feat: use client registration token for ndt7 tests

Update ndt7-js to 0.1.3 which supports the `clientRegistrationToken`
option. Before running ndt7 tests, fetch a short-lived JWT token from
the speed-backend service which enables priority access to the Locate
API for registered integrations.

This is the first step toward using the client registration system
for M-Lab's speed test website along with the new backend that we
have written for this purpose: https://github.com/m-lab/speed-proxy.

We implement an open failure model where failure to get the token
causes ndt7 to avoid using the client-integration code.

We use `staging` when not in production so we always know which is
the `m-lab/speed-proxy` branch we're testing against.

Also, update `yarn.lock`.

Also, distinguish between staging and production.

Also, make sure we use correct permissions for GitHub actions.

Also, mention deployment location in the `README.md`.

Author: bassosimone

.github/workflows/firebase-hosting-merge.yml

@@ -6,12 +6,17 @@ name: Deploy to Firebase Hosting on merge
   push:
     branches:
       - main
+permissions:
+  contents: read
+  checks: write
 jobs:
   build_and_deploy:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - run: npm install -g yarn && yarn install --frozen-lockfile && yarn build
+      - name: Substitute M-Lab project placeholder
+        run: sed -i 's/MLAB_PROJECT_PLACEHOLDER/mlab-oti/g' app/measure/measure.js
       - uses: FirebaseExtended/action-hosting-deploy@v0
         with:
           repoToken: '${{ secrets.GITHUB_TOKEN }}'

.github/workflows/firebase-hosting-pull-request.yml

@@ -3,13 +3,18 @@
 
 name: Deploy to Firebase Hosting on PR
 'on': pull_request
+permissions:
+  contents: read
+  checks: write
 jobs:
   build_and_preview:
     if: '${{ github.event.pull_request.head.repo.full_name == github.repository }}'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - run: npm install -g yarn && yarn install --frozen-lockfile && yarn build
+      - name: Substitute M-Lab project placeholder
+        run: sed -i 's/MLAB_PROJECT_PLACEHOLDER/mlab-sandbox/g' app/measure/measure.js
       - uses: FirebaseExtended/action-hosting-deploy@v0
         with:
           repoToken: '${{ secrets.GITHUB_TOKEN }}'

README.md

@@ -38,4 +38,15 @@ To preview the site locally, we recommend using the Python Simple HTTP Server.
 
 * Navigate to the `/app` directory and run: `python3 -m http.server 8000`
 
-If you are a user on the M-Lab Firebase project, you can also preview the site locally using the firebase-cli: `firebase serve --only hosting:mlab-speedtest`
+If you are a user on the M-Lab Firebase project, you can also preview the site locally using the firebase-cli: `firebase serve --only hosting:mlab-speedtest`
+
+## Deployment
+
+The site is deployed via GitHub Actions to Firebase Hosting:
+
+| Environment | Trigger                       | URL                              |
+|-------------|-------------------------------|----------------------------------|
+| Sandbox     | Pull request (from same repo) | https://mlab-sandbox.web.app     |
+| Production  | Merge to `main`               | https://speed.measurementlab.net |
+
+**Note:** PR deployments only work for branches pushed directly to `m-lab/mlab-speedtest`, not from forks (due to Firebase secrets not being available to fork PRs).

app/measure/measure.js

@@ -67,9 +67,50 @@ angular.module('Measure.Measure', ['ngRoute'])
       testRunning = false;
     }
 
+    // Determine the M-Lab project based on a placeholder that is substituted
+    // during deployment. If the placeholder is not substituted (e.g., local
+    // development), default to `staging` for safe testing.
+    //
+    // The reason for using `staging` as opposed to `sandbox` by default is that
+    // using `staging` allows us to know which commit of `m-lab/speed-proxy` we
+    // are testing against (i.e., the latest commit of the `main` branch) as opposed
+    // to being unsure (which commit of a possibly now deleted `sandbox-*` branch
+    // are we actually testing against?).
+    function mlabProject() {
+      const placeholder = 'MLAB_PROJECT_PLACEHOLDER';
+      return placeholder.includes('PLACEHOLDER') ? 'mlab-`staging`' : placeholder;
+    }
+
+    // Build the locate service priority URL for the given project. Production uses
+    // locate.measurementlab.net while `staging` uses locate.mlab-`staging`.measurementlab.net.
+    function locatePriorityURLForProject(project) {
+      const host = project === 'mlab-oti'
+        ? 'locate.measurementlab.net'
+        : `locate.${project}.measurementlab.net`;
+      return `https://${host}/v2/priority/nearest/ndt/ndt7`;
+    }
+
     async function runNdt7(sid) {
+      // Fetch a short-lived token from the speed-backend service to enable
+      // priority access to the Locate API for registered integrations.
+      // If token fetch fails, gracefully degrade to running without a token.
+      const project = mlabProject();
+      const tokenURL = `https://speed-backend.${project}.measurementlab.net/v0/token`;
+      const locatePriorityURL = locatePriorityURLForProject(project);
+
+      let token = null;
+      try {
+        const tokenResp = await fetch(tokenURL);
+        const tokenData = await tokenResp.json();
+        token = tokenData.token;
+      } catch (err) {
+        console.warn('Failed to fetch token, running without priority access:', err);
+      }
+
       return ndt7.test(
         {
+          clientRegistrationToken: token,
+          loadbalancer: token ? locatePriorityURL : null,
           userAcceptedDataPolicy: true,
           uploadworkerfile: "/libraries/ndt7-upload-worker.min.js",
           downloadworkerfile: "/libraries/ndt7-download-worker.min.js",

package.json

@@ -35,7 +35,7 @@
     "@bower_components/jquery": "jquery/jquery-dist#3.0.0",
     "@bower_components/skel": "n33/skel#~3.0.1",
     "@m-lab/msak": "0.3.1",
-    "@m-lab/ndt7": "0.0.6",
+    "@m-lab/ndt7": "0.1.3",
     "@m-lab/packet-test": "0.0.16",
     "ng-device-detector": "^5.1.4",
     "re-tree": "^0.1.7",