Harden routing regression coverage

Author: tnsardesai

src/lib/browser-routing.ts

@@ -296,6 +296,14 @@ function buildRoutedInit(
   headers: Headers,
 ): RequestInit {
   const method = request.method.toUpperCase();
+  const body = method === 'GET' || method === 'HEAD' ? undefined : requestBodyForFetch(request, originalInit);
+  if (derivesOwnContentType(body) && !new Headers(originalInit?.headers).get('content-type')) {
+    // `request` was constructed from the same body, so its content-type carries
+    // that construction's multipart boundary. The routed fetch re-encodes the
+    // body with a new boundary, so let it derive the header again.
+    headers.delete('content-type');
+  }
+
   const routedInit = {
     ...((originalInit ?? {}) as Record<string, unknown>),
     method,
@@ -307,17 +315,10 @@ function buildRoutedInit(
   delete routedInit['body'];
   delete routedInit['duplex'];
 
+  if (body !== undefined) {
+    routedInit.body = body;
+  }
   if (method !== 'GET' && method !== 'HEAD') {
-    const body = requestBodyForFetch(request, originalInit);
-    if (body !== undefined) {
-      routedInit.body = body;
-      if (derivesOwnContentType(body) && !new Headers(originalInit?.headers).get('content-type')) {
-        // `request` was constructed from the same body, so its content-type carries
-        // that construction's multipart boundary. The routed fetch re-encodes the
-        // body with a new boundary, so let it derive the header again.
-        headers.delete('content-type');
-      }
-    }
     if (originalInit?.duplex !== undefined) {
       routedInit.duplex = originalInit.duplex;
     } else if (requiresHalfDuplex(body)) {

tests/lib/browser-routing.test.ts

@@ -1,4 +1,7 @@
-import Kernel, { toFile } from '@onkernel/sdk';
+import http from 'http';
+import { AddressInfo } from 'net';
+import { Readable } from 'stream';
+import Kernel, { APIConnectionError, toFile } from '@onkernel/sdk';
 
 import {
   BrowserRouteCache,
@@ -744,7 +747,7 @@ describe('browser routing', () => {
             headers: new Headers(request.headers),
             body: new Uint8Array(await request.arrayBuffer()),
           });
-          return new Response(null, { status: 204 });
+          return new Response(null, { status: 201 });
         },
       });
       kernel.browserRouteCache.set({
@@ -783,7 +786,7 @@ describe('browser routing', () => {
             headers: new Headers(request.headers),
             body: await request.text(),
           });
-          return new Response(null, { status: 204 });
+          return new Response(null, { status: 201 });
         },
       });
       kernel.browserRouteCache.set({
@@ -897,7 +900,7 @@ describe('browser routing', () => {
           if (request.url.includes('browser-session.test')) {
             return new Response('Invalid JWT', { status: 401, headers: { 'content-type': 'text/plain' } });
           }
-          return new Response(null, { status: 204 });
+          return new Response(null, { status: 201 });
         },
       });
       kernel.browserRouteCache.set({
@@ -935,7 +938,7 @@ describe('browser routing', () => {
           if (request.url.includes('browser-session.test')) {
             return new Response('Invalid JWT', { status: 403, headers: { 'content-type': 'text/plain' } });
           }
-          return new Response(null, { status: 204 });
+          return new Response(null, { status: 201 });
         },
       });
       kernel.browserRouteCache.set({
@@ -956,6 +959,50 @@ describe('browser routing', () => {
     });
   });
 
+  test('does not send a consumed stream to the control plane after a stale JWT', async () => {
+    await withBrowserRoutingEnv(undefined, async () => {
+      const paths: string[] = [];
+      const server = http.createServer((request, response) => {
+        paths.push(request.url ?? '');
+        request.resume();
+        request.on('end', () => {
+          const direct = request.url?.startsWith('/browser/kernel/') ?? false;
+          response.writeHead(direct ? 401 : 201, { 'content-type': 'text/plain' });
+          response.end(direct ? 'Invalid JWT' : '');
+        });
+      });
+      const baseURL = await new Promise<string>((resolve) => {
+        server.listen(0, '127.0.0.1', () => {
+          const address = server.address() as AddressInfo;
+          resolve(`http://127.0.0.1:${address.port}`);
+        });
+      });
+
+      try {
+        const kernel = new Kernel({ apiKey: 'k', baseURL, maxRetries: 0 });
+        kernel.browserRouteCache.set({
+          sessionId: 'sess-1',
+          baseURL: `${baseURL}/browser/kernel`,
+          jwt: 'token-abc',
+        });
+
+        await expect(
+          kernel.browsers.fs.writeFile('sess-1', Readable.from([Buffer.from('payload')]) as never, {
+            path: '/tmp/x',
+          }),
+        ).rejects.toBeInstanceOf(APIConnectionError);
+
+        expect(paths).toHaveLength(1);
+        expect(paths[0]).toContain('/browser/kernel/fs/write_file');
+        expect(kernel.browserRouteCache.get('sess-1')).toBeUndefined();
+      } finally {
+        const closed = new Promise<void>((resolve) => server.close(() => resolve()));
+        server.closeAllConnections();
+        await closed;
+      }
+    });
+  });
+
   test('env override keeps fs and logs on the control plane', async () => {
     await withBrowserRoutingEnv('computer', async () => {
       const calls: string[] = [];
@@ -1039,7 +1086,7 @@ describe('browser routing', () => {
             dest: form.get('files[0][dest_path]'),
             file: await (form.get('files[0][file]') as File).text(),
           });
-          return new Response(null, { status: 204 });
+          return new Response(null, { status: 201 });
         },
       });
       kernel.browserRouteCache.set({