mirror of
https://github.com/Vateron-Media/XC_VM.git
synced 2026-10-31 11:03:22 +01:00
obscuremind
2de2a6ca8b
Every stream link, HLS key URL and admin preview token is minted under
live_streaming_pass, and the links are already in players' hands when the
secret changes: the token a viewer sends next was minted under the old value.
Changing the secret — which the settings form has always allowed — therefore
broke every live link at once, so a leaked secret could not be rotated without
an outage. The replica's `secrets` section already carried
{kid, current, previous, previous_valid_until} for exactly this, with the
previous half hard-coded to null.
StreamSecret keeps the value replaced beside the config (0600, as OPENSSL_EXTRA
keeps its own) and readToken() tries it once the current secret fails, for the
sealed and legacy formats alike. MAIN writes it when a settings save changes
the value, ReplicaBuilder publishes it, and a node adopts what MAIN dated and
never invents one of its own. The file is stat-ed on each read rather than
cached for the process's life, because the php-fpm worker that reads a viewer's
token is not the process that replaced the secret.
A `log.*` event is bounded in bytes as well as rows now: a caller's batch is
bounded in rows while a row is as long as its source made it, so a thousand
oversized rows were one event of tens of megabytes to redact, serialise and
post — more than MAIN's ingest takes, and more than the import survived. The
unit suite declares its memory limit for the same reason: a run that crossed
PHP's 128M default died with a bare exit 255, the message swallowed by
PHPUnit's per-test output buffer, and the class that reaches megabyte rows
already sat at 101M on its own.
35 lines
1.6 KiB
XML
35 lines
1.6 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/10.5/phpunit.xsd" defaultTestSuite="XC_VM Unit" bootstrap="bootstrap.php" cacheDirectory=".cache/phpunit" colors="true" failOnRisky="true" failOnWarning="true">
|
|
<testsuites>
|
|
<testsuite name="XC_VM Unit">
|
|
<directory>Unit</directory>
|
|
</testsuite>
|
|
</testsuites>
|
|
<!-- The suite deliberately handles megabyte values (LogImportCronJobsTest's
|
|
oversized spool rows, the crypto vectors, the replica fixtures) and the
|
|
classes that reach them already sit near PHP's 128M default: a run that
|
|
crossed it died with a bare exit 255, the message swallowed by PHPUnit's
|
|
per-test output buffer. -->
|
|
<php>
|
|
<ini name="memory_limit" value="512M"/>
|
|
</php>
|
|
<source>
|
|
<include>
|
|
<directory suffix=".php">../src/Core</directory>
|
|
<directory suffix=".php">../src/Domain</directory>
|
|
<directory suffix=".php">../src/Infrastructure</directory>
|
|
<directory suffix=".php">../src/Modules</directory>
|
|
<directory suffix=".php">../src/Streaming</directory>
|
|
<directory suffix=".php">../src/Cli</directory>
|
|
<file>../src/autoload.php</file>
|
|
<file>../src/bootstrap.php</file>
|
|
</include>
|
|
<exclude>
|
|
<directory suffix=".php">../src/Public/Views</directory>
|
|
<directory suffix=".php">../src/config</directory>
|
|
<directory suffix=".php">../src/ministra</directory>
|
|
<directory suffix=".php">../src/content</directory>
|
|
</exclude>
|
|
</source>
|
|
</phpunit>
|