@norskvideo/ctl-test-harness 0.1.57 → 0.1.58

package/daemon-stores.d.ts

@@ -0,0 +1,5 @@
+/** Called by startDaemon. Last writer wins: a port reused by a later daemon in
+ *  the same process belongs to that daemon. */
+export declare function rememberDaemonStore(port: number, storeDir: string): void;
+export declare function forgetDaemonStore(port: number): void;
+export declare function storeDirForDaemonPort(port: number): string | undefined;

package/daemon-stores.js

@@ -0,0 +1,31 @@
+// Which store dir the daemon on a given port was started with.
+//
+// The daemon's ingress secret lives in its store (`<storeDir>/proxy-secret`),
+// and RFC 0003 D10b guards /api/* for loopback callers too — so anything
+// driving a test daemon's API needs that file. Every caller already has the
+// PORT; almost none of them has the store dir, because a test holds a harness
+// that started the daemon for it. That gap is why `startCameraSource` shipped
+// with a `proxySecret` option that nearly nobody passed, and why five product
+// repos' smoke tiers were 307'd for days.
+//
+// `startDaemon` knows both, so it records the pairing here and the pump looks
+// it up. Deliberately a process-global: the two are one-to-one within a test
+// process (one daemon per port), and the alternative — threading a store dir
+// through every helper signature and every call site — is the arrangement that
+// already failed.
+//
+// A daemon this process did not start (the demo driver's `reuse` policy, a
+// developer's own `norsk-ctl serve`) is absent, and callers that know their
+// store read it themselves.
+const storeByPort = new Map();
+/** Called by startDaemon. Last writer wins: a port reused by a later daemon in
+ *  the same process belongs to that daemon. */
+export function rememberDaemonStore(port, storeDir) {
+    storeByPort.set(port, storeDir);
+}
+export function forgetDaemonStore(port) {
+    storeByPort.delete(port);
+}
+export function storeDirForDaemonPort(port) {
+    return storeByPort.get(port);
+}

package/daemon.js

@@ -12,6 +12,7 @@ import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createServer } from "node:net";
 import { join } from "node:path";
 import { cliCommand } from "./cli-command.js";
+import { rememberDaemonStore } from "./daemon-stores.js";
 import { pollUntil } from "./poll.js";
 import { makeStoreDir, makeTempDir, TEST_TMP_BASE } from "./temp-dir.js";
 export const HEALTH_TIMEOUT_MS = 120_000;
@@ -146,6 +147,9 @@ export function seedDaemonConfig(storeDir) {
 }
 export function startDaemon(storeDir, options) {
     const port = options?.port ?? 8333;
+    // Before the spawn, so anything reaching for this daemon's ingress secret can
+    // find its store by the port it will answer on (daemon-stores.ts).
+    rememberDaemonStore(port, storeDir);
     killProcessOnPort(port);
     if (options?.seedConfig !== false)
         seedDaemonConfig(storeDir);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-test-harness",
-  "version": "0.1.57",
+  "version": "0.1.58",
   "type": "module",
   "exports": {
     ".": {
@@ -15,6 +15,10 @@
       "types": "./daemon.d.ts",
       "default": "./daemon.js"
     },
+    "./daemon-stores": {
+      "types": "./daemon-stores.d.ts",
+      "default": "./daemon-stores.js"
+    },
     "./image-surface": {
       "types": "./image-surface.d.ts",
       "default": "./image-surface.js"

package/source-pump.d.ts

@@ -42,16 +42,17 @@ export interface StartCameraSourceOptions {
      *  (kept even when the fallback is used, so the handle is stable). Required
      *  when the same asset must run multiple times within an instance. */
     name?: string;
-    /** Sent as `x-norsk-proxy`. **Effectively required.** `readProxySecret`
-     *  reads it out of the store the daemon was started with; pass what that
-     *  returns.
+    /** Sent as `x-norsk-proxy`. **Usually leave this out**: when the daemon on
+     *  `daemonPort` was started by this process's harness, the secret is resolved
+     *  from its store automatically. Pass it only for a daemon the harness did
+     *  not start — the demo driver's `reuse` policy, or a developer's own
+     *  `norsk-ctl serve`.
      *
-     *  BREAKING for callers that omitted it (RFC 0003 D10b, ctl >= this
-     *  release): the daemon used to admit any loopback caller without a secret
-     *  while TLS was off, and that bypass is gone — a loopback caller is a host
-     *  admin, and a host admin can read the secret file. A harness or guide that
-     *  relied on it now fails on the guard's 307, which `guardRedirectError`
-     *  names rather than following. */
+     *  RFC 0003 D10b: the daemon used to admit any loopback caller without a
+     *  secret while TLS was off, and that bypass is gone — a loopback caller is a
+     *  host admin, and a host admin can read the secret file. When neither this
+     *  option nor the registry supplies one, the call meets the guard's 307,
+     *  which `guardRedirectError` names rather than following. */
     proxySecret?: string;
     timeoutMs?: number;
     /** Test seams. */

package/source-pump.js

@@ -18,6 +18,7 @@
 // file the daemon writes.
 import { existsSync, readFileSync } from "node:fs";
 import { basename, extname, join } from "node:path";
+import { storeDirForDaemonPort } from "./daemon-stores.js";
 import { pollUntil } from "./poll.js";
 /** Where every daemon the harness starts writes its ingress secret: the store
  *  root (the guard's stateDir is `<storeDir>` under NORSK_CTL_STORE_DIR). One
@@ -58,6 +59,12 @@ function assetFields(asset, fileExists) {
     }
     return { ...asset };
 }
+/** The secret of whichever daemon this process started on `port`, or undefined
+ *  for a daemon it did not start. */
+function secretForDaemonPort(port) {
+    const storeDir = storeDirForDaemonPort(port);
+    return storeDir === undefined ? undefined : readProxySecret(storeDir);
+}
 /** A 307/308 off `/api/*` is the daemon's guard, not a route that moved: the
  *  API itself never redirects. */
 function isGuardRedirect(res) {
@@ -70,7 +77,9 @@ function guardRedirectError(method, res, sentSecret) {
             ? "The x-norsk-proxy secret that was sent is not the one this daemon holds — it is re-issued on start, so a " +
                 "secret read before the daemon booted is stale (read it after `ready`)."
             : "No x-norsk-proxy secret was sent, and RFC 0003 D10b removed the loopback bypass, so a local caller needs " +
-                "one too. Read it with `readProxySecret(storeDir)` and pass it as `proxySecret`.") +
+                "one too. This process started no daemon on that port, so there was no store to read one from: either start " +
+                "it through the harness's startDaemon, or read the secret yourself with `readProxySecret(storeDir)` and pass " +
+                "it as `proxySecret`.") +
         " Following this redirect instead is what turns a missing secret into an unrelated-looking ConnectionRefused or " +
         "a `Failed to parse JSON` on nginx's HTML.");
 }
@@ -81,7 +90,12 @@ export async function startCameraSource(opts) {
     const asset = opts.asset ?? { preset: opts.preset ?? "camera1" };
     const name = opts.name ?? defaultSourceName(asset);
     const fetchImpl = opts.fetch ?? ((url, init) => fetch(url, init));
-    const headers = opts.proxySecret ? { "x-norsk-proxy": opts.proxySecret } : {};
+    // Resolved here, not at the call site: every caller has the port and almost
+    // none has the store dir, which is exactly why the explicit option went
+    // unpassed. Read now rather than when the daemon was registered — the guard
+    // issues the secret as the proxy comes up, after startDaemon returns.
+    const secret = opts.proxySecret ?? secretForDaemonPort(opts.daemonPort);
+    const headers = secret ? { "x-norsk-proxy": secret } : {};
     const base = `http://localhost:${opts.daemonPort}`;
     const body = {
         instanceId: opts.instanceId,