fix(orchestrator): release a station's redirect targets in media-src

Deutschlandfunk stayed silent: its signed URL answers 302 to
f111.rndfnk.com, an origin the signed media-src never listed, so the
browser blocked the redirected load and reported only the station's own
URL in securitypolicyviolation.

The hub now resolves each https stream's redirect chain server side when
a settings save adds or changes it and stores the extra origins as the
stream's via list. media-src lists them next to the signed origins. A CDN
host of three or more labels widens to its siblings (*.rndfnk.com); an
IP, a two-label host and a name under a country code's generic second
level stay exact.

Hardening:

- Only the signed URL itself may lie at a non-global address; every
  redirect hop dials a global address only, checked on the address
  actually dialed (NAT64 and IPv4-compatible IPv6 count by the embedded
  IPv4 address).
- A resolve answers within three socket timeouts even for a server that
  drips its headers; a late probe goes on in a daemon thread and a url
  still in flight is not probed twice.
- A failed resolution stores via null and retries on a save ten minutes
  later; the radio page says so instead of blaming the CSP.
- A save whose settings changed while it was resolved fails instead of
  overwriting them (compare and set under the settings lock).
- A new stream URL at an already signed origin takes the passkey too.
- Settings written before via existed load as via [] and never dial.

Residuals:

- The passkey proof is spent before the resolve, so a save racing
  another one fails and the operator signs again.
- A save that hits a due retry blocks up to twelve seconds and may
  reload the page.
- A page loaded before the upgrade throws on the missing via until it
  reloads.
- A private multi-tenant suffix such as github.io still widens.
- getaddrinfo has no timeout; it runs inside the daemon thread.

Operator step after install: remove Deutschlandfunk in Radio, Sender
bearbeiten, save, add it again and save with the passkey.

🎯 Fix: 92 %
💥 Break: 4 %
💸 Cost: 100 %
⏱️ Time: –
🛡️ Security: 100 %
🏆 Score: 88
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -405,7 +405,7 @@ Both commands also patch the target's `.claude/settings.local.json` — the mach
 
 The global install also runs the Agent Orchestrator, a local review page in which the operator approves or rejects the agents' staged commits (the `kvb-git-diff` skill): it copies `orchestrator/` to `~/.local/share/kvb-orchestrator`, starts it there with `docker compose up -d --build` (restart `unless-stopped`, bound to `127.0.0.1` only, state in `~/.local/state/kvb-orchestrator`) and registers its MCP server for Claude Code at user scope. Its port is `KVB_ORCHESTRATOR_PORT` in `orchestrator/.env`; the hub page is `http://localhost:<port>/`, the MCP endpoint `/mcp`. Without docker the hub is skipped and the commit skills ask in chat. The hub reads new radio traffic aloud in maritime phraseology and takes push-to-talk input; its image builds both engines from pinned, sha256-verified sources and runs each as a separate process: Piper (`piper-tts`, GPL-3.0-or-later) with the `en_US-libritts-high` voice (904 speakers, trained on LibriTTS, CC BY 4.0, from `rhasspy/piper-voices`) and whisper.cpp (MIT) with the multilingual `ggml-base-q8_0` model (OpenAI Whisper weights, MIT, 82 MB). The operator's own voice is `KVB_ORCHESTRATOR_OPERATOR_VOICE` in `orchestrator/.env`. Its Tree reads only the file `pkgmgr branch tree` writes: the install clones `PKGMGR_REPO` (default the GitHub repository, never the sandbox-writable local checkout), builds the newest `v*` tag a fully trusted GPG key signed into `~/.local/share/kvb-orchestrator/pkgmgr`, and enables the `kvb-orchestrator-tree.timer` user timer, which writes `~/.local/state/pkgmgr/tree/branch-tree.json` a minute after its previous run while the hub page polls, on at most half a core; the hub mounts that directory read-only and starts no git. A signed tag without `branch tree` leaves the timer off.
 
-Stream → Radio (`#stream/radio`) is the hub's radio interface. Its station list shows one line per station, the full name in the tooltip, with its state and a play or stop button; when the browser blocks autoplay, the stream fails or the CSP refuses its origin, the row and a toast say so, and one click starts the station. New stations play daily around the clock. While the hub reads a message aloud, the speaking agent pulses there and in the Orbit and Chord views, under the caption "<Agent> spricht" with the message's first line; under `prefers-reduced-motion` the ring stays still. The composer sends on all seven channels: post and call to one agent, newsletter, broadcast, pan-pan, security and mayday to all. "Aufnehmen" records with MediaRecorder; the hub transcribes the recording with whisper.cpp off the request thread (at most 120 s of audio, a 120 s timeout, four at a time), keeps it for replay in `~/.local/state/kvb-orchestrator/voice` (the newest 50) and puts the transcript into the field to edit; the message goes out as text, with the recording's host path and sha256 only when "Aufnahme anhängen" is ticked. The hub transcribes at most six recordings a minute and 600 s of audio an hour. Every operator message is passkey-signed, and the hub verifies the signature against the pinned keys, each once, before it relays; `operator_message(id, text, to)` answers `match` only for the signed text and recipient; for a denial the signature covers the recipient the inbox resolved at signing, and the answer's text is only the signed reason, never the agent's own words the radio row quotes. "Mayday aufheben", Abend, Sonnenuntergang, Sonnenaufgang and a settings save that adds a stream origin take the passkey the same way.
+Stream → Radio (`#stream/radio`) is the hub's radio interface. Its station list shows one line per station, the full name in the tooltip, with its state and a play or stop button; when the browser blocks autoplay, the stream fails or the CSP refuses its origin, the row and a toast say so, and one click starts the station. New stations play daily around the clock. While the hub reads a message aloud, the speaking agent pulses there and in the Orbit and Chord views, under the caption "<Agent> spricht" with the message's first line; under `prefers-reduced-motion` the ring stays still. The composer sends on all seven channels: post and call to one agent, newsletter, broadcast, pan-pan, security and mayday to all. "Aufnehmen" records with MediaRecorder; the hub transcribes the recording with whisper.cpp off the request thread (at most 120 s of audio, a 120 s timeout, four at a time), keeps it for replay in `~/.local/state/kvb-orchestrator/voice` (the newest 50) and puts the transcript into the field to edit; the message goes out as text, with the recording's host path and sha256 only when "Aufnahme anhängen" is ticked. The hub transcribes at most six recordings a minute and 600 s of audio an hour. Every operator message is passkey-signed, and the hub verifies the signature against the pinned keys, each once, before it relays; `operator_message(id, text, to)` answers `match` only for the signed text and recipient; for a denial the signature covers the recipient the inbox resolved at signing, and the answer's text is only the signed reason, never the agent's own words the radio row quotes. "Mayday aufheben", Abend, Sonnenuntergang, Sonnenaufgang and a settings save that adds a stream URL take the passkey the same way.
 
 The hub page loads nothing from the network: its icons come from Bootstrap Icons 1.13.1 (`orchestrator/vendor/bootstrap-icons`, MIT), inlined per page as the symbols it uses, and its 3D views from `3d-force-graph` 1.80.1 and `three` 0.186.1 (`orchestrator/vendor`, MIT, served by the hub under `/vendor/`). In the Artifacts Tree, "Löschen" on a `merged-clean` branch without skip reason, or "Alle gemergten löschen", shows the dry-run lines and asks for the passkey signature; the hub then writes a job (repository, branch, worktree and tip per item, no command) into `~/.local/state/kvb-orchestrator/cleanup/jobs`. The `kvb-orchestrator-cleanup.path` user unit runs `client/cleanup.py` on the host, which verifies the signature against the pinned keys, runs `pkgmgr branch cleanup --json --local --branch <name>` as a dry run in the repository, then `--apply` only when that plan names exactly the signed branch as `merged-clean` at the signed tip and worktree, refuses everything else unchanged, writes each result to `cleanup/results` and rewrites the tree file. The buttons stay disabled while the tree file says `delete_ready: false`.
 

orchestrator/client/signing.py

@@ -139,8 +139,8 @@ def board_item(action: str) -> dict:
     return {"kind": "board", "action": action}
 
 
-def stream_item(origins: list[str]) -> dict:
+def stream_item(origins: list[str], urls: list[str]) -> dict:
-    return {"kind": "streams", "origins": origins}
+    return {"kind": "streams", "origins": origins, "urls": urls}
 
 
 def task_item(task: str, argv: list[str]) -> dict:

orchestrator/kvb_orchestrator/hub.py

@@ -24,6 +24,7 @@ from .mcp import Mcp
 from .messaging import Messaging
 from .names import Names
 from .offices import Offices
+from .redirects import Redirects
 from .requesting import Requesting
 from .reviewing import Reviewing
 from .rules import Rules
@@ -86,6 +87,7 @@ class Hub(Mcp, Reviewing, Asking, Messaging, Approving, Denying, Requesting, Cle
     model: Model
     timers: Path
     settings: Settings
+    redirects: Redirects
     speech: Speech
     approvers: Path
     vendor: Path
@@ -103,7 +105,7 @@ class Hub(Mcp, Reviewing, Asking, Messaging, Approving, Denying, Requesting, Cle
         return f"{signing.origin_of(self.public_port)}/"
 
 
-def open_hub(council: Path, pages: Path, public_port: int, state: Path, host_state: Path, transcripts: Path, scripts: Runner, templates: Path, places: Places, model: Model, engines: Engines, approvers: Path) -> Hub:
+def open_hub(council: Path, pages: Path, public_port: int, state: Path, host_state: Path, transcripts: Path, scripts: Runner, templates: Path, places: Places, model: Model, engines: Engines, approvers: Path, redirects: Redirects) -> Hub:
     uploads = state / "uploads"
     uploads.mkdir(exist_ok=True)
     reviews = Reviews(state)
@@ -126,6 +128,7 @@ def open_hub(council: Path, pages: Path, public_port: int, state: Path, host_sta
         batches=Pending(),
         names=Names(state / "names.json"),
         settings=Settings(state / "settings.json"),
+        redirects=redirects,
         watch=Watch(),
         tree=Tree(file=places.tree_file, heartbeat=state / TREE_HEARTBEAT, lock=threading.Lock(), cached=None, stamp=None),
         model=model,

orchestrator/kvb_orchestrator/redirects.py

@@ -0,0 +1,204 @@
+from __future__ import annotations
+
+import http.client
+import ipaddress
+import socket
+import ssl
+import threading
+import time
+from collections.abc import Callable
+from urllib.parse import urljoin, urlsplit
+
+from . import NAME
+from .errors import ToolError
+from .settings import stream_origin
+
+HOP_LIMIT = 5
+TIMEOUT = 4.0
+DEADLINE_HOPS = 3
+RETRY_SECONDS = 600
+MOVED = frozenset({301, 302, 303, 307, 308})
+HEADERS = {"User-Agent": NAME, "Accept": "*/*"}
+EMBEDDING = (ipaddress.ip_network("64:ff9b::/96"), ipaddress.ip_network("::/96"))
+SECOND_LEVELS = frozenset({"ac", "co", "com", "edu", "go", "gov", "ne", "net", "or", "org"})
+
+Dial = Callable[[str, int, float, bool], socket.socket]
+
+
+def global_address(text: str) -> bool:
+    """Returns:
+        Whether the address is global; a NAT64 or IPv4-compatible IPv6
+        address counts by the IPv4 address it embeds.
+    """
+    address = ipaddress.ip_address(text)
+    if address.version == 6 and any(address in network for network in EMBEDDING):
+        return ipaddress.IPv4Address(int(address) & 0xFFFFFFFF).is_global
+    return address.is_global
+
+
+def dial(host: str, port: int, timeout: float, public: bool) -> socket.socket:
+    """Args:
+        public: connect only to a global address, as for a redirect target
+            the operator never signed; the address checked is the one
+            dialed, so a second lookup cannot swap it. Each allowed address
+            is tried in turn.
+    """
+    failure: Exception = ToolError(f"{host} has no public address")
+    for _, _, _, _, address in socket.getaddrinfo(host, port, type=socket.SOCK_STREAM):
+        if public and not global_address(address[0]):
+            continue
+        try:
+            return socket.create_connection(address[:2], timeout)
+        except OSError as error:
+            failure = error
+    raise failure
+
+
+def media_source(url: str) -> str:
+    """Returns:
+        The media-src source a redirect hop to the url needs. A host of three
+        or more labels widens to its siblings (https://*.cdn.example): a CDN
+        such as the ARD's rndfnk.com picks another node per request, so the
+        exact host the server saw is not the one the browser gets. An IP
+        address, a two-label host and a name right under a country code's
+        generic second level (bbc.co.uk, SECOND_LEVELS) stay exact; a
+        private multi-tenant suffix such as github.io is not known and
+        widens.
+    """
+    origin = stream_origin(url)
+    parts = urlsplit(origin)
+    host = parts.hostname or ""
+    labels = host.split(".")
+    try:
+        ipaddress.ip_address(host)
+        exact = True
+    except ValueError:
+        exact = len(labels) < 3 or (len(labels) == 3 and len(labels[2]) == 2 and labels[1] in SECOND_LEVELS)
+    shown = host if exact else "*." + ".".join(labels[1:])
+    return f"https://{shown}" if parts.port is None else f"https://{shown}:{parts.port}"
+
+
+class Hop(http.client.HTTPConnection):
+    default_port = 443
+
+    def __init__(self, host: str, port: int, tls: ssl.SSLContext, opener: Dial, timeout: float, public: bool) -> None:
+        super().__init__(host, port, timeout=timeout)
+        self.tls = tls
+        self.opener = opener
+        self.public = public
+
+    def connect(self) -> None:
+        self.sock = self.tls.wrap_socket(self.opener(self.host, self.port, self.timeout, self.public), server_hostname=self.host)
+
+
+class Redirects:
+    """Args:
+        tls: the context every hop's certificate is verified against.
+        dial: opens the TCP connection to a host and port within a timeout,
+            to a global address only when told so.
+        timeout: seconds each socket operation of a hop may take; a whole
+            resolve answers within DEADLINE_HOPS times that.
+    """
+
+    def __init__(self, tls: ssl.SSLContext, dial: Dial, timeout: float) -> None:
+        self.tls = tls
+        self.dial = dial
+        self.timeout = timeout
+        self.tried: dict[str, float] = {}
+        self.running: set[str] = set()
+        self.lock = threading.Lock()
+
+    def due(self, url: str) -> bool:
+        return time.monotonic() - self.tried.get(url, -RETRY_SECONDS) >= RETRY_SECONDS
+
+    def hop(self, url: str, public: bool) -> str | None:
+        """Returns:
+            The absolute URL the url redirects to, or None when it answers
+            without a redirect. A GET that reads no byte of the body, since a
+            live stream never ends and some stream servers refuse HEAD.
+        """
+        parts = urlsplit(url)
+        connection = Hop(parts.hostname or "", parts.port or Hop.default_port, self.tls, self.dial, self.timeout, public)
+        try:
+            connection.request("GET", (parts.path or "/") + (f"?{parts.query}" if parts.query else ""), headers=HEADERS)
+            with connection.getresponse() as response:
+                status, location = response.status, response.getheader("Location")
+        finally:
+            connection.close()
+        if status not in MOVED:
+            return None
+        if not location:
+            raise ToolError(f"answers {status} without a Location")
+        return urljoin(url, location)
+
+    def chain(self, url: str) -> list[str]:
+        """Returns:
+            Every URL the url redirects through, in order, after the url.
+
+        Raises:
+            ToolError when a hop leaves https, the chain is longer than
+            HOP_LIMIT, or a hop names no valid URL. Only the url itself, which
+            the operator signed, may lie at a non-global address.
+        """
+        hops: list[str] = []
+        target = self.hop(url, False)
+        while target is not None:
+            origin = stream_origin(target)
+            if urlsplit(origin).scheme != "https":
+                raise ToolError(f"redirects to {origin}, which is not https")
+            if len(hops) == HOP_LIMIT:
+                raise ToolError(f"redirects more than {HOP_LIMIT} times")
+            hops.append(target)
+            target = self.hop(target, True)
+        return hops
+
+    def via(self, url: str) -> list[str]:
+        own = stream_origin(url)
+        return list(dict.fromkeys(media_source(hop) for hop in self.chain(url) if stream_origin(hop) != own))
+
+    def outcome(self, url: str) -> tuple[list[str] | None, str]:
+        try:
+            return self.via(url), ""
+        except (OSError, http.client.HTTPException, ToolError, ValueError) as error:
+            return None, str(error) or type(error).__name__
+
+    def probe(self, url: str, outcomes: dict[str, tuple[list[str] | None, str]]) -> None:
+        try:
+            outcomes[url] = self.outcome(url)
+        finally:
+            with self.lock:
+                self.running.discard(url)
+
+    def claim(self, urls: list[str]) -> tuple[list[str], list[str]]:
+        """Returns:
+            The https urls among urls, and those of them no earlier probe
+            still resolves, now marked running and tried.
+        """
+        wanted = sorted({url for url in urls if urlsplit(url).scheme == "https"})
+        with self.lock:
+            probed = [url for url in wanted if url not in self.running]
+            self.running.update(probed)
+        self.tried.update(dict.fromkeys(probed, time.monotonic()))
+        return wanted, probed
+
+    def resolve(self, urls: list[str]) -> dict[str, tuple[list[str] | None, str]]:
+        """Returns:
+            Per url the origins its redirect chain needs besides its own, or
+            None and why the chain could not be resolved, within the deadline
+            even when a station answers byte by byte. A late chain goes on in
+            its daemon thread until its socket timeouts end it, and a url
+            whose earlier probe still runs is not probed again, so at most one
+            thread per url lingers. Only https urls are probed; any other maps
+            to no origins. Records each probe for due().
+        """
+        wanted, probed = self.claim(urls)
+        limit = self.timeout * DEADLINE_HOPS
+        deadline = time.monotonic() + limit
+        found: dict[str, tuple[list[str] | None, str]] = {}
+        threads = [threading.Thread(target=self.probe, args=(url, found), name=f"redirects {url}", daemon=True) for url in probed]
+        for thread in threads:
+            thread.start()
+        for thread in threads:
+            thread.join(max(0.0, deadline - time.monotonic()))
+        outcomes = {url: (None, "an earlier save still resolves it") for url in wanted} | {url: (None, f"no answer within {limit:g} s") for url in probed} | dict(found)
+        return {url: outcomes.get(url, ([], "")) for url in urls}

orchestrator/kvb_orchestrator/settings.py

@@ -21,6 +21,8 @@ MIDNIGHT = "24:00"
 STREAMS_LIMIT = 20
 STREAM_URL = re.compile(r"https?://[A-Za-z0-9._~:/?#\[\]@!$&()*+,;=%-]{1,2040}")
 HOSTNAME = re.compile(r"(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*")
+VIA = re.compile(r"https://(?P<wild>\*\.)?(?P<host>[a-z0-9.-]{1,253})(?::(?P<port>[1-9][0-9]{0,4}))?")
+VIA_LIMIT = 8
 DEFAULT_PORTS = {"http": 80, "https": 443}
 SETTINGS = {
     "latitude": 0.0,
@@ -93,6 +95,21 @@ def stream_origin(url: object) -> str:
     return f"{parts.scheme}://{host}" if port in (None, DEFAULT_PORTS[parts.scheme]) else f"{parts.scheme}://{host}:{port}"
 
 
+def via_origin(value: object, name: str) -> str:
+    found = VIA.fullmatch(value) if isinstance(value, str) else None
+    host = found is not None and HOSTNAME.fullmatch(found["host"]) is not None and (found["wild"] is None or "." in found["host"])
+    port = found is not None and (found["port"] is None or (found["port"] != "443" and int(found["port"]) <= 65535))
+    if not (host and port):
+        raise ToolError(f"{name} must hold https origins like https://cdn.example or https://*.cdn.example, without the default port")
+    return value
+
+
+def via_list(value: object, name: str) -> list[str]:
+    if not isinstance(value, list) or len(value) > VIA_LIMIT or len(set(map(str, value))) != len(value):
+        raise ToolError(f"{name} must list at most {VIA_LIMIT} distinct origins")
+    return [via_origin(origin, name) for origin in value]
+
+
 def clock_minutes(value: object, name: str, end: bool) -> int:
     if end and value == MIDNIGHT:
         return 24 * 60
@@ -102,9 +119,18 @@ def clock_minutes(value: object, name: str, end: bool) -> int:
     return int(hours) * 60 + int(minutes)
 
 
+def stream_fields(raw: object, name: str) -> dict:
+    """Returns:
+        The stream's fields with their names checked and its via valid; a
+        missing via and None both mean not resolved yet.
+    """
+    entry = section({"via": None, **raw} if isinstance(raw, dict) else raw, name, ("name", "url", "from", "to", "days", "on", "via"))
+    return {**entry, "via": None if entry["via"] is None else via_list(entry["via"], f"{name}.via")}
+
+
 def stream_entry(raw: object, index: int) -> dict:
     name = f"streams[{index}]"
-    entry = section(raw, name, ("name", "url", "from", "to", "days", "on"))
+    entry = stream_fields(raw, name)
     label, days = entry["name"], entry["days"]
     if not isinstance(label, str) or not FIELDS["label"][0].fullmatch(label):
         raise ToolError(f"{name}.name must be one line of 1 to {NAME_LIMIT} characters")
@@ -113,7 +139,10 @@ def stream_entry(raw: object, index: int) -> dict:
         raise ToolError(f"{name} must end at another time than it starts")
     if not isinstance(days, list) or not days or len(set(map(str, days))) != len(days) or any(isinstance(day, bool) or not isinstance(day, int) or not 0 <= day <= 6 for day in days):
         raise ToolError(f"{name}.days must list distinct weekdays from 0 (Monday) to 6 (Sunday)")
-    return {"name": label, "url": entry["url"], "from": entry["from"], "to": entry["to"], "days": sorted(days), "on": flag(entry["on"], f"{name}.on")}
+    return {
+        "name": label, "url": entry["url"], "from": entry["from"], "to": entry["to"], "days": sorted(days), "on": flag(entry["on"], f"{name}.on"),
+        "via": entry["via"],
+    }
 
 
 def tone_setting(raw: object, kind_name: str) -> dict:
@@ -173,7 +202,7 @@ def valid_settings(raw: object) -> dict:
     }
 
 
-def migrated(stored: object) -> object:
+def speech_renamed(stored: object) -> object:
     speech = stored.get("speech") if isinstance(stored, dict) else None
     classes = speech.get("classes") if isinstance(speech, dict) else None
     if not isinstance(classes, list) or not any(name in LEGACY_CLASSES for name in classes):
@@ -182,10 +211,28 @@ def migrated(stored: object) -> object:
     return {**stored, "speech": {**speech, "classes": list(dict.fromkeys(renamed))}}
 
 
-def media_origins(settings: dict) -> list[str]:
+def migrated(stored: object) -> object:
+    """Returns:
+        The stored settings in the current shape: legacy speech classes
+        renamed, and a stream saved before redirect resolution with via []:
+        it may have been saved without the passkey, so the hub never dials
+        it unsigned; re-adding it with the passkey resolves its redirects.
+    """
+    stored = speech_renamed(stored)
+    streams = stored.get("streams") if isinstance(stored, dict) else None
+    if not isinstance(streams, list):
+        return stored
+    return {**stored, "streams": [{**stream, "via": []} if isinstance(stream, dict) and "via" not in stream else stream for stream in streams]}
+
+
+def station_origins(settings: dict) -> list[str]:
     return sorted({stream_origin(stream["url"]) for stream in settings["streams"]})
 
 
+def media_origins(settings: dict) -> list[str]:
+    return sorted({*station_origins(settings), *(origin for stream in settings["streams"] for origin in stream["via"] or ())})
+
+
 class Settings:
     def __init__(self, file: Path) -> None:
         self.file = file
@@ -200,9 +247,16 @@ class Settings:
         with self.lock:
             return copy.deepcopy(self.current)
 
-    def put(self, raw: object) -> dict:
+    def put(self, raw: object, expected: dict) -> dict:
+        """Args:
+            raw: the settings to save.
+            expected: the settings the save was judged against; another save
+                that landed meanwhile refuses this one.
+        """
         settings = valid_settings(raw)
         with self.lock:
+            if self.current != expected:
+                raise ToolError("the settings changed while this save was checked; save again")
             write_atomic(self.file, json.dumps(settings, indent=1, sort_keys=True).encode("utf-8"))
             self.current = settings
             return copy.deepcopy(settings)

orchestrator/kvb_orchestrator/view.py

@@ -33,7 +33,7 @@ from .register import (
     stored_order,
 )
 from .reviewing import review_row
-from .settings import media_origins, valid_settings
+from .settings import media_origins, station_origins, valid_settings
 from .signed import signing
 from .skill_scripts import OUTPUT_LIMIT
 from .tasks import task_rows
@@ -138,25 +138,64 @@ class View:
             "graph": drawn,
         }
 
-    def stream_change(self, raw: dict) -> dict | None:
+    def stream_change(self, settings: dict, saved: dict) -> dict | None:
-        """Returns:
+        """Args:
-            The item the operator's passkey signs when the settings let the
+            settings: valid settings the page wants to save.
-            page load audio from an origin the saved ones do not, else None.
+            saved: the settings saved now.
+
+        Returns:
+            The item the operator's passkey signs when the settings name a
+            stream url the saved ones do not, else None: the station origins
+            and those urls. The hub dials no url before it is signed, and
+            resolves its redirect targets only after the signature.
         """
-        origins = media_origins(valid_settings(raw))
+        urls = sorted({stream["url"] for stream in settings["streams"]} - {stream["url"] for stream in saved["streams"]})
-        return signing.stream_item(origins) if set(origins) - set(media_origins(self.settings.get())) else None
+        return signing.stream_item(station_origins(settings), urls) if urls else None
+
+    def resolved(self, settings: dict, saved: dict) -> tuple[dict, list[str]]:
+        """Args:
+            settings: valid settings whose new stream urls the operator
+                signed in this request.
+            saved: the settings saved now.
+
+        Returns:
+            The settings with the via of each new url taken from its redirect
+            chain, and of each saved url whose via is still None (unresolved)
+            once Redirects.due allows a retry; every other stream keeps its
+            saved via without a dial, and the page's via is never used. Also
+            one line per stream whose chain did not resolve; its via stays
+            None.
+        """
+        known = {stream["url"]: stream["via"] for stream in saved["streams"]}
+        urls = {stream["url"] for stream in settings["streams"]}
+        outcomes = self.redirects.resolve(sorted(url for url in urls if url not in known or (known[url] is None and self.redirects.due(url))))
+        streams, problems = [], []
+        for stream in settings["streams"]:
+            via, problem = outcomes.get(stream["url"], (known.get(stream["url"]), ""))
+            if problem:
+                problems.append(f"{stream['name']}: {problem}")
+            streams.append({**stream, "via": via})
+        return {**settings, "streams": streams}, problems
 
     def sign_settings(self, body: bytes) -> dict:
-        change = self.stream_change(decode(body))
+        change = self.stream_change(valid_settings(decode(body)), self.settings.get())
         return self.challenge_for([] if change is None else [change])
 
     def save_settings(self, body: bytes) -> dict:
+        """Returns:
+            {"settings", "problems"}: the saved settings, their via resolved
+            once the proof holds, and why a chain did not resolve. A save
+            that lands while this one resolves makes this one fail.
+        """
         payload = decode(body)
         proof = payload.pop("proof", None)
-        change = self.stream_change(payload)
+        settings = valid_settings(payload)
+        saved = self.settings.get()
+        change = self.stream_change(settings, saved)
         if change is not None:
             self.operator_proven(proof, change)
-        return self.settings.put(payload)
+        resolved, problems = self.resolved(settings, saved)
+        return {"settings": self.settings.put(resolved, saved), "problems": problems}
 
     def render(self, nonce: str) -> tuple[str, str]:
         now = time.time()

orchestrator/server.py

@@ -59,6 +59,7 @@
 from __future__ import annotations
 
 import argparse
+import ssl
 from pathlib import Path
 
 from kvb_orchestrator import NAME
@@ -68,6 +69,7 @@ from kvb_orchestrator.exchange import HubServer
 from kvb_orchestrator.handler import Handler
 from kvb_orchestrator.hub import Places, open_hub
 from kvb_orchestrator.language import Model, read_key
+from kvb_orchestrator.redirects import TIMEOUT, Redirects, dial
 from kvb_orchestrator.skill_scripts import Scripts
 
 
@@ -96,6 +98,7 @@ def main() -> int:
             model=Model(url=args.llm_url.strip(), model=args.llm_model.strip(), key=read_key(args.llm_key_file)),
             engines=Engines(piper=args.piper, voices=args.voices, operator_voice=args.operator_voice, whisper=args.whisper, whisper_model=args.whisper_model, scratch=args.scratch),
             approvers=args.approvers,
+            redirects=Redirects(tls=ssl.create_default_context(), dial=dial, timeout=TIMEOUT),
         )
     except ToolError as error:
         parser.error(str(error))

orchestrator/templates/ambience.js

@@ -8,6 +8,8 @@ const Ambience = (() => {
   const GLASS = 0.8;
   const CARD = 0.92;
   const LIGHT_FROM = 4;
+  // Trip-wire: one blocked redirect also fails the media element and rejects play(), in no fixed order; the highest rank is the cause, the rest are its symptoms.
+  const TROUBLE_RANKS = {refused: 0, media: 1, csp: 2};
   const SKY = [
     [-90, "#03050b", "#070a14"],
     [-18, "#04060e", "#0a0f1f"],
@@ -209,7 +211,17 @@ const Ambience = (() => {
     return streams.find((stream) => stream.on && covers(stream, slot)) || null;
   }
 
-  return {GLASS, CARD, SKY, THEMES, julian, sidereal, horizontal, sun, moon, hex, mix, css, luminance, contrast, skyAt, stage, starlight, modeAt, modeOf, stars, slotOf, activeStream};
+  function stationOrigins(stream) {
+    return [new URL(stream.url).origin, ...(stream.via || [])];
+  }
+
+  function retold(told, url, kind, cause) {
+    const key = `${url}|${kind}`;
+    const rank = TROUBLE_RANKS[cause];
+    return !told || told.key !== key || rank > told.rank ? {key, rank} : null;
+  }
+
+  return {GLASS, CARD, SKY, THEMES, julian, sidereal, horizontal, sun, moon, hex, mix, css, luminance, contrast, skyAt, stage, starlight, modeAt, modeOf, stars, slotOf, activeStream, stationOrigins, retold};
 })();
 if (typeof module === "object" && module.exports) {
   module.exports = Ambience;

orchestrator/templates/page-dom.js

@@ -89,6 +89,7 @@
     box.addEventListener("click", () => box.remove());
     document.getElementById("toasts").append(box);
     window.setTimeout(() => box.remove(), good ? 9000 : 20000);
+    return box;
   }
 
   function runLines(data) {

orchestrator/templates/page-radio.js

@@ -3,6 +3,7 @@
     NotSupportedError: ["error", "nicht abspielbar", "Nicht abspielbar: der Browser versteht Format oder Adresse nicht, oder der Sender leitet auf eine Adresse um, von der die Seite keinen Ton laden darf."],
   };
   const MEDIA_ERRORS = {1: "Laden abgebrochen", 2: "Netzwerkfehler", 3: "Ton nicht dekodierbar", 4: "Format oder Adresse nicht abspielbar"};
+  const RESOLVE_STEP = "Radio → Sender bearbeiten: ändere die Adresse des Senders, oder entferne ihn, speichere, lege ihn neu an und speichere wieder; dann löst der Server die Weiterleitung neu auf und gibt ihr Ziel frei.";
 
   function radioVolume() {
     if (radio.element) {
@@ -34,14 +35,34 @@
     drawStations();
   }
 
-  function radioTrouble(kind, label, note) {
+  function radioTrouble(kind, label, note, cause) {
-    radioStatus(kind, label, note);
+    const told = radio.told;
-    const key = `${radio.url}|${kind}|${label}`;
+    const fresh = Ambience.retold(told, radio.url, kind, cause);
-    if (radio.told !== key) {
+    if (!fresh) {
-      radio.told = key;
+      radioStatus(...told.status);
-      const stream = settings.streams[radio.index];
+      return;
-      toast(`Radio ${kind === "blocked" ? "blockiert" : "stumm"}: ${stream ? stream.name : radio.url}`, [note], false);
     }
+    radioStatus(kind, label, note);
+    if (told) {
+      told.box.remove();
+    }
+    const stream = settings.streams[radio.index];
+    const box = toast(`Radio ${kind === "blocked" ? "blockiert" : "stumm"}: ${stream ? stream.name : radio.url}`, [note], false);
+    radio.told = {...fresh, status: [kind, label, note], box};
+  }
+
+  function redirectNote(stream) {
+    if (stream && stream.via === null) {
+      return "Der Server hat die Weiterleitung dieses Senders noch nicht aufgelöst; ein Speichern nach zehn Minuten versucht es erneut.";
+    }
+    const released = stream ? stream.via : [];
+    const unloaded = released.filter((origin) => !pageMedia.has(origin));
+    if (unloaded.length) {
+      return `Der Sender leitet auf ${unloaded.join(", ")} um; die geladene Seite darf von dort noch keinen Ton laden: Seite neu laden.`;
+    }
+    return released.length
+      ? `Der Sender leitet auf eine Adresse außerhalb der freigegebenen ${released.join(", ")} um. ${RESOLVE_STEP}`
+      : `Der Sender leitet auf eine Adresse um, die noch nicht freigegeben ist; der Browser nennt das Ziel einer Weiterleitung nicht. ${RESOLVE_STEP}`;
   }
 
   function stopStream() {
@@ -70,16 +91,17 @@
 
   function syncRadio() {
     const index = dueStation();
-    const url = index < 0 ? "" : settings.streams[index].url;
+    const stream = index < 0 ? null : settings.streams[index];
+    const url = stream ? stream.url : "";
     if (url === radio.url && !radio.waiting) {
       drawStations();
       return;
     }
-    const origin = url ? new URL(url).origin : "";
+    const missing = stream ? Ambience.stationOrigins(stream).filter((origin) => !pageMedia.has(origin)) : [];
     radio.index = index;
-    if (origin && !pageMedia.has(origin)) {
+    if (missing.length) {
-      radioStatus("reload", "lädt neu", "Neue Adresse: die Seite lädt neu, damit der Browser von dort Ton laden darf.");
+      radioStatus("reload", "lädt neu", `Neue Adresse ${missing.join(", ")}: die Seite lädt neu, damit der Browser von dort Ton laden darf.`);
-      if (state.media.includes(origin)) {
+      if (missing.every((origin) => state.media.includes(origin))) {
         window.location.reload();
       }
       return;
@@ -98,7 +120,7 @@
       radio.element.src = url;
       radio.element.play().then(() => {
         radio.playing = true;
-        radio.told = "";
+        radio.told = null;
         radioStatus("playing", "spielt", `spielt seit ${clock.format(new Date())}`);
         tuneMusic(FADE / 1000);
         fadeRadio(1, () => null);
@@ -108,10 +130,7 @@
         }
         radio.waiting = true;
         const [kind, label, note] = PLAY_REFUSED[error.name] || ["error", "Fehler", `${error.name}: ${error.message}`];
-        // Trip-wire: the media error event fires before this rejection and already named the cause; a second toast would hide it.
+        radioTrouble(kind, label, note, "refused");
-        if (!(kind === "error" && radio.state === "error")) {
-          radioTrouble(kind, label, note);
-        }
       });
     });
   }
@@ -141,11 +160,12 @@
       radio.waiting = true;
       tuneMusic(FADE / 1000);
       const reason = failure ? MEDIA_ERRORS[failure.code] || `Fehler ${failure.code}` : "unbekannter Fehler";
-      radioTrouble("error", "Fehler", `Der Sender spielt nicht: ${reason}${failure && failure.message ? ` (${failure.message})` : ""}.`);
+      radioTrouble("error", "Fehler", `Der Sender spielt nicht: ${reason}${failure && failure.message ? ` (${failure.message})` : ""}.`, "media");
     });
     document.addEventListener("securitypolicyviolation", (event) => {
+      // Trip-wire: for a redirected load, blockedURI is the station's own URL, never the redirect target.
       if (event.effectiveDirective === "media-src" && radio.url && !event.blockedURI.startsWith(window.location.origin)) {
-        radioTrouble("error", "gesperrt", `Der Sender leitet auf ${event.blockedURI} um; die Seite spielt nur von den Adressen, die du mit deinem Passkey gespeichert hast.`);
+        radioTrouble("error", "gesperrt", redirectNote(settings.streams[radio.index]), "csp");
       }
     });
     return element;

orchestrator/templates/page-settings.js

@@ -1,3 +1,5 @@
+  let redirectsTold = "";
+
   function adoptSettings(next) {
     settings = next;
     settingsSig = JSON.stringify(next);
@@ -23,10 +25,16 @@
       toast("Einstellungen nicht gespeichert", [`${result.status} ${result.text}`.trim()], false);
       return false;
     }
-    const fresh = result.data.streams.map((stream) => new URL(stream.url).origin).filter((origin) => !pageMedia.has(origin));
+    const {settings: saved, problems} = result.data;
-    adoptSettings(result.data);
+    const unresolved = problems.join("\n");
+    if (unresolved && unresolved !== redirectsTold) {
+      toast("Weiterleitung nicht aufgelöst", [...problems, "Diese Sender laden vorerst nur von ihrer eigenen Adresse; ein Speichern nach zehn Minuten versucht es erneut."], false);
+    }
+    redirectsTold = unresolved;
+    const fresh = [...new Set(saved.streams.flatMap((stream) => Ambience.stationOrigins(stream)))].filter((origin) => !pageMedia.has(origin));
+    adoptSettings(saved);
     if (fresh.length) {
-      toast("Neuer Sender", ["Die Seite lädt neu, damit der Browser ihn abspielen darf. Blockiert der Browser danach das Abspielen, startet ein Klick den Sender."], true);
+      toast("Neuer Sender", ["Die Seite lädt neu, damit der Browser ihn abspielen darf. Blockiert der Browser danach das Abspielen, startet ein Klick den Sender.", `Neu für diese Seite: ${fresh.join(", ")}`], true);
       window.setTimeout(() => window.location.reload(), 1500);
     }
     return true;
@@ -47,6 +55,7 @@
       to: to.value === "00:00" && stream.to === "24:00" ? "24:00" : to.value,
       days: days.flatMap((box, index) => (box.checked ? [index] : [])),
       on: on.checked,
+      via: stream.via,
     })};
     entry.row = h("div", {class: "stream-row"},
       h("div", {class: "grid"}, h("label", {}, "Name", name), h("label", {}, "Stream-URL", url), h("label", {}, "von", from), h("label", {}, "bis", to)),
@@ -129,8 +138,8 @@
         h("div", {class: "days"}, h("label", {class: "check"}, speechOn, "Funk vorlesen"), sample),
         h("div", {class: "days", role: "group", "aria-label": "Klassen"}, spoken.map((entry) => h("label", {class: "check"}, entry.box, entry.label))),
         stations.length ? h("div", {class: "days", role: "group", "aria-label": "Stationen"}, stations.map((entry) => h("label", {class: "check"}, entry.box, entry.label))) : null),
-      h("section", {}, h("h3", {}, "Radio"), h("p", {class: "muted"}, "Internetradio zu festen Zeiten mit 3 s Ein- und Ausblenden; die Musik pausiert solange. Ein neuer Sender läuft rund um die Uhr, bis du seine Zeiten änderst; unter Stream → Radio startest und stoppst du ihn von Hand. Die Seite darf nur von diesen Adressen Ton laden; eine neue Adresse signiert dein Passkey."),
+      h("section", {}, h("h3", {}, "Radio"), h("p", {class: "muted"}, "Internetradio zu festen Zeiten mit 3 s Ein- und Ausblenden; die Musik pausiert solange. Ein neuer Sender läuft rund um die Uhr, bis du seine Zeiten änderst; unter Stream → Radio startest und stoppst du ihn von Hand. Die Seite darf nur von diesen Adressen Ton laden; eine neue Adresse signiert dein Passkey. Leitet ein signierter Sender um, löst der Server die Weiterleitung beim Speichern eines neuen Senders oder einer geänderten Adresse auf und gibt ihr Ziel frei; der Hinweis nach dem Speichern nennt es."),
-        list, h("div", {}, btn("+ Sender", "btn small soft", () => streamRow({name: "", url: "", from: "00:00", to: "24:00", days: [0, 1, 2, 3, 4, 5, 6], on: true}, rows, list)))),
+        list, h("div", {}, btn("+ Sender", "btn small soft", () => streamRow({name: "", url: "", from: "00:00", to: "24:00", days: [0, 1, 2, 3, 4, 5, 6], on: true, via: []}, rows, list)))),
       passkeySection(),
       h("div", {class: "sheet-foot"}, h("span", {class: "spacer"}), btn("Abbrechen", "btn ghost", closeSheet), h("button", {type: "submit", class: "btn primary"}, "Speichern")));
     form.addEventListener("submit", async (event) => {

orchestrator/templates/page-state.js

@@ -39,7 +39,7 @@
   const pageMedia = new Set(state.media);
   const sky = {canvas: document.getElementById("sky"), stars: Ambience.stars(320, 7), mode: "", frame: 0};
   const music = {gain: null, filter: null, drone: [], timer: 0, tension: 0, ducked: 0};
-  const radio = {element: null, url: "", level: 0, timer: 0, playing: false, waiting: false, index: -1, pick: null, sig: "", state: "", short: "", note: "", told: ""};
+  const radio = {element: null, url: "", level: 0, timer: 0, playing: false, waiting: false, index: -1, pick: null, sig: "", state: "", short: "", note: "", told: null};
   const speech = {pending: [], busy: false, warned: 0, current: null, source: null};
   const mic = {recorder: null, held: false, busy: false, timer: 0};
   const space = {

tests/e2e/test_orchestrator_e2e.py

@@ -662,7 +662,7 @@ class TestOrchestratorE2E(HubCase):
 
     def speaks(self, cues: tuple[str, ...]) -> None:
         hub = self.httpd.hub
-        hub.settings.put({**hub.settings.get(), "speech": {"on": True, "classes": ["mayday", "pan-pan", "security"], "muted": []}})
+        hub.settings.put({**hub.settings.get(), "speech": {"on": True, "classes": ["mayday", "pan-pan", "security"], "muted": []}}, hub.settings.get())
         spoken = tone(6, 8000)
 
         def synthesize(body: bytes) -> bytes:
@@ -719,7 +719,7 @@ class TestOrchestratorE2E(HubCase):
             first = {"width": 1366, "height": 768, "url": f"http://localhost:{self.port}/#stream", "wait": 900, "probe": ADD_STATION.replace("@STATION@", station).replace("@NAME@", STATION_NAME), "shot": None, "gesture": True}
         else:
             hub = self.httpd.hub
-            hub.settings.put({**hub.settings.get(), "streams": [{"name": STATION_NAME, "url": station, "from": "00:00", "to": "24:00", "days": list(range(7)), "on": True}]})
+            hub.settings.put({**hub.settings.get(), "streams": [{"name": STATION_NAME, "url": station, "from": "00:00", "to": "24:00", "days": list(range(7)), "on": True, "via": []}]}, hub.settings.get())
             first = {"width": 1366, "height": 768, "url": f"{self.base}#stream", "wait": 900, "probe": None, "shot": None}
         steps = [
             first,

tests/hub_case.py

@@ -27,7 +27,9 @@ from hub_support import (
     TREE,
     FakeScripts,
     Key,
+    Redirects,
     key,
+    offline_redirects,
     server,
     signing,
 )
@@ -72,6 +74,7 @@ class HubCase(unittest.TestCase):
             model=server.Model(url="", model="", key=""),
             engines=self.engines,
             approvers=self.approvers,
+            redirects=self.redirects(),
         )
         self.httpd = httpd
         self.origin = signing.origin_of(self.port)
@@ -82,6 +85,9 @@ class HubCase(unittest.TestCase):
         self.addCleanup(httpd.shutdown)
         self.host = f"127.0.0.1:{self.port}"
 
+    def redirects(self) -> Redirects:
+        return offline_redirects()
+
     def call(self, method: str, path: str, body: bytes | None, headers: dict[str, str]) -> tuple[int, dict, bytes]:
         connection = http.client.HTTPConnection("127.0.0.1", self.port, timeout=30)
         try:

tests/hub_support.py

@@ -9,6 +9,8 @@ import importlib.util
 import json
 import os
 import secrets
+import socket
+import ssl
 import subprocess
 import sys
 import tempfile
@@ -33,6 +35,7 @@ import hub_api  # noqa: F401
 import passkey
 import signing
 import verifier
+from kvb_orchestrator.redirects import Redirects
 
 SCORE = "🎯 95 💥 3"
 GIT_ENV = {
@@ -56,10 +59,20 @@ HOOK = {
 OPTIONS = [{"label": "Merge now", "description": "Gate is green"}, {"label": "Wait", "description": ""}]
 AMBIENCE = HUB / "templates" / "ambience.js"
 STREAMS = [
-    {"name": "Morgen", "url": "https://radio.example/morgen", "from": "07:00", "to": "09:00", "days": [0, 1, 2, 3, 4], "on": True},
+    {"name": "Morgen", "url": "https://radio.example/morgen", "from": "07:00", "to": "09:00", "days": [0, 1, 2, 3, 4], "on": True, "via": []},
-    {"name": "Nacht", "url": "http://10.0.0.5:8000/nacht", "from": "22:00", "to": "02:00", "days": [5], "on": True},
+    {"name": "Nacht", "url": "http://10.0.0.5:8000/nacht", "from": "22:00", "to": "02:00", "days": [5], "on": True, "via": []},
-    {"name": "Aus", "url": "https://other.example:8443/", "from": "00:00", "to": "24:00", "days": [0, 1, 2, 3, 4, 5, 6], "on": False},
+    {"name": "Aus", "url": "https://other.example:8443/", "from": "00:00", "to": "24:00", "days": [0, 1, 2, 3, 4, 5, 6], "on": False, "via": []},
 ]
+
+
+def offline(host: str, port: int, timeout: float, public: bool) -> socket.socket:
+    raise ConnectionRefusedError(f"no network in tests: {host}:{port}")
+
+
+def offline_redirects() -> Redirects:
+    return Redirects(tls=ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT), dial=offline, timeout=1.0)
+
+
 VOICE = HUB / "templates" / "voice.js"
 SPACE = HUB / "templates" / "space.js"
 NAV = HUB / "templates" / "nav.js"

tests/test_hub_radio_trouble.py

@@ -0,0 +1,67 @@
+from __future__ import annotations
+
+import json
+import subprocess
+import unittest
+
+from hub_support import AMBIENCE
+from kvb_orchestrator.settings import stream_origin
+
+DLF = "https://st01.sslstream.dlf.de/dlf/01/high/aac/stream.aac?aggregator=web"
+OTHER = "https://radio.example/morgen"
+URLS = [DLF, "https://Radio.Example:443/zweiter?x=1", "http://10.0.0.5:8000/nacht", "https://other.example:8443/", "http://radio.example:80/x"]
+PROBE = """
+const A = require(process.argv[1]);
+const [DLF, OTHER] = JSON.parse(process.argv[2]);
+const toasts = (events) => {
+  let told = null;
+  const shown = [];
+  for (const [url, kind, cause] of events) {
+    const fresh = A.retold(told, url, kind, cause);
+    if (fresh) {
+      told = fresh;
+      shown.push(`${kind}:${cause}`);
+    }
+  }
+  return shown;
+};
+const attempt = [[DLF, "error", "csp"], [DLF, "error", "media"], [DLF, "error", "refused"]];
+console.log(JSON.stringify({
+  attempt: toasts(attempt),
+  reversed: toasts([...attempt].reverse()),
+  clicks: toasts([1, 2, 3, 4].flatMap(() => attempt)),
+  autoplay: toasts([[DLF, "blocked", "refused"], [DLF, "blocked", "refused"], ...attempt]),
+  stations: toasts([...attempt, [OTHER, "error", "media"], [OTHER, "error", "csp"]]),
+  origins: JSON.parse(process.argv[3]).map((url) => A.stationOrigins({url, via: []})[0]),
+  redirected: A.stationOrigins({url: DLF, via: ["https://*.rndfnk.com"]}),
+}));
+"""
+
+
+class TestRadioTrouble(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        command = ["node", "-e", PROBE, str(AMBIENCE), json.dumps([DLF, OTHER]), json.dumps(URLS)]
+        done = subprocess.run(command, capture_output=True, text=True, timeout=60, check=True)
+        cls.data = json.loads(done.stdout)
+
+    def test_a_blocked_redirect_and_its_media_error_toast_once(self):
+        self.assertEqual(self.data["attempt"], ["error:csp"])
+
+    def test_a_later_cause_replaces_a_lesser_one_but_never_the_other_way(self):
+        self.assertEqual(self.data["reversed"], ["error:refused", "error:media", "error:csp"])
+
+    def test_retries_through_clicks_stack_no_toast(self):
+        self.assertEqual(self.data["clicks"], ["error:csp"])
+
+    def test_each_failure_and_station_toasts_on_its_own(self):
+        self.assertEqual(self.data["autoplay"], ["blocked:refused", "error:csp"])
+        self.assertEqual(self.data["stations"], ["error:csp", "error:media", "error:csp"])
+
+    def test_the_page_computes_the_origins_the_server_puts_into_media_src(self):
+        self.assertEqual(self.data["origins"], [stream_origin(url) for url in URLS])
+        self.assertEqual(self.data["redirected"], ["https://st01.sslstream.dlf.de", "https://*.rndfnk.com"])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_hub_redirects.py

@@ -0,0 +1,407 @@
+from __future__ import annotations
+
+import http.server
+import json
+import socket
+import ssl
+import subprocess
+import tempfile
+import threading
+import time
+import unittest
+from pathlib import Path
+
+from hub_case import HubCase
+from hub_support import key, signing
+from kvb_orchestrator import settings
+from kvb_orchestrator.errors import ToolError
+from kvb_orchestrator.redirects import (
+    DEADLINE_HOPS,
+    HOP_LIMIT,
+    RETRY_SECONDS,
+    Redirects,
+    dial,
+    global_address,
+    media_source,
+)
+
+NODES = ("f111", "f121", "d111", "f131")
+STATION = "https://station.radio.test/dlf/01/high/aac/stream.aac?aggregator=web"
+NAMES = ("radio.test", "*.radio.test", "cdn.test", "*.cdn.test", "*.mid.test")
+TIMEOUT = 0.5
+STREAMED = 3.0
+MUSIC_ON = {"on": True, "volume": 0.4}
+
+
+class Cdn(http.server.BaseHTTPRequestHandler):
+    def log_message(self, format: str, *args: object) -> None:
+        return
+
+    def answer(self, status: int, location: str | None) -> None:
+        self.send_response(status)
+        if location is not None:
+            self.send_header("Location", location)
+        self.send_header("Content-Length", "0")
+        self.end_headers()
+
+    def stream(self) -> None:
+        self.send_response(200)
+        self.send_header("Content-Type", "audio/aac")
+        self.end_headers()
+        deadline = time.monotonic() + STREAMED
+        while time.monotonic() < deadline:
+            self.wfile.write(bytes(4096))
+            time.sleep(0.01)
+
+    def drip(self) -> None:
+        self.wfile.write(b"HTTP/1.1 302 Found\r\n")
+        deadline = time.monotonic() + STREAMED
+        while time.monotonic() < deadline:
+            self.wfile.write(b"X-Drip: 1\r\n")
+            time.sleep(TIMEOUT / 2)
+
+    def do_GET(self) -> None:
+        host = self.headers["Host"].split(":")[0]
+        self.server.asked.append(host)
+        try:
+            self.route(host, len(self.server.asked))
+        except OSError:
+            return
+
+    def route(self, host: str, count: int) -> None:
+        if host in self.server.broken:
+            self.answer(302, None)
+        elif host == "station.radio.test":
+            self.answer(302, f"https://{NODES[count % len(NODES)]}.cdn.test/ard/dlf/01/aac/192/stream.aac?aggregator=web&token=t{count}")
+        elif host == "chain.radio.test":
+            self.answer(301, "https://edge.mid.test/hop")
+        elif host == "edge.mid.test":
+            self.answer(307, "https://f111.cdn.test:8443/ard/live.aac")
+        elif host == "moved.radio.test" and self.path == "/a":
+            self.answer(302, "/b")
+        elif host == "plain.radio.test":
+            self.answer(302, "http://f111.cdn.test/live")
+        elif host == "loop.radio.test":
+            self.answer(302, f"/hop{count}")
+        elif host == "short.radio.test":
+            self.answer(302, "https://cdn.test/live")
+        elif host == "slow.radio.test":
+            time.sleep(TIMEOUT * 3)
+            self.answer(200, None)
+        elif host == "drip.radio.test":
+            self.drip()
+        elif host == "badloc.radio.test":
+            self.answer(302, "https://[x")
+        else:
+            self.stream()
+
+
+class CdnServer(http.server.ThreadingHTTPServer):
+    daemon_threads = True
+
+    def handle_error(self, request: object, client_address: object) -> None:
+        return
+
+
+class FakeCdn:
+    def __init__(self) -> None:
+        self.folder = tempfile.TemporaryDirectory()
+        key, cert = Path(self.folder.name) / "key.pem", Path(self.folder.name) / "cert.pem"
+        names = ",".join(f"DNS:{name}" for name in NAMES)
+        subprocess.run(
+            ["openssl", "req", "-x509", "-newkey", "ec", "-pkeyopt", "ec_paramgen_curve:P-256", "-nodes", "-keyout", str(key), "-out", str(cert), "-days", "1", "-subj", "/CN=radio.test", "-addext", f"subjectAltName={names}"],
+            capture_output=True, timeout=60, check=True,
+        )
+        served = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+        served.load_cert_chain(cert, key)
+        self.httpd = CdnServer(("127.0.0.1", 0), Cdn)
+        self.httpd.socket = served.wrap_socket(self.httpd.socket, server_side=True)
+        self.httpd.asked = []
+        self.httpd.broken = set()
+        self.dialed: list[tuple[str, int, bool]] = []
+        self.trusted = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        self.trusted.load_verify_locations(cert)
+        self.thread = threading.Thread(target=self.httpd.serve_forever, args=(0.05,), daemon=True)
+        self.thread.start()
+
+    def dial(self, host: str, port: int, timeout: float, public: bool) -> socket.socket:
+        self.dialed.append((host, port, public))
+        return socket.create_connection(("127.0.0.1", self.httpd.server_address[1]), timeout)
+
+    def redirects(self, tls: ssl.SSLContext) -> Redirects:
+        return Redirects(tls=tls, dial=self.dial, timeout=TIMEOUT)
+
+    def close(self) -> None:
+        self.httpd.shutdown()
+        self.httpd.server_close()
+        self.thread.join(10)
+        self.folder.cleanup()
+
+
+CDN: list[FakeCdn] = []
+
+
+def setUpModule() -> None:
+    CDN.append(FakeCdn())
+
+
+def tearDownModule() -> None:
+    CDN.pop().close()
+
+
+def cdn() -> FakeCdn:
+    return CDN[0]
+
+
+class TestRedirects(unittest.TestCase):
+    def resolver(self) -> Redirects:
+        return cdn().redirects(cdn().trusted)
+
+    def test_a_rotating_cdn_signs_one_wildcard_and_no_body_is_read(self):
+        before = len(cdn().dialed)
+        began = time.monotonic()
+        seen = [self.resolver().via(STATION) for _ in range(4)]
+        self.assertLess(time.monotonic() - began, STREAMED / 2)
+        self.assertEqual(seen, [["https://*.cdn.test"]] * 4)
+        hops = {self.resolver().chain(STATION)[0].split("/")[2] for _ in range(4)}
+        self.assertGreater(len(hops), 1, hops)
+        self.assertTrue(all(host.endswith(".cdn.test") for host in hops), hops)
+        self.assertEqual({port for _, port, _ in cdn().dialed[before:]}, {443})
+
+    def test_every_hop_of_a_chain_is_signed_in_order_with_its_port(self):
+        self.assertEqual(self.resolver().via("https://chain.radio.test/listen"), ["https://*.mid.test", "https://*.cdn.test:8443"])
+        self.assertIn(("f111.cdn.test", 8443, True), cdn().dialed)
+
+    def test_only_the_signed_station_may_lie_at_a_non_global_address(self):
+        port = cdn().httpd.server_address[1]
+        self.assertEqual([global_address(text) for text in ("8.8.8.8", "64:ff9b::808:808", "64:ff9b::7f00:1", "::127.0.0.1", "::ffff:127.0.0.1")], [True, True, False, False, False])
+        for host in ("127.0.0.1", "2130706433", "::1", "10.0.0.5", "169.254.169.254", "64:ff9b::7f00:1", "::127.0.0.1"):
+            with self.subTest(host=host), self.assertRaisesRegex(ToolError, f"{host} has no public address"):
+                dial(host, port, TIMEOUT, True)
+        dial("127.0.0.1", port, TIMEOUT, False).close()
+        before = len(cdn().dialed)
+        self.resolver().via("https://chain.radio.test/listen")
+        self.assertEqual([public for _, _, public in cdn().dialed[before:]], [False, True, True])
+
+    def test_a_station_answering_byte_by_byte_cannot_hold_a_resolve_past_its_deadline_or_pile_up_threads(self):
+        resolver = self.resolver()
+        url = "https://drip.radio.test/"
+        began = time.monotonic()
+        deadline = TIMEOUT * DEADLINE_HOPS
+        self.assertEqual(resolver.resolve([url]), {url: (None, f"no answer within {deadline:g} s")})
+        self.assertLess(time.monotonic() - began, deadline + 1)
+        self.assertEqual(resolver.resolve([url]), {url: (None, "an earlier save still resolves it")})
+        self.assertEqual(sum(thread.name == f"redirects {url}" for thread in threading.enumerate()), 1)
+
+    def test_a_same_host_redirect_adds_nothing_and_a_two_label_host_stays_exact(self):
+        self.assertEqual(self.resolver().via("https://moved.radio.test/a"), [])
+        self.assertEqual(self.resolver().via("https://short.radio.test/"), ["https://cdn.test"])
+
+    def test_an_unresolvable_chain_names_its_cause(self):
+        resolver = self.resolver()
+        self.assertEqual(resolver.outcome("https://plain.radio.test/"), (None, "redirects to http://f111.cdn.test, which is not https"))
+        before = cdn().httpd.asked.count("loop.radio.test")
+        self.assertEqual(resolver.outcome("https://loop.radio.test/"), (None, f"redirects more than {HOP_LIMIT} times"))
+        self.assertEqual(cdn().httpd.asked.count("loop.radio.test") - before, HOP_LIMIT + 1)
+        via, problem = resolver.outcome("https://slow.radio.test/")
+        self.assertIsNone(via)
+        self.assertIn("timed out", problem)
+        cdn().httpd.broken.add("gone.radio.test")
+        self.addCleanup(cdn().httpd.broken.discard, "gone.radio.test")
+        self.assertEqual(resolver.outcome("https://gone.radio.test/"), (None, "answers 302 without a Location"))
+        via, problem = resolver.outcome("https://other.invalid/")
+        self.assertIsNone(via)
+        self.assertIn("Hostname mismatch", problem)
+        via, problem = cdn().redirects(ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)).outcome(STATION)
+        self.assertIsNone(via)
+        self.assertIn("certificate verify failed", problem)
+        via, problem = resolver.outcome("https://badloc.radio.test/")
+        self.assertIsNone(via)
+        self.assertIn("Invalid IPv6 URL", problem)
+
+    def test_only_https_urls_are_probed(self):
+        before = len(cdn().dialed)
+        self.assertEqual(self.resolver().resolve(["http://10.0.0.5:8000/nacht", STATION]), {"http://10.0.0.5:8000/nacht": ([], ""), STATION: (["https://*.cdn.test"], "")})
+        self.assertEqual(len(cdn().dialed) - before, 2)
+
+    def test_media_sources_widen_one_label_and_pass_the_settings_check(self):
+        for url, origin in (
+            ("https://f111.rndfnk.com/ard/dlf/01/aac/192/stream.aac?token=t", "https://*.rndfnk.com"),
+            ("https://F121.RNDFNK.com:8443/", "https://*.rndfnk.com:8443"),
+            ("https://a.b.c.example:443/x", "https://*.b.c.example"),
+            ("https://rndfnk.com/x", "https://rndfnk.com"),
+            ("https://203.0.113.5/x", "https://203.0.113.5"),
+            ("https://bbc.co.uk/x", "https://bbc.co.uk"),
+            ("https://a.bbc.co.uk/x", "https://*.bbc.co.uk"),
+            ("https://stream.ndr.de/x", "https://*.ndr.de"),
+        ):
+            with self.subTest(url=url):
+                self.assertEqual(media_source(url), origin)
+                self.assertEqual(settings.via_origin(origin, "via"), origin)
+
+
+class TestRedirectSettings(HubCase):
+    def redirects(self) -> Redirects:
+        return cdn().redirects(cdn().trusted)
+
+    def station(self, url: str, via: list[str]) -> dict:
+        return {"name": "DLF", "url": url, "from": "00:00", "to": "24:00", "days": list(range(7)), "on": True, "via": via}
+
+    def payload(self, streams: list[dict]) -> dict:
+        return {**settings.SETTINGS, "streams": streams}
+
+    def media_src(self) -> str:
+        csp = self.get("/")[1]["content-security-policy"]
+        return next(part.strip() for part in csp.split(";") if part.strip().startswith("media-src"))
+
+    def dials(self) -> int:
+        return len(cdn().dialed)
+
+    def prepared(self, streams: list[dict]) -> dict:
+        status, _, body = self.post_json("/api/settings/sign", self.payload(streams), self.guard(self.host))
+        self.assertEqual(status, 200, body)
+        return json.loads(body)
+
+    def saved(self, streams: list[dict], proof: dict | None) -> dict:
+        status, _, body = self.post_json("/api/settings", {**self.payload(streams), "proof": proof}, self.guard(self.host))
+        self.assertEqual(status, 200, body)
+        return json.loads(body)
+
+    def signed_and_saved(self, streams: list[dict]) -> dict:
+        prepared = self.prepared(streams)
+        return self.saved(streams, None if prepared["payload"] is None else self.pin().proof(prepared["payload"], self.origin))
+
+    def music_toggled(self, streams: list[dict]) -> dict:
+        status, _, body = self.post_json("/api/settings", {**self.payload(streams), "music": MUSIC_ON, "proof": None}, self.guard(self.host))
+        self.assertEqual(status, 200, body)
+        return json.loads(body)
+
+    def test_an_agent_cannot_make_the_hub_contact_an_unsigned_origin(self):
+        self.pin()
+        before = self.dials()
+        streams = [self.station("https://attacker.radio.test/exfil?secret=s3cr3t", [])]
+        prepared = self.prepared(streams)
+        self.assertEqual(set(prepared), {"payload", "challenge", "credentials"})
+        self.assertEqual(prepared["payload"]["items"], [signing.item_hash(signing.stream_item(["https://attacker.radio.test"], [streams[0]["url"]]))])
+        unsigned = self.post_json("/api/settings", {**self.payload(streams), "proof": None}, self.guard(self.host))
+        self.assertEqual(unsigned[:3:2], (400, b"nicht signiert: no signature\n"))
+        stranger = {**self.payload(streams), "proof": key(-7, "stranger").proof(prepared["payload"], self.origin)}
+        self.assertEqual(self.post_json("/api/settings", stranger, self.guard(self.host))[:3:2], (400, b"nicht signiert: the signing key is not pinned\n"))
+        self.assertEqual(self.dials(), before)
+        self.assertNotIn("attacker.radio.test", cdn().httpd.asked)
+        self.assertFalse((self.state / "settings.json").exists())
+
+    def test_a_signed_save_resolves_and_stores_the_redirect_target(self):
+        streams = [self.station(STATION, [])]
+        self.assertEqual(self.prepared(streams)["payload"]["items"], [signing.item_hash(signing.stream_item(["https://station.radio.test"], [STATION]))])
+        result = self.signed_and_saved(streams)
+        self.assertEqual(result["problems"], [])
+        self.assertEqual(result["settings"]["streams"][0]["via"], ["https://*.cdn.test"])
+        self.assertEqual(settings.Settings(self.state / "settings.json").get(), result["settings"])
+        self.assertEqual(self.media_src(), "media-src 'self' https://*.cdn.test https://station.radio.test")
+        self.assertEqual(self.snapshot()["media"], ["https://*.cdn.test", "https://station.radio.test"])
+        before = self.dials()
+        self.assertIsNone(self.prepared(result["settings"]["streams"])["payload"])
+        self.assertEqual(self.saved(result["settings"]["streams"], None), result)
+        self.assertEqual(self.dials(), before)
+
+    def test_a_music_toggle_with_a_resolved_station_makes_no_dial_even_in_an_outage(self):
+        saved = self.signed_and_saved([self.station(STATION, [])])["settings"]
+        cdn().httpd.broken.add("station.radio.test")
+        self.addCleanup(cdn().httpd.broken.discard, "station.radio.test")
+        before = self.dials()
+        self.assertEqual(self.music_toggled(saved["streams"]), {"settings": {**saved, "music": MUSIC_ON}, "problems": []})
+        self.assertEqual(self.dials(), before)
+
+    def test_a_page_sent_via_is_overwritten(self):
+        saved = self.signed_and_saved([self.station(STATION, [])])["settings"]
+        result = self.saved([{**saved["streams"][0], "via": ["https://*.evil.test"]}], None)
+        self.assertEqual(result["settings"]["streams"][0]["via"], ["https://*.cdn.test"])
+        self.assertNotIn("evil", self.media_src())
+
+    def test_a_new_url_at_a_signed_origin_takes_the_passkey_before_any_dial(self):
+        saved = self.signed_and_saved([self.station(STATION, [])])["settings"]
+        other = self.station("https://station.radio.test/go", [])
+        streams = [*saved["streams"], other]
+        self.assertEqual(self.prepared(streams)["payload"]["items"], [signing.item_hash(signing.stream_item(["https://station.radio.test"], [other["url"]]))])
+        before = self.dials()
+        unsigned = self.post_json("/api/settings", {**self.payload(streams), "proof": None}, self.guard(self.host))
+        self.assertEqual(unsigned[:3:2], (400, b"nicht signiert: no signature\n"))
+        self.assertEqual(self.dials(), before)
+        self.assertEqual(self.httpd.hub.settings.get(), saved)
+
+    def test_a_failed_resolution_stays_unresolved_names_the_station_and_retries_once_due(self):
+        saved = self.signed_and_saved([self.station(STATION, [])])["settings"]
+        cdn().httpd.broken.add("station.radio.test")
+        self.addCleanup(cdn().httpd.broken.discard, "station.radio.test")
+        crafted = ["https://*.evil.test"]
+        other = "https://station.radio.test/other"
+        before = self.dials()
+        result = self.signed_and_saved([{**saved["streams"][0], "via": crafted}, self.station(other, crafted)])
+        self.assertEqual(self.dials() - before, 1)
+        self.assertEqual(result["problems"], ["DLF: answers 302 without a Location"])
+        self.assertEqual([stream["via"] for stream in result["settings"]["streams"]], [["https://*.cdn.test"], None])
+        self.assertEqual(self.media_src(), "media-src 'self' https://*.cdn.test https://station.radio.test")
+        cdn().httpd.broken.discard("station.radio.test")
+        before = self.dials()
+        early = self.music_toggled(result["settings"]["streams"])
+        self.assertEqual((self.dials() - before, early["problems"], early["settings"]["streams"][1]["via"]), (0, [], None))
+        self.httpd.hub.redirects.tried[other] -= RETRY_SECONDS
+        retried = self.music_toggled(early["settings"]["streams"])
+        self.assertEqual([stream["via"] for stream in retried["settings"]["streams"]], [["https://*.cdn.test"], ["https://*.cdn.test"]])
+        self.assertEqual(retried["problems"], [])
+
+    def test_a_save_that_lands_while_another_resolves_makes_that_one_fail(self):
+        saved = self.signed_and_saved([self.station(STATION, [])])["settings"]
+        slow = [*saved["streams"], self.station("https://drip.radio.test/", [])]
+        proof = self.pin().proof(self.prepared(slow)["payload"], self.origin)
+        answers: list[tuple] = []
+        racing = threading.Thread(target=lambda: answers.append(self.post_json("/api/settings", {**self.payload(slow), "proof": proof}, self.guard(self.host))))
+        racing.start()
+        time.sleep(TIMEOUT)
+        self.assertEqual(self.music_toggled(saved["streams"])["settings"]["music"], MUSIC_ON)
+        racing.join(TIMEOUT * DEADLINE_HOPS + 5)
+        self.assertEqual(answers[0][:3:2], (400, b"the settings changed while this save was checked; save again\n"))
+        self.assertEqual([stream["url"] for stream in self.httpd.hub.settings.get()["streams"]], [STATION])
+
+    def test_settings_saved_before_redirect_resolution_are_never_dialed_unsigned_and_heal_when_re_added(self):
+        legacy = {name: value for name, value in self.station(STATION, []).items() if name != "via"}
+        (self.state / "settings.json").write_text(json.dumps(self.payload([legacy])), encoding="utf-8")
+        loaded = settings.Settings(self.state / "settings.json").get()
+        self.assertEqual(loaded["streams"], [{**legacy, "via": []}])
+        self.assertEqual(settings.media_origins(loaded), ["https://station.radio.test"])
+        self.httpd.hub.settings.put(loaded, self.httpd.hub.settings.get())
+        self.assertIsNone(self.prepared([legacy])["payload"])
+        self.assertEqual(self.media_src(), "media-src 'self' https://station.radio.test")
+        before = self.dials()
+        self.assertEqual(self.music_toggled([legacy])["settings"]["streams"][0]["via"], [])
+        self.assertEqual(self.dials(), before)
+        self.assertEqual(self.post_json("/api/settings", {**self.payload([]), "proof": None}, self.guard(self.host))[0], 200)
+        result = self.signed_and_saved([legacy])
+        self.assertGreater(self.dials(), before)
+        self.assertEqual(result["settings"]["streams"][0]["via"], ["https://*.cdn.test"])
+        self.assertEqual(self.media_src(), "media-src 'self' https://*.cdn.test https://station.radio.test")
+
+    def test_via_holds_only_canonical_https_origins(self):
+        for via in (
+            "https://cdn.example",
+            ["https://*.com"],
+            ["https://*.*.cdn.example"],
+            ["http://cdn.example"],
+            ["https://cdn.example:443"],
+            ["https://cdn.example:70000"],
+            ["https://cdn.example/path"],
+            ["https://user@cdn.example"],
+            ["https://cdn.example 'unsafe-inline'"],
+            ["https://cdn.example;script-src"],
+            ["https://Cdn.example"],
+            [7],
+            ["https://a.example", "https://a.example"],
+            [f"https://n{index}.example" for index in range(settings.VIA_LIMIT + 1)],
+        ):
+            with self.subTest(via=via):
+                self.assertEqual(self.post_json("/api/settings/sign", {**settings.SETTINGS, "streams": [self.station(STATION, via)]}, self.guard(self.host))[0], 400)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_hub_settings.py

@@ -32,7 +32,7 @@ class TestHubSettings(HubCase):
         proof = None if request is None else signer.proof(request, self.origin)
         return self.post_json("/api/settings", {**payload, "proof": proof}, self.guard(self.host))
 
-    def test_a_new_stream_origin_needs_the_passkey(self):
+    def test_a_new_stream_url_needs_the_passkey(self):
         good = self.guard(self.host)
         payload = self.settings_payload(STREAMS)
         self.assertEqual(self.post_json("/api/settings", payload, good)[:3:2], (400, b"nicht signiert: no signature\n"))
@@ -47,11 +47,13 @@ class TestHubSettings(HubCase):
         self.assertEqual(status, 200, body)
         self.assertEqual(self.media_src(), "media-src 'self' http://10.0.0.5:8000 https://other.example:8443 https://radio.example")
         moved = self.settings_payload([{**STREAMS[0], "url": "https://radio.example/abend"}, STREAMS[1]])
-        self.assertIsNone(self.prepared(moved)["payload"])
+        self.assertEqual(self.post_json("/api/settings", moved, good)[:3:2], (400, b"nicht signiert: no signature\n"))
-        status, _, body = self.post_json("/api/settings", moved, good)
+        status, _, body = self.save(moved, signer)
         self.assertEqual(status, 200, body)
         self.assertEqual(self.media_src(), "media-src 'self' http://10.0.0.5:8000 https://radio.example")
+        self.assertEqual(self.post_json("/api/settings", self.settings_payload([]), good)[0], 200)
         self.assertEqual(self.post_json("/api/settings", {**payload, "proof": proof}, good)[:3:2], (400, b"nicht signiert: this signature was already used for this item\n"))
+        self.assertEqual(self.save(moved, signer)[0], 200)
         evil = self.settings_payload([*moved["streams"], {**STREAMS[0], "url": "https://evil.example/listen"}])
         self.assertEqual(self.post_json("/api/settings", {**evil, "proof": signer.proof(self.prepared(payload)["payload"], self.origin)}, good)[:3:2], (400, b"nicht signiert: the signature does not list this item\n"))
         self.assertEqual(self.post_json("/api/settings", evil, good)[0], 400)
@@ -137,15 +139,16 @@ class TestHubSettings(HubCase):
                 self.assertEqual(self.post_json("/api/settings", broken, good)[0], 400)
         status, _, body = self.save(payload, self.pin())
         self.assertEqual(status, 200, body)
-        self.assertEqual(json.loads(body), payload)
+        unresolved = {**payload, "streams": [{**stream, "via": None if stream["url"].startswith("https:") else []} for stream in payload["streams"]]}
-        self.assertEqual(json.loads((self.state / "settings.json").read_text(encoding="utf-8")), payload)
+        self.assertEqual(json.loads(body)["settings"], unresolved)
-        self.assertEqual(self.snapshot()["settings"], payload)
+        self.assertEqual(json.loads((self.state / "settings.json").read_text(encoding="utf-8")), unresolved)
-        self.assertEqual(settings.Settings(self.state / "settings.json").get(), payload)
+        self.assertEqual(self.snapshot()["settings"], unresolved)
+        self.assertEqual(settings.Settings(self.state / "settings.json").get(), unresolved)
         self.assertEqual(self.get("/api/settings")[0], 405)
         shuffled = {**payload, "speech": {"on": False, "classes": ["mayday", "broadcast", "security"], "muted": ["s1", "Operator", "name:Docs"]}}
         status, _, body = self.post_json("/api/settings", shuffled, good)
         self.assertEqual(status, 200, body)
-        self.assertEqual(json.loads(body)["speech"], {"on": False, "classes": ["broadcast", "mayday", "security"], "muted": ["Operator", "name:Docs", "s1"]})
+        self.assertEqual(json.loads(body)["settings"]["speech"], {"on": False, "classes": ["broadcast", "mayday", "security"], "muted": ["Operator", "name:Docs", "s1"]})
 
     def test_settings_written_before_the_radio_filter_keep_their_values(self):
         older = {key: value for key, value in self.settings_payload(STREAMS).items() if key != "speech"}