feat: use client registration token for ndt7 tests (#81)

Update ndt7-js to 0.1.3 which supports the `clientRegistrationToken`
option. Before running ndt7 tests, fetch a short-lived JWT token from
the speed-backend service which enables priority access to the Locate
API for registered integrations.

This is the first step toward using the client registration system
for M-Lab's speed test website along with the new backend that we
have written for this purpose: https://github.com/m-lab/speed-proxy.

We implement an open failure model where failure to get the token
causes ndt7 to avoid using the client-integration code.

We use `mlab-staging` as the default when the placeholder is not
substituted (local development and PR previews), so we always know
which `m-lab/speed-proxy` commit we're testing against. Only the
production merge workflow substitutes the placeholder with `mlab-oti`.

Also, update `yarn.lock`.

Also, make sure we use correct permissions for GitHub actions.

Also, mention deployment location in the `README.md`.

Author: bassosimone

.github/workflows/firebase-hosting-merge.yml

@@ -15,6 +15,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - run: npm install -g yarn && yarn install --frozen-lockfile && yarn build
+      - name: Substitute M-Lab project placeholder
+        run: sed -i 's/MLAB_PROJECT_PLACEHOLDER/mlab-oti/g' app/measure/measure.js
       - uses: FirebaseExtended/action-hosting-deploy@v0
         with:
           repoToken: '${{ secrets.GITHUB_TOKEN }}'

README.md

@@ -38,4 +38,15 @@ To preview the site locally, we recommend using the Python Simple HTTP Server.
 
 * Navigate to the `/app` directory and run: `python3 -m http.server 8000`
 
-If you are a user on the M-Lab Firebase project, you can also preview the site locally using the firebase-cli: `firebase serve --only hosting:mlab-speedtest`
+If you are a user on the M-Lab Firebase project, you can also preview the site locally using the firebase-cli: `firebase serve --only hosting:mlab-speedtest`
+
+## Deployment
+
+The site is deployed via GitHub Actions to Firebase Hosting:
+
+| Environment | Trigger                       | URL                              |
+|-------------|-------------------------------|----------------------------------|
+| Sandbox     | Pull request (from same repo) | https://mlab-sandbox.web.app     |
+| Production  | Merge to `main`               | https://speed.measurementlab.net |
+
+**Note:** PR deployments only work for branches pushed directly to `m-lab/mlab-speedtest`, not from forks (due to Firebase secrets not being available to fork PRs).

app/measure/measure.js

@@ -67,9 +67,56 @@ angular.module('Measure.Measure', ['ngRoute'])
       testRunning = false;
     }
 
+    // Determine the M-Lab project based on a placeholder that is substituted
+    // during deployment. If the placeholder is not substituted (e.g., local
+    // development), default to `staging` for safe testing.
+    //
+    // The reason for using `staging` as opposed to `sandbox` by default is that
+    // using `staging` allows us to know which commit of `m-lab/speed-proxy` we
+    // are testing against (i.e., the latest commit of the `main` branch) as opposed
+    // to being unsure (which commit of a possibly now deleted `sandbox-*` branch
+    // are we actually testing against?).
+    //
+    // TODO(bassosimone): when we modernize the website build system, we should
+    // replace this placeholder-and-sed approach with proper build-time environment
+    // variable injection. The current approach is acceptable for a single config
+    // value, but if we find ourselves adding two or three more substitutions, we
+    // should refactor to use a proper configuration mechanism instead.
+    function mlabProject() {
+      const placeholder = 'MLAB_PROJECT_PLACEHOLDER';
+      return placeholder === 'MLAB_PROJECT_PLACEHOLDER' ? 'mlab-staging' : placeholder;
+    }
+
+    // Build the locate service priority URL for the given project. Production uses
+    // locate.measurementlab.net while `staging` uses locate.mlab-`staging`.measurementlab.net.
+    function locatePriorityURLForProject(project) {
+      const host = project === 'mlab-oti'
+        ? 'locate.measurementlab.net'
+        : `locate.${project}.measurementlab.net`;
+      return `https://${host}/v2/priority/nearest/ndt/ndt7`;
+    }
+
     async function runNdt7(sid) {
+      // Fetch a short-lived token from the speed-backend service to enable
+      // priority access to the Locate API for registered integrations.
+      // If token fetch fails, gracefully degrade to running without a token.
+      const project = mlabProject();
+      const tokenURL = `https://speed-backend.${project}.measurementlab.net/v0/token`;
+      const locatePriorityURL = locatePriorityURLForProject(project);
+
+      let token = null;
+      try {
+        const tokenResp = await fetch(tokenURL);
+        const tokenData = await tokenResp.json();
+        token = tokenData.token;
+      } catch (err) {
+        console.warn('Failed to fetch token, running without priority access:', err);
+      }
+
       return ndt7.test(
         {
+          clientRegistrationToken: token,
+          loadbalancer: token ? locatePriorityURL : null,
           userAcceptedDataPolicy: true,
           uploadworkerfile: "/libraries/ndt7-upload-worker.js",
           downloadworkerfile: "/libraries/ndt7-download-worker.js",