Move browser authentication behind a generated-contract BFF

web/tests/system/proxy.mjs

@@ -5,13 +5,14 @@ const upstreamHost = 'qualification-ingress'
 const upstreamPort = 80
 
 const server = http.createServer((request, response) => {
+  const headers = upstreamHeaders(request.headers)
   const upstream = http.request(
     {
       host: upstreamHost,
       port: upstreamPort,
       method: request.method,
       path: request.url,
-      headers: { ...request.headers, host: upstreamHost },
+      headers,
     },
     (upstreamResponse) => {
       response.writeHead(
@@ -30,7 +31,7 @@ const server = http.createServer((request, response) => {
 
 server.on('upgrade', (request, socket, head) => {
   const upstream = net.connect(upstreamPort, upstreamHost, () => {
-    const headers = Object.entries(request.headers)
+    const headers = Object.entries(upstreamHeaders(request.headers))
       .filter(([name]) => name.toLowerCase() !== 'host')
       .map(([name, value]) => `${name}: ${String(value)}`)
       .join('\r\n')
@@ -41,6 +42,25 @@ server.on('upgrade', (request, socket, head) => {
     socket.pipe(upstream).pipe(socket)
   })
   upstream.on('error', () => socket.destroy())
+  socket.on('error', () => upstream.destroy())
 })
 
+function upstreamHeaders(incoming) {
+  const headers = { ...incoming, host: upstreamHost }
+  const session = qualificationSession(headers.cookie)
+  if (typeof session === 'string' && /^[A-Za-z0-9_-]{43}$/.test(session))
+    headers.cookie = `__Host-remora-session=${session}`
+  else delete headers.cookie
+  return headers
+}
+
+function qualificationSession(cookieHeader) {
+  if (typeof cookieHeader !== 'string') return null
+  for (const cookie of cookieHeader.split(';')) {
+    const [name, value] = cookie.trim().split('=', 2)
+    if (name === 'remora-qualification-session') return value
+  }
+  return null
+}
+
 server.listen(4174, '127.0.0.1')