dsh 0.2.0-rc.2: in-container update (experimental channel), path-agnostic compose, upstream patches adapted to 0.1.x/0.2.x

upstream/container/control-plane/services/gateway/test/dsh-upstream-auth.test.mjs

@@ -0,0 +1,84 @@
+import assert from 'node:assert/strict'
+import { chmod, mkdtemp } from 'node:fs/promises'
+import { createServer } from 'node:http'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import test from 'node:test'
+import { DshUpstreamAuthentication } from '../lib/dsh-upstream-auth.mjs'
+
+async function listen(server, target, host) {
+  await new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(target, host, resolve)
+  })
+}
+
+test('exchanges and caches the private DSH launch URL', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'dsh-upstream-auth-'))
+  const socketPath = join(root, 'lifecycle.sock')
+  let exchanges = 0
+  const dsh = createServer((request, response) => {
+    exchanges += 1
+    assert.equal(request.url, '/?token=fixture-token')
+    response.writeHead(303, {
+      location: '/',
+      'set-cookie': 'dsh-auth-fixture=signed; Path=/; HttpOnly; SameSite=Strict',
+    })
+    response.end()
+  })
+  await listen(dsh, 0, '127.0.0.1')
+  const port = dsh.address().port
+  let generation = 'generation-one'
+  let publicReady = false
+  const lifecycle = createServer((_request, response) => {
+    response.writeHead(200, { 'content-type': 'application/json' })
+    response.end(JSON.stringify({
+      generation,
+      publicReady,
+      ready: true,
+      readyUrl: `http://127.0.0.1:${String(port)}/?token=fixture-token`,
+    }))
+  })
+  await listen(lifecycle, socketPath)
+  await chmod(socketPath, 0o600)
+  t.after(() => { dsh.close(); lifecycle.close() })
+  const authentication = new DshUpstreamAuthentication({ socketPath, port })
+  assert.equal(await authentication.publicReady(), false)
+  assert.equal(await authentication.cookie(), null)
+  assert.equal(exchanges, 0)
+  publicReady = true
+  assert.equal(await authentication.publicReady(), true)
+  assert.equal(await authentication.cookie(), 'dsh-auth-fixture=signed')
+  assert.equal(await authentication.cookie(), 'dsh-auth-fixture=signed')
+  assert.equal(exchanges, 1)
+  generation = 'generation-two'
+  assert.equal(await authentication.cookie(), 'dsh-auth-fixture=signed')
+  assert.equal(exchanges, 2)
+  publicReady = false
+  assert.equal(await authentication.cookie(), null)
+  publicReady = true
+  assert.equal(await authentication.publicReady(), true)
+  assert.equal(await authentication.cookie(), 'dsh-auth-fixture=signed')
+  assert.equal(exchanges, 3)
+})
+
+test('keeps probing legacy DSH readiness without inventing a cookie', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'dsh-upstream-auth-legacy-'))
+  const socketPath = join(root, 'lifecycle.sock')
+  let now = 0
+  let probes = 0
+  const lifecycle = createServer((_request, response) => {
+    probes += 1
+    response.writeHead(200, { 'content-type': 'application/json' })
+    response.end(JSON.stringify({ ready: true, readyUrl: null }))
+  })
+  await listen(lifecycle, socketPath)
+  t.after(() => lifecycle.close())
+  const authentication = new DshUpstreamAuthentication({ socketPath, now: () => now })
+  assert.equal(await authentication.cookie(), null)
+  assert.equal(await authentication.cookie(), null)
+  assert.equal(probes, 1)
+  now = 250
+  assert.equal(await authentication.cookie(), null)
+  assert.equal(probes, 2)
+})