headroom/tests/test_ws_http_fallback.py
gglucass 0ce68dedd7
fix(proxy): restore Codex usage headers on WS and streaming SSE transports (#577) (#794)
## Description

Codex's subscription/rate-limit window (the `x-codex-*` headers) was
being
**stripped on every transport Codex actually uses**, so session/weekly
usage
never reached the Codex CLI's own `/status` display, Headroom
`/stats`/dashboard,
or any consumer that sniffs the client-facing handshake. This PR
restores it on
**both** the WebSocket and streaming-SSE paths — the two halves of #577
— in one
place.

Fixes #577

**Supersedes #582 and #590.** This PR incorporates #582's SSE fix
(carried verbatim
with a `Co-authored-by` trailer) and additionally forwards the window
onto the client
`101` on the WS path, which #582/#590's capture-only WS code cannot do.
Both can be
closed as superseded once this merges — GitHub closing keywords only
auto-close
issues (hence `Fixes #577` above), not PRs, so #582/#590 need a manual
close.

### WebSocket (`gpt-5.4+`)

OpenAI delivers `x-codex-*` **only** on the upstream WS handshake
response, never
in data frames. `handle_openai_responses_ws` accepted the client WS
*before* it
connected upstream and never read `upstream.response.headers`, so the
window was
dropped. This reorders the handler to **connect upstream first**,
extract the
`x-codex-*` subset, then **accept the client WS with those headers
attached** to
the `101`, and refresh the Python state for `/stats` parity.

### Streaming SSE (incorporated from #582, @m16khb)

Codex CLI almost always streams. `streaming.py` neither captured
`x-codex-*` into
`CodexRateLimitState` nor forwarded it — the forwarded-header filter
matched only
the substring `"ratelimit"`, which `x-codex-*` does not contain. This
calls
`update_from_headers()` **before** the `>=400` early-return (so a
streaming 429/5xx
still refreshes the window, matching the non-streaming handlers) and
widens the
forward filter to pass `x-codex-*`.

> Credit: the SSE fix is @m16khb's work from #582, carried here verbatim
with a
> `Co-authored-by` trailer so the maintainer gets a single PR covering
both
> transports. This supersedes #582/#590's **WS** capture (which only
writes
> `/stats`); the connect-before-accept reorder additionally forwards the
window to
> the client `101`, which capture-only cannot do. #590's optional
snapshot
> persistence is intentionally left out (separable; hot-path sync write;
doesn't
> help the `101`-sniff consumers).

## Type of Change

- [x] Bug fix (non-breaking change that fixes an issue)
- [ ] New feature (non-breaking change that adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
- [ ] Performance improvement
- [ ] Code refactoring (no functional changes)

## Changes Made

- `openai.py`: add `_extract_codex_handshake_headers()` (strictly
`x-codex-*`, via
`raw_items()` to avoid `MultipleValuesError`; never
`set-cookie`/`authorization`).
- `openai.py`: reorder `handle_openai_responses_ws` — connect-only retry
loop runs
before `accept()`; `accept(headers=...)` carries the forwarded window;
first
client frame read afterward. HTTP fallback preserved; it now also
refreshes
  `/stats` from the HTTP response headers.
- `streaming.py`: capture `x-codex-*` on all statuses + widen the
forwarded-header
  filter (from #582).

### Diff-size note

The bulk of the `openai.py` line count is **whitespace-only
relocation**: the relay
block dedents one level out of the old per-attempt `async with`. Logical
change is
~290 lines. **Review with `?w=1`.** In API-key mode the handshake
carries no
`x-codex-*`, so the accept-header list is empty and the path behaves
exactly as
before — the fix only activates for ChatGPT-subscription auth.

## Testing

- [x] Unit tests pass (`pytest`)
- [x] Linting passes (`ruff check .`)
- [ ] Type checking passes (`mypy headroom`)
- [x] New tests added for new functionality
- [x] Manual testing performed

- WS: `test_ws_connect_happens_before_accept`,
`test_ws_forwards_codex_headers_to_client_accept`
(only `x-codex-*` forwarded; `set-cookie`/`authorization` excluded;
`/stats` refreshed),
`test_ws_connect_failure_falls_back_to_http`,
`test_ws_first_frame_timeout_after_connect_closes_upstream`.
- Fallback: `test_fallback_refreshes_codex_rate_limit_state`.
- SSE:
`test_codex_rate_limit_headers_captured_and_forwarded_in_streaming`,
  `test_codex_rate_limit_captured_on_streaming_429` (from #582).
- Wire-level e2e: `tests/e2e_ws_codex_usage_headers.py` boots the real
proxy + fake
upstream + real `websockets` client and reads the client `101` — closes
the gap
the unit tests stub (that uvicorn/starlette actually write
`accept(headers=...)`).

## Test Output

```
$ uv run pytest tests/test_proxy_streaming_ratelimit_headers.py \
                tests/test_ws_http_fallback.py \
                tests/test_openai_codex_ws_lifecycle.py \
                tests/test_openai_codex_ws_timings.py \
                tests/test_codex_rate_limits.py -q
63 passed in 0.83s

$ .venv/bin/python tests/e2e_ws_codex_usage_headers.py
[codex-hdr-e2e] client 101 headers:
    x-codex-primary-used-percent: 42
    x-codex-primary-window-minutes: 300
    x-codex-secondary-used-percent: 7
    x-codex-secondary-window-minutes: 10080
[codex-hdr-e2e] /stats reflects codex window (primary-used=42)
=== CODEX-HDR E2E ALL GREEN ===

$ uv run ruff check . && uv run ruff format --check <touched files>
All checks passed!
```

## Checklist

- [x] My code follows the project's style guidelines
- [x] I have performed a self-review of my code
- [x] I have commented my code, particularly in hard-to-understand areas
- [ ] I have made corresponding changes to the documentation
- [x] My changes generate no new warnings
- [x] I have added tests that prove my fix is effective or that my
feature works
- [x] New and existing unit tests pass locally with my changes
- [ ] I have updated the CHANGELOG.md if applicable

## Additional Notes

- **Why connect-before-accept (not capture-only).** Once `accept()`
sends the `101`,
headers can no longer be added; the `x-codex-*` window only exists after
we connect
upstream. Capturing into Python state (as #582/#590's WS code does)
fixes `/stats`
but not the Codex CLI's native display or any `101`-sniffing consumer —
those need
  the headers *on the client handshake*, which requires the reorder.
- **Security.** Forwarding is filtered strictly to `x-codex-*`;
`set-cookie`,
`authorization`, and all other upstream headers are never forwarded to
the client
  (asserted by both the unit test and the e2e).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Contract Schemas

Per maintainer request: a JSON Schema (draft 2020-12) artifact
enshrining the OpenAI
interaction expectations this changeset relies on, so drift is
detectable later.

Committed following the repo's parity convention:
- schema:
`tests/parity/fixtures/codex_openai_contracts/codex-openai-interaction.schema.json`
- test: `tests/test_codex_openai_contract_parity.py` binds the schema to
the **live code**
in both directions, so drift fails CI rather than living only in this
description -
every declared `x-codex-*` header must be consumed by
`parse_codex_rate_limits`, and
`_extract_codex_handshake_headers` must forward exactly the declared
subset and never
`set-cookie`/`authorization`. No new dependency (does not pull in
`jsonschema`).

It covers, as `$defs`:

- `WSUpstreamHandshakeResponse` / `StreamingUpstreamResponseHeaders` -
the upstream
`x-codex-*` header family (full superset, with per-header wire pattern +
the parsed
semantic type) the WS and SSE captures read. Source of truth:
`parse_codex_rate_limits`.
- `ClientForwardedHandshakeHeaders` - the WS-101 **allow/deny**
contract: only
`x-codex-*` may be forwarded; `set-cookie`/`authorization` are
explicitly forbidden
  (`propertyNames` + `not`).
- `ClientForwardedStreamingHeaders` - the wider SSE forward set
(`*ratelimit*` OR `x-codex*`).
- `WSClientRequestFrame` / `WSRelayEvent` / `HTTPFallbackRequestBody` -
the WS frame
  envelopes and the unwrapped HTTP-fallback POST body.
- `CodexRateLimitStatsOutput` - the headroom `/stats` shape the parity
tests assert.

Validated with `jsonschema` (Draft202012 `check_schema` passes; positive
instances from
the e2e validate; negative instances - a leaked `set-cookie`, a fallback
body still
carrying a top-level `type` - are correctly rejected).

<details>
<summary><code>codex-openai-interaction.schema.json</code> (draft
2020-12)</summary>

```json
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://github.com/chopratejas/headroom/contracts/codex-openai-interaction.schema.json",
  "title": "Codex <-> OpenAI interaction contracts (PR #794)",
  "description": "Enshrines the OpenAI interaction expectations this changeset depends on, so drift is detectable. Header values are transported as strings on the wire; the `x-headroom-parsed-type` annotation on each records the semantic type the parser (headroom/subscription/codex_rate_limits.py) coerces them to. Sources: codex_rate_limits.parse_codex_rate_limits (header family + gating), openai._extract_codex_handshake_headers (WS-101 forward filter), streaming.py (SSE forward filter).",
  "$defs": {
    "OpenAICodexWindowHeaders": {
      "title": "x-codex-*-{primary,secondary} window headers",
      "description": "A rolling rate-limit/subscription window. A window is materialized iff its `*-used-percent` header is present and numeric; `*-window-minutes` and `*-reset-at` are optional. `primary` and `secondary` are independent and either may be absent.",
      "type": "object",
      "properties": {
        "x-codex-primary-used-percent": {
          "type": "string",
          "pattern": "^\\d+(?:\\.\\d+)?$",
          "x-headroom-parsed-type": "float (0-100, NaN-guarded)",
          "description": "Percent of the primary window consumed. Gates creation of the primary window."
        },
        "x-codex-primary-window-minutes": {
          "type": "string",
          "pattern": "^\\d+$",
          "x-headroom-parsed-type": "int",
          "description": "Primary window size in minutes."
        },
        "x-codex-primary-reset-at": {
          "type": "string",
          "pattern": "^\\d+$",
          "x-headroom-parsed-type": "int (Unix epoch seconds)",
          "description": "Absolute reset time of the primary window."
        },
        "x-codex-secondary-used-percent": {
          "type": "string",
          "pattern": "^\\d+(?:\\.\\d+)?$",
          "x-headroom-parsed-type": "float (0-100, NaN-guarded)",
          "description": "Percent of the secondary window consumed. Gates creation of the secondary window."
        },
        "x-codex-secondary-window-minutes": {
          "type": "string",
          "pattern": "^\\d+$",
          "x-headroom-parsed-type": "int"
        },
        "x-codex-secondary-reset-at": {
          "type": "string",
          "pattern": "^\\d+$",
          "x-headroom-parsed-type": "int (Unix epoch seconds)"
        }
      },
      "additionalProperties": true
    },
    "OpenAICodexCreditsHeaders": {
      "title": "x-codex-credits-* headers",
      "description": "OpenAI credits balance. A credits snapshot is materialized iff `x-codex-credits-has-credits` is present; `unlimited` defaults to false; `balance` is optional.",
      "type": "object",
      "properties": {
        "x-codex-credits-has-credits": {
          "type": "string",
          "pattern": "^(?:[Tt][Rr][Uu][Ee]|[Ff][Aa][Ll][Ss][Ee]|[01])$",
          "x-headroom-parsed-type": "bool (true|false|1|0, case-insensitive)",
          "description": "Gates creation of the credits snapshot."
        },
        "x-codex-credits-unlimited": {
          "type": "string",
          "pattern": "^(?:[Tt][Rr][Uu][Ee]|[Ff][Aa][Ll][Ss][Ee]|[01])$",
          "x-headroom-parsed-type": "bool (defaults false when absent/unparseable)"
        },
        "x-codex-credits-balance": {
          "type": "string",
          "x-headroom-parsed-type": "str (empty -> null)",
          "description": "Free-form server string, e.g. \"$5.00\"."
        }
      },
      "additionalProperties": true
    },
    "OpenAICodexMetaHeaders": {
      "title": "x-codex meta headers",
      "type": "object",
      "properties": {
        "x-codex-limit-name": {
          "type": "string",
          "x-headroom-parsed-type": "str (empty -> null)",
          "description": "Active limit/model label, e.g. \"gpt-5.2-codex-sonic\"."
        },
        "x-codex-promo-message": {
          "type": "string",
          "x-headroom-parsed-type": "str (empty -> null)",
          "description": "Server announcement. Also gates snapshot creation when present."
        }
      },
      "additionalProperties": true
    },
    "OpenAICodexRateLimitHeaders": {
      "title": "Full x-codex-* header family OpenAI may emit",
      "description": "Superset of every x-codex-* header headroom reads. parse_codex_rate_limits returns a snapshot iff at least one of: a primary window, a secondary window, a credits snapshot, or a non-empty promo message is present; otherwise null (treated as a non-Codex response). All members are individually optional.",
      "type": "object",
      "allOf": [
        { "$ref": "#/$defs/OpenAICodexWindowHeaders" },
        { "$ref": "#/$defs/OpenAICodexCreditsHeaders" },
        { "$ref": "#/$defs/OpenAICodexMetaHeaders" }
      ],
      "additionalProperties": true
    },
    "WSUpstreamHandshakeResponse": {
      "title": "OpenAI WS handshake (101) response headers consumed by the WS fix",
      "description": "On the Codex WebSocket transport the x-codex-* window is delivered ONLY on the upstream handshake response (never in data frames). handle_openai_responses_ws reads upstream.response.headers here. This is the contract the connect-before-accept reorder depends on: if OpenAI ever moves these headers off the handshake (e.g. into a frame), the WS half of the fix goes stale.",
      "$ref": "#/$defs/OpenAICodexRateLimitHeaders"
    },
    "StreamingUpstreamResponseHeaders": {
      "title": "OpenAI streaming/HTTP response headers consumed by the SSE fix",
      "description": "On the streaming SSE/HTTP transport the same x-codex-* headers ride the HTTP response. streaming.py captures them on ALL statuses (including >=400) via update_from_headers, and forwards a wider set to the client (see ClientForwardedStreamingHeaders).",
      "$ref": "#/$defs/OpenAICodexRateLimitHeaders"
    },
    "ClientForwardedHandshakeHeaders": {
      "title": "Headers forwarded onto the CLIENT-facing WS 101 (allow/deny contract)",
      "description": "_extract_codex_handshake_headers forwards ONLY headers whose (lowercased) name starts with `x-codex-`. Every other upstream handshake header - notably set-cookie and authorization - MUST NOT appear on the client 101. Enforced by propertyNames below and asserted by the unit tests + tests/e2e_ws_codex_usage_headers.py.",
      "type": "object",
      "propertyNames": {
        "pattern": "^[Xx]-[Cc][Oo][Dd][Ee][Xx]-"
      },
      "not": {
        "anyOf": [
          { "required": ["set-cookie"] },
          { "required": ["Set-Cookie"] },
          { "required": ["authorization"] },
          { "required": ["Authorization"] }
        ]
      },
      "additionalProperties": { "type": "string" }
    },
    "ClientForwardedStreamingHeaders": {
      "title": "Headers forwarded to the client on the streaming SSE path",
      "description": "streaming.py forwards a header iff `\"ratelimit\" in name.lower()` OR `name.lower().startswith(\"x-codex\")`. This is a SUPERSET of the WS allow-list: it additionally passes generic *ratelimit* headers (e.g. the Anthropic streaming path) which do not contain the x-codex prefix.",
      "type": "object",
      "propertyNames": {
        "pattern": "(?:[Rr][Aa][Tt][Ee][Ll][Ii][Mm][Ii][Tt])|^[Xx]-[Cc][Oo][Dd][Ee][Xx]"
      },
      "additionalProperties": { "type": "string" }
    },
    "WSClientRequestFrame": {
      "title": "Client -> proxy WS data frame (Responses API over WS)",
      "description": "Codex sends the request as a response.create envelope. The HTTP fallback unwraps `.response` for the POST body, forces stream=true, and strips any top-level `type`. A flattened variant (no envelope, fields at top level) is also tolerated by the fallback.",
      "type": "object",
      "properties": {
        "type": { "const": "response.create" },
        "response": {
          "type": "object",
          "properties": {
            "model": { "type": "string", "description": "e.g. gpt-5.4" },
            "input": {
              "description": "String prompt or Responses-API structured input array.",
              "type": ["string", "array"]
            },
            "stream": { "type": "boolean" }
          },
          "required": ["model"],
          "additionalProperties": true
        }
      },
      "required": ["type", "response"],
      "additionalProperties": true
    },
    "WSRelayEvent": {
      "title": "proxy -> client WS data frame (relayed Responses API event)",
      "description": "SSE `data:` payloads relayed verbatim as WS text frames. `[DONE]` sentinels are dropped (not relayed). Every relayed event is a JSON object carrying a `type`. response.completed additionally carries usage under `response.usage`. anyOf (not oneOf): an error event also satisfies the looser lifecycle shape, which is fine.",
      "anyOf": [
        {
          "title": "lifecycle event",
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "examples": [
                "response.created",
                "response.output_item.added",
                "response.completed"
              ]
            },
            "response": { "type": "object", "additionalProperties": true }
          },
          "required": ["type"],
          "additionalProperties": true
        },
        {
          "title": "error event",
          "type": "object",
          "properties": {
            "type": { "const": "error" },
            "error": {
              "type": "object",
              "properties": { "message": { "type": "string" } },
              "required": ["message"],
              "additionalProperties": true
            }
          },
          "required": ["type", "error"],
          "additionalProperties": true
        }
      ]
    },
    "HTTPFallbackRequestBody": {
      "title": "proxy -> OpenAI HTTP POST body on WS->HTTP fallback",
      "description": "Derived from WSClientRequestFrame: the inner `.response` object, with `stream` forced to true and any top-level `type` removed.",
      "type": "object",
      "properties": {
        "model": { "type": "string" },
        "stream": { "const": true },
        "input": { "type": ["string", "array"] }
      },
      "required": ["model", "stream"],
      "not": { "required": ["type"] },
      "additionalProperties": true
    },
    "CodexRateLimitStatsOutput": {
      "title": "headroom /stats output for the codex tracker (CodexRateLimitSnapshot.to_dict)",
      "description": "Internal (headroom-emitted) shape produced from the headers above; the WS and SSE update_from_headers parity tests assert this is refreshed. Included so drift in our own surface is also caught.",
      "type": "object",
      "properties": {
        "limit_id": { "const": "codex" },
        "limit_name": { "type": ["string", "null"] },
        "primary": { "$ref": "#/$defs/CodexWindowDict" },
        "secondary": { "$ref": "#/$defs/CodexWindowDict" },
        "credits": {
          "oneOf": [
            { "type": "null" },
            {
              "type": "object",
              "properties": {
                "has_credits": { "type": "boolean" },
                "unlimited": { "type": "boolean" },
                "balance": { "type": ["string", "null"] }
              },
              "required": ["has_credits", "unlimited", "balance"],
              "additionalProperties": false
            }
          ]
        },
        "promo_message": { "type": ["string", "null"] },
        "captured_at": { "type": "number", "description": "Unix epoch seconds (float)." }
      },
      "required": ["limit_id", "limit_name", "primary", "secondary", "credits", "promo_message", "captured_at"],
      "additionalProperties": false
    },
    "CodexWindowDict": {
      "oneOf": [
        { "type": "null" },
        {
          "type": "object",
          "properties": {
            "used_percent": { "type": "number" },
            "window_minutes": { "type": ["integer", "null"] },
            "window_label": { "type": "string", "description": "e.g. \"5h\", \"7d\"-style label; \"unknown\" when window_minutes is null." },
            "resets_at": { "type": ["integer", "null"], "description": "Unix epoch seconds." },
            "seconds_until_reset": { "type": ["integer", "null"] }
          },
          "required": ["used_percent", "window_minutes", "window_label", "resets_at", "seconds_until_reset"],
          "additionalProperties": false
        }
      ]
    }
  }
}
```

</details>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: m16khb <m16khb@gmail.com>
2026-06-09 15:55:53 -05:00

321 lines
11 KiB
Python

"""Tests for WebSocket HTTP fallback in the OpenAI handler.
When the upstream WebSocket connection to OpenAI fails (HTTP 500),
the proxy should transparently fall back to HTTP POST streaming
and relay SSE events over the client WebSocket.
"""
from __future__ import annotations
import asyncio
import json
from types import SimpleNamespace
import httpx
class FakeWebSocket:
"""Minimal WebSocket mock for testing."""
def __init__(self):
self.sent_texts: list[str] = []
self.closed = False
async def send_text(self, data: str) -> None:
self.sent_texts.append(data)
async def close(self, code: int = 1000, reason: str = "") -> None:
self.closed = True
class FakeStreamResponse:
"""Mock httpx streaming response."""
def __init__(
self,
status_code: int = 200,
sse_events: list[str] | None = None,
headers: dict[str, str] | None = None,
):
self.status_code = status_code
self._events = sse_events or []
self.headers = headers or {}
async def aiter_text(self):
for event in self._events:
yield event
async def aiter_bytes(self):
yield b"error body"
async def __aenter__(self):
return self
async def __aexit__(self, *args):
pass
class FakeHttpClient:
"""Mock httpx.AsyncClient with stream support."""
def __init__(self, response: FakeStreamResponse):
self._response = response
def stream(self, method, url, **kwargs):
return self._response
def _make_handler():
"""Create a minimal OpenAIHandlerMixin-like object."""
from headroom.proxy.handlers.openai import OpenAIHandlerMixin
obj = object.__new__(OpenAIHandlerMixin)
obj.OPENAI_API_URL = "https://api.openai.com"
obj.http_client = None
obj.config = SimpleNamespace(
retry_max_attempts=3,
retry_base_delay_ms=0,
retry_max_delay_ms=0,
)
return obj
class TestWsHttpFallback:
def test_fallback_relays_sse_events(self):
"""HTTP fallback should relay SSE data lines as WS text messages."""
handler = _make_handler()
ws = FakeWebSocket()
sse_lines = [
'event: response.created\ndata: {"type":"response.created","response":{"id":"r1"}}\n\n',
'event: response.output_item.added\ndata: {"type":"response.output_item.added"}\n\n',
'event: response.completed\ndata: {"type":"response.completed"}\n\n',
"data: [DONE]\n\n",
]
response = FakeStreamResponse(200, sse_lines)
handler.http_client = FakeHttpClient(response)
body = {"model": "gpt-5.4", "input": "hi"}
first_msg_raw = json.dumps({"type": "response.create", "response": body})
asyncio.run(
handler._ws_http_fallback(
ws, body, first_msg_raw, {"Authorization": "Bearer test"}, "req_1"
)
)
assert len(ws.sent_texts) == 3 # 3 data events, [DONE] skipped
assert '"response.created"' in ws.sent_texts[0]
assert '"response.output_item.added"' in ws.sent_texts[1]
assert '"response.completed"' in ws.sent_texts[2]
assert ws.closed
def test_fallback_sends_error_on_non_200(self):
"""HTTP fallback should send error event on non-200 response."""
handler = _make_handler()
ws = FakeWebSocket()
response = FakeStreamResponse(status_code=401)
handler.http_client = FakeHttpClient(response)
body = {"model": "gpt-5.4", "input": "hi"}
asyncio.run(
handler._ws_http_fallback(
ws, body, json.dumps(body), {"Authorization": "Bearer bad"}, "req_2"
)
)
assert len(ws.sent_texts) == 1
event = json.loads(ws.sent_texts[0])
assert event["type"] == "error"
assert "401" in event["error"]["message"]
def test_fallback_sets_stream_true(self):
"""HTTP fallback should force stream=True in request body.
After PR-A3 (byte-faithful Python forwarders) the fallback sends
the request body as raw bytes via `content=`, not via the `json=`
kwarg. The test extracts the posted JSON from the captured bytes.
"""
handler = _make_handler()
ws = FakeWebSocket()
captured_kwargs: dict = {}
class CapturingClient:
def stream(self, method, url, **kwargs):
captured_kwargs.update(kwargs)
return FakeStreamResponse(200, ["data: [DONE]\n\n"])
handler.http_client = CapturingClient()
body = {"model": "gpt-5.4", "input": "test", "stream": False}
asyncio.run(handler._ws_http_fallback(ws, body, json.dumps(body), {}, "req_3"))
posted = json.loads(captured_kwargs["content"])
assert posted["stream"] is True
def test_fallback_unwraps_response_create_envelope(self):
"""HTTP fallback should unwrap WS response.create wrapper for HTTP POST."""
handler = _make_handler()
ws = FakeWebSocket()
captured_kwargs: dict = {}
class CapturingClient:
def stream(self, method, url, **kwargs):
captured_kwargs.update(kwargs)
return FakeStreamResponse(200, ["data: [DONE]\n\n"])
handler.http_client = CapturingClient()
# WS sends wrapped format: {"type": "response.create", "response": {...}}
inner = {
"model": "gpt-5.4",
"input": [{"role": "user", "content": [{"type": "input_text", "text": "hi"}]}],
}
ws_msg = {"type": "response.create", "response": inner}
asyncio.run(handler._ws_http_fallback(ws, ws_msg, json.dumps(ws_msg), {}, "req_unwrap"))
posted = json.loads(captured_kwargs["content"])
# Should be the inner response, not the wrapper
assert "type" not in posted # no "response.create" type field
assert posted["model"] == "gpt-5.4"
assert posted["stream"] is True
assert "input" in posted
def test_fallback_strips_top_level_response_create_type(self):
"""HTTP fallback should strip top-level response.create metadata."""
handler = _make_handler()
ws = FakeWebSocket()
captured_kwargs: dict = {}
class CapturingClient:
def stream(self, method, url, **kwargs):
captured_kwargs.update(kwargs)
return FakeStreamResponse(200, ["data: [DONE]\n\n"])
handler.http_client = CapturingClient()
body = {"type": "response.create", "model": "gpt-5.4", "input": "hi"}
asyncio.run(handler._ws_http_fallback(ws, body, json.dumps(body), {}, "req_type_strip"))
posted = json.loads(captured_kwargs["content"])
assert posted["model"] == "gpt-5.4"
assert posted["stream"] is True
assert "type" not in posted
def test_fallback_handles_http_exception(self):
"""HTTP fallback should send error event when HTTP request fails."""
handler = _make_handler()
ws = FakeWebSocket()
class FailingClient:
def stream(self, method, url, **kwargs):
raise ConnectionError("upstream unreachable")
handler.http_client = FailingClient()
body = {"model": "gpt-5.4", "input": "test"}
asyncio.run(handler._ws_http_fallback(ws, body, json.dumps(body), {}, "req_4"))
assert len(ws.sent_texts) == 1
event = json.loads(ws.sent_texts[0])
assert event["type"] == "error"
assert "unreachable" in event["error"]["message"]
def test_fallback_retries_connect_timeout(self):
"""HTTP fallback should retry transient connect timeouts."""
handler = _make_handler()
ws = FakeWebSocket()
attempts = {"count": 0}
class FlakyClient:
def stream(self, method, url, **kwargs):
attempts["count"] += 1
if attempts["count"] == 1:
raise httpx.ConnectTimeout("timed out")
return FakeStreamResponse(200, ['data: {"type":"response.completed"}\n\n'])
handler.http_client = FlakyClient()
body = {"model": "gpt-5.4", "input": "test"}
asyncio.run(handler._ws_http_fallback(ws, body, json.dumps(body), {}, "req_retry"))
assert attempts["count"] == 2
assert len(ws.sent_texts) == 1
assert json.loads(ws.sent_texts[0])["type"] == "response.completed"
def test_fallback_routes_chatgpt_auth_to_chatgpt_domain(self):
"""ChatGPT session auth should route to chatgpt.com, not api.openai.com."""
handler = _make_handler()
ws = FakeWebSocket()
captured_url = {}
class CapturingClient:
def stream(self, method, url, **kwargs):
captured_url["url"] = url
return FakeStreamResponse(200, ["data: [DONE]\n\n"])
handler.http_client = CapturingClient()
body = {"model": "gpt-5.4", "input": "test"}
# ChatGPT session auth includes this header
headers = {
"Authorization": "Bearer chatgpt-session-token",
"ChatGPT-Account-ID": "acct_abc123",
}
asyncio.run(handler._ws_http_fallback(ws, body, json.dumps(body), headers, "req_5"))
assert "chatgpt.com" in captured_url["url"]
assert "api.openai.com" not in captured_url["url"]
def test_fallback_routes_api_key_to_openai(self):
"""API key auth should route to api.openai.com."""
handler = _make_handler()
ws = FakeWebSocket()
captured_url = {}
class CapturingClient:
def stream(self, method, url, **kwargs):
captured_url["url"] = url
return FakeStreamResponse(200, ["data: [DONE]\n\n"])
handler.http_client = CapturingClient()
body = {"model": "gpt-5.4", "input": "test"}
# API key auth — no ChatGPT-Account-ID header
headers = {"Authorization": "Bearer sk-abc123"}
asyncio.run(handler._ws_http_fallback(ws, body, json.dumps(body), headers, "req_6"))
assert "api.openai.com" in captured_url["url"]
def test_fallback_refreshes_codex_rate_limit_state(self, monkeypatch):
"""A successful fallback refreshes Codex /stats from response headers.
The fallback can't forward headers onto the (already-accepted) client
101, but it should still keep Python /stats in sync so the gauge does
not go stale when the WS upgrade fails and we drop to HTTP.
"""
handler = _make_handler()
ws = FakeWebSocket()
captured: dict[str, dict[str, str]] = {}
class _FakeState:
def update_from_headers(self, hdrs):
captured["headers"] = dict(hdrs)
import headroom.subscription.codex_rate_limits as crl
monkeypatch.setattr(crl, "get_codex_rate_limit_state", lambda: _FakeState())
response = FakeStreamResponse(
200,
['data: {"type":"response.completed"}\n\n', "data: [DONE]\n\n"],
headers={
"x-codex-primary-used-percent": "42",
"content-type": "text/event-stream",
},
)
handler.http_client = FakeHttpClient(response)
body = {"model": "gpt-5.4", "input": "hi"}
asyncio.run(handler._ws_http_fallback(ws, body, json.dumps(body), {}, "req_capture"))
assert captured["headers"]["x-codex-primary-used-percent"] == "42"