react-native-audio-browser 0.2.0-next.3 → 0.2.0-next.31

package/android/src/test/java/com/audiobrowser/player/CrossOriginHeaderStripperTest.kt

@@ -0,0 +1,94 @@
+package com.audiobrowser.player
+
+import okhttp3.HttpUrl.Companion.toHttpUrl
+import okhttp3.Request
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * OkHttp drops `Authorization` across a cross-origin redirect by itself; these cover the rest,
+ * which it forwards and [CrossOriginHeaderStripper.stripCallerHeaders] removes.
+ */
+class CrossOriginHeaderStripperTest {
+
+  private val api = "https://api.example.com/stream/7".toHttpUrl()
+
+  @Test
+  fun `same origin ignores the path`() {
+    assertTrue(
+      CrossOriginHeaderStripper.sameOrigin(
+        api,
+        "https://api.example.com/signed/track.mp3".toHttpUrl(),
+      )
+    )
+  }
+
+  @Test
+  fun `a different host, port or scheme is a different origin`() {
+    assertFalse(
+      CrossOriginHeaderStripper.sameOrigin(api, "https://cdn.example.com/track.mp3".toHttpUrl())
+    )
+    assertFalse(
+      CrossOriginHeaderStripper.sameOrigin(
+        api,
+        "https://api.example.com:8443/track.mp3".toHttpUrl(),
+      )
+    )
+    assertFalse(
+      CrossOriginHeaderStripper.sameOrigin(api, "http://api.example.com/track.mp3".toHttpUrl())
+    )
+  }
+
+  @Test
+  fun `strips every caller header, whatever its name`() {
+    val request =
+      Request.Builder()
+        .url(api)
+        .header("Authorization", "Bearer token")
+        .header("X-Api-Key", "k")
+        .header("Cookie", "session=abc")
+        .build()
+
+    val stripped = CrossOriginHeaderStripper.stripCallerHeaders(request)
+
+    assertNull(stripped.header("Authorization"))
+    assertNull(stripped.header("X-Api-Key"))
+    assertNull(stripped.header("Cookie"))
+  }
+
+  @Test
+  fun `keeps the transport headers the hop needs`() {
+    val request =
+      Request.Builder()
+        .url(api)
+        .header("Range", "bytes=1024-")
+        .header("accept-encoding", "identity")
+        .header("User-Agent", "react-native-audio-browser")
+        .header("X-Api-Key", "k")
+        .build()
+
+    val stripped = CrossOriginHeaderStripper.stripCallerHeaders(request)
+
+    // a dropped Range would restart the read from zero on every seek past a redirect
+    assertEquals("bytes=1024-", stripped.header("Range"))
+    assertEquals("identity", stripped.header("Accept-Encoding"))
+    assertEquals("react-native-audio-browser", stripped.header("User-Agent"))
+    assertNull(stripped.header("X-Api-Key"))
+  }
+
+  @Test
+  fun `keeps media3's ICY metadata request across a hop`() {
+    // ProgressiveMediaPeriod asks for Shoutcast metadata on the DataSpec, the same channel the
+    // config's headers arrive on. Dropping it costs icy-metaint, so onMetadata never fires again.
+    val request =
+      Request.Builder().url(api).header("Icy-MetaData", "1").header("X-Api-Key", "k").build()
+
+    val stripped = CrossOriginHeaderStripper.stripCallerHeaders(request)
+
+    assertEquals("1", stripped.header("Icy-MetaData"))
+    assertNull(stripped.header("X-Api-Key"))
+  }
+}

package/android/src/test/java/com/audiobrowser/player/MediaSessionSlotMappingTest.kt

@@ -0,0 +1,45 @@
+package com.audiobrowser.player
+
+import androidx.media3.session.CommandButton
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * Guards the slot preference lists handed to Media3.
+ *
+ * The invariant that matters is the OVERFLOW fallback: every flattening keeps a button only if it
+ * won SLOT_BACK, won SLOT_FORWARD, or names SLOT_OVERFLOW. A slot that stops naming OVERFLOW
+ * silently deletes its button from the notification and the car the moment its primary position is
+ * unavailable, so the loop below asserts the property for every slot rather than only today's
+ * three.
+ */
+class MediaSessionSlotMappingTest {
+
+  @Test
+  fun `primary slots are preferred with an overflow fallback`() {
+    assertArrayEquals(
+      intArrayOf(CommandButton.SLOT_BACK, CommandButton.SLOT_OVERFLOW),
+      media3SlotsFor(ButtonSlot.BACK),
+    )
+    assertArrayEquals(
+      intArrayOf(CommandButton.SLOT_FORWARD, CommandButton.SLOT_OVERFLOW),
+      media3SlotsFor(ButtonSlot.FORWARD),
+    )
+  }
+
+  @Test
+  fun `overflow does not repeat itself`() {
+    assertArrayEquals(intArrayOf(CommandButton.SLOT_OVERFLOW), media3SlotsFor(ButtonSlot.OVERFLOW))
+  }
+
+  @Test
+  fun `every slot names OVERFLOW so nothing can be dropped`() {
+    for (slot in ButtonSlot.entries) {
+      assertTrue(
+        "$slot must name SLOT_OVERFLOW or its button is dropped from the notification and the car",
+        media3SlotsFor(slot).contains(CommandButton.SLOT_OVERFLOW),
+      )
+    }
+  }
+}

package/android/src/test/java/com/audiobrowser/player/NowPlayingUpdaterTest.kt

@@ -377,7 +377,7 @@ class NowPlayingUpdaterTest {
   }
 
   @Test
-  fun `artwork re-resolves for a new track id and skips without an id`() = runTest {
+  fun `artwork re-resolves for a new track identity including id-less tracks`() = runTest {
     val surface =
       FakeSurface().apply {
         currentTrack = track("A", id = "a")
@@ -393,10 +393,31 @@ class NowPlayingUpdaterTest {
     runCurrent()
     assertEquals(2, surface.artworkResolveCount)
 
+    // The config runs for id-less tracks too — no blanket skip.
     surface.currentTrack = track("C", id = null, src = "https://s/c.mp3")
     updater.render()
     runCurrent()
-    assertEquals(2, surface.artworkResolveCount) // no id → no resolve
+    assertEquals(3, surface.artworkResolveCount)
+    assertEquals(0 to "https://img/a.png", surface.artworkStamps.last())
+  }
+
+  @Test
+  fun `artwork for an id-less track resolves once keyed on src identity`() = runTest {
+    val surface =
+      FakeSurface().apply {
+        currentTrack = track("C", id = null, src = "https://s/c.mp3")
+        hasNowPlayingArtworkConfig = true
+        artworkResult = "https://img/c.png"
+      }
+    val updater = NowPlayingUpdater(surface, backgroundScope)
+
+    updater.render()
+    runCurrent()
+    updater.updateNowPlaying(update(title = "Song")) // re-render, same track
+    runCurrent()
+
+    assertEquals(1, surface.artworkResolveCount)
+    assertEquals(listOf(0 to "https://img/c.png"), surface.artworkStamps)
   }
 
   @Test
@@ -439,4 +460,23 @@ class NowPlayingUpdaterTest {
 
     assertTrue(surface.artworkStamps.isEmpty())
   }
+
+  @Test
+  fun `a stale artwork result for an id-less track is not stamped after a track change`() =
+    runTest {
+      val surface =
+        FakeSurface().apply {
+          currentTrack = track("A", id = null, src = "https://s/a.mp3")
+          hasNowPlayingArtworkConfig = true
+          artworkResult = "https://img/a.png"
+        }
+      val updater = NowPlayingUpdater(surface, backgroundScope)
+
+      updater.render() // schedules the artwork resolve
+      // Skip to another id-less track before it lands: identity (src) keying must catch it.
+      surface.currentTrack = track("B", id = null, src = "https://s/b.mp3")
+      runCurrent()
+
+      assertTrue(surface.artworkStamps.isEmpty())
+    }
 }

package/android/src/test/java/com/audiobrowser/player/PlaybackErrorClassifierTest.kt

@@ -132,8 +132,8 @@ class PlaybackErrorClassifierTest {
 
   /**
    * Load errors are raw IOExceptions from the transport layer; the policy only retries network
-   * ones, so the advisory classification is UNREACHABLE unless the device is offline or the
-   * server actually answered.
+   * ones, so the advisory classification is UNREACHABLE unless the device is offline or the server
+   * actually answered.
    */
   @Test
   fun `retrying transport failure is unreachable`() {
@@ -158,8 +158,7 @@ class PlaybackErrorClassifierTest {
   /** The HTTP status is dug out of the cause chain and mapped through the shared status table. */
   @Test
   fun `retrying HTTP failure carries the status`() {
-    val error =
-      PlaybackErrorClassifier.retryingLoadError(httpException(503), online = true)
+    val error = PlaybackErrorClassifier.retryingLoadError(httpException(503), online = true)
     assertEquals(PlaybackErrorKind.SERVER_ERROR, error.kind)
     assertEquals(503.0, error.statusCode!!, 0.0)
     assertEquals(true, error.retrying)

package/android/src/test/java/com/audiobrowser/player/PlaybackStateStoreTrackJsonTest.kt

@@ -0,0 +1,55 @@
+package com.audiobrowser.player
+
+import com.audiobrowser.TestFixtures
+import com.audiobrowser.TestFixtures.trackStyle
+import com.margelo.nitro.audiobrowser.ArtworkRendering
+import com.margelo.nitro.audiobrowser.StyleDisplay
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+
+/**
+ * The bespoke org.json persistence of the resumption track. ADR 0011: the style block and
+ * `disabled` survive process death (a restored queue keeps its visible fidelity), and a snapshot
+ * written before the block model — `style` as an enum-name string — restores without a declaration
+ * rather than failing.
+ */
+@RunWith(RobolectricTestRunner::class)
+class PlaybackStateStoreTrackJsonTest {
+
+  @Test
+  fun `style and disabled survive the round-trip`() {
+    val track =
+      TestFixtures.track(title = "Night Mix", src = "https://s/a.mp3", disabled = true)
+        .copy(
+          style =
+            trackStyle(display = StyleDisplay.GRID, artworkRendering = ArtworkRendering.STENCIL)
+        )
+
+    val restored = PlaybackStateStore.trackFromJson(PlaybackStateStore.trackToJson(track))
+
+    assertEquals(StyleDisplay.GRID, restored?.style?.display)
+    assertEquals(ArtworkRendering.STENCIL, restored?.style?.artworkRendering)
+    assertEquals(true, restored?.disabled)
+  }
+
+  @Test
+  fun `a track without style round-trips without one`() {
+    val track = TestFixtures.track(title = "Plain", src = "https://s/a.mp3")
+
+    val restored = PlaybackStateStore.trackFromJson(PlaybackStateStore.trackToJson(track))
+
+    assertNull(restored?.style)
+    assertNull(restored?.disabled)
+  }
+
+  @Test
+  fun `a pre-block snapshot with a string style restores without a declaration`() {
+    val restored = PlaybackStateStore.trackFromJson("""{"title":"X","src":"s","style":"LIST"}""")
+
+    assertEquals("X", restored?.title)
+    assertNull(restored?.style)
+  }
+}

package/android/src/test/java/com/audiobrowser/player/RetryLoadErrorHandlingPolicyTest.kt

@@ -201,9 +201,9 @@ class RetryLoadErrorHandlingPolicyBudgetTest {
   }
 
   /**
-   * Offline failures must not burn the first-connect budget (a station tapped in a tunnel parks
-   * for connectivity); the budget's clock starts at the first error observed online, so a dead
-   * station still gets a fast verdict after restoration.
+   * Offline failures must not burn the first-connect budget (a station tapped in a tunnel parks for
+   * connectivity); the budget's clock starts at the first error observed online, so a dead station
+   * still gets a fast verdict after restoration.
    */
   @Test
   fun `offline time does not burn the first-connect budget`() {

package/android/src/test/java/com/audiobrowser/player/ShuffleOrderLedByTest.kt

@@ -0,0 +1,79 @@
+package com.audiobrowser.player
+
+import androidx.media3.common.C
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * Media3's `ShuffleOrder.cloneAndSet(insertionCount, startIndex)` discards the start index (the
+ * interface default clears and re-inserts from 0, and `DefaultShuffleOrder` does not override it),
+ * so `setMediaItems(items, startIndex, …)` leaves the starting track at a random shuffle position —
+ * last, for a 1-in-N share of queues, which reads as end-of-queue from the very first track.
+ */
+class ShuffleOrderLedByTest {
+  @Test
+  fun `the start index leads the order`() {
+    for (start in 0 until 6) {
+      val order = shuffleOrderLedBy(startIndex = start, count = 6)
+      assertEquals("start index must be at shuffle position 0", start, order.firstIndex)
+      assertNotEquals(
+        "a queue of 6 must have somewhere to advance to from its start track",
+        C.INDEX_UNSET.toLong(),
+        order.getNextIndex(start).toLong(),
+      )
+    }
+  }
+
+  @Test
+  fun `every index appears exactly once`() {
+    val order = shuffleOrderLedBy(startIndex = 3, count = 8)
+    assertEquals(8, order.length)
+    val seen = mutableListOf<Int>()
+    var index = order.firstIndex
+    while (index != C.INDEX_UNSET) {
+      seen.add(index)
+      index = order.getNextIndex(index)
+    }
+    assertEquals((0 until 8).toList(), seen.sorted())
+  }
+
+  @Test
+  fun `a single-track queue leads with its only track and ends there`() {
+    val order = shuffleOrderLedBy(startIndex = 0, count = 1)
+    assertEquals(0, order.firstIndex)
+    assertEquals(C.INDEX_UNSET, order.getNextIndex(0))
+  }
+
+  @Test
+  fun `an out-of-range start index is clamped rather than throwing`() {
+    assertEquals(4, shuffleOrderLedBy(startIndex = 99, count = 5).firstIndex)
+    assertEquals(0, shuffleOrderLedBy(startIndex = -3, count = 5).firstIndex)
+  }
+
+  @Test
+  fun `an empty queue produces an empty order`() {
+    assertEquals(0, shuffleOrderLedBy(startIndex = 0, count = 0).length)
+  }
+
+  @Test
+  fun `the tail is actually shuffled`() {
+    // Not a strict guarantee of any single draw — but across many draws an
+    // unshuffled tail would be impossible to miss.
+    val tails =
+      (0 until 50)
+        .map { shuffleOrderLedBy(startIndex = 0, count = 8) }
+        .map { order ->
+          buildList {
+            var index = order.getNextIndex(order.firstIndex)
+            while (index != C.INDEX_UNSET) {
+              add(index)
+              index = order.getNextIndex(index)
+            }
+          }
+        }
+        .toSet()
+    assertTrue("50 draws produced one identical tail — the order is not shuffled", tails.size > 1)
+  }
+}

package/android/src/test/java/com/audiobrowser/tls/AiaCertChaserTest.kt

@@ -7,12 +7,98 @@ import java.security.cert.PKIXParameters
 import java.security.cert.TrustAnchor
 import java.security.cert.X509Certificate
 import java.util.Date
+import javax.security.auth.x500.X500Principal
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertThrows
 import org.junit.Test
+import org.mockito.Mockito.mock
+import org.mockito.Mockito.`when`
 
 class AiaCertChaserTest {
 
+  /**
+   * A certificate whose AIA extension value is exactly [extensionValue].
+   *
+   * Subject and issuer are stubbed to distinct principals on purpose: an unstubbed mock answers
+   * null to both, which `completeChain` would read as a self-signed root and stop on before
+   * fetching anything.
+   */
+  private fun certWithAia(extensionValue: ByteArray): X509Certificate =
+    mock(X509Certificate::class.java).also {
+      `when`(it.getExtensionValue("1.3.6.1.5.5.7.1.1")).thenReturn(extensionValue)
+      `when`(it.subjectX500Principal).thenReturn(X500Principal("CN=leaf"))
+      `when`(it.issuerX500Principal).thenReturn(X500Principal("CN=issuer"))
+    }
+
+  /** A DER tag-length-value, with the length in whichever form fits. */
+  private fun der(tag: Int, content: ByteArray): ByteArray {
+    val length =
+      when (val n = content.size) {
+        in 0..0x7F -> byteArrayOf(n.toByte())
+        in 0x80..0xFF -> byteArrayOf(0x81.toByte(), n.toByte())
+        in 0x100..0xFFFF -> byteArrayOf(0x82.toByte(), (n shr 8).toByte(), n.toByte())
+        else -> byteArrayOf(0x83.toByte(), (n shr 16).toByte(), (n shr 8).toByte(), n.toByte())
+      }
+    return byteArrayOf(tag.toByte()) + length + content
+  }
+
+  /** A well-formed AIA extension value listing [urls] as caIssuers locations. */
+  private fun aiaExtension(urls: List<String>): ByteArray {
+    val caIssuersOid = byteArrayOf(0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x02)
+    val descriptions =
+      urls.fold(ByteArray(0)) { acc, url ->
+        acc + der(0x30, der(0x06, caIssuersOid) + der(0x86, url.toByteArray(Charsets.US_ASCII)))
+      }
+    return der(0x04, der(0x30, descriptions))
+  }
+
+  @Test
+  fun `the AIA fixture builder round-trips through the parser`() {
+    // Guards the two tests below: if this builder were malformed they would pass by parsing
+    // nothing at all, rather than by the cap doing its job.
+    val urls = listOf("http://ca1.example/i.crt", "http://ca2.example/i.crt")
+
+    assertEquals(urls, AiaCertChaser.extractCaIssuerUrls(certWithAia(aiaExtension(urls))))
+  }
+
+  @Test(timeout = 5_000)
+  fun `a negative long-form length does not hang the parser`() {
+    // OCTET STRING { SEQUENCE { tag 0x00, long-form length 0xFFFFFFFA = -6 } }.
+    // The length's four bytes shift into a negative Int, so `pos += len` rewinds the
+    // reader by exactly the six bytes it just consumed: the tag is not a SEQUENCE, the
+    // loop `continue`s, and the reader is back where it started with more input to read.
+    val aia =
+      byteArrayOf(
+        0x04,
+        0x08,
+        0x30,
+        0x06,
+        0x00,
+        0x84.toByte(),
+        0xFF.toByte(),
+        0xFF.toByte(),
+        0xFF.toByte(),
+        0xFA.toByte(),
+      )
+
+    assertEquals(emptyList<String>(), AiaCertChaser.extractCaIssuerUrls(certWithAia(aia)))
+  }
+
+  @Test(timeout = 5_000)
+  fun `a length running past the buffer is treated as no AIA`() {
+    // SEQUENCE claiming 0x7F content bytes inside a 2-byte buffer.
+    val aia = byteArrayOf(0x04, 0x04, 0x30, 0x02, 0x30, 0x7F)
+
+    assertEquals(emptyList<String>(), AiaCertChaser.extractCaIssuerUrls(certWithAia(aia)))
+  }
+
+  @Test(timeout = 5_000)
+  fun `truncated DER is treated as no AIA`() {
+    val aia = byteArrayOf(0x04, 0x08, 0x30)
+
+    assertEquals(emptyList<String>(), AiaCertChaser.extractCaIssuerUrls(certWithAia(aia)))
+  }
+
   @Test
   fun `extracts CA Issuers URL from real leaf certificate AIA extension`() {
     val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
@@ -27,7 +113,7 @@ class AiaCertChaserTest {
     val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
     val r13 = CertFixtures.cert("letsencrypt-r13.pem")
     // Fetcher knows only the R13 URL (the leaf's AIA pointer); empty for the root URL.
-    val fetch = { url: String ->
+    val fetch = { url: String, _: Long ->
       if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
     }
 
@@ -44,8 +130,8 @@ class AiaCertChaserTest {
 
     // A PKCS#7-style bundle where the genuine issuer is not first must still be selected.
     val completed =
-      AiaCertChaser.completeChain(listOf(leaf)) {
-        if (it == "http://r13.i.lencr.org/") listOf(unrelated, r13) else emptyList()
+      AiaCertChaser.completeChain(listOf(leaf)) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(unrelated, r13) else emptyList()
       }
 
     assertEquals(listOf(leaf, r13), completed)
@@ -57,7 +143,7 @@ class AiaCertChaserTest {
     var fetches = 0
 
     val completed =
-      AiaCertChaser.completeChain(listOf(root)) {
+      AiaCertChaser.completeChain(listOf(root)) { _, _ ->
         fetches++
         emptyList()
       }
@@ -66,11 +152,115 @@ class AiaCertChaserTest {
     assertEquals(0, fetches)
   }
 
+  @Test
+  fun `completeChain stops at a chain that already reaches a trust anchor`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val root = CertFixtures.cert("isrg-root-x1.pem")
+    val fetched = mutableListOf<String>()
+
+    // R13's own AIA points at the ISRG root, so without knowing the anchors this walks one hop
+    // too far and pays for a second blocking fetch on the ordinary rescue path.
+    val completed =
+      AiaCertChaser.completeChain(
+        listOf(leaf),
+        anchorSubjects = setOf(root.subjectX500Principal),
+      ) { url, _ ->
+        fetched.add(url)
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else listOf(root)
+      }
+
+    assertEquals(listOf(leaf, r13), completed)
+    assertEquals(listOf("http://r13.i.lencr.org/"), fetched)
+  }
+
+  @Test
+  fun `completeChain fetches nothing when the presented chain is already anchored`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val root = CertFixtures.cert("isrg-root-x1.pem")
+    var fetches = 0
+
+    // The shape of every non-path failure — expiry, hostname mismatch, CT — where the server
+    // sent a complete chain and validation failed for some other reason.
+    val completed =
+      AiaCertChaser.completeChain(
+        listOf(leaf, r13),
+        anchorSubjects = setOf(root.subjectX500Principal),
+      ) { _, _ ->
+        fetches++
+        emptyList()
+      }
+
+    assertEquals(listOf(leaf, r13), completed)
+    assertEquals(0, fetches)
+  }
+
+  @Test
+  fun `completeChain tries only a few of a certificate's CA-Issuers URLs`() {
+    // The extension is authored by the server that just failed validation, and nothing limits
+    // how many URLs it lists. Each one costs a blocking connect on the handshake thread, so
+    // hundreds of them are a denial of service whatever each individual fetch costs.
+    val manyUrls = (1..500).map { "http://ca$it.example/issuer.crt" }
+    val cert = certWithAia(aiaExtension(manyUrls))
+    val fetched = mutableListOf<String>()
+
+    AiaCertChaser.completeChain(listOf(cert)) { url, _ ->
+      fetched.add(url)
+      emptyList()
+    }
+
+    assertEquals(AiaCertChaser.MAX_URLS_PER_CERT, fetched.size)
+  }
+
+  @Test
+  fun `duplicate CA-Issuers URLs do not consume the URL cap`() {
+    // 500 copies of one dead URL followed by a distinct one: the cap must buy distinct hosts,
+    // not three visits to the same dead one.
+    val urls = List(500) { "http://ca.example/issuer.crt" } + "http://ca-b.example/issuer.crt"
+    val cert = certWithAia(aiaExtension(urls))
+    val fetched = mutableListOf<String>()
+
+    AiaCertChaser.completeChain(listOf(cert)) { url, _ ->
+      fetched.add(url)
+      emptyList()
+    }
+
+    assertEquals(listOf("http://ca.example/issuer.crt", "http://ca-b.example/issuer.crt"), fetched)
+  }
+
+  @Test
+  fun `completeChain stops fetching once its wall-clock budget is spent`() {
+    val cert = certWithAia(aiaExtension((1..500).map { "http://ca$it.example/issuer.crt" }))
+    var fetches = 0
+    var nanos = 0L
+    val deadlines = mutableListOf<Long>()
+
+    // Each fetch "takes" 8s against a 20s budget, so the walk must stop after a handful even
+    // though the URL cap alone would have allowed more.
+    AiaCertChaser.completeChain(
+      listOf(cert),
+      maxUrlsPerCert = 500,
+      budgetMs = 20_000,
+      nowNanos = { nanos },
+    ) { _, deadline ->
+      fetches++
+      deadlines.add(deadline)
+      nanos += 8_000_000_000
+      emptyList()
+    }
+
+    assertEquals(3, fetches)
+    // Every fetch is handed the same walk-wide deadline, so it can clip its own I/O to it —
+    // the budget bounds the fetches themselves, not just how many of them start.
+    assertEquals(listOf(20_000_000_000L, 20_000_000_000L, 20_000_000_000L), deadlines)
+  }
+
   @Test
   fun `completeChain stops when the issuer cannot be fetched`() {
     val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
 
-    val completed = AiaCertChaser.completeChain(listOf(leaf)) { emptyList() }
+    val completed = AiaCertChaser.completeChain(listOf(leaf)) { _, _ -> emptyList() }
 
     assertEquals(listOf(leaf), completed)
   }
@@ -88,8 +278,8 @@ class AiaCertChaserTest {
 
     // After AIA chasing splices in R13, the chain validates to the trusted root.
     val completed =
-      AiaCertChaser.completeChain(listOf(leaf)) {
-        if (it == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      AiaCertChaser.completeChain(listOf(leaf)) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
       }
     validatePath(completed, root, date) // must not throw
   }