socketduct 0.1.25 → 0.1.27

package/test/integration/reverse-route-class.test.js

@@ -1,10 +1,9 @@
 /* eslint-disable jsdoc/escape-inline-tags, jsdoc/require-param, jsdoc/require-returns */
-import assert from "node:assert/strict"
+import {describe, expect, it, withTestCleanup} from "@velocious/testing"
 import {mkdtemp, rm} from "node:fs/promises"
 import {createServer} from "node:net"
 import {tmpdir} from "node:os"
 import {join} from "node:path"
-import test from "node:test"
 
 import {StaticTokenStore} from "../../src/auth/static-token-store.js"
 import {V3FrameType} from "../../src/protocol/v3-frame.js"
@@ -18,7 +17,7 @@ async function listen(server) {
     server.listen(0, "127.0.0.1", () => { server.off("error", reject); resolve(undefined) })
   })
   const address = server.address()
-  assert(address !== null && typeof address !== "string")
+  if (address === null || typeof address === "string") throw new Error("Server did not bind to a TCP port")
   return address.port
 }
 
@@ -86,365 +85,383 @@ async function exchange(socket, payload) {
   return await withTimeout(response, `response for ${payload}`)
 }
 
-test("route-class clients fail closed per OPEN while unaffected routes and legacy exact clients remain usable", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-route-class-"))
-  t.after(() => rm(root, {recursive: true, force: true}))
-  const certificates = generateTestCertificates(root)
-  const targetA = await createEchoTarget("a:")
-  const targetB = await createEchoTarget("b:")
-  t.after(() => targetA.close())
-  t.after(() => targetB.close())
+describe("reverse gateway route-class", () => {
+  it("route-class clients fail closed per OPEN while unaffected routes and legacy exact clients remain usable", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-route-class-"))
+    after(() => rm(root, {recursive: true, force: true}))
+    const certificates = generateTestCertificates(root)
+    const targetA = await createEchoTarget("a:")
+    const targetB = await createEchoTarget("b:")
+    after(() => targetA.close())
+    after(() => targetB.close())
 
-  const tokens = new StaticTokenStore([
-    {username: "home-a", token: "gateway-a-token"},
-    {username: "home-b", token: "gateway-b-token"},
-    {username: "tensorbuzz", token: "client-token"},
-    {username: "untrusted", token: "untrusted-token"}
-  ])
-  let ambiguousTargetA = false
-  const hub = await startReverseGatewayHub({
-    tokens,
-    tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile},
-    knownGatewayIds: ["server-a-starlink", "server-b-starlink"],
-    knownRouteClasses: ["starlink"],
-    authorizeGateway: ({principal, gatewayId}) => (
-      (principal.username === "home-a" && gatewayId === "server-a-starlink")
-      || (principal.username === "home-b" && gatewayId === "server-b-starlink")
-    ),
-    authorizeClientGateway: ({principal, gatewayId}) => principal.username === "tensorbuzz" && gatewayId === "server-a-starlink",
-    authorizeClientRouteClass: ({principal}) => principal.username === "tensorbuzz",
-    resolveOpenGateways: ({principal, routeClass, target}) => {
-      if (principal.username !== "tensorbuzz" || routeClass !== "starlink" || target.host !== "127.0.0.1") return []
-      if (target.port === targetA.port) return ambiguousTargetA ? ["server-a-starlink", "server-b-starlink"] : ["server-a-starlink"]
-      if (target.port === targetB.port) return ["server-b-starlink"]
-      return []
-    },
-    authorizeOpen: ({principal, gatewayId, target}) => principal.username === "tensorbuzz" && (
-      (gatewayId === "server-a-starlink" && target.host === targetA.host && target.port === targetA.port)
-      || (gatewayId === "server-b-starlink" && target.host === targetB.host && target.port === targetB.port)
-    )
-  })
-  t.after(() => hub.close())
-  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
-  const gatewayA = new OutboundReverseGateway({
-    gatewayId: "server-a-starlink",
-    connectionId: "route_class_gateway_a",
-    hub: {host: "127.0.0.1", port: hub.port, token: "gateway-a-token"},
-    tls,
-    authorizeTarget: (target) => target.host === targetA.host && target.port === targetA.port,
-    reconnectDelayMs: 10,
-    maxReconnectDelayMs: 20
-  })
-  const gatewayB = new OutboundReverseGateway({
-    gatewayId: "server-b-starlink",
-    connectionId: "route_class_gateway_b",
-    hub: {host: "127.0.0.1", port: hub.port, token: "gateway-b-token"},
-    tls,
-    authorizeTarget: (target) => target.host === targetB.host && target.port === targetB.port,
-    reconnectDelayMs: 10,
-    maxReconnectDelayMs: 20
-  })
-  t.after(() => gatewayA.close())
-  t.after(() => gatewayB.close())
-  await Promise.all([gatewayA.start(), gatewayB.start()])
+    const tokens = new StaticTokenStore([
+      {username: "home-a", token: "gateway-a-token"},
+      {username: "home-b", token: "gateway-b-token"},
+      {username: "tensorbuzz", token: "client-token"},
+      {username: "untrusted", token: "untrusted-token"}
+    ])
+    let ambiguousTargetA = false
+    const hub = await startReverseGatewayHub({
+      tokens,
+      tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile},
+      knownGatewayIds: ["server-a-starlink", "server-b-starlink"],
+      knownRouteClasses: ["starlink"],
+      authorizeGateway: ({principal, gatewayId}) => (
+        (principal.username === "home-a" && gatewayId === "server-a-starlink")
+        || (principal.username === "home-b" && gatewayId === "server-b-starlink")
+      ),
+      authorizeClientGateway: ({principal, gatewayId}) => principal.username === "tensorbuzz" && gatewayId === "server-a-starlink",
+      authorizeClientRouteClass: ({principal}) => principal.username === "tensorbuzz",
+      resolveOpenGateways: ({principal, routeClass, target}) => {
+        if (principal.username !== "tensorbuzz" || routeClass !== "starlink" || target.host !== "127.0.0.1") return []
+        if (target.port === targetA.port) return ambiguousTargetA ? ["server-a-starlink", "server-b-starlink"] : ["server-a-starlink"]
+        if (target.port === targetB.port) return ["server-b-starlink"]
+        return []
+      },
+      authorizeOpen: ({principal, gatewayId, target}) => principal.username === "tensorbuzz" && (
+        (gatewayId === "server-a-starlink" && target.host === targetA.host && target.port === targetA.port)
+        || (gatewayId === "server-b-starlink" && target.host === targetB.host && target.port === targetB.port)
+      )
+    })
+    after(() => hub.close())
+    const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+    const gatewayA = new OutboundReverseGateway({
+      gatewayId: "server-a-starlink",
+      connectionId: "route_class_gateway_a",
+      hub: {host: "127.0.0.1", port: hub.port, token: "gateway-a-token"},
+      tls,
+      authorizeTarget: (target) => target.host === targetA.host && target.port === targetA.port,
+      reconnectDelayMs: 10,
+      maxReconnectDelayMs: 20
+    })
+    const gatewayB = new OutboundReverseGateway({
+      gatewayId: "server-b-starlink",
+      connectionId: "route_class_gateway_b",
+      hub: {host: "127.0.0.1", port: hub.port, token: "gateway-b-token"},
+      tls,
+      authorizeTarget: (target) => target.host === targetB.host && target.port === targetB.port,
+      reconnectDelayMs: 10,
+      maxReconnectDelayMs: 20
+    })
+    after(() => gatewayA.close())
+    after(() => gatewayB.close())
+    await Promise.all([gatewayA.start(), gatewayB.start()])
 
-  const unknown = new ReverseGatewayConnection({
-    routeClass: "missing",
-    connectionId: "route_class_unknown_client",
-    hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
-    tls,
-    continuousReconnect: false
-  })
-  t.after(() => unknown.close())
-  await assert.rejects(withTimeout(unknown.connect(), "unknown route class"), (error) => /** @type {{code?: string}} */ (error).code === "UNKNOWN_ROUTE_CLASS")
+    const unknown = new ReverseGatewayConnection({
+      routeClass: "missing",
+      connectionId: "route_class_unknown_client",
+      hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
+      tls,
+      continuousReconnect: false
+    })
+    after(() => unknown.close())
+    /** @type {Error & {code?: string} | undefined} */
+    let error
+    try {
+      await withTimeout(unknown.connect(), "unknown route class")
+    } catch (caught) {
+      error = /** @type {Error & {code?: string}} */ (caught)
+    }
+    expect(error).toBeDefined()
+    expect(error?.code).toBe("UNKNOWN_ROUTE_CLASS")
 
-  const unauthorized = new ReverseGatewayConnection({
-    routeClass: "starlink",
-    connectionId: "route_class_unauthorized_client",
-    hub: {host: "127.0.0.1", port: hub.port, token: "untrusted-token"},
-    tls,
-    continuousReconnect: false
-  })
-  t.after(() => unauthorized.close())
-  await assert.rejects(withTimeout(unauthorized.connect(), "unauthorized route class"), (error) => /** @type {{code?: string}} */ (error).code === "ROUTE_CLASS_UNAUTHORIZED")
+    const unauthorized = new ReverseGatewayConnection({
+      routeClass: "starlink",
+      connectionId: "route_class_unauthorized_client",
+      hub: {host: "127.0.0.1", port: hub.port, token: "untrusted-token"},
+      tls,
+      continuousReconnect: false
+    })
+    after(() => unauthorized.close())
+    /** @type {Error & {code?: string} | undefined} */
+    let unauthorizedError
+    try {
+      await withTimeout(unauthorized.connect(), "unauthorized route class")
+    } catch (caught) {
+      unauthorizedError = /** @type {Error & {code?: string}} */ (caught)
+    }
+    expect(unauthorizedError).toBeDefined()
+    expect(unauthorizedError?.code).toBe("ROUTE_CLASS_UNAUTHORIZED")
 
-  const client = new ReverseGatewayConnection({
-    routeClass: "starlink",
-    connectionId: "route_class_tensorbuzz_client",
-    hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
-    tls
-  })
-  t.after(() => client.close())
-  await client.connect()
-  assert.equal(client.status().physicalConnects, 1)
-  assert.equal(hub.status().clientPhysicalConnections, 1)
+    const client = new ReverseGatewayConnection({
+      routeClass: "starlink",
+      connectionId: "route_class_tensorbuzz_client",
+      hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
+      tls
+    })
+    after(() => client.close())
+    await client.connect()
+    expect(client.status().physicalConnects).toBe(1)
+    expect(hub.status().clientPhysicalConnections).toBe(1)
 
-  const denied = client.createConnection({host: "127.0.0.1", port: 65_534})
-  assert.equal((await nextError(denied)).code, "TARGET_UNAUTHORIZED")
+    const denied = client.createConnection({host: "127.0.0.1", port: 65_534})
+    expect((await nextError(denied)).code).toBe("TARGET_UNAUTHORIZED")
 
-  ambiguousTargetA = true
-  const ambiguous = client.createConnection({host: targetA.host, port: targetA.port})
-  assert.equal((await nextError(ambiguous)).code, "AMBIGUOUS_ROUTE")
-  ambiguousTargetA = false
+    ambiguousTargetA = true
+    const ambiguous = client.createConnection({host: targetA.host, port: targetA.port})
+    expect((await nextError(ambiguous)).code).toBe("AMBIGUOUS_ROUTE")
+    ambiguousTargetA = false
 
-  const legacy = new ReverseGatewayConnection({
-    gatewayId: "server-a-starlink",
-    connectionId: "legacy_exact_gateway_client",
-    hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
-    tls
-  })
-  t.after(() => legacy.close())
-  await legacy.connect()
-  const legacyStream = legacy.createConnection({host: targetA.host, port: targetA.port})
-  await onceEvent(legacyStream, "connect")
-  assert.equal(await exchange(legacyStream, "legacy"), "a:legacy")
-  legacyStream.destroy()
-  await legacy.close()
+    const legacy = new ReverseGatewayConnection({
+      gatewayId: "server-a-starlink",
+      connectionId: "legacy_exact_gateway_client",
+      hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
+      tls
+    })
+    after(() => legacy.close())
+    await legacy.connect()
+    const legacyStream = legacy.createConnection({host: targetA.host, port: targetA.port})
+    await onceEvent(legacyStream, "connect")
+    expect(await exchange(legacyStream, "legacy")).toBe("a:legacy")
+    legacyStream.destroy()
+    await legacy.close()
 
-  const streamA = client.createConnection({host: targetA.host, port: targetA.port})
-  const streamB = client.createConnection({host: targetB.host, port: targetB.port})
-  await Promise.all([onceEvent(streamA, "connect"), onceEvent(streamB, "connect")])
-  assert.deepEqual(await Promise.all([exchange(streamA, "one"), exchange(streamB, "two")]), ["a:one", "b:two"])
+    const streamA = client.createConnection({host: targetA.host, port: targetA.port})
+    const streamB = client.createConnection({host: targetB.host, port: targetB.port})
+    await Promise.all([onceEvent(streamA, "connect"), onceEvent(streamB, "connect")])
+    expect(await Promise.all([exchange(streamA, "one"), exchange(streamB, "two")])).toEqual(["a:one", "b:two"])
 
-  const resumed = Promise.all([onceEvent(streamA, "ready"), onceEvent(streamB, "ready")])
-  await hub.closeActiveGateway("server-a-starlink")
-  await withTimeout(resumed, "route-class streams resume after gateway transport replacement")
-  await waitUntil(() => hub.status().healthyGateways === 2, "gateway A re-registration")
-  assert.equal(await exchange(streamA, "resumed"), "a:resumed")
-  assert.equal(await exchange(streamB, "still-open"), "b:still-open")
+    const resumed = Promise.all([onceEvent(streamA, "ready"), onceEvent(streamB, "ready")])
+    await hub.closeActiveGateway("server-a-starlink")
+    await withTimeout(resumed, "route-class streams resume after gateway transport replacement")
+    await waitUntil(() => hub.status().healthyGateways === 2, "gateway A re-registration")
+    expect(await exchange(streamA, "resumed")).toBe("a:resumed")
+    expect(await exchange(streamB, "still-open")).toBe("b:still-open")
 
-  const anotherA = client.createConnection({host: targetA.host, port: targetA.port})
-  await onceEvent(anotherA, "connect")
-  assert.equal(await exchange(anotherA, "new-a"), "a:new-a")
-  const anotherB = client.createConnection({host: targetB.host, port: targetB.port})
-  await onceEvent(anotherB, "connect")
-  assert.equal(await exchange(anotherB, "new"), "b:new")
+    const anotherA = client.createConnection({host: targetA.host, port: targetA.port})
+    await onceEvent(anotherA, "connect")
+    expect(await exchange(anotherA, "new-a")).toBe("a:new-a")
+    const anotherB = client.createConnection({host: targetB.host, port: targetB.port})
+    await onceEvent(anotherB, "connect")
+    expect(await exchange(anotherB, "new")).toBe("b:new")
 
-  streamA.destroy()
-  anotherA.destroy()
-  await gatewayA.close()
-  const replacementA = new OutboundReverseGateway({
-    gatewayId: "server-a-starlink",
-    connectionId: "route_class_gateway_a",
-    initialGeneration: gatewayA.status().connectionGeneration,
-    hub: {host: "127.0.0.1", port: hub.port, token: "gateway-a-token"},
-    tls,
-    authorizeTarget: (target) => target.host === targetA.host && target.port === targetA.port
-  })
-  t.after(() => replacementA.close())
-  await replacementA.start()
-  const rejoinedA = client.createConnection({host: targetA.host, port: targetA.port})
-  await onceEvent(rejoinedA, "connect")
-  assert.equal(await exchange(rejoinedA, "rejoined"), "a:rejoined")
-  assert(client.status().physicalConnects >= 2)
-  assert.equal(hub.status().clientPhysicalConnections, 1)
-  streamB.destroy()
-  anotherB.destroy()
-  rejoinedA.destroy()
-})
+    streamA.destroy()
+    anotherA.destroy()
+    await gatewayA.close()
+    const replacementA = new OutboundReverseGateway({
+      gatewayId: "server-a-starlink",
+      connectionId: "route_class_gateway_a",
+      initialGeneration: gatewayA.status().connectionGeneration,
+      hub: {host: "127.0.0.1", port: hub.port, token: "gateway-a-token"},
+      tls,
+      authorizeTarget: (target) => target.host === targetA.host && target.port === targetA.port
+    })
+    after(() => replacementA.close())
+    await replacementA.start()
+    const rejoinedA = client.createConnection({host: targetA.host, port: targetA.port})
+    await onceEvent(rejoinedA, "connect")
+    expect(await exchange(rejoinedA, "rejoined")).toBe("a:rejoined")
+    expect(client.status().physicalConnects).toBeGreaterThanOrEqual(2)
+    expect(hub.status().clientPhysicalConnections).toBe(1)
+    streamB.destroy()
+    anotherB.destroy()
+    rejoinedA.destroy()
+  }))
 
-test("a backpressured gateway does not block DATA or a new OPEN for another route-class gateway", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-route-class-backpressure-"))
-  t.after(() => rm(root, {recursive: true, force: true}))
-  const certificates = generateTestCertificates(root)
-  const targetA = await createEchoTarget("a:")
-  const targetB = await createEchoTarget("b:")
-  t.after(() => targetA.close())
-  t.after(() => targetB.close())
+  it("a backpressured gateway does not block DATA or a new OPEN for another route-class gateway", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-route-class-backpressure-"))
+    after(() => rm(root, {recursive: true, force: true}))
+    const certificates = generateTestCertificates(root)
+    const targetA = await createEchoTarget("a:")
+    const targetB = await createEchoTarget("b:")
+    after(() => targetA.close())
+    after(() => targetB.close())
 
-  const hub = await startReverseGatewayHub({
-    tokens: new StaticTokenStore([
-      {username: "home-a", token: "gateway-a-token"},
-      {username: "home-b", token: "gateway-b-token"},
-      {username: "tensorbuzz", token: "client-token"}
-    ]),
-    tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile},
-    knownGatewayIds: ["server-a-starlink", "server-b-starlink"],
-    knownRouteClasses: ["starlink"],
-    authorizeGateway: ({principal, gatewayId}) => (
-      (principal.username === "home-a" && gatewayId === "server-a-starlink")
-      || (principal.username === "home-b" && gatewayId === "server-b-starlink")
-    ),
-    authorizeClientGateway: () => false,
-    authorizeClientRouteClass: ({principal, routeClass}) => principal.username === "tensorbuzz" && routeClass === "starlink",
-    resolveOpenGateways: ({routeClass, target}) => {
-      if (routeClass !== "starlink" || target.host !== "127.0.0.1") return []
-      if (target.port === targetA.port) return ["server-a-starlink"]
-      if (target.port === targetB.port) return ["server-b-starlink"]
-      return []
-    },
-    authorizeOpen: ({gatewayId, target}) => (
-      (gatewayId === "server-a-starlink" && target.port === targetA.port)
-      || (gatewayId === "server-b-starlink" && target.port === targetB.port)
-    ),
-    maxOutputBytesPerConnection: 1_024
-  })
-  t.after(() => hub.close())
-  /** @type {import('node:tls').TLSSocket[]} */
-  const accepted = []
-  hub.server.on("secureConnection", (socket) => accepted.push(socket))
-  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
-  const gatewayA = new OutboundReverseGateway({
-    gatewayId: "server-a-starlink",
-    connectionId: "backpressure_gateway_a",
-    hub: {host: "127.0.0.1", port: hub.port, token: "gateway-a-token"},
-    tls,
-    authorizeTarget: (target) => target.host === targetA.host && target.port === targetA.port,
-    reconnectDelayMs: 10_000,
-    maxReconnectDelayMs: 10_000
-  })
-  const gatewayB = new OutboundReverseGateway({
-    gatewayId: "server-b-starlink",
-    connectionId: "backpressure_gateway_b",
-    hub: {host: "127.0.0.1", port: hub.port, token: "gateway-b-token"},
-    tls,
-    authorizeTarget: (target) => target.host === targetB.host && target.port === targetB.port,
-    reconnectDelayMs: 10_000,
-    maxReconnectDelayMs: 10_000
-  })
-  t.after(() => gatewayA.close())
-  t.after(() => gatewayB.close())
-  await gatewayA.start()
-  await gatewayB.start()
-  assert.equal(accepted.length, 2)
+    const hub = await startReverseGatewayHub({
+      tokens: new StaticTokenStore([
+        {username: "home-a", token: "gateway-a-token"},
+        {username: "home-b", token: "gateway-b-token"},
+        {username: "tensorbuzz", token: "client-token"}
+      ]),
+      tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile},
+      knownGatewayIds: ["server-a-starlink", "server-b-starlink"],
+      knownRouteClasses: ["starlink"],
+      authorizeGateway: ({principal, gatewayId}) => (
+        (principal.username === "home-a" && gatewayId === "server-a-starlink")
+        || (principal.username === "home-b" && gatewayId === "server-b-starlink")
+      ),
+      authorizeClientGateway: () => false,
+      authorizeClientRouteClass: ({principal, routeClass}) => principal.username === "tensorbuzz" && routeClass === "starlink",
+      resolveOpenGateways: ({routeClass, target}) => {
+        if (routeClass !== "starlink" || target.host !== "127.0.0.1") return []
+        if (target.port === targetA.port) return ["server-a-starlink"]
+        if (target.port === targetB.port) return ["server-b-starlink"]
+        return []
+      },
+      authorizeOpen: ({gatewayId, target}) => (
+        (gatewayId === "server-a-starlink" && target.port === targetA.port)
+        || (gatewayId === "server-b-starlink" && target.port === targetB.port)
+      ),
+      maxOutputBytesPerConnection: 1_024
+    })
+    after(() => hub.close())
+    /** @type {import('node:tls').TLSSocket[]} */
+    const accepted = []
+    hub.server.on("secureConnection", (socket) => accepted.push(socket))
+    const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+    const gatewayA = new OutboundReverseGateway({
+      gatewayId: "server-a-starlink",
+      connectionId: "backpressure_gateway_a",
+      hub: {host: "127.0.0.1", port: hub.port, token: "gateway-a-token"},
+      tls,
+      authorizeTarget: (target) => target.host === targetA.host && target.port === targetA.port,
+      reconnectDelayMs: 10_000,
+      maxReconnectDelayMs: 10_000
+    })
+    const gatewayB = new OutboundReverseGateway({
+      gatewayId: "server-b-starlink",
+      connectionId: "backpressure_gateway_b",
+      hub: {host: "127.0.0.1", port: hub.port, token: "gateway-b-token"},
+      tls,
+      authorizeTarget: (target) => target.host === targetB.host && target.port === targetB.port,
+      reconnectDelayMs: 10_000,
+      maxReconnectDelayMs: 10_000
+    })
+    after(() => gatewayA.close())
+    after(() => gatewayB.close())
+    await gatewayA.start()
+    await gatewayB.start()
+    expect(accepted.length).toBe(2)
 
-  const client = new ReverseGatewayConnection({
-    routeClass: "starlink",
-    connectionId: "backpressure_route_client",
-    hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
-    tls,
-    continuousReconnect: false,
-    reconnectDelayMs: 10_000,
-    maxReconnectDelayMs: 10_000
-  })
-  t.after(() => client.close())
-  await client.connect()
-  const streamA = client.createConnection({host: targetA.host, port: targetA.port})
-  const streamB = client.createConnection({host: targetB.host, port: targetB.port})
-  await Promise.all([onceEvent(streamA, "connect"), onceEvent(streamB, "connect")])
+    const client = new ReverseGatewayConnection({
+      routeClass: "starlink",
+      connectionId: "backpressure_route_client",
+      hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
+      tls,
+      continuousReconnect: false,
+      reconnectDelayMs: 10_000,
+      maxReconnectDelayMs: 10_000
+    })
+    after(() => client.close())
+    await client.connect()
+    const streamA = client.createConnection({host: targetA.host, port: targetA.port})
+    const streamB = client.createConnection({host: targetB.host, port: targetB.port})
+    await Promise.all([onceEvent(streamA, "connect"), onceEvent(streamB, "connect")])
 
-  const gatewayASocket = /** @type {import('node:tls').TLSSocket} */ (accepted[0])
-  const writable = /** @type {{write: (chunk: Buffer) => boolean}} */ (/** @type {unknown} */ (gatewayASocket))
-  const originalWrite = writable.write
-  let blocked = false
-  /** @type {() => void} */
-  let markBlocked = () => {}
-  const backpressured = new Promise((resolve) => { markBlocked = () => resolve(undefined) })
-  writable.write = (chunk) => {
-    const acceptedWrite = Reflect.apply(originalWrite, gatewayASocket, [chunk])
-    if (!blocked && chunk[5] === V3FrameType.DATA) {
-      blocked = true
-      markBlocked()
-      return false
+    const gatewayASocket = /** @type {import('node:tls').TLSSocket} */ (accepted[0])
+    const writable = /** @type {{write: (chunk: Buffer) => boolean}} */ (/** @type {unknown} */ (gatewayASocket))
+    const originalWrite = writable.write
+    let blocked = false
+    /** @type {() => void} */
+    let markBlocked = () => {}
+    const backpressured = new Promise((resolve) => { markBlocked = () => resolve(undefined) })
+    writable.write = (chunk) => {
+      const acceptedWrite = Reflect.apply(originalWrite, gatewayASocket, [chunk])
+      if (!blocked && chunk[5] === V3FrameType.DATA) {
+        blocked = true
+        markBlocked()
+        return false
+      }
+      return acceptedWrite
     }
-    return acceptedWrite
-  }
-  t.after(() => {
-    writable.write = originalWrite
-    if (blocked) gatewayASocket.emit("drain")
-  })
+    after(() => {
+      writable.write = originalWrite
+      if (blocked) gatewayASocket.emit("drain")
+    })
 
-  streamA.write("blocked")
-  await withTimeout(backpressured, "gateway A backpressure")
-  const newStreamB = client.createConnection({host: targetB.host, port: targetB.port})
-  t.after(() => newStreamB.destroy())
-  const newStreamBExchange = (async () => {
-    await onceEvent(newStreamB, "connect")
-    return await exchange(newStreamB, "new-open")
-  })()
-  assert.deepEqual(await withTimeout(Promise.all([
-    exchange(streamB, "existing"),
-    newStreamBExchange
-  ]), "healthy gateway progress while gateway A is backpressured"), ["b:existing", "b:new-open"])
-  assert.equal(client.status().physicalConnects, 1)
-  assert(hub.status().queuedOutputBytes > 0)
-  const streamAError = nextError(streamA)
-  const queuedAErrors = Array.from({length: 8}, () => {
-    const socket = client.createConnection({host: targetA.host, port: targetA.port, sessionName: "a".repeat(256)})
-    t.after(() => socket.destroy())
-    return nextError(socket)
-  })
-  const outputError = /** @type {Error & Record<string, unknown>} */ (await withTimeout(streamAError, "gateway A output limit"))
-  assert.equal(outputError.code, "OUTPUT_BACKPRESSURE_LIMIT")
-  assert.equal(outputError.disconnectReason, "output_backpressure_limit")
-  assert.equal(outputError.incidentOrigin, "reverse_hub")
-  assert.equal(outputError.physicalRole, "gateway")
-  assert.match(/** @type {string} */ (outputError.disconnectIncidentId), /^[A-Za-z0-9_-]{22}$/)
-  await withTimeout(Promise.all(queuedAErrors), "queued gateway A stream cleanup")
-  assert.equal(await exchange(streamB, "after-limit"), "b:after-limit")
-  assert.equal(hub.status().healthyGateways, 1)
-  assert.equal(hub.status().clientPhysicalConnections, 1)
-  assert.equal(client.status().physicalConnects, 1)
-  writable.write = originalWrite
-  assert.equal(hub.status().queuedOutputBytes, 0)
-  streamA.destroy()
-  streamB.destroy()
-})
+    streamA.write("blocked")
+    await withTimeout(backpressured, "gateway A backpressure")
+    const newStreamB = client.createConnection({host: targetB.host, port: targetB.port})
+    after(() => { newStreamB.destroy() })
+    const newStreamBExchange = (async () => {
+      await onceEvent(newStreamB, "connect")
+      return await exchange(newStreamB, "new-open")
+    })()
+    expect(await withTimeout(Promise.all([
+      exchange(streamB, "existing"),
+      newStreamBExchange
+    ]), "healthy gateway progress while gateway A is backpressured")).toEqual(["b:existing", "b:new-open"])
+    expect(client.status().physicalConnects).toBe(1)
+    expect(hub.status().queuedOutputBytes).toBeGreaterThan(0)
+    const streamAError = nextError(streamA)
+    const queuedAErrors = Array.from({length: 8}, () => {
+      const socket = client.createConnection({host: targetA.host, port: targetA.port, sessionName: "a".repeat(256)})
+      after(() => { socket.destroy() })
+      return nextError(socket)
+    })
+    const outputError = /** @type {Error & Record<string, unknown>} */ (await withTimeout(streamAError, "gateway A output limit"))
+    expect(outputError.code).toBe("OUTPUT_BACKPRESSURE_LIMIT")
+    expect(outputError.disconnectReason).toBe("output_backpressure_limit")
+    expect(outputError.incidentOrigin).toBe("reverse_hub")
+    expect(outputError.physicalRole).toBe("gateway")
+    expect(/** @type {string} */ (outputError.disconnectIncidentId)).toMatch(/^[A-Za-z0-9_-]{22}$/)
+    await withTimeout(Promise.all(queuedAErrors), "queued gateway A stream cleanup")
+    expect(await exchange(streamB, "after-limit")).toBe("b:after-limit")
+    expect(hub.status().healthyGateways).toBe(1)
+    expect(hub.status().clientPhysicalConnections).toBe(1)
+    expect(client.status().physicalConnects).toBe(1)
+    writable.write = originalWrite
+    expect(hub.status().queuedOutputBytes).toBe(0)
+    streamA.destroy()
+    streamB.destroy()
+  }))
 
-test("hub announces route-class availability at selection and the client exposes gateway unavailability", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-route-class-selectable-"))
-  t.after(() => rm(root, {recursive: true, force: true}))
-  const certificates = generateTestCertificates(root)
-  const targetA = await createEchoTarget("a:")
-  t.after(() => targetA.close())
+  it("hub announces route-class availability at selection and the client exposes gateway unavailability", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-route-class-selectable-"))
+    after(() => rm(root, {recursive: true, force: true}))
+    const certificates = generateTestCertificates(root)
+    const targetA = await createEchoTarget("a:")
+    after(() => targetA.close())
 
-  const hub = await startReverseGatewayHub({
-    tokens: new StaticTokenStore([
-      {username: "home-a", token: "gateway-a-token"},
-      {username: "tensorbuzz", token: "client-token"}
-    ]),
-    tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile},
-    knownGatewayIds: ["server-a-starlink"],
-    knownRouteClasses: ["starlink"],
-    authorizeGateway: ({principal, gatewayId}) => principal.username === "home-a" && gatewayId === "server-a-starlink",
-    authorizeClientGateway: () => false,
-    authorizeClientRouteClass: ({principal, routeClass}) => principal.username === "tensorbuzz" && routeClass === "starlink",
-    resolveRouteClassGateways: () => ["server-a-starlink"],
-    resolveOpenGateways: ({routeClass, target}) => (routeClass === "starlink" && target.host === targetA.host ? ["server-a-starlink"] : []),
-    authorizeOpen: ({gatewayId, target}) => gatewayId === "server-a-starlink" && target.port === targetA.port
-  })
-  t.after(() => hub.close())
-  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+    const hub = await startReverseGatewayHub({
+      tokens: new StaticTokenStore([
+        {username: "home-a", token: "gateway-a-token"},
+        {username: "tensorbuzz", token: "client-token"}
+      ]),
+      tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile},
+      knownGatewayIds: ["server-a-starlink"],
+      knownRouteClasses: ["starlink"],
+      authorizeGateway: ({principal, gatewayId}) => principal.username === "home-a" && gatewayId === "server-a-starlink",
+      authorizeClientGateway: () => false,
+      authorizeClientRouteClass: ({principal, routeClass}) => principal.username === "tensorbuzz" && routeClass === "starlink",
+      resolveRouteClassGateways: () => ["server-a-starlink"],
+      resolveOpenGateways: ({routeClass, target}) => (routeClass === "starlink" && target.host === targetA.host ? ["server-a-starlink"] : []),
+      authorizeOpen: ({gatewayId, target}) => gatewayId === "server-a-starlink" && target.port === targetA.port
+    })
+    after(() => hub.close())
+    const tls = {caFile: certificates.caCertFile, servername: "localhost"}
 
-  const client = new ReverseGatewayConnection({
-    routeClass: "starlink",
-    connectionId: "route_class_selectable_client",
-    hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
-    tls
-  })
-  t.after(() => client.close())
+    const client = new ReverseGatewayConnection({
+      routeClass: "starlink",
+      connectionId: "route_class_selectable_client",
+      hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
+      tls
+    })
+    after(() => client.close())
 
-  // No gateway registered for the route class yet: the hub must announce selectable=false
-  // and the client must surface the member as gateway-unavailable before any open is attempted.
-  await client.connect()
-  assert.equal(client.status().physicalState, "ready")
-  assert.equal(client.status().gatewayUnavailable, true)
+    // No gateway registered for the route class yet: the hub must announce selectable=false
+    // and the client must surface the member as gateway-unavailable before any open is attempted.
+    await client.connect()
+    expect(client.status().physicalState).toBe("ready")
+    expect(client.status().gatewayUnavailable).toBe(true)
 
-  // Once the gateway registers, a replacement selection announces selectable=true and clears the mark.
-  const gatewayA = new OutboundReverseGateway({
-    gatewayId: "server-a-starlink",
-    connectionId: "selectable_gateway_a",
-    hub: {host: "127.0.0.1", port: hub.port, token: "gateway-a-token"},
-    tls,
-    authorizeTarget: (target) => target.host === targetA.host && target.port === targetA.port,
-    reconnectDelayMs: 10,
-    maxReconnectDelayMs: 20
-  })
-  t.after(() => gatewayA.close())
-  await gatewayA.start()
-  await waitUntil(() => hub.status().healthyGateways === 1, "gateway A registration")
+    // Once the gateway registers, a replacement selection announces selectable=true and clears the mark.
+    const gatewayA = new OutboundReverseGateway({
+      gatewayId: "server-a-starlink",
+      connectionId: "selectable_gateway_a",
+      hub: {host: "127.0.0.1", port: hub.port, token: "gateway-a-token"},
+      tls,
+      authorizeTarget: (target) => target.host === targetA.host && target.port === targetA.port,
+      reconnectDelayMs: 10,
+      maxReconnectDelayMs: 20
+    })
+    after(() => gatewayA.close())
+    await gatewayA.start()
+    await waitUntil(() => hub.status().healthyGateways === 1, "gateway A registration")
 
-  const replacement = new ReverseGatewayConnection({
-    routeClass: "starlink",
-    connectionId: "selectable_client_replacement",
-    hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
-    tls
-  })
-  t.after(() => replacement.close())
-  await replacement.connect()
-  assert.equal(replacement.status().gatewayUnavailable, false)
-  const stream = replacement.createConnection({host: targetA.host, port: targetA.port})
-  await onceEvent(stream, "connect")
-  assert.equal(await exchange(stream, "probe"), "a:probe")
-  stream.destroy()
+    const replacement = new ReverseGatewayConnection({
+      routeClass: "starlink",
+      connectionId: "selectable_client_replacement",
+      hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
+      tls
+    })
+    after(() => replacement.close())
+    await replacement.connect()
+    expect(replacement.status().gatewayUnavailable).toBe(false)
+    const stream = replacement.createConnection({host: targetA.host, port: targetA.port})
+    await onceEvent(stream, "connect")
+    expect(await exchange(stream, "probe")).toBe("a:probe")
+    stream.destroy()
+  }))
 })