gowalk-cicd 1.0.148 → 1.0.149

package/CLAUDE.md

@@ -249,7 +249,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   `backend-<app>-edge.conf`; preserve a legacy vhost's TLS/public access and update both managed
   ports. A missing token/settings cannot downgrade an already protected app. Keep tokens in private
   stdin/file transport, strip the ingress header before app forwarding, and validate real nginx in
-  focused tests. Preserve legacy deployments that have not opted in and existing failure phases.
+  focused tests. Managed locations forward WebSocket upgrades with a domain-scoped Connection map
+  and disable response buffering; verify a real frame exchange and a first SSE event before upstream
+  completion. Preserve legacy deployments that have not opted in and existing failure phases.
 - The Android action serves two build systems. `android_config.project_kind()`
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie

package/action/.daemux-version

@@ -1 +1 @@
-1.0.148
+1.0.149

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.148
+1.0.149

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.148
+1.0.149

package/backend-action/configure_vhost.py

@@ -1,4 +1,5 @@
-"""Update one managed nginx upstream without discarding Certbot's HTTPS configuration."""
+"""Update managed nginx transport without discarding Certbot's HTTPS configuration."""
+import hashlib
 import os
 from pathlib import Path
 import re
@@ -7,6 +8,29 @@ import sys
 import tempfile
 
 
+def transport(text, domain):
+    variable = "$gowalk_backend_connection_" + hashlib.sha256(domain.encode()).hexdigest()[:16]
+    mapping = f"map $http_upgrade {variable} {{\n    default upgrade;\n    '' close;\n}}\n\n"
+    result = text.removeprefix(mapping)
+    directives = (r"proxy_http_version", r"proxy_set_header[ \t]+Upgrade",
+                  r"proxy_set_header[ \t]+Connection", r"proxy_buffering")
+    for directive in directives:
+        pattern = rf"(?mi)^[ \t]*{directive}[ \t]+[^;\n]+;[^\n]*\n"
+        result, count = re.subn(pattern, "", result)
+        if count > 1:
+            raise ValueError("managed transport directive is not unique")
+    if variable in result:
+        raise ValueError("managed connection map is not recognized")
+    settings = ("proxy_http_version 1.1;", "proxy_set_header Upgrade $http_upgrade;",
+                f"proxy_set_header Connection {variable};", "proxy_buffering off;")
+    pattern = r"(?m)^([ \t]*)proxy_pass[ \t]+http://127\.0\.0\.1:\d+;[^\n]*$"
+    result, count = re.subn(pattern, lambda match: match[0] + "\n"
+                            + "\n".join(match[1] + setting for setting in settings), result)
+    if count != 1:
+        raise ValueError("managed upstream is not unique")
+    return mapping + result
+
+
 def content(previous, domain, port):
     if not re.fullmatch(r"[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?", domain) or not 0 < port < 65536:
         raise ValueError("invalid domain or port")
@@ -18,14 +42,13 @@ def content(previous, domain, port):
         result, count = re.subn(pattern, lambda match: f"{match[1]}{port}{match[2]}", previous)
         if count != 1:
             raise ValueError("managed upstream is not unique")
-        return result
-    return f"""server {{
+        return transport(result, domain)
+    return transport(f"""server {{
     listen 80;
     server_name {domain};
     client_max_body_size 100m;
     location / {{
         proxy_pass http://127.0.0.1:{port};
-        proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -33,7 +56,7 @@ def content(previous, domain, port):
         proxy_read_timeout 120s;
     }}
 }}
-"""
+""", domain)
 
 
 def configure(path, domain, port):

package/backend-action/nginx_test_fixture.py

@@ -0,0 +1,98 @@
+"""A task-owned HTTP server for real nginx protocol and streaming checks."""
+import base64
+import hashlib
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import json
+import subprocess
+import threading
+
+LEGACY_VHOST = """server {
+    listen 80;
+    server_name legacy.example;
+    location / {
+        proxy_pass http://127.0.0.1:31000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 120s;
+    }
+}
+"""
+
+
+class BackendServer(ThreadingHTTPServer):
+    def __init__(self):
+        super().__init__(("127.0.0.1", 0), Backend)
+        self.stream_release = threading.Event()
+        self.stream_finished = threading.Event()
+
+
+class Backend(BaseHTTPRequestHandler):
+    protocol_version = "HTTP/1.1"
+
+    def do_GET(self):
+        if self.path == "/ws":
+            return self.websocket()
+        if self.path == "/stream":
+            return self.stream()
+        payload = json.dumps({"build_sha": "a" * 40, "path": self.path,
+                              "upgrade": self.headers.get("Upgrade"),
+                              "connection": self.headers.get("Connection"),
+                              "ingress_received": "X-App-Robot-Backend-Token" in self.headers}).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(payload)))
+        self.end_headers()
+        self.wfile.write(payload)
+
+    def websocket(self):
+        self.close_connection = True
+        if (self.headers.get("Upgrade", "").lower() != "websocket"
+                or self.headers.get("Connection", "").lower() != "upgrade"
+                or self.request_version != "HTTP/1.1"
+                or "X-App-Robot-Backend-Token" in self.headers):
+            self.send_error(400)
+            return
+        key = self.headers["Sec-WebSocket-Key"] + "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"
+        self.send_response(101)
+        self.send_header("Upgrade", "websocket")
+        self.send_header("Connection", "Upgrade")
+        self.send_header("Sec-WebSocket-Accept", base64.b64encode(hashlib.sha1(key.encode()).digest()).decode())
+        self.end_headers()
+        self.connection.settimeout(2)
+        frame = self.rfile.read(2)
+        if len(frame) != 2 or frame[0] != 0x81 or frame[1] & 0x80 == 0 or frame[1] & 0x7F > 125:
+            return
+        mask = self.rfile.read(4)
+        payload = self.rfile.read(frame[1] & 0x7F)
+        decoded = bytes(value ^ mask[index % 4] for index, value in enumerate(payload))
+        self.wfile.write(bytes((0x81, len(decoded))) + decoded)
+        self.wfile.flush()
+
+    def stream(self):
+        self.close_connection = True
+        self.send_response(200)
+        self.send_header("Content-Type", "text/event-stream")
+        self.end_headers()
+        self.wfile.write(b"data: first\n\n")
+        self.wfile.flush()
+        try:
+            if self.server.stream_release.wait(5):
+                self.wfile.write(b"data: second\n\n")
+                self.wfile.flush()
+        finally:
+            self.server.stream_finished.set()
+
+    def log_message(self, *_args):
+        pass
+
+
+def stop(process):
+    process.terminate()
+    try:
+        process.communicate(timeout=5)
+    except subprocess.TimeoutExpired:
+        process.kill()
+        process.communicate(timeout=5)

package/backend-action/test_edge_nginx.py

@@ -1,5 +1,5 @@
-"""Exercise the generated ingress config with an owned nginx process and real HTTP."""
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+"""Exercise generated ingress with an owned nginx process and real HTTP, WebSocket and SSE."""
+from http.client import HTTPResponse
 import json
 from pathlib import Path
 import shutil
@@ -12,41 +12,18 @@ import unittest
 from urllib.error import HTTPError, URLError
 from urllib.request import Request, urlopen
 
-import configure_vhost
 import edge_vhost
+from nginx_test_fixture import BackendServer, LEGACY_VHOST, stop
 from test_edge_inputs import configured
 
 
-class Backend(BaseHTTPRequestHandler):
-    def do_GET(self):
-        payload = json.dumps({"build_sha": "a" * 40, "path": self.path,
-                              "ingress_received": "X-App-Robot-Backend-Token" in self.headers}).encode()
-        self.send_response(200)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(payload)))
-        self.end_headers()
-        self.wfile.write(payload)
-
-    def log_message(self, *_args):
-        pass
-
-
-def stop(process):
-    process.terminate()
-    try:
-        process.communicate(timeout=5)
-    except subprocess.TimeoutExpired:
-        process.kill()
-        process.communicate(timeout=5)
-
-
 class Ingress(unittest.TestCase):
     def setUp(self):
         self.assertIsNotNone(shutil.which("nginx"), "nginx is required for the backend ingress contract")
         directory = tempfile.TemporaryDirectory()
         self.addCleanup(directory.cleanup)
         self.root = Path(directory.name)
-        server = ThreadingHTTPServer(("127.0.0.1", 0), Backend)
+        server = self.server = BackendServer()
         self.addCleanup(server.server_close)
         thread = threading.Thread(target=server.serve_forever, daemon=True)
         thread.start()
@@ -57,7 +34,7 @@ class Ingress(unittest.TestCase):
         self.config = self.root / ".backend-edge.json"
         self.config.write_text(json.dumps(configured()))
         legacy = self.root / "backend-fixture.conf"
-        legacy.write_text(configure_vhost.content("", "legacy.example", server.server_port))
+        legacy.write_text(LEGACY_VHOST.replace(":31000;", f":{server.server_port};"))
         files = edge_vhost.planned(self.config, "fixture", "edge.example", server.server_port, self.root)
         for path, (data, mode) in files.items():
             path.write_bytes(data.replace(b"listen 80;", f"listen 127.0.0.1:{self.port};".encode()))
@@ -101,3 +78,48 @@ class Ingress(unittest.TestCase):
             self.assertEqual(body["build_sha"], "a" * 40)
             self.assertEqual(body["path"], "/healthz?probe=owned")
             self.assertFalse(body["ingress_received"])
+            self.assertIsNone(body["upgrade"])
+            self.assertEqual(body["connection"], "close")
+
+    def test_real_nginx_exchanges_websocket_frames_and_enforces_ingress(self):
+        cases = (("edge.example", None, 403), ("edge.example", "wrong-token", 403),
+                 ("edge.example", configured()["ingress_token"], 101), ("legacy.example", None, 101))
+        for host, token, status in cases:
+            with self.subTest(host=host, status=status), socket.create_connection(("127.0.0.1", self.port), 2) as peer:
+                request = (f"GET /ws HTTP/1.1\r\nHost: {host}\r\nUpgrade: websocket\r\n"
+                           "Connection: Upgrade\r\nSec-WebSocket-Version: 13\r\n"
+                           "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n")
+                if token is not None:
+                    request += f"X-App-Robot-Backend-Token: {token}\r\n"
+                peer.sendall((request + "\r\n").encode())
+                with HTTPResponse(peer) as response:
+                    response.begin()
+                    self.assertEqual(response.status, status)
+                    if status != 101:
+                        continue
+                    self.assertEqual(response.getheader("Upgrade").lower(), "websocket")
+                    self.assertEqual(response.getheader("Sec-WebSocket-Accept"), "s3pPLMBiTxaQ9kYGzzhZRbK+xOo=")
+                    payload, mask = b"ping-through-nginx", b"\x01\x02\x03\x04"
+                    masked = bytes(value ^ mask[index % 4] for index, value in enumerate(payload))
+                    peer.sendall(bytes((0x81, 0x80 | len(payload))) + mask + masked)
+                    self.assertEqual(response.fp.read(2), bytes((0x81, len(payload))))
+                    self.assertEqual(response.fp.read(len(payload)), payload)
+
+    def test_real_nginx_delivers_sse_before_upstream_completion(self):
+        for host, token in (("edge.example", configured()["ingress_token"]), ("legacy.example", None)):
+            with self.subTest(host=host):
+                self.server.stream_release.clear()
+                self.server.stream_finished.clear()
+                headers = {"Host": host}
+                if token is not None:
+                    headers["X-App-Robot-Backend-Token"] = token
+                request = Request(f"http://127.0.0.1:{self.port}/stream", headers=headers)
+                try:
+                    with urlopen(request, timeout=2) as response:
+                        self.assertEqual(response.readline(), b"data: first\n")
+                        self.assertFalse(self.server.stream_finished.is_set())
+                        self.server.stream_release.set()
+                        self.assertEqual(response.read(), b"\ndata: second\n\n")
+                finally:
+                    self.server.stream_release.set()
+                    self.assertTrue(self.server.stream_finished.wait(2))

package/docs/BACKEND_EDGE.md

@@ -34,6 +34,12 @@ The old public hostname is health-checked without authentication so released cli
 An edge alias matching the existing legacy hostname is refused; provision a new alias instead.
 Missing ingress settings on an already protected app cannot reopen its origin.
 
+Managed backend locations forward WebSocket upgrades and disable response buffering so SSE and
+streaming responses arrive incrementally. The Connection header becomes `upgrade` only when the
+request carries an Upgrade header; ordinary HTTP requests use `close`. Each vhost owns a distinct
+connection map, so protected and legacy domains coexist. Deployment updates existing locations
+while preserving their domains, TLS settings and ingress checks.
+
 These options are also named backend settings in `.gowalk-cicd.yml`: `public-base-url`,
 `public-health-url`, `expected-build-sha`, `ingress-required` and `ingress-token`. Reference secrets
-by name. Deployments without these options retain their existing nginx/certificate/health behavior.
+by name. Deployments without these options retain public origin access, certificate handling and health checks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.148",
+  "version": "1.0.149",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {