Loyaly/Behavision
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 22 Wiki Activity

The camera tiles put a password in the page, and loaded nothing

Browse Source 
StreamURL built http://user:pass@127.0.0.1:8010/api/cameras/<id>/
stream.mjpeg and handed it to an <img>, with a comment saying the
credentials were inline "so an <img> tag can load it".

It cannot. Chromium strips credentials from subresource URLs and has
since M59, and WebView2 is Chromium - so on the one platform this
product ships to, every camera tile on a shop counter was a broken
image. Measured against a running engine: the app's Go-side calls
returned stats and people while an <img> on that very URL failed, and
curl proved the URL answered 200. The engine was never the problem.

The password now stays on this side of the process boundary. A loopback
relay attaches Basic auth and streams the engine's bytes back
unchanged - the same reasoning Shot.jsx already follows at head office,
where an <img> equally cannot carry a session.

What the relay is careful about, since it is a door onto the biometric
API with a credential attached:

  - loopback only, on a port the OS picks; a fixed one would collide
    with whatever else a shop PC runs and read as "the cameras broke"
  - a per-run random token in the path. The engine's own credential
    exists so the live face feed is never served open; an
    unauthenticated relay would hand that feed to any other process on
    the PC. Compared in constant time, and a wrong one is 404, not 403
  - an allow-list of stream.mjpeg and frame.jpg. Holding the token does
    not reach the identity list, the gallery, or erasure
  - camera ids validated, not interpolated
  - every chunk flushed; a buffered MJPEG stream is a tile that never
    paints, which looks identical to the bug being fixed

Two of those were written after a test failed, not before:

  - `..` MATCHES the id pattern, because real camera ids contain dots.
    `/api/cameras/../stream.mjpeg` is not the endpoint anyone intended.
    The id can never hold a slash, so `.` and `..` are the whole
    remaining traversal surface and are now refused by name.
  - the serve goroutine read p.srv off the struct while stop() was
    nilling it, so a quick start/stop dereferenced nil and took the
    process down. Captured before launching now.

FrameURL is deliberately not added. No screen asks for a still, and a
bound method nothing calls is the same defect as a capability the UI
cannot reach, only pointing the other way.

Verified: nine unit tests, plus a live test against the real engine and
the real office camera - two MJPEG frames, 90,793 bytes, no credential
in the URL. Windows and darwin both build; vet clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pcn9asw19WGBfCEaHvNug6
This commit is contained in:
Suriyakumarvijayanayagam
2026-09-10 19:53:28 +05:30
parent 9521cb986b
commit 5e544eee3d
4 changed files with 577 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
desktop/app.go
View File

@@ -43,6 +43,9 @@ type App struct {
broker *agentmqtt.Client
stopBridge func()
hookURL string
// Relays camera feeds to the webview so the engine's credential never has
// to travel in an <img> src, which a Chromium webview would strip anyway.
proxy *streamProxy
// Set once the operator logs in. Until then the UI shows the login sheet
// and nothing else is reachable.
onSessionChange func(bool)
@@ -63,6 +66,7 @@ func NewApp() *App {
cfg: cfg,
cloud: cloud.New(envOr("BEHAVISION_CLOUD", "https://mcp.loyaly.ai")),
local: local.New(base, cfg.APIUser, cfg.APIPassword),
proxy: newStreamProxy(),
}
}
@@ -70,6 +74,14 @@ func (a *App) startup(ctx context.Context) {
a.ctx = ctx
_ = agentpaths.EnsureState()
// Before any screen asks for a camera URL. A failure here is logged and
// not fatal: the rest of the app - people, cameras, the engine controls -
// works without a picture, and refusing to start over a broken tile would
// take a working shop offline.
if err := a.proxy.start(a.local.Base, a.local.User, a.local.Password); err != nil {
log.Printf("camera relay unavailable, tiles will not load: %v", err)
}
// A saved session means a shop PC that rebooted overnight comes back
// working instead of waiting for someone to log in.
if a.cfg.SessionToken != "" {
@@ -549,15 +561,25 @@ func (a *App) PlacementResult(id string) (map[string]any, error) {
return a.local.PlacementResult(ctx, id)
}
// StreamURL is the MJPEG endpoint for a camera, with credentials inline so an
// <img> tag can load it. Loopback only - it never leaves this machine.
// StreamURL is the MJPEG endpoint for a camera tile.
//
// It points at this app's own loopback relay, not at the engine directly. The
// previous version put the engine's Basic credentials inline in the URL, with
// a comment saying they were there "so an <img> tag can load it" - which a
// browser will not do. Chromium strips credentials from subresource URLs, and
// WebView2 is Chromium, so every camera tile on a shop PC was a broken image.
// See stream_proxy.go for the measurement.
//
// The relay is also why no password appears in the page any more. If it is not
// running the fallback is the bare engine URL with no credential: correct for
// an engine configured without auth, and for one with auth a tile that fails
// to load rather than a password sitting in the DOM.
func (a *App) StreamURL(cameraID string) string {
base := strings.TrimPrefix(strings.TrimPrefix(a.local.Base, "http://"), "https://")
if a.local.User == "" {
return fmt.Sprintf("http://%s/api/cameras/%s/stream.mjpeg", base, cameraID)
if u := a.proxy.urlFor(cameraID, "stream.mjpeg"); u != "" {
return u
}
return fmt.Sprintf("http://%s:%s@%s/api/cameras/%s/stream.mjpeg",
a.local.User, a.local.Password, base, cameraID)
base := strings.TrimPrefix(strings.TrimPrefix(a.local.Base, "http://"), "https://")
return fmt.Sprintf("http://%s/api/cameras/%s/stream.mjpeg", base, cameraID)
}
// ------------------------------------------------------------------- live --

1
desktop/main.go
View File

@@ -49,6 +49,7 @@ func main() {
},
OnShutdown: func(ctx context.Context) {
tray.stop()
app.proxy.stop()
app.StopEngine()
},
Bind: []any{app},

249
desktop/stream_proxy.go Normal file
View File

@@ -0,0 +1,249 @@
package main
// streamProxy serves the engine's camera feeds to this app's own webview
// without putting a credential in the page.
//
// What this replaces: StreamURL used to build
// http://user:pass@127.0.0.1:8010/api/cameras/<id>/stream.mjpeg and hand it
// to an <img>, with a comment saying the credentials were inline "so an <img>
// tag can load it". It cannot. Chromium strips credentials from subresource
// URLs and has since M59, and WebView2 is Chromium - so on the one platform
// this product ships to, every camera tile on the shop floor renders as a
// broken image. Measured against the same running engine: the app's Go-side
// calls returned stats and people while an <img> on the very same URL failed,
// and curl proved the URL itself answered 200. The engine was never the
// problem; the browser was throwing the password away before it asked.
//
// So the password stays on this side of the process boundary. The webview
// asks this loopback listener, the listener attaches Basic auth and relays
// the engine's bytes back unchanged. It is the same reasoning the head-office
// web app already follows in Shot.jsx, where an <img> equally cannot carry a
// session and the bytes are fetched and handed over as an object URL.
import (
"crypto/rand"
"crypto/subtle"
"encoding/hex"
"fmt"
"net"
"net/http"
"net/url"
"regexp"
"strings"
"sync"
"time"
)
// A camera id reaches this from the engine and from a person typing into the
// Add Camera form. Validated rather than interpolated: without this a `..`
// would climb out of the two paths below and turn a camera relay into a proxy
// for any engine endpoint, with the credential helpfully attached.
var safeCameraIDChars = regexp.MustCompile(`^[A-Za-z0-9_.-]{1,64}$`)
// safeCameraID is the character check AND the two names that pass it and still
// mean something to a path resolver.
//
// The pattern allows `.` because real camera ids contain them - which means it
// also allows exactly `.` and `..`, and `/api/cameras/../stream.mjpeg` is not
// the endpoint anyone intended. The id can never contain a slash (the path is
// split on them before we get here), so these two strings are the entire
// remaining traversal surface. Found by the test, not by reading the regex.
func safeCameraID(id string) bool {
if id == "." || id == ".." {
return false
}
return safeCameraIDChars.MatchString(id)
}
type streamProxy struct {
mu sync.RWMutex
ln net.Listener
srv *http.Server
client *http.Client
token string
target string // engine origin, e.g. http://127.0.0.1:8010
user string
pass string
}
func newStreamProxy() *streamProxy { return &streamProxy{} }
// start binds a loopback listener and begins relaying. Calling it again while
// running is a no-op, so a restarted engine cannot leave two listeners behind.
func (p *streamProxy) start(base, user, pass string) error {
p.mu.Lock()
defer p.mu.Unlock()
if p.srv != nil {
return nil
}
if !strings.HasPrefix(base, "http://") && !strings.HasPrefix(base, "https://") {
base = "http://" + base
}
if _, err := url.Parse(base); err != nil {
return fmt.Errorf("engine base %q: %w", base, err)
}
// The engine's own credential exists precisely so that the live face feed
// is never served open - CLAUDE.md is explicit that an unauthenticated
// listener would expose it. An unauthenticated loopback relay would hand
// that same feed to any other process on this PC, which on a shop counter
// is not a theoretical set. A per-run token, minted here and given only to
// this app's own webview, keeps the relay as private as the engine is.
raw := make([]byte, 32)
if _, err := rand.Read(raw); err != nil {
return fmt.Errorf("proxy token: %w", err)
}
// Port 0: the OS picks a free one. A fixed port would collide with
// whatever else a shop PC happens to be running, and the failure would be
// "the cameras stopped working" with nothing pointing at the cause.
ln, err := net.Listen("tcp", "127.0.0.1:0")
if err != nil {
return fmt.Errorf("stream proxy listen: %w", err)
}
p.ln = ln
p.token = hex.EncodeToString(raw)
p.target = strings.TrimRight(base, "/")
p.user, p.pass = user, pass
// No client timeout: an MJPEG stream is endless by design and any deadline
// would cut the picture off mid-shift. The request context ends it when
// the webview navigates away or the tile is replaced.
p.client = &http.Client{
Transport: &http.Transport{
DialContext: (&net.Dialer{Timeout: 5 * time.Second}).DialContext,
TLSHandshakeTimeout: 5 * time.Second,
},
}
srv := &http.Server{Handler: http.HandlerFunc(p.handle)}
p.srv = srv
// srv and ln are captured, not read off the struct inside the goroutine:
// stop() sets both to nil, so a serve loop that reached for them after a
// quick start/stop would dereference nil and take the whole app down. The
// test that stops the relay found exactly that.
go func() { _ = srv.Serve(ln) }()
return nil
}
func (p *streamProxy) stop() {
p.mu.Lock()
srv, ln := p.srv, p.ln
p.srv, p.ln, p.token = nil, nil, ""
p.mu.Unlock()
if srv != nil {
_ = srv.Close()
}
if ln != nil {
_ = ln.Close()
}
}
// urlFor returns the loopback URL for one camera resource, or "" when the
// proxy is not running so the caller can fall back.
func (p *streamProxy) urlFor(cameraID, file string) string {
p.mu.RLock()
defer p.mu.RUnlock()
if p.ln == nil || p.token == "" || !safeCameraID(cameraID) {
return ""
}
return fmt.Sprintf("http://%s/s/%s/%s/%s",
p.ln.Addr().String(), p.token, cameraID, file)
}
func (p *streamProxy) handle(w http.ResponseWriter, r *http.Request) {
p.mu.RLock()
token, target, user, pass, client := p.token, p.target, p.user, p.pass, p.client
p.mu.RUnlock()
if token == "" || client == nil {
http.NotFound(w, r)
return
}
// /s/<token>/<camera>/<file>
parts := strings.Split(strings.TrimPrefix(r.URL.Path, "/"), "/")
if len(parts) != 4 || parts[0] != "s" {
http.NotFound(w, r)
return
}
// Constant time: the token is the only thing standing between another
// local process and a live view of customers' faces.
if subtle.ConstantTimeCompare([]byte(parts[1]), []byte(token)) != 1 {
// 404 rather than 403. There is nothing here to tell an unwelcome
// caller they have found the right door with the wrong key.
http.NotFound(w, r)
return
}
cameraID := parts[2]
if !safeCameraID(cameraID) {
http.NotFound(w, r)
return
}
// An allow-list, not a prefix match. Everything else the engine serves -
// the identity list, the gallery, erasure - stays unreachable through here
// even for a caller holding the token.
//
// frame.jpg is listed although no screen asks for one yet. It is reachable
// only through urlFor, which is internal, so it adds no bound API nobody
// calls; it is here so that adding a still later is a change to a screen
// rather than a change to the one file where a mistake is a credentialed
// proxy onto the biometric API.
var enginePath string
switch parts[3] {
case "stream.mjpeg":
enginePath = "/api/cameras/" + cameraID + "/stream.mjpeg"
case "frame.jpg":
enginePath = "/api/cameras/" + cameraID + "/frame.jpg"
default:
http.NotFound(w, r)
return
}
req, err := http.NewRequestWithContext(r.Context(), http.MethodGet, target+enginePath, nil)
if err != nil {
http.Error(w, "bad upstream request", http.StatusInternalServerError)
return
}
// frame.jpg takes width and quality; the engine re-encodes on demand.
req.URL.RawQuery = r.URL.RawQuery
if user != "" {
req.SetBasicAuth(user, pass)
}
resp, err := client.Do(req)
if err != nil {
http.Error(w, "engine unreachable", http.StatusBadGateway)
return
}
defer resp.Body.Close()
for _, h := range []string{"Content-Type", "Cache-Control", "Pragma", "Expires"} {
if v := resp.Header.Get(h); v != "" {
w.Header().Set(h, v)
}
}
w.WriteHeader(resp.StatusCode)
// Copied by hand rather than with io.Copy so every chunk is flushed. An
// MJPEG stream never ends, so anything buffered waiting for a full buffer
// is a tile that stays blank forever - which is the same symptom as the
// bug this file exists to fix, and would look like it had not worked.
flusher, _ := w.(http.Flusher)
buf := make([]byte, 32*1024)
for {
n, rerr := resp.Body.Read(buf)
if n > 0 {
if _, werr := w.Write(buf[:n]); werr != nil {
return // webview went away
}
if flusher != nil {
flusher.Flush()
}
}
if rerr != nil {
return
}
}
}

296
desktop/stream_proxy_test.go Normal file
View File

@@ -0,0 +1,296 @@
package main
import (
"fmt"
"io"
"net/http"
"net/http/httptest"
"os"
"strings"
"testing"
"time"
)
// fakeEngine stands in for the Python engine: it demands Basic auth exactly as
// the real one does when a credential is configured, and records what it was
// asked for.
type fakeEngine struct {
*httptest.Server
gotPath string
gotUser string
gotPass string
hadAuth bool
}
func newFakeEngine(t *testing.T, body string) *fakeEngine {
t.Helper()
f := &fakeEngine{}
f.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
f.gotPath = r.URL.Path
if r.URL.RawQuery != "" {
f.gotPath += "?" + r.URL.RawQuery
}
f.gotUser, f.gotPass, f.hadAuth = r.BasicAuth()
if !f.hadAuth {
w.Header().Set("WWW-Authenticate", `Basic realm="behavision"`)
w.WriteHeader(http.StatusUnauthorized)
return
}
w.Header().Set("Content-Type", "multipart/x-mixed-replace; boundary=frame")
_, _ = io.WriteString(w, body)
}))
t.Cleanup(f.Close)
return f
}
func startProxy(t *testing.T, engine string, user, pass string) *streamProxy {
t.Helper()
p := newStreamProxy()
if err := p.start(engine, user, pass); err != nil {
t.Fatalf("start: %v", err)
}
t.Cleanup(p.stop)
return p
}
func get(t *testing.T, url string) (int, string) {
t.Helper()
c := &http.Client{Timeout: 5 * time.Second}
resp, err := c.Get(url)
if err != nil {
t.Fatalf("get %s: %v", url, err)
}
defer resp.Body.Close()
b, _ := io.ReadAll(resp.Body)
return resp.StatusCode, string(b)
}
// The whole point: the webview gets a URL it can actually load, and the
// password stays behind. A credential in the src is both unloadable in a
// Chromium webview and readable by anything that can see the DOM.
func TestTheCameraURLCarriesNoPassword(t *testing.T) {
engine := newFakeEngine(t, "frames")
p := startProxy(t, engine.URL, "behavision", "hunter2-the-real-one")
u := p.urlFor("cam2", "stream.mjpeg")
if u == "" {
t.Fatal("no url while the proxy is running")
}
if strings.Contains(u, "hunter2-the-real-one") || strings.Contains(u, "behavision:") {
t.Fatalf("credential leaked into the tile URL: %s", u)
}
if !strings.HasPrefix(u, "http://127.0.0.1:") {
t.Fatalf("relay must be loopback only, got %s", u)
}
}
func TestTheRelayAttachesTheCredentialItself(t *testing.T) {
engine := newFakeEngine(t, "frame-bytes")
p := startProxy(t, engine.URL, "behavision", "s3cret")
code, body := get(t, p.urlFor("cam2", "stream.mjpeg"))
if code != http.StatusOK {
t.Fatalf("want 200 through the relay, got %d", code)
}
if body != "frame-bytes" {
t.Fatalf("body not relayed unchanged: %q", body)
}
if !engine.hadAuth || engine.gotUser != "behavision" || engine.gotPass != "s3cret" {
t.Fatalf("engine did not receive the credential: auth=%v user=%q",
engine.hadAuth, engine.gotUser)
}
if engine.gotPath != "/api/cameras/cam2/stream.mjpeg" {
t.Fatalf("wrong upstream path: %s", engine.gotPath)
}
}
// The token is what keeps every other process on a shop PC from opening a live
// view of customers' faces, now that the relay itself has no password.
func TestAnotherProcessCannotGuessItsWayIn(t *testing.T) {
engine := newFakeEngine(t, "frames")
p := startProxy(t, engine.URL, "behavision", "s3cret")
addr := p.ln.Addr().String()
for _, bad := range []string{"", "0", strings.Repeat("a", 64), "wrong-token"} {
url := fmt.Sprintf("http://%s/s/%s/cam2/stream.mjpeg", addr, bad)
if code, _ := get(t, url); code != http.StatusNotFound {
t.Fatalf("token %q got %d, want 404", bad, code)
}
}
if engine.hadAuth {
t.Fatal("a rejected request still reached the engine")
}
}
// A camera id is interpolated into the upstream path, so it has to be a camera
// id and not a way to walk to a different endpoint with the credential
// attached.
func TestACameraIdCannotClimbOutOfItsPath(t *testing.T) {
engine := newFakeEngine(t, "frames")
p := startProxy(t, engine.URL, "behavision", "s3cret")
addr := p.ln.Addr().String()
for _, bad := range []string{"..", "%2e%2e", "cam2/../../api/identities", "cam 2", ""} {
url := fmt.Sprintf("http://%s/s/%s/%s/stream.mjpeg", addr, p.token, bad)
code, _ := get(t, url)
if code != http.StatusNotFound {
t.Fatalf("camera id %q got %d, want 404", bad, code)
}
}
if strings.Contains(engine.gotPath, "identities") {
t.Fatalf("reached a non-camera endpoint: %s", engine.gotPath)
}
}
// Only the two files a tile needs. The engine also serves the identity list and
// the erasure endpoint; holding the token must not open those.
func TestOnlyTheTwoCameraFilesAreReachable(t *testing.T) {
engine := newFakeEngine(t, "frames")
p := startProxy(t, engine.URL, "behavision", "s3cret")
addr := p.ln.Addr().String()
for _, bad := range []string{"identities", "stats", "commission", "stream.mjpeg.bak"} {
url := fmt.Sprintf("http://%s/s/%s/cam2/%s", addr, p.token, bad)
if code, _ := get(t, url); code != http.StatusNotFound {
t.Fatalf("file %q got %d, want 404", bad, code)
}
}
for _, good := range []string{"stream.mjpeg", "frame.jpg"} {
url := fmt.Sprintf("http://%s/s/%s/cam2/%s", addr, p.token, good)
if code, _ := get(t, url); code != http.StatusOK {
t.Fatalf("file %q got %d, want 200", good, code)
}
}
}
// frame.jpg takes width and quality - the engine re-encodes on demand, and a
// relay that dropped the query would silently serve full-size frames.
func TestTheQueryStringSurvivesTheRelay(t *testing.T) {
engine := newFakeEngine(t, "frames")
p := startProxy(t, engine.URL, "behavision", "s3cret")
url := p.urlFor("cam2", "frame.jpg") + "?width=640&quality=70"
if code, _ := get(t, url); code != http.StatusOK {
t.Fatalf("got %d", code)
}
if !strings.Contains(engine.gotPath, "width=640") ||
!strings.Contains(engine.gotPath, "quality=70") {
t.Fatalf("query dropped: %s", engine.gotPath)
}
}
// An engine that is not running must read as a bad gateway, not as a hang. A
// blank tile that never resolves is the symptom this whole file exists to end.
func TestAnEngineThatIsDownFailsQuickly(t *testing.T) {
// Port 1 on loopback: nothing listens, and the connection is refused
// rather than dropped, so this is fast and deterministic.
p := startProxy(t, "http://127.0.0.1:1", "behavision", "s3cret")
done := make(chan int, 1)
go func() { code, _ := get(t, p.urlFor("cam2", "stream.mjpeg")); done <- code }()
select {
case code := <-done:
if code != http.StatusBadGateway {
t.Fatalf("want 502, got %d", code)
}
case <-time.After(8 * time.Second):
t.Fatal("a dead engine left the request hanging")
}
}
// Stopping must actually free the port, or a restarted engine leaves listeners
// behind for the life of the process.
func TestStoppingReleasesEverything(t *testing.T) {
engine := newFakeEngine(t, "frames")
p := newStreamProxy()
if err := p.start(engine.URL, "u", "p"); err != nil {
t.Fatalf("start: %v", err)
}
url := p.urlFor("cam2", "stream.mjpeg")
if code, _ := get(t, url); code != http.StatusOK {
t.Fatalf("want 200 before stop, got %d", code)
}
p.stop()
if got := p.urlFor("cam2", "stream.mjpeg"); got != "" {
t.Fatalf("still handing out URLs after stop: %s", got)
}
c := &http.Client{Timeout: 3 * time.Second}
if resp, err := c.Get(url); err == nil {
resp.Body.Close()
t.Fatal("listener still accepting after stop")
}
}
// start twice must not leave two listeners, which is what a restarted engine
// would otherwise cause.
func TestStartingTwiceIsANoOp(t *testing.T) {
engine := newFakeEngine(t, "frames")
p := startProxy(t, engine.URL, "u", "p")
first := p.urlFor("cam2", "stream.mjpeg")
if err := p.start(engine.URL, "u", "p"); err != nil {
t.Fatalf("second start: %v", err)
}
if second := p.urlFor("cam2", "stream.mjpeg"); second != first {
t.Fatalf("second start moved the relay: %s -> %s", first, second)
}
}
// Against the real engine, which the unit tests above deliberately do not
// touch. Skipped unless TEST_ENGINE_URL is set, the same rule the server's
// live store tests follow: the suite must stay runnable with no services.
//
// TEST_ENGINE_URL=http://127.0.0.1:8010 \
// TEST_ENGINE_USER=... TEST_ENGINE_PASS=... go test ./desktop/ -run Live
//
// It exists because everything above proves the relay against a fake that
// agrees with me. Only a real engine proves the thing that was actually
// broken: that a multipart MJPEG stream arrives through the relay in pieces,
// rather than being buffered into a tile that never paints.
func TestLiveRelayCarriesRealMJPEGFrames(t *testing.T) {
base := os.Getenv("TEST_ENGINE_URL")
if base == "" {
t.Skip("set TEST_ENGINE_URL to run the live relay test")
}
cam := os.Getenv("TEST_ENGINE_CAMERA")
if cam == "" {
cam = "cam2"
}
p := startProxy(t, base, os.Getenv("TEST_ENGINE_USER"), os.Getenv("TEST_ENGINE_PASS"))
url := p.urlFor(cam, "stream.mjpeg")
req, _ := http.NewRequest(http.MethodGet, url, nil)
resp, err := (&http.Client{}).Do(req)
if err != nil {
t.Fatalf("relay: %v", err)
}
defer resp.Body.Close()
if resp.StatusCode != http.StatusOK {
t.Fatalf("relay returned %d - the credential did not reach the engine", resp.StatusCode)
}
if ct := resp.Header.Get("Content-Type"); !strings.Contains(ct, "multipart") {
t.Fatalf("not a stream: Content-Type %q", ct)
}
// Read until two JPEG start markers have gone past. One proves it opened;
// two prove it is still delivering, which is the difference between a
// working tile and a single frozen frame.
deadline := time.Now().Add(15 * time.Second)
var seen, total int
buf := make([]byte, 16*1024)
for seen < 2 && time.Now().Before(deadline) {
n, rerr := resp.Body.Read(buf)
total += n
seen += strings.Count(string(buf[:n]), "\xff\xd8\xff")
if rerr != nil {
break
}
}
if seen < 2 {
t.Fatalf("only %d JPEG frames in %d bytes - the relay is not streaming", seen, total)
}
t.Logf("relayed %d frames in %d bytes with no credential in the URL", seen, total)
}