Files
ThothII/backend/test/sse-route.test.ts
marcopanandClaude Fable 5 2958b32fd5 fix(backend): generation-aware SSE event ids — stale cursors can no longer eat events
Audit finding 3.1 (high, 3/3 reviewer consensus). Event ids restart at 1
when the backend restarts; a browser auto-reconnect carrying the old
numeric Last-Event-ID was honored whenever the new process had already
emitted that many events, silently suppressing fresh events (same ids,
different content). The previous guard only caught cursor > lastId.

Wire ids are now "<generation>:<seq>" (generation = per-hub instance
token; seq = the existing per-session monotonic counter). The hub parses
raw header/query candidates itself: other-generation and legacy bare-
number cursors are stale → replay from the beginning; same-generation
cursors keep the newest-valid-wins behavior. EventSource treats ids as
opaque, so no frontend change.

Finding 3.2 (eviction) resolved by NOT evicting: close keeps the seq
counter on purpose (sessions reopen; monotonicity is what makes old
cursors detectable) — documented at the call site; buffers are emptied by
clear() and ring-bounded at 200.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20 01:32:47 +02:00

201 lines
7.6 KiB
TypeScript

import { test, expect } from "vitest";
import { buildApp } from "../src/app.js";
import { loadConfig } from "../src/config.js";
import { SseHub } from "../src/sse/sse-hub.js";
const seqOf = (id: string) => Number(id.split(":")[1]);
async function readUntil(
reader: ReadableStreamDefaultReader<Uint8Array>,
predicate: (text: string) => boolean,
): Promise<string> {
const decoder = new TextDecoder();
let text = "";
const deadline = Date.now() + 1_000;
while (Date.now() < deadline) {
const result = await Promise.race([
reader.read(),
new Promise<{ timeout: true }>((resolve) =>
setTimeout(() => resolve({ timeout: true }), Math.max(0, deadline - Date.now())),
),
]);
if ("timeout" in result || result.done) break;
text += decoder.decode(result.value);
if (predicate(text)) break;
}
return text;
}
async function captureReplay(
options: { query?: (ids: string[]) => string; lastEventId?: (ids: string[]) => string },
): Promise<{ body: string; ids: string[] }> {
const hub = new SseHub();
const ids = [
hub.publish("s1", "info", { type: "info", text: "one" }),
hub.publish("s1", "info", { type: "info", text: "two" }),
hub.publish("s1", "info", { type: "info", text: "three" }),
];
const app = buildApp(loadConfig({ THT_HARNESS_DIR: "/tmp/h" }), {
hub,
thtRunner: {} as any,
});
await app.listen({ port: 0, host: "127.0.0.1" });
const port = (app.server.address() as { port: number }).port;
const controller = new AbortController();
try {
const lastEventId = options.lastEventId?.(ids);
const query = options.query ? `?lastEventId=${encodeURIComponent(options.query(ids))}` : "";
const response = await fetch(
`http://127.0.0.1:${port}/sessions/s1/events${query}`,
{
headers: lastEventId ? { "Last-Event-ID": lastEventId } : undefined,
signal: controller.signal,
},
);
const reader = response.body!.getReader();
const body = await readUntil(reader, (text) => text.includes('"three"'));
await reader.cancel();
return { body, ids };
} finally {
controller.abort();
await app.close();
}
}
async function expectStreamEnd(reader: ReadableStreamDefaultReader<Uint8Array>): Promise<void> {
const result = await Promise.race([
reader.read(),
new Promise<{ timeout: true }>((resolve) =>
setTimeout(() => resolve({ timeout: true }), 1_000),
),
]);
expect(result).not.toEqual({ timeout: true });
expect("done" in result && result.done).toBe(true);
}
test("SSE emits ids and honors the native Last-Event-ID replay cursor", async () => {
const { body, ids } = await captureReplay({ lastEventId: (published) => published[0] });
expect(body).not.toContain('"one"');
expect(body).toContain(`id: ${ids[1]}\nevent: info\n`);
expect(body).toContain('data: {"type":"info","text":"two"}');
expect(body).toContain(`id: ${ids[2]}\nevent: info\n`);
expect(body).toContain('data: {"type":"info","text":"three"}');
});
test("SSE honors the manual lastEventId query cursor", async () => {
const { body, ids } = await captureReplay({ query: (published) => published[1] });
expect(body).not.toContain('"one"');
expect(body).not.toContain('"two"');
expect(body).toContain(`id: ${ids[2]}\nevent: info\n`);
expect(body).toContain('data: {"type":"info","text":"three"}');
});
test("SSE uses the newer valid cursor when header and query are both present", async () => {
const { body } = await captureReplay({
query: (published) => published[1],
lastEventId: (published) => published[0],
});
expect(body).not.toContain('"two"');
expect(body).toContain('"three"');
});
test("SSE resets a cursor from an older backend generation and emits a buffered pending gate once", async () => {
// The cursor comes from a PREVIOUS process: same session, ids restarted. It must be
// treated as stale (replay from the beginning), not honored against the new ids.
const oldGeneration = new SseHub();
oldGeneration.publish("s1", "info", { type: "info", text: "old" });
const staleCursor = oldGeneration.publish("s1", "info", { type: "info", text: "older" });
const hub = new SseHub();
const descriptor = { id: "gate-fresh", widget: "select", title: "Choose" };
const infoId = hub.publish("s1", "info", { type: "info", text: "fresh generation" });
const gateId = hub.publish("s1", "ui_request", { type: "ui_request", ui_request: descriptor });
const app = buildApp(loadConfig({ THT_HARNESS_DIR: "/tmp/h" }), {
hub,
thtRunner: {} as any,
mgr: {
get: () => ({ bridge: { pendingWidget: () => ({ ...descriptor }) } }),
} as any,
});
await app.listen({ port: 0, host: "127.0.0.1" });
const port = (app.server.address() as { port: number }).port;
const controller = new AbortController();
try {
const response = await fetch(`http://127.0.0.1:${port}/sessions/s1/events`, {
headers: { "Last-Event-ID": staleCursor },
signal: controller.signal,
});
const reader = response.body!.getReader();
const body = await readUntil(reader, (text) => text.includes('"gate-fresh"'));
await reader.cancel();
expect(body).toContain(`id: ${infoId}\nevent: info\n`);
expect(body).toContain('data: {"type":"info","text":"fresh generation"}');
expect(body.match(/event: ui_request/g)).toHaveLength(1);
expect(body).toContain(`id: ${gateId}\nevent: ui_request\n`);
expect(body).toContain('"ui_request":{"id":"gate-fresh","widget":"select","title":"Choose"}');
} finally {
controller.abort();
await app.close();
}
});
test("clear ends every live SSE response and a cursor reconnect replays post-clear events", async () => {
const hub = new SseHub();
const app = buildApp(loadConfig({ THT_HARNESS_DIR: "/tmp/h" }), {
hub,
thtRunner: {} as any,
});
await app.listen({ port: 0, host: "127.0.0.1" });
const port = (app.server.address() as { port: number }).port;
const controllers = [new AbortController(), new AbortController(), new AbortController()];
try {
const responses = await Promise.all(controllers.slice(0, 2).map((controller) => fetch(
`http://127.0.0.1:${port}/sessions/s1/events`,
{ signal: controller.signal },
)));
const readers = responses.map((response) => response.body!.getReader());
const beforeId = hub.publish("s1", "info", { type: "info", text: "before" });
expect(seqOf(beforeId)).toBe(1);
const initial = await Promise.all(readers.map((reader) =>
readUntil(reader, (text) => text.includes('"before"'))));
expect(initial.every((body) => body.includes(`id: ${beforeId}\nevent: info\n`))).toBe(true);
hub.clear("s1");
await Promise.all(readers.map(expectStreamEnd));
const afterId = hub.publish("s1", "info", { type: "info", text: "after" });
expect(seqOf(afterId)).toBe(2);
const gateId = hub.publish("s1", "ui_request", {
type: "ui_request",
ui_request: { id: "gate-1", widget: "select" },
});
expect(seqOf(gateId)).toBe(3);
const reconnected = await fetch(
`http://127.0.0.1:${port}/sessions/s1/events`,
{
headers: { "Last-Event-ID": beforeId },
signal: controllers[2].signal,
},
);
const reconnectReader = reconnected.body!.getReader();
const replay = await readUntil(reconnectReader, (text) => text.includes('"gate-1"'));
expect(replay).toContain(`id: ${afterId}\nevent: info\n`);
expect(replay).toContain('data: {"type":"info","text":"after"}');
expect(replay).toContain(`id: ${gateId}\nevent: ui_request\n`);
expect(replay).toContain('"ui_request":{"id":"gate-1","widget":"select"}');
await reconnectReader.cancel();
} finally {
for (const controller of controllers) controller.abort();
await app.close();
}
});