3 Commits

Include renames

Author	SHA1	Message	Date
Hermes	f2285a2550	test(api): DC-087 hermetic caddy-admin health mirrors + file-level raw-fetch guard [glm-grade=B] ... Two mirrored health-handler test suites (health-endpoints, health-probe-aliases) probed the Caddy admin API with raw Origin-less native fetch. On the prod host the adversarial cron runs the full jest suite every 30 min against a live Caddy admin with enforce_origin: 12 journal 403 lines per run (~700/day of 'client is not allowed to access from origin' spam) while tests stayed green. - Mirrors now call fetchT (byte-identical to src/app.js:930 probe) with fetchT jest.spyOn-mocked at buildApp scope; caddyOk-configurable in both suites - New guard test in utils-http-caddy-admin-origin.test.js: any __tests__ file pairing a raw await-fetch with a Caddy-admin token (:2019|adminUrl| CADDY_ADMIN) fails the suite — file-level pairing catches the historical cross-line drift shape a call-window regex missed - DC-087-ALLOW-RAW-FETCH comment escape hatch (raw-text marker, guard file never self-exempts, skips logged to jest output) Judge: GLM-5.3 cold read via delegate_task deleg_4d384dea (round 1 C -> round 2 B, zero blockers, polish folded). Verdict URN: urn:ump:azrv2xp72koiwi5r4yb6ureu4aqqloqq64sgmftsajh6ci2mzj2q Mutation probes: historical drift reintroduction -> guard red; hatch marker -> skipped+logged; restore -> 33/33. Full suite 2603/2603.	2026-08-22 15:14:25 -07:00
Krystie	d539ee3b08	DC-044: fix /health/ready caddy probe false negative ... The caddy.ok check in /health/ready probed /config/ (51KB) and timed out at 3s with "This operation was aborted" while Caddy admin was actually healthy. Two underlying issues: 1. Native undici fetch() rejects connections to :2019 (Caddy admin). Use fetchT() which falls back to raw http.request for the admin port. 2. /config/ is heavy and head-of-line blocks when /load is in flight. Switch to /config/apps/http/servers/srv0/listen (9 bytes) and bump timeout to 10s. Verified on DNS2 2026-07-09: direct Caddy admin curl 200 in 3ms, /health/ready was aborting at 3s. After fix: /health/ready caddy.ok true in <100ms. Caddyfile change (/etc/caddy/Caddyfile) added /dashcaddy-login to the @needsAuth not path exclude so direct hits to the auto-login landing page render the page instead of getting gate-redirected to a blank 302 — applied and reloaded via POST /load earlier this session.	2026-07-08 21:33:06 -07:00
Hermes	264de9644c	Fix /health/ready res.status bug + add comprehensive health endpoint tests ... The readiness probe was crashing with 'res.status is not a function' because asyncHandler(async (req, res) => {...}, 'health-ready') was called directly, but asyncHandler's signature is (logError, fn, context) — first arg is the logger, not the handler. The fix uses boundAsyncHandler like all other routes in the file do. Added 8 unit tests for both /health/live and /health/ready: - live always 200 (liveness ≠ readiness) - ready returns 503 when config/services/docker fail - no 'res.status is not a function' crash when dependencies fail - all 4 check keys present in response Also added MONITORING_PUBLIC env var (defaults true) and the new health endpoints to PUBLIC_ROUTES so k8s probes can hit them without auth.	2026-06-10 20:35:27 -07:00