fix(gateway): preserve canvas tls urls

src/gateway/server/ws-connection.test.ts

@@ -111,6 +111,63 @@ describe("attachGatewayWsConnectionHandler", () => {
     );
   });
 
+  it("uses the gateway TLS scheme for canvas host URLs", async () => {
+    const listeners = new Map<string, (...args: unknown[]) => void>();
+    const wss = {
+      on: vi.fn((event: string, handler: (...args: unknown[]) => void) => {
+        listeners.set(event, handler);
+      }),
+    } as unknown as WebSocketServer;
+    const socket = Object.assign(new EventEmitter(), {
+      _socket: {
+        remoteAddress: "127.0.0.1",
+        remotePort: 1234,
+        localAddress: "127.0.0.1",
+        localPort: 5678,
+      },
+      send: vi.fn(),
+      close: vi.fn(),
+    });
+    const upgradeReq = {
+      headers: { host: "gateway.example.com" },
+      socket: { localAddress: "127.0.0.1" },
+    };
+
+    attachGatewayWsConnectionHandler({
+      wss,
+      clients: new Set(),
+      preauthConnectionBudget: { release: vi.fn() } as never,
+      port: 18789,
+      canvasHostEnabled: true,
+      canvasHostScheme: "https",
+      resolvedAuth: createResolvedAuth("token"),
+      gatewayMethods: [],
+      events: [],
+      refreshHealthSnapshot: vi.fn(async () => ({}) as never),
+      logGateway: createLogger() as never,
+      logHealth: createLogger() as never,
+      logWsControl: createLogger() as never,
+      extraHandlers: {},
+      broadcast: vi.fn(),
+      buildRequestContext: () =>
+        ({
+          unsubscribeAllSessionEvents: vi.fn(),
+          nodeRegistry: { unregister: vi.fn() },
+          nodeUnsubscribeAll: vi.fn(),
+        }) as never,
+    });
+
+    const onConnection = listeners.get("connection");
+    expect(onConnection).toBeTypeOf("function");
+    onConnection?.(socket, upgradeReq);
+    await waitForLazyMessageHandler();
+
+    const passed = attachGatewayWsMessageHandlerMock.mock.calls[0]?.[0] as {
+      canvasHostUrl?: string;
+    };
+    expect(passed.canvasHostUrl).toBe("https://gateway.example.com:443");
+  });
+
   it("rejects late client registration after a pre-connect socket close", async () => {
     const listeners = new Map<string, (...args: unknown[]) => void>();
     const wss = {

src/gateway/server/ws-connection.ts

@@ -124,6 +124,7 @@ export type GatewayWsSharedHandlerParams = {
   port: number;
   gatewayHost?: string;
   canvasHostEnabled: boolean;
+  canvasHostScheme?: "http" | "https";
   canvasHostServerPort?: number;
   resolvedAuth: ResolvedGatewayAuth;
   getResolvedAuth?: () => ResolvedGatewayAuth;
@@ -199,6 +200,7 @@ export function attachGatewayWsConnectionHandler(params: AttachGatewayWsConnecti
     port,
     gatewayHost,
     canvasHostEnabled,
+    canvasHostScheme,
     canvasHostServerPort,
     resolvedAuth,
     getResolvedAuth = () => resolvedAuth,
@@ -253,6 +255,7 @@ export function attachGatewayWsConnectionHandler(params: AttachGatewayWsConnecti
       requestHost: upgradeReq.headers.host,
       forwardedProto: upgradeReq.headers["x-forwarded-proto"],
       localAddress: upgradeReq.socket?.localAddress,
+      scheme: canvasHostScheme,
     });
 
     logWs("in", "open", { connId, remoteAddr, remotePort, localAddr, localPort, endpoint });