Skip to content

fix(test):sse stream integration - #101

Merged
wellCh4n merged 2 commits into
mainfrom
fix/sse-stream-integration
Sep 4, 2026
Merged

wellCh4n merged 2 commits into
mainfrom
fix/sse-stream-integration

Conversation

@wellCh4n

@wellCh4n wellCh4n commented Sep 4, 2026

Copy link
Copy Markdown
Owner

No description provided.

wellCh4n and others added 2 commits September 5, 2026 02:00
…ewer leaves

Two things went wrong at the end of every server-sent event stream, and
neither was visible from a browser because an EventSource closes itself on
the `end` event and reconnects on anything else.

The completion of an SseEmitter is an ASYNC dispatch that walks the security
filter chain again. JwtAuthFilter is a OncePerRequestFilter and sits that
dispatch out, so nothing is authenticated by then and the "/api/**" rule
denied a request it had already let through. With the response committed the
only effect was Tomcat cutting the connection before the final chunk, plus an
AuthorizationDeniedException stack trace per stream; a client reading to the
end saw "Response ended prematurely". The ASYNC dispatch is only ever reached
through an authorized REQUEST dispatch, so it is now permitted outright, which
is what Spring Security recommends.

A browser closing an EventSource mid-stream reaches the DispatcherServlet as
the container's error notification, an AsyncRequestNotUsableException. The
catch-all in GlobalExceptionHandler logged it as an unhandled error and then
failed again trying to write a JSON envelope onto a text/event-stream
response, two stack traces for someone leaving the pipeline page. A dedicated
handler now logs it at debug and returns nothing: nobody is listening.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… that passed vacuously

The pipeline log moved from one WebSocket to two server-sent event streams,
which left the route inventory stale and the streams module connecting to a
handler that no longer exists. routes.json is regenerated, and the client
gains an SSE reader that records the GET for the coverage check.

The streams module now pins the SSE contract: the status stream opens with
`steps`, ends with `end`, and its final snapshot is a Succeeded phase with
every step SUCCEEDED; a step's log replays in stamped batches whose event id
is the last line's time; resuming with Last-Event-ID after the final line
replays nothing; an unknown step answers `error` then `end`. The old
status/watch test in operations uses the same reader instead of a hand-rolled
request.

The pod log and terminal socket tests never passed `?environment=`, so the
server closed the socket at once and the tests proved nothing. Passing it
exposed a hang in read_until_closed: recv() answers the server's ten-second
protocol pings itself and restarts its timeout on each, so an idle socket
never timed out. Frames are now read one at a time against a wall-clock
deadline, with pings answered here. The ping/pong test moves to the pod log
socket, which is the log socket that remains.

The coverage figure is recorded on the test suite rather than the case, which
is what the xunit2 JUnit schema allows. AGENTS.md named the build steps
clone/build/push; the containers, and therefore the `steps` event, are
fetch/compile/publish, which is what the suite asserts.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@wellCh4n
wellCh4n merged commit fd3211f into main Sep 4, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant