n  if (alternativeRoot !== undefined && conf.alternativeRoot !== undefined)\n    throw new Error(\"test pl address configured with alternative root\");\n  return await PlClient.init({ ...conf, ...confOverrides, alternativeRoot }, auth);\n}\n\nexport type WithTempRootOptions =\n  | {\n      /** If true and PL_ADDRESS is http://localhost or http://127.0.0.1:<port>,\n       * a TCP proxy will be started and PL client will connect through it. */\n      viaTcpProxy: true;\n      /** Artificial latency for proxy (ms). Default 0 */\n      proxyLatencyMs?: number;\n    }\n  | {\n      viaTcpProxy?: undefined;\n    };\n\nexport async function withTempRoot<T>(body: (pl: PlClient) => Promise<T>): Promise<T | void>;\n\nexport async function withTempRoot<T>(\n  body: (pl: PlClient, proxy: Awaited<ReturnType<typeof startTcpProxy>>) => Promise<T>,\n  options: {\n    viaTcpProxy: true;\n    proxyLatencyMs?: number;\n  },\n): Promise<T>;\n\nexport async function withTempRoot<T>(\n  body: (pl: PlClient, proxy: any) => Promise<T>,\n  options: WithTempRootOptions = {},\n): Promise<T | undefined> {\n  const alternativeRoot = `test_${Date.now()}_${randomUUID()}`;\n  let altRootId: OptionalSignedResourceId = NullSignedResourceId;\n  // Proxy management\n  let proxy: Awaited<ReturnType<typeof startTcpProxy>> | undefined;\n  let confOverrides: Partial<PlClientConfig> = {};\n  try {\n    // Optionally start TCP proxy and rewrite PL_ADDRESS to point to proxy\n    if (options.viaTcpProxy === true && process.env.PL_ADDRESS) {\n      try {\n        const url = new URL(process.env.PL_ADDRESS);\n        const isHttp = url.protocol === \"http:\";\n        const isLocal = url.hostname === \"127.0.0.1\" || url.hostname === \"localhost\";\n        const port = parseInt(url.port);\n        if (isHttp && isLocal && Number.isFinite(port)) {\n          proxy = await startTcpProxy({ targetPort: port, latency: options.proxyLatencyMs ?? 0 });\n          // Override client connection host:port to proxy\n          confOverrides = { hostAndPort: `127.0.0.1:${proxy.port}` } as Partial<PlClientConfig>;\n        } else {\n          console.warn(\n            \"*** skipping proxy-based test, PL_ADDRESS is not localhost\",\n            process.env.PL_ADDRESS,\n          );\n          return;\n        }\n      } catch {\n        // ignore proxy setup errors; tests will run against original address\n      }\n    }\n\n    const client = await getTestClient(alternativeRoot, confOverrides);\n    altRootId = client.clientRoot;\n    try {\n      const value = await body(client, proxy);\n      const rawClient = await getTestClient();\n      try {\n        await rawClient.deleteAlternativeRoot(alternativeRoot);\n      } catch (cleanupErr: any) {\n        // Cleanup may fail if test intentionally deleted resources\n        console.warn(`Failed to clean up alternative root ${alternativeRoot}:`, cleanupErr.message);\n      } finally {\n        // Close the cleanup client to avoid dangling gRPC channels that can cause\n        // segfaults during process exit\n        await rawClient.close();\n      }\n      return value;\n    } finally {\n      // Close the test client to avoid dangling gRPC channels\n      await client.close();\n    }\n  } catch (err: any) {\n    console.log(`ALTERNATIVE ROOT: ${alternativeRoot} (${resourceIdToString(altRootId)})`);\n    throw err;\n    // throw new Error('withTempRoot error: ' + err.message, { cause: err });\n  } finally {\n    // Stop proxy if started\n    if (proxy) {\n      try {\n        await proxy.disconnectAll();\n      } catch {\n        /* ignore */\n      }\n      try {\n        await new Promise<void>((resolve) => proxy!.server.close(() => resolve()));\n      } catch {\n        /* ignore */\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAM,cAAc;AAGpB,IAAI;AAEJ,SAAS,0BAA0B;CACjC,IAAI,qBAAqB,KAAA,GAAW,mBAAmB,KAAK,QAAQ,iBAAiB;CACrF,OAAO;AACT;AAEA,SAAgB,gBAA4B;CAC1C,IAAI,OAA4B,CAAC;CACjC,IAAIA,KAAG,WAAW,WAAW,GAC3B,OAAO,KAAK,MAAMA,KAAG,aAAa,aAAa,EAAE,UAAU,QAAQ,CAAC,CAAC;CAEvE,IAAI,QAAQ,IAAI,eAAe,KAAA,GAAW,KAAK,UAAU,QAAQ,IAAI;CAErE,IAAI,QAAQ,IAAI,iBAAiB,KAAA,GAAW,KAAK,YAAY,QAAQ,IAAI;CAEzE,IAAI,QAAQ,IAAI,qBAAqB,KAAA,GAAW,KAAK,gBAAgB,QAAQ,IAAI;CAEjF,IAAI,QAAQ,IAAI,kBAAkB,KAAA,GAAW,KAAK,aAAa,QAAQ,IAAI;CAE3E,IAAI,QAAQ,IAAI,uBAAuB,KAAA,GACrC,KAAK,kBAAkB,QAAQ,IAAI;CAErC,IAAI,QAAQ,IAAI,2BAA2B,KAAA,GACzC,KAAK,sBAAsB,QAAQ,IAAI;CAEzC,IAAI,KAAK,YAAY,KAAA,GACnB,MAAM,IAAI,MACR,2CAA2C,YAAY,sCACzD;CAEF,OAAO;AACT;;;;;;;;;;;;;;AAeA,MAAa,uBAAuB,OAAO,QAAQ,IAAI,2BAA2B,GAAG;;AAGrF,SAAS,4BAA4B,SAA0B;CAC7D,IAAI,QAAQ,QAAQ,KAAK,MAAM,IAAI,OAAO;CAC1C,OAAO,IAAI,IAAI,OAAO,CAAC,CAAC,aAAa,IAAI,iBAAiB;AAC5D;;AAGA,SAAgB,sBAAsB,SAAiC;CACrE,MAAM,SAAS,kBAAkB,OAAO;CAOxC,IAAI,CAAC,4BAA4B,OAAO,GAAG,OAAO,wBAAwB;CAC1E,OAAO;AACT;AAeA,SAAS,qBACP,OACA,YAC4C;CAC5C,QAAQ,oBAAoB;EAC1B,MAAM,MAAM,wBAAwB;EACpC,MAAM,SAAS,wBAAwB,IAAI,WAAW;EACtD,KAAG,cACD,QACA,OAAO,KACL,KAAK,UAAU;GACb,MAAM;GACN;GACA;GACA,YAAY,qBAAqB,iBAAiB,OAAU,EAAE;EAChE,CAAc,CAChB,GACA,MACF;EACA,KAAG,WAAW,QAAQ,GAAG;CAC3B;AACF;AAEA,MAAM,8BAA8B;CAClC,MAAM,IAAI,wBAAwB;CAClC,IAAIA,KAAG,WAAW,CAAC,GAAG;EACpB,QAAQ,KAAK,aAAa,GAAG;EAC7B,KAAG,OAAO,CAAC;CACb;AACF;AAEA,eAAsB,oBAAsE;CAC1F,MAAM,QAAQ,cAAc;CAE5B,MAAM,SAAS,sBAAsB,MAAM,OAAO;CAClD,MAAM,UAAU,MAAM,wBAAwB,MAAM,MAAM;CAG1D,MAAM,aAAa,QAAQ,GAAG,WAAW;CAEzC,IAAI,kBAA+C,KAAA;CAOnD,IAAIA,KAAG,WAAW,wBAAwB,CAAC,GACzC,IAAI;EACF,MAAM,QAAmB,KAAK,MAC5BA,KAAG,aAAa,wBAAwB,GAAG,EAAE,UAAU,QAAQ,CAAC,CAClE;EACA,IACE,MAAM,KAAK,YAAY,MAAM,WAC7B,MAAM,KAAK,cAAc,MAAM,aAC/B,MAAM,KAAK,kBAAkB,MAAM,iBACnC,MAAM,aAAa,KAAK,IAAI,KAC5B,MAAM,eAAe,YAErB,kBAAkB,MAAM;CAC5B,QAAQ;EAEN,KAAG,OAAO,wBAAwB,CAAC;CACrC;CAGF,MAAM,cAAc,MAAM,QAAQ,YAAY;CAE9C,IAAI,CAAC,gBAAgB,MAAM,cAAc,KAAA,KAAa,MAAM,kBAAkB,KAAA,IAC5E,MAAM,IAAI,MACR,iFAAiF,YAAY,sDAC/F;CAEF,IAAI,gBAAgB,MAAM,cAAc,KAAA,KAAa,MAAM,kBAAkB,KAAA,IAC3E,MAAM,IAAI,MACR,wCAAwC,YAAY,sDACtD;CAEF,IAAI,oBAAoB,KAAA,GAAW;EACjC,IAAI,aAAa,kBAAkB,MAAM,QAAQ,MAAM,MAAM,WAAY,MAAM,aAAc;OAExF,kBAAkB,CAAC;EAGxB,qBAAqB,OAAO,UAAU,CAAC,CAAC,eAAe;CACzD;CAEA,OAAO;EACL,MAAM;EACN,MAAM;GACJ;GACA,UAAU,qBAAqB,OAAO,UAAU;GAChD,aAAa;GACb,eAAe;EACjB;CACF;AACF;AAEA,eAAsB,gBAAgB,gBAAyC,CAAC,GAAG;CACjF,MAAM,EAAE,MAAM,SAAS,MAAM,kBAAkB;CAC/C,OAAO,MAAM,WAAW,MAAM;EAAE,GAAG;EAAM,GAAG;CAAc,GAAG,EAAE,KAAK,CAAC;AACvE;;;;;AAMA,eAAsB,yBAA2E;CAC/F,MAAM,QAAQ,cAAc;CAE5B,IAAI,MAAM,oBAAoB,KAAA,KAAa,MAAM,wBAAwB,KAAA,GACvE,OAAO,MAAM,kBAAkB;CAEjC,MAAM,SAAS,sBAAsB,MAAM,OAAO;CAIlD,OAAO;EACL,MAAM;EACN,MAAM;GACJ,iBAAA,OAL0B,MADR,wBAAwB,MAAM,MAAM,EAAA,CACpB,MAAM,MAAM,iBAAiB,MAAM,mBAAmB;GAMxF,gBAAgB,CAAC;GACjB,mBAAmB,CAAC;GACpB,qBAAqB,CAAC;EACxB;CACF;AACF;AAEA,eAAsB,qBAAqB,gBAAyC,CAAC,GAAG;CACtF,MAAM,EAAE,MAAM,SAAS,MAAM,uBAAuB;CACpD,OAAO,MAAM,WAAW,MAAM;EAAE,GAAG;EAAM,GAAG;CAAc,GAAG,EAAE,KAAK,CAAC;AACvE;AAEA,eAAsB,mBACpB,iBACA,gBAAyC,CAAC,GAC1C;CACA,MAAM,EAAE,MAAM,SAAS,MAAM,uBAAuB;CACpD,IAAI,oBAAoB,KAAA,KAAa,KAAK,oBAAoB,KAAA,GAC5D,MAAM,IAAI,MAAM,kDAAkD;CACpE,OAAO,MAAM,SAAS,KAAK;EAAE,GAAG;EAAM,GAAG;EAAe;CAAgB,GAAG,IAAI;AACjF;AAEA,eAAsB,kBAAqB,MAAuD;CAChG,MAAM,kBAAkB,QAAQ,KAAK,IAAI,EAAE,GAAG,WAAW;CACzD,IAAI,YAAA;CACJ,IAAI;EACF,MAAM,SAAS,MAAM,mBAAmB,eAAe;EACvD,YAAY,OAAO;EACnB,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,MAAM;GAC/B,MAAM,YAAY,MAAM,mBAAmB;GAC3C,IAAI;IACF,MAAM,UAAU,sBAAsB,eAAe;GACvD,SAAS,YAAiB;IACxB,QAAQ,KAAK,uCAAuC,gBAAgB,IAAI,WAAW,OAAO;GAC5F,UAAU;IACR,MAAM,UAAU,MAAM;GACxB;GACA,OAAO;EACT,UAAU;GACR,MAAM,OAAO,MAAM;EACrB;CACF,SAAS,KAAU;EACjB,QAAQ,IAAI,qBAAqB,gBAAgB,IAAI,mBAAmB,SAAS,EAAE,EAAE;EACrF,MAAM;CACR;AACF;AAEA,eAAsB,cACpB,iBACA,gBAAyC,CAAC,GAC1C;CACA,MAAM,EAAE,MAAM,SAAS,MAAM,kBAAkB;CAC/C,IAAI,oBAAoB,KAAA,KAAa,KAAK,oBAAoB,KAAA,GAC5D,MAAM,IAAI,MAAM,kDAAkD;CACpE,OAAO,MAAM,SAAS,KAAK;EAAE,GAAG;EAAM,GAAG;EAAe;CAAgB,GAAG,IAAI;AACjF;AAwBA,eAAsB,aACpB,MACA,UAA+B,CAAC,GACR;CACxB,MAAM,kBAAkB,QAAQ,KAAK,IAAI,EAAE,GAAG,WAAW;CACzD,IAAI,YAAA;CAEJ,IAAI;CACJ,IAAI,gBAAyC,CAAC;CAC9C,IAAI;EAEF,IAAI,QAAQ,gBAAgB,QAAQ,QAAQ,IAAI,YAC9C,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI,UAAU;GAC1C,MAAM,SAAS,IAAI,aAAa;GAChC,MAAM,UAAU,IAAI,aAAa,eAAe,IAAI,aAAa;GACjE,MAAM,OAAO,SAAS,IAAI,IAAI;GAC9B,IAAI,UAAU,WAAW,OAAO,SAAS,IAAI,GAAG;IAC9C,QAAQ,MAAM,cAAc;KAAE,YAAY;KAAM,SAAS,QAAQ,kBAAkB;IAAE,CAAC;IAEtF,gBAAgB,EAAE,aAAa,aAAa,MAAM,OAAO;GAC3D,OAAO;IACL,QAAQ,KACN,8DACA,QAAQ,IAAI,UACd;IACA;GACF;EACF,QAAQ,CAER;EAGF,MAAM,SAAS,MAAM,cAAc,iBAAiB,aAAa;EACjE,YAAY,OAAO;EACnB,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK;GACtC,MAAM,YAAY,MAAM,cAAc;GACtC,IAAI;IACF,MAAM,UAAU,sBAAsB,eAAe;GACvD,SAAS,YAAiB;IAExB,QAAQ,KAAK,uCAAuC,gBAAgB,IAAI,WAAW,OAAO;GAC5F,UAAU;IAGR,MAAM,UAAU,MAAM;GACxB;GACA,OAAO;EACT,UAAU;GAER,MAAM,OAAO,MAAM;EACrB;CACF,SAAS,KAAU;EACjB,QAAQ,IAAI,qBAAqB,gBAAgB,IAAI,mBAAmB,SAAS,EAAE,EAAE;EACrF,MAAM;CAER,UAAU;EAER,IAAI,OAAO;GACT,IAAI;IACF,MAAM,MAAM,cAAc;GAC5B,QAAQ,CAER;GACA,IAAI;IACF,MAAM,IAAI,SAAe,YAAY,MAAO,OAAO,YAAY,QAAQ,CAAC,CAAC;GAC3E,QAAQ,CAER;EACF;CACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@milaboratories/pl-client",
-  "version": "3.17.0",
+  "version": "3.17.2",
   "description": "New TS/JS client for Platform API",
   "files": [
     "./dist/**/*",
@@ -31,7 +31,7 @@
     "utility-types": "^3.11.0",
     "yaml": "^2.8.0",
     "@milaboratories/pl-http": "1.2.4",
-    "@milaboratories/pl-model-common": "1.49.0",
+    "@milaboratories/pl-model-common": "1.50.0",
     "@milaboratories/ts-helpers": "1.8.6"
   },
   "devDependencies": {
@@ -41,9 +41,9 @@
     "openapi-typescript": "^7.13.0",
     "typescript": "7.0.2",
     "vitest": "^4.1.3",
-    "@milaboratories/build-configs": "2.0.1",
-    "@milaboratories/ts-configs": "1.4.0",
-    "@milaboratories/ts-builder": "1.7.2"
+    "@milaboratories/build-configs": "2.0.2",
+    "@milaboratories/ts-builder": "1.7.2",
+    "@milaboratories/ts-configs": "1.4.0"
   },
   "engines": {
     "node": ">=22.19.0"

package/src/core/client.test.ts

@@ -1,4 +1,4 @@
-import { getTestClient, getTestClientConf } from "../test/test_config";
+import { getTestAdminClient, getTestAdminClientConf } from "../test/test_config";
 import { PlClient } from "./client";
 import { PlDriver, PlDriverDefinition } from "./driver";
 import { Dispatcher, request } from "undici";
@@ -6,12 +6,12 @@ import { GrpcClientProviderFactory } from "./grpc";
 import { test, expect } from "vitest";
 
 test("test client init", async () => {
-  await getTestClient(undefined);
+  await getTestAdminClient(undefined);
 });
 
 test("test client alternative root init", async () => {
   const aRootName = "test_root";
-  const { conf, auth } = await getTestClientConf();
+  const { conf, auth } = await getTestAdminClientConf();
   await PlClient.init({ ...conf, alternativeRoot: aRootName }, auth);
   const clientB = await PlClient.init(conf, auth);
   const result = await clientB.deleteAlternativeRoot(aRootName);
@@ -19,7 +19,7 @@ test("test client alternative root init", async () => {
 });
 
 test("test client init 2", async () => {
-  await getTestClient();
+  await getTestAdminClient();
 });
 
 interface SimpleDriver extends PlDriver {
@@ -46,7 +46,7 @@ const SimpleDriverDefinition: PlDriverDefinition<SimpleDriver> = {
 };
 
 test("test driver", async () => {
-  const client = await getTestClient();
+  const client = await getTestAdminClient();
   const drv = client.getDriver(SimpleDriverDefinition);
   expect(await drv.ping()).toEqual("pong");
 });

package/src/core/ll_client.test.ts

@@ -3,6 +3,8 @@ import {
   getTestConfig,
   plAddressToTestConfig,
   getTestLLClient,
+  getTestAdminLLClient,
+  getTestAdminClient,
   getTestClientConf,
 } from "../test/test_config";
 import {
@@ -160,7 +162,12 @@ test("test https call via proxy", async () => {
 });
 
 test("list user resources returns user root", async () => {
-  const client = await getTestLLClient();
+  // PlClient.init() creates the user root via the legacy path, which requires the admin
+  // role. After that, listUserResources returns it.
+  const plClient = await getTestAdminClient();
+  await plClient.close();
+
+  const client = await getTestAdminLLClient();
 
   let responses: AuthAPI_ListUserResources_Response[] = [];
   try {

package/src/core/ll_transaction.test.ts

@@ -1,4 +1,4 @@
-import { getTestClient, getTestLLClient } from "../test/test_config";
+import { getTestClient, getTestLLClient, getTestAdminLLClient } from "../test/test_config";
 import { TxAPI_Open_Request_WritableTx } from "../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api";
 import { createLocalResourceId, parseSignedResourceId } from "./types";
 import { test, expect } from "vitest";
@@ -95,7 +95,7 @@ test("check timeout error type (passive)", async () => {
 });
 
 test("check timeout error type (active)", async () => {
-  const client = await getTestLLClient();
+  const client = await getTestAdminLLClient();
   const rootSig = await getRootSignature();
   const tx = client.createTx(true, { timeout: 500 });
 
@@ -172,7 +172,7 @@ test("check timeout error type (active)", async () => {
 });
 
 test("check is abort error (active)", async () => {
-  const client = await getTestLLClient();
+  const client = await getTestAdminLLClient();
   const rootSig = await getRootSignature();
   const tx = client.createTx(true, { abortSignal: AbortSignal.timeout(100) });
 

package/src/core/transaction.test.ts

@@ -1,4 +1,4 @@
-import { withTempRoot } from "../test/test_config";
+import { withAdminTempRoot, withTempRoot } from "../test/test_config";
 import { StructTestResource, ValueTestResource } from "../helpers/pl";
 import { field, toGlobalFieldId, toGlobalResourceId } from "./transaction";
 import { RecoverablePlError } from "./errors";
@@ -7,7 +7,7 @@ import { test, expect } from "vitest";
 import { StatefulPromise } from "./StatefulPromise";
 
 test("get field", async () => {
-  await withTempRoot(async (pl) => {
+  await withAdminTempRoot(async (pl) => {
     const [rr0, theField1] = await pl.withWriteTx("resource1", async (tx) => {
       const r0 = tx.createStruct(StructTestResource);
       const r1 = tx.createStruct(StructTestResource);
@@ -54,7 +54,7 @@ test("get field", async () => {
 });
 
 test("handle absent resource error", async () => {
-  await withTempRoot(async (pl) => {
+  await withAdminTempRoot(async (pl) => {
     const [rr0, ff0] = await pl.withWriteTx("testCreateResource", async (tx) => {
       const r0 = tx.createStruct(StructTestResource);
       const f0 = { resourceId: tx.clientRoot, fieldName: "test0" };
@@ -114,7 +114,7 @@ test("handle absent resource error", async () => {
 });
 
 test("handle KV storage", async () => {
-  await withTempRoot(async (pl) => {
+  await withAdminTempRoot(async (pl) => {
     await pl.withWriteTx("writeKV", async (tx) => {
       tx.setKValue(tx.clientRoot, "a", "a");
       tx.setKValue(tx.clientRoot, "b", "b");
@@ -151,7 +151,7 @@ test("handle KV storage", async () => {
 });
 
 test("handle empty KV storage", async () => {
-  await withTempRoot(async (pl) => {
+  await withAdminTempRoot(async (pl) => {
     await pl.withReadTx("testReadIndividualAndList", async (tx) => {
       expect(await tx.listKeyValuesString(tx.clientRoot)).toEqual([]);
     });
@@ -159,7 +159,7 @@ test("handle empty KV storage", async () => {
 });
 
 test("handle KV storage 2", async () => {
-  await withTempRoot(async (pl) => {
+  await withAdminTempRoot(async (pl) => {
     const r1 = await pl.withWriteTx("writeKV", async (tx) => {
       const rr1 = tx.createEphemeral(StructTestResource);
       tx.createField(field(rr1, "a"), "Dynamic", rr1);

package/src/test/test_config.test.ts

@@ -1,7 +1,20 @@
-import { getTestClientConf } from "./test_config";
+import { getTestClientConf, plAddressToTestConfig, TEST_REQUEST_TIMEOUT } from "./test_config";
 import { test, expect } from "vitest";
 
 test("test that test config have no alternative root set", async () => {
   const { conf } = await getTestClientConf();
   expect(conf.alternativeRoot).toBeUndefined();
 });
+
+test("address request-timeout survives the test config", () => {
+  expect(
+    plAddressToTestConfig("http://pl.example:6345?request-timeout=3000").defaultRequestTimeout,
+  ).toBe(3000);
+});
+
+test("address without request-timeout takes the test one", () => {
+  expect(plAddressToTestConfig("http://pl.example:6345").defaultRequestTimeout).toBe(
+    TEST_REQUEST_TIMEOUT,
+  );
+  expect(plAddressToTestConfig("pl.example:6345").defaultRequestTimeout).toBe(TEST_REQUEST_TIMEOUT);
+});

package/src/test/test_config.ts

@@ -19,6 +19,8 @@ export interface TestConfig {
   test_proxy?: string;
   test_user?: string;
   test_password?: string;
+  test_admin_user?: string;
+  test_admin_password?: string;
 }
 
 const CONFIG_FILE = "test_config.json";
@@ -44,6 +46,12 @@ export function getTestConfig(): TestConfig {
 
   if (process.env.PL_TEST_PROXY !== undefined) conf.test_proxy = process.env.PL_TEST_PROXY;
 
+  if (process.env.PL_TEST_ADMIN_USER !== undefined)
+    conf.test_admin_user = process.env.PL_TEST_ADMIN_USER;
+
+  if (process.env.PL_TEST_ADMIN_PASSWORD !== undefined)
+    conf.test_admin_password = process.env.PL_TEST_ADMIN_PASSWORD;
+
   if (conf.address === undefined)
     throw new Error(
       `can't resolve platform address (checked ${CONFIG_FILE} file and PL_ADDRESS environment var)`,
@@ -52,13 +60,37 @@ export function getTestConfig(): TestConfig {
   return conf as TestConfig;
 }
 
-/** Default request timeout for tests (ms) */
-export const TEST_REQUEST_TIMEOUT = 500;
+/**
+ * Default request timeout for tests (ms).
+ *
+ * Kept short so a hung call fails the test instead of the suite's own budget. A deploy the
+ * tests reach over cluster DNS needs more than that on first contact, where the deadline
+ * covers name resolution too:
+ *
+ *   RpcError: Deadline exceeded after 0.500s,waiting for name resolution
+ *
+ * That call builds the shared client, so the whole file dies with it and retries only
+ * repeat the error against an undefined client. PL_TEST_REQUEST_TIMEOUT raises the budget
+ * where resolution is slow, and every other environment keeps the short one.
+ */
+export const TEST_REQUEST_TIMEOUT = Number(process.env.PL_TEST_REQUEST_TIMEOUT ?? 500);
+
+/** True when the address carries an explicit `request-timeout` query parameter. */
+function addressStatesRequestTimeout(address: string): boolean {
+  if (address.indexOf("://") === -1) return false;
+  return new URL(address).searchParams.has("request-timeout");
+}
 
-/** Returns PlClientConfig with reduced timeout for tests */
+/** Returns PlClientConfig with reduced timeout for tests, unless the address sets its own */
 export function plAddressToTestConfig(address: string): PlClientConfig {
   const plConf = plAddressToConfig(address);
-  plConf.defaultRequestTimeout = TEST_REQUEST_TIMEOUT;
+  // An explicit request-timeout in the address wins over TEST_REQUEST_TIMEOUT. In the k8s e2e
+  // deploy the client dials a cluster service DNS name, and the first call on a cold channel must
+  // finish name resolution and get a load-balancer pick before it is even sent; 500ms does not
+  // cover that, so whichever test happened to open the cold channel died with DEADLINE_EXCEEDED
+  // ("Waiting for LB pick") against a healthy backend. Addresses that carry no request-timeout
+  // keep the short default, so local runs still fail fast.
+  if (!addressStatesRequestTimeout(address)) plConf.defaultRequestTimeout = TEST_REQUEST_TIMEOUT;
   return plConf;
 }
 
@@ -178,6 +210,72 @@ export async function getTestLLClient(confOverrides: Partial<PlClientConfig> = {
   return await LLPlClient.build({ ...conf, ...confOverrides }, { auth });
 }
 
+/** Returns a config logged in as the admin test user, or the ordinary test config where no
+ * admin credentials are set. A backend that needs no auth, and one whose single test user
+ * already holds the admin role, both leave PL_TEST_ADMIN_USER and PL_TEST_ADMIN_PASSWORD
+ * unset, and a test that asks for admin must still run there. */
+export async function getTestAdminClientConf(): Promise<{ conf: PlClientConfig; auth: AuthOps }> {
+  const tConf = getTestConfig();
+
+  if (tConf.test_admin_user === undefined || tConf.test_admin_password === undefined)
+    return await getTestClientConf();
+
+  const plConf = plAddressToTestConfig(tConf.address);
+  const uClient = await UnauthenticatedPlClient.build(plConf);
+  const authInformation = await uClient.login(tConf.test_admin_user, tConf.test_admin_password);
+
+  return {
+    conf: plConf,
+    auth: {
+      authInformation,
+      onUpdate: () => {},
+      onAuthError: () => {},
+      onUpdateError: () => {},
+    },
+  };
+}
+
+export async function getTestAdminLLClient(confOverrides: Partial<PlClientConfig> = {}) {
+  const { conf, auth } = await getTestAdminClientConf();
+  return await LLPlClient.build({ ...conf, ...confOverrides }, { auth });
+}
+
+export async function getTestAdminClient(
+  alternativeRoot?: string,
+  confOverrides: Partial<PlClientConfig> = {},
+) {
+  const { conf, auth } = await getTestAdminClientConf();
+  if (alternativeRoot !== undefined && conf.alternativeRoot !== undefined)
+    throw new Error("test pl address configured with alternative root");
+  return await PlClient.init({ ...conf, ...confOverrides, alternativeRoot }, auth);
+}
+
+export async function withAdminTempRoot<T>(body: (pl: PlClient) => Promise<T>): Promise<T | void> {
+  const alternativeRoot = `test_${Date.now()}_${randomUUID()}`;
+  let altRootId: OptionalSignedResourceId = NullSignedResourceId;
+  try {
+    const client = await getTestAdminClient(alternativeRoot);
+    altRootId = client.clientRoot;
+    try {
+      const value = await body(client);
+      const rawClient = await getTestAdminClient();
+      try {
+        await rawClient.deleteAlternativeRoot(alternativeRoot);
+      } catch (cleanupErr: any) {
+        console.warn(`Failed to clean up alternative root ${alternativeRoot}:`, cleanupErr.message);
+      } finally {
+        await rawClient.close();
+      }
+      return value;
+    } finally {
+      await client.close();
+    }
+  } catch (err: any) {
+    console.log(`ALTERNATIVE ROOT: ${alternativeRoot} (${resourceIdToString(altRootId)})`);
+    throw err;
+  }
+}
+
 export async function getTestClient(
   alternativeRoot?: string,
   confOverrides: Partial<PlClientConfig> = {},