stacklok / toolhive / 35621197906

71%

push

github

Recognise every SSE session id spelling (#6698)

* Recognise every SSE session id spelling

Operator E2E has been failing on every kind version since session ownership
landed: the sse scenario reports "missing endpoint: unexpected EOF" and no
SSE workload can connect.

extractSessionID looks for the session id in an endpoint event and treats an
unrecognised carrier as an absent one, which closes the stream before the
client is ever told where to post. It looked only for "sessionId", but the
proxy does not choose that name -- the backend does, and the spellings in the
wild differ. The yardstick server the operator suite runs emits
`data: /sse?sessionid=...`, all lowercase, so its stream was closed on every
connection. ToolHive's own SSE proxy emits `session_id`, so a chained
deployment had the same problem.

Recognising one spelling does not fail safe here. It is not a tightened
check: the client never receives the endpoint event at all, which is a total
outage for that backend rather than a refused session.

The known spellings now live in one list that every site reading, enforcing
or rewriting a carrier shares, because a carrier bound under one spelling and
checked under another is how a request gets authorized as one session and
executed as another. Two spellings carrying different values are refused
rather than resolved to one of them, for the same reason.

An endpoint event that genuinely carries no session id is still refused, as
TestSSEEndpointWithoutSessionIDIsNotExposed requires: that case has no
ownership to bind, which is a different question from one this proxy simply
failed to parse.

Verified against the real yardstick image: without this change the endpoint
event never arrives and the stream ends in "unexpected EOF"; with it the
event is delivered and initialize is accepted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Fix chart-testing action setup

* Pin compatible chart-testing action

---------

Co-authored-by: Claude O... (continued)

15 of 17 new or added lines in 3 files covered. (88.24%)

84267 of 118808 relevant lines covered (70.93%)

107.91 hits per line