fix: stabilize cloud web proxy runtime

internal/dev-entrypoint/cloud-web-runtime.test.mjs

@@ -0,0 +1,62 @@
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import test from "node:test";
+
+import { createCloudWebServer } from "./cloud-web-runtime.mjs";
+
+test("cloud web auth requests are proxied once", async () => {
+  let upstreamRequests = 0;
+  const upstream = createServer((request, response) => {
+    upstreamRequests += 1;
+    request.resume();
+    response.writeHead(200, { "content-type": "application/json" });
+    response.end(JSON.stringify({ authenticated: true, path: request.url }));
+  });
+  await listen(upstream);
+
+  const cloudWeb = createCloudWebServer({
+    serviceId: "hwlab-cloud-web",
+    cloudApiBaseUrl: serverUrl(upstream),
+    cloudApiProxyTimeoutMs: 1000,
+    healthPayload: () => ({ status: "ok" }),
+    sendJson(response, statusCode, body) {
+      const payload = JSON.stringify(body);
+      response.writeHead(statusCode, {
+        "content-type": "application/json",
+        "content-length": Buffer.byteLength(payload)
+      });
+      response.end(payload);
+    }
+  });
+  await listen(cloudWeb);
+
+  try {
+    const response = await fetch(`${serverUrl(cloudWeb)}/auth/session`, {
+      headers: { cookie: "hwlab_session=token" }
+    });
+    assert.equal(response.status, 200);
+    assert.deepEqual(await response.json(), { authenticated: true, path: "/auth/session" });
+    assert.equal(upstreamRequests, 1);
+  } finally {
+    await close(cloudWeb);
+    await close(upstream);
+  }
+});
+
+function listen(server) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+}
+
+function close(server) {
+  return new Promise((resolve, reject) => {
+    server.close((error) => (error ? reject(error) : resolve()));
+  });
+}
+
+function serverUrl(server) {
+  const address = server.address();
+  return `http://127.0.0.1:${address.port}`;
+}