The front was mounted on the API mux and served through the API middleware
chain, which is shaped for handlers that buffer a request and write one
response. Four consequences.
negroni.NewRecovery() recovers every panic with no http.ErrAbortHandler
exemption, and NewRecovery sets PrintStack. On an abort it wrote "PANIC: ..."
and a goroutine stack into the already-committed body, then returned normally,
so net/http terminated the chunked stream cleanly. A truncated response
reached the client as complete, with a stack trace appended. Detection was
already correct; delivery was not, and the x-lk- trailers that would otherwise
signal it are stripped before the response leaves. A Content-Length response
still failed safe, since net/http enforces the declared length itself, so the
gap was the chunked and trailer paths.
Endpoints.Disabled documents that it turns the front off, but only
registrations were refused; the mount was unconditional.
The CORS method list omits PUT, which a manifest may declare.
The API body limiter capped request bodies at MaxAPIRequestBodySize, though
the front streams a body through a pooled buffer and never holds one.
NewHTTPHandler now routes the prefix to a chain carrying AgentRecovery, a CORS
list matching the methods a manifest may declare, and the api-key auth
middleware the front resolves a caller's access from. The mount is built only
when endpoints are enabled, so the prefix otherwise falls through and 404s.
RemoveDoubleSlashes moves above the split, so routing and both chains see one
path form.
Taking the front off the mux also stops ServeMux rewriting the paths it is
handed: "//x", "/../" and interior "//" were answered with a redirect rather
than proxied, which a byte-transparent exchange cannot do.
The endpoint stack tests now build the production handler, so they run on the
chain the node serves on.
The name is percent-encoded into its URL path segment, so it needs no charset.
Only "_", "." and ".." are refused, and only for workers declaring endpoints:
all three are unreserved, so no encoded form addresses them distinctly. "_"
now addresses a worker registered with an empty agent name, which the
implicit-dispatch default leaves unset.
Two escaping fixes the escaped-path split depends on:
- the trailing-slash alternate treated a decoded slash as literal, so
/known%2F normalized onto route /known and the worker was handed a path it
does not serve.
- RemoveDoubleSlashes trimmed URL.Path and left RawPath, which makes
EscapedPath() re-encode from Path and lose every escape in the request.
Request logs now carry the encoded path, since a decoded %0A forges a log line.
Bound the size of HTTP request bodies on the main API listener so large
messages cannot exhaust memory. Configurable via limit.max_api_request_body_size
(defaults to 10 MiB, 0 disables).
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Proper message id checks.
Some refactoring for common code in rtcv2service handlers.
Instantiate signalling based on synchronous local candidates flag, but
needs better defined code.
* Handle room configuration that's set in the grant itself
* ensure refresh token contains updates
* deps
* dep
---------
Co-authored-by: Paul Wells <paulwe@gmail.com>
When a user includes a trailing slash in LIVEKIT_URL, it would produce
double slashes in the path, i.e. `https://myhost.livekit.cloud//twirp/RoomService.ListRooms`
Currently the server will send a 302 MOVED response, causing Twirp requests to fail.
We now remove the double slash in front within the middleware.
* Log cleanup pass
Demoted a bunch of logs to DEBUG, consolidated logs.
* use context logger and fix context var usage
* moved common error types, fixed tests
When the instance handling the signal request did not respond to the
initial connection, we will fail the connection attempt instead of
having it hang forever.
* feat: unpublish tracks after publish permissions are revoked.
Uses protocol 7 to indicate client support, otherwise it attempts to
mute the tracks.
Also sends back permissions objects of all participants, and cleaned up
our handling of various permissions attributes.
* fix static check
* Stream Allocator Try 3
Making an intermediate PR to do
- Special treatment for screen share tracks
- When allocating all tracks,
o try to stream all tracks by starting with the lowest layer
o multi-pass across tracks to get a more even distribution
Not yet done:
-------------
In deficient state,
o Allocate a specific track on a change
o Steal from other tracks
* Correct sense of managed track
* have to range to copy
* generate
* fix VideoLayers compare
* Use t.simulcasted
* small refactor
* extra line
* fix room allocator test
* selector fakes not used
* keep decisions out of router
* put nodeId logic back
* fix room allocator test
* more generic turn server
* public turn realm name
* support turn cert itself in config
* remove cert/key from config
* double auth handler
* generate
Co-authored-by: Mathew Kamkar <578302+matkam@users.noreply.github.com>
* SendData Server API
* SendData Server-API adjustments based on suggestions
* Update proto version
* enforce publishData permission
* go mod tidy
* fix go.mod
* go mod tidy
Co-authored-by: ChesterMing <89124853+ChesterMing@users.noreply.github.com>
Paul Wells