@norskvideo/ctl-test-harness 0.1.63 → 0.1.65

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-test-harness",
-  "version": "0.1.63",
+  "version": "0.1.65",
   "type": "module",
   "exports": {
     ".": {

package/source-pump.js

@@ -65,21 +65,52 @@ function secretForDaemonPort(port) {
     const storeDir = storeDirForDaemonPort(port);
     return storeDir === undefined ? undefined : readProxySecret(storeDir);
 }
+/** The secret to stamp on the NEXT request, resolved per request rather than
+ *  once per call.
+ *
+ *  The ingress guard issues a fresh `crypto.randomUUID()` and REWRITES
+ *  `<store>/proxy-secret` on every proxy configure, and the proxy is recreated
+ *  mid-run whenever its mounts or ports stop matching the expected config. So a
+ *  secret read once and reused for a 120s poll goes stale the moment that
+ *  happens: the POST is admitted, a recreation follows, and every later GET is
+ *  307'd until the window runs out. (commentary's integration, red from
+ *  2026-09-24 — the earlier fix covered only the never-sent-one case.)
+ *
+ *  A caller-supplied `proxySecret` is returned as given: it belongs to a daemon
+ *  this process did not start, so this process has no store to re-read, and
+ *  keeping it fresh is the caller's. */
+function currentSecret(opts) {
+    return opts.proxySecret ?? secretForDaemonPort(opts.daemonPort);
+}
 /** A 307/308 off `/api/*` is the daemon's guard, not a route that moved: the
  *  API itself never redirects. */
 function isGuardRedirect(res) {
     return res.status === 307 || res.status === 308;
 }
-function guardRedirectError(method, res, sentSecret) {
+/** Why the guard refused, in the words of what this process can actually see.
+ *
+ *  `sentSecret` is the secret that WAS stamped on the refused request, not the
+ *  caller's `proxySecret` option. Reporting the option instead made every
+ *  refusal claim "no secret was sent / this process started no daemon on that
+ *  port" — including the ones where a secret came from the registry and was
+ *  simply stale, which is the case that actually had commentary red. The
+ *  wrong half of the message is the half an operator acts on. */
+function guardRedirectError(method, res, sentSecret, storeKnown) {
     const where = res.headers.get("location");
-    return new Error(`${method} /api/sources was refused by the daemon's ingress guard (${res.status} -> ${where ?? "the ingress port"}). ` +
-        (sentSecret
-            ? "The x-norsk-proxy secret that was sent is not the one this daemon holds — it is re-issued on start, so a " +
-                "secret read before the daemon booted is stale (read it after `ready`)."
+    const why = sentSecret
+        ? "The x-norsk-proxy secret that was sent is not the one this daemon holds. The ingress re-issues it and rewrites " +
+            "<store>/proxy-secret on every proxy configure — including a mid-run recreation — so a secret cached for the " +
+            "length of a poll goes stale."
+        : storeKnown
+            ? "No x-norsk-proxy secret was sent: this process started the daemon on that port, but its store holds no " +
+                "proxy-secret yet. The ingress writes it as the proxy comes up, so either the proxy has not come up or this " +
+                "daemon is `test-unguarded`."
             : "No x-norsk-proxy secret was sent, and RFC 0003 D10b removed the loopback bypass, so a local caller needs " +
                 "one too. This process started no daemon on that port, so there was no store to read one from: either start " +
                 "it through the harness's startDaemon, or read the secret yourself with `readProxySecret(storeDir)` and pass " +
-                "it as `proxySecret`.") +
+                "it as `proxySecret`.";
+    return new Error(`${method} /api/sources was refused by the daemon's ingress guard (${res.status} -> ${where ?? "the ingress port"}). ` +
+        `${why}` +
         " Following this redirect instead is what turns a missing secret into an unrelated-looking ConnectionRefused or " +
         "a `Failed to parse JSON` on nginx's HTML.");
 }
@@ -90,12 +121,14 @@ export async function startCameraSource(opts) {
     const asset = opts.asset ?? { preset: opts.preset ?? "camera1" };
     const name = opts.name ?? defaultSourceName(asset);
     const fetchImpl = opts.fetch ?? ((url, init) => fetch(url, init));
-    // Resolved here, not at the call site: every caller has the port and almost
-    // none has the store dir, which is exactly why the explicit option went
-    // unpassed. Read now rather than when the daemon was registered — the guard
-    // issues the secret as the proxy comes up, after startDaemon returns.
-    const secret = opts.proxySecret ?? secretForDaemonPort(opts.daemonPort);
-    const headers = secret ? { "x-norsk-proxy": secret } : {};
+    // Resolved per request, not at the call site: every caller has the port and
+    // almost none has the store dir, which is exactly why the explicit option
+    // went unpassed — and the secret is re-issued under us, so one read per call
+    // is not enough (see currentSecret).
+    const stamp = () => {
+        const secret = currentSecret(opts);
+        return { secret, headers: secret ? { "x-norsk-proxy": secret } : {} };
+    };
     const base = `http://localhost:${opts.daemonPort}`;
     const body = {
         instanceId: opts.instanceId,
@@ -105,9 +138,10 @@ export async function startCameraSource(opts) {
     };
     if (opts.streamId !== undefined)
         body.streamId = opts.streamId;
+    const post = stamp();
     const startRes = await fetchImpl(`${base}/api/sources`, {
         method: "POST",
-        headers: { ...headers, "Content-Type": "application/json" },
+        headers: { ...post.headers, "Content-Type": "application/json" },
         body: JSON.stringify(body),
         // MANUAL. The guard answers an unsecreted /api/* with a 307 to the ingress
         // port, and a followed redirect hides which call was refused: on a runner
@@ -118,14 +152,16 @@ export async function startCameraSource(opts) {
         redirect: "manual",
         signal: AbortSignal.timeout(10_000),
     });
-    if (isGuardRedirect(startRes))
-        throw guardRedirectError("POST", startRes, opts.proxySecret);
+    if (isGuardRedirect(startRes)) {
+        throw guardRedirectError("POST", startRes, post.secret, storeDirForDaemonPort(opts.daemonPort) !== undefined);
+    }
     if (!startRes.ok) {
         throw new Error(`POST /api/sources failed (${startRes.status}): ${await startRes.text()}`);
     }
     await pollUntil(async () => {
+        const poll = stamp();
         const r = await fetchImpl(`${base}/api/sources?instanceId=${encodeURIComponent(opts.instanceId)}`, {
-            headers,
+            headers: poll.headers,
             redirect: "manual",
             signal: AbortSignal.timeout(5000),
         });
@@ -133,8 +169,9 @@ export async function startCameraSource(opts) {
         // condition, and pollUntil carries the last error into its timeout
         // message. Returning false spends the whole window and then says only
         // that the source never ran.
-        if (isGuardRedirect(r))
-            throw guardRedirectError("GET", r, opts.proxySecret);
+        if (isGuardRedirect(r)) {
+            throw guardRedirectError("GET", r, poll.secret, storeDirForDaemonPort(opts.daemonPort) !== undefined);
+        }
         if (!r.ok)
             return false;
         // GET /api/sources returns a bare array of SampleSource — not { sources: [...] }.
@@ -151,7 +188,9 @@ export async function startCameraSource(opts) {
         async stop() {
             await fetchImpl(`${base}/api/sources/${encodeURIComponent(opts.instanceId)}/${encodeURIComponent(name)}`, {
                 method: "DELETE",
-                headers,
+                // Stamped now, not at launch: teardown is the furthest a cached secret
+                // ever gets from the one the ingress currently holds.
+                headers: stamp().headers,
                 // Swallowed either way (stopAll sweeps the instance), but not chased:
                 // following the guard's redirect to a port this process may not reach
                 // spends the full 10s timeout on every source at teardown.