feat: use client registration token for ndt7 tests

Update ndt7-js to 0.1.3 which supports the `clientRegistrationToken`
option. Before running ndt7 tests, fetch a short-lived JWT token from
the speed-backend service which enables priority access to the Locate
API for registered integrations.

This is the first step toward using the client registration system
for M-Lab's speed test website along with the new backend that we
have written for this purpose: https://github.com/m-lab/speed-proxy.

We implement an open failure model where failure to get the token
causes ndt7 to avoid using the client-integration code.

We use `staging` when not in production so we always know which is
the `m-lab/speed-proxy` branch we're testing against.

Also, update `yarn.lock`.

Also, distinguish between staging and production.

Also, make sure we use correct permissions for GitHub actions.

Also, mention deployment location in the `README.md`.

Author: bassosimone

.github/workflows/firebase-hosting-merge.yml

@@ -6,12 +6,17 @@ name: Deploy to Firebase Hosting on merge
   push:
     branches:
       - main
+permissions:
+  contents: read
+  checks: write
 jobs:
   build_and_deploy:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - run: npm install -g yarn && yarn install --frozen-lockfile && yarn build
+      - name: Substitute M-Lab project placeholder
+        run: sed -i 's/MLAB_PROJECT_PLACEHOLDER/mlab-oti/g' app/measure/measure.js
       - uses: FirebaseExtended/action-hosting-deploy@v0
         with:
           repoToken: '${{ secrets.GITHUB_TOKEN }}'

.github/workflows/firebase-hosting-pull-request.yml

@@ -3,13 +3,18 @@
 
 name: Deploy to Firebase Hosting on PR
 'on': pull_request
+permissions:
+  contents: read
+  checks: write
 jobs:
   build_and_preview:
     if: '${{ github.event.pull_request.head.repo.full_name == github.repository }}'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - run: npm install -g yarn && yarn install --frozen-lockfile && yarn build
+      - name: Substitute M-Lab project placeholder
+        run: sed -i 's/MLAB_PROJECT_PLACEHOLDER/mlab-sandbox/g' app/measure/measure.js
       - uses: FirebaseExtended/action-hosting-deploy@v0
         with:
           repoToken: '${{ secrets.GITHUB_TOKEN }}'

README.md

@@ -38,4 +38,15 @@ To preview the site locally, we recommend using the Python Simple HTTP Server.
 
 * Navigate to the `/app` directory and run: `python3 -m http.server 8000`
 
-If you are a user on the M-Lab Firebase project, you can also preview the site locally using the firebase-cli: `firebase serve --only hosting:mlab-speedtest`
+If you are a user on the M-Lab Firebase project, you can also preview the site locally using the firebase-cli: `firebase serve --only hosting:mlab-speedtest`
+
+## Deployment
+
+The site is deployed via GitHub Actions to Firebase Hosting:
+
+| Environment | Trigger                       | URL                              |
+|-------------|-------------------------------|----------------------------------|
+| Sandbox     | Pull request (from same repo) | https://mlab-sandbox.web.app     |
+| Production  | Merge to `main`               | https://speed.measurementlab.net |
+
+**Note:** PR deployments only work for branches pushed directly to `m-lab/mlab-speedtest`, not from forks (due to Firebase secrets not being available to fork PRs).

app/measure/measure.js

@@ -67,9 +67,50 @@ angular.module('Measure.Measure', ['ngRoute'])
       testRunning = false;
     }
 
+    // Determine the M-Lab project based on a placeholder that is substituted
+    // during deployment. If the placeholder is not substituted (e.g., local
+    // development), default to `staging` for safe testing.
+    //
+    // The reason for using `staging` as opposed to `sandbox` by default is that
+    // using `staging` allows us to know which commit of `m-lab/speed-proxy` we
+    // are testing against (i.e., the latest commit of the `main` branch) as opposed
+    // to being unsure (which commit of a possibly now deleted `sandbox-*` branch
+    // are we actually testing against?).
+    function mlabProject() {
+      const placeholder = 'MLAB_PROJECT_PLACEHOLDER';
+      return placeholder.includes('PLACEHOLDER') ? 'mlab-`staging`' : placeholder;
+    }
+
+    // Build the locate service priority URL for the given project. Production uses
+    // locate.measurementlab.net while `staging` uses locate.mlab-`staging`.measurementlab.net.
+    function locatePriorityURLForProject(project) {
+      const host = project === 'mlab-oti'
+        ? 'locate.measurementlab.net'
+        : `locate.${project}.measurementlab.net`;
+      return `https://${host}/v2/priority/nearest/ndt/ndt7`;
+    }
+
     async function runNdt7(sid) {
+      // Fetch a short-lived token from the speed-backend service to enable
+      // priority access to the Locate API for registered integrations.
+      // If token fetch fails, gracefully degrade to running without a token.
+      const project = mlabProject();
+      const tokenURL = `https://speed-backend.${project}.measurementlab.net/v0/token`;
+      const locatePriorityURL = locatePriorityURLForProject(project);
+
+      let token = null;
+      try {
+        const tokenResp = await fetch(tokenURL);
+        const tokenData = await tokenResp.json();
+        token = tokenData.token;
+      } catch (err) {
+        console.warn('Failed to fetch token, running without priority access:', err);
+      }
+
       return ndt7.test(
         {
+          clientRegistrationToken: token,
+          loadbalancer: token ? locatePriorityURL : null,
           userAcceptedDataPolicy: true,
           uploadworkerfile: "/libraries/ndt7-upload-worker.min.js",
           downloadworkerfile: "/libraries/ndt7-download-worker.min.js",

package.json

@@ -35,7 +35,7 @@
     "@bower_components/jquery": "jquery/jquery-dist#3.0.0",
     "@bower_components/skel": "n33/skel#~3.0.1",
     "@m-lab/msak": "0.3.1",
-    "@m-lab/ndt7": "0.0.6",
+    "@m-lab/ndt7": "0.1.3",
     "@m-lab/packet-test": "0.0.16",
     "ng-device-detector": "^5.1.4",
     "re-tree": "^0.1.7",

yarn.lock

@@ -46,17 +46,10 @@
   dependencies:
     ua-parser-js "^1.0.37"
 
-"@m-lab/ndt7@0.0.6":
-  version "0.0.6"
-  resolved "https://registry.yarnpkg.com/@m-lab/ndt7/-/ndt7-0.0.6.tgz#844da956dcadf1a03b0f76c11833922b8ee67741"
-  integrity sha512-vOnbJETYUqg8Tj6V3tLshj7Nch4SmuJGPVmedIkC7V/x7LTWNHU98RdYcZbbhMWoPOrqGwhOylkqZZtjXdi0BA==
-  dependencies:
-    node-fetch "^2.6.0"
-    workerjs "^0.1.1"
-    ws "^8.5.0"
-  optionalDependencies:
-    bufferutil "^4.0.6"
-    utf-8-validate "^5.0.8"
+"@m-lab/ndt7@0.1.3":
+  version "0.1.3"
+  resolved "https://registry.yarnpkg.com/@m-lab/ndt7/-/ndt7-0.1.3.tgz#d17db5dda6aec5015069c4a6de397aceb57b4a48"
+  integrity sha512-/Fmh5oO7NnS4pJ8dmeut+aYcegILEo8OLzH58MmCzDsHGuWYPhw1GZFMYDTQ9Q9ty/fbGQ+i3b/D/ipJnpxxuw==
 
 "@m-lab/packet-test@0.0.16":
   version "0.0.16"
@@ -549,13 +542,6 @@ buffer-from@^1.0.0:
   resolved "https://registry.yarnpkg.com/buffer-from/-/buffer-from-1.1.2.tgz#2b146a6fd72e80b4f55d255f35ed59a3a9a41bd5"
   integrity sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==
 
-bufferutil@^4.0.6:
-  version "4.0.8"
-  resolved "https://registry.yarnpkg.com/bufferutil/-/bufferutil-4.0.8.tgz#1de6a71092d65d7766c4d8a522b261a6e787e8ea"
-  integrity sha512-4T53u4PdgsXqKaIctwF8ifXlRTTmEPJ8iEPWFdGZvcf7sbwYo6FKFEX9eNNAnzFZ7EzJAQ3CJeOtCRA4rDp7Pw==
-  dependencies:
-    node-gyp-build "^4.3.0"
-
 bytes@3.1.2:
   version "3.1.2"
   resolved "https://registry.yarnpkg.com/bytes/-/bytes-3.1.2.tgz#8b0beeb98605adf1b128fa4386403c009e0221a5"
@@ -2918,18 +2904,6 @@ ng-device-detector@^5.1.4:
     re-tree "^0.1.7"
     ua-device-detector "^1.1.1"
 
-node-fetch@^2.6.0:
-  version "2.7.0"
-  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.7.0.tgz#d0f0fa6e3e2dc1d27efcd8ad99d550bda94d187d"
-  integrity sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==
-  dependencies:
-    whatwg-url "^5.0.0"
-
-node-gyp-build@^4.3.0:
-  version "4.8.0"
-  resolved "https://registry.yarnpkg.com/node-gyp-build/-/node-gyp-build-4.8.0.tgz#3fee9c1731df4581a3f9ead74664369ff00d26dd"
-  integrity sha512-u6fs2AEUljNho3EYTJNBfImO5QTo/J/1Etd+NVdCj7qWKUSN/bSLkZwhDv7I+w/MSC6qJ4cknepkAYykDdK8og==
-
 node-uuid@~1.4.7:
   version "1.4.8"
   resolved "https://registry.yarnpkg.com/node-uuid/-/node-uuid-1.4.8.tgz#b040eb0923968afabf8d32fb1f17f1167fdab907"
@@ -4150,11 +4124,6 @@ tough-cookie@~2.2.0:
   resolved "https://registry.yarnpkg.com/tough-cookie/-/tough-cookie-2.2.2.tgz#c83a1830f4e5ef0b93ef2a3488e724f8de016ac7"
   integrity sha512-Knz9Yr0hlBoWQgUKzOIvRg5adinizAf49i2gHRhj6cLjlM304zRw7uyiY22ADniDxnPHXfIeyQD0EAkgpIz0ow==
 
-tr46@~0.0.3:
-  version "0.0.3"
-  resolved "https://registry.yarnpkg.com/tr46/-/tr46-0.0.3.tgz#8184fd347dac9cdc185992f3a6622e14b9d9ab6a"
-  integrity sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==
-
 tunnel-agent@~0.4.1:
   version "0.4.3"
   resolved "https://registry.yarnpkg.com/tunnel-agent/-/tunnel-agent-0.4.3.tgz#6373db76909fe570e08d73583365ed828a74eeeb"
@@ -4298,13 +4267,6 @@ useragent@^2.1.6:
     lru-cache "4.1.x"
     tmp "0.0.x"
 
-utf-8-validate@^5.0.8:
-  version "5.0.10"
-  resolved "https://registry.yarnpkg.com/utf-8-validate/-/utf-8-validate-5.0.10.tgz#d7d10ea39318171ca982718b6b96a8d2442571a2"
-  integrity sha512-Z6czzLq4u8fPOyx7TU6X3dvUZVvoJmxSQ+IcrlmagKhilxlhZgxPK6C5Jqbkw1IDUmFTM+cz9QDnnLTwDz/2gQ==
-  dependencies:
-    node-gyp-build "^4.3.0"
-
 util-deprecate@^1.0.1, util-deprecate@~1.0.1:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/util-deprecate/-/util-deprecate-1.0.2.tgz#450d4dc9fa70de732762fbd2d4a28981419a0ccf"
@@ -4406,19 +4368,6 @@ void-elements@^2.0.0:
   resolved "https://registry.yarnpkg.com/void-elements/-/void-elements-2.0.1.tgz#c066afb582bb1cb4128d60ea92392e94d5e9dbec"
   integrity sha512-qZKX4RnBzH2ugr8Lxa7x+0V6XD9Sb/ouARtiasEQCHB1EVU4NXtmHsDDrx1dO4ne5fc3J6EW05BP1Dl0z0iung==
 
-webidl-conversions@^3.0.0:
-  version "3.0.1"
-  resolved "https://registry.yarnpkg.com/webidl-conversions/-/webidl-conversions-3.0.1.tgz#24534275e2a7bc6be7bc86611cc16ae0a5654871"
-  integrity sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==
-
-whatwg-url@^5.0.0:
-  version "5.0.0"
-  resolved "https://registry.yarnpkg.com/whatwg-url/-/whatwg-url-5.0.0.tgz#966454e8765462e37644d3626f6742ce8b70965d"
-  integrity sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==
-  dependencies:
-    tr46 "~0.0.3"
-    webidl-conversions "^3.0.0"
-
 which-module@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/which-module/-/which-module-1.0.0.tgz#bba63ca861948994ff307736089e3b96026c2a4f"
@@ -4436,11 +4385,6 @@ wordwrap@~0.0.2:
   resolved "https://registry.yarnpkg.com/wordwrap/-/wordwrap-0.0.3.tgz#a3d5da6cd5c0bc0008d37234bbaf1bed63059107"
   integrity sha512-1tMA907+V4QmxV7dbRvb4/8MaRALK6q9Abid3ndMYnbyo8piisCmeONVqVSXqQA3KaP4SLt5b7ud6E2sqP8TFw==
 
-workerjs@^0.1.1:
-  version "0.1.1"
-  resolved "https://registry.yarnpkg.com/workerjs/-/workerjs-0.1.1.tgz#b7939ed54400937c1c1ef35b74b37dd9bbcbdde6"
-  integrity sha512-fMlithUrdswVB/bDtrncuXeuIOwc4hS+LXsAZNjdcpoOjU0rw1TFV2I5IlCwx6hysU2IveI8uWlkf5mTAQXHcw==
-
 wrap-ansi@^2.0.0:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-2.1.0.tgz#d8fc3d284dd05794fe84973caecdd1cf824fdd85"
@@ -4462,11 +4406,6 @@ ws@^1.0.1, ws@~1.1.5:
     options ">=0.0.5"
     ultron "1.0.x"
 
-ws@^8.5.0:
-  version "8.16.0"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-8.16.0.tgz#d1cd774f36fbc07165066a60e40323eab6446fd4"
-  integrity sha512-HS0c//TP7Ina87TfiPUz1rQzMhHrl/SG2guqRcTOIUYD2q8uhUdNHZYJUaQ8aTGPzCh+c6oawMKW35nFl1dxyQ==
-
 wtf-8@1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/wtf-8/-/wtf-8-1.0.0.tgz#392d8ba2d0f1c34d1ee2d630f15d0efb68e1048a"