fix(signalk): connect WebSocket directly, detect token rejection on the upgrade

SKWSClient validated the stored auth token with a separate HTTPS GET to
/signalk/v1/stream (test_token) before opening the WebSocket. On
memory-constrained targets (e.g. ESP32-C3) the token-probe TLS handshake and
the WebSocket TLS handshake run back-to-back; mbedTLS's two 16 KB record
buffers fragment the heap, and the second handshake fails to allocate
(MBEDTLS_ERR_SSL_ALLOC_FAILED) -- so the device can never connect to a TLS
Signal K server.

Connect the WebSocket directly with the stored token and move auth-failure
recovery onto the upgrade itself: on a 401 handshake status, on_error() clears
the token and the next reconnect re-requests access -- the same recovery
test_token did, now driven by the real upgrade instead of a separate probe.
This removes one TLS handshake per connect attempt. A non-401 transport error
keeps the token and simply retries. server_detected_/token_test_success_ are
set at connect time so the on_disconnected() bad-token heuristic stays inert;
bad-token detection is now precise via the 401 status.

Removes the now-unused test_token().

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mairas

src/sensesp/signalk/signalk_ws_client.cpp

@@ -135,7 +135,17 @@ static void websocket_event_handler(void* handler_args,
       }
       break;
     case WEBSOCKET_EVENT_ERROR:
-      ws_client->on_error();
+      // The HTTP status of the failed upgrade (e.g. 401 for a rejected token)
+      // lets us distinguish a bad token from a transient transport error. The
+      // handshake status field only exists in the newer esp_websocket_client
+      // component pulled for SSL builds; the version bundled with the EOL
+      // espressif32 Arduino platform lacks it, so fall back to 0 (not
+      // applicable), matching how on_error() treats a transient failure.
+#ifdef SENSESP_SSL_SUPPORT
+      ws_client->on_error(data->error_handle.esp_ws_handshake_status_code);
+#else
+      ws_client->on_error(0);
+#endif
       break;
   }
 }
@@ -219,9 +229,19 @@ void SKWSClient::on_disconnected() {
  * Called in the websocket task context.
  *
  */
-void SKWSClient::on_error() {
+void SKWSClient::on_error(int handshake_status) {
   this->set_connection_state(SKWSConnectionState::kSKWSDisconnected);
-  ESP_LOGW(__FILENAME__, "Websocket client error.");
+  if (handshake_status == 401) {
+    // The server rejected the token on the WebSocket upgrade (e.g. the server
+    // was reinstalled, or the device was moved to a different server). Clear it
+    // so the next reconnect requests fresh access. A non-401 error (transport,
+    // TLS, network) leaves the token intact and simply retries.
+    ESP_LOGW(__FILENAME__, "Token rejected (401), requesting new access");
+    auth_token_ = NULL_AUTH_TOKEN;
+    save();
+  } else {
+    ESP_LOGW(__FILENAME__, "Websocket client error.");
+  }
 }
 
 /**
@@ -731,106 +751,24 @@ void SKWSClient::connect() {
     return;
   }
 
-  // Test the validity of the authorization token
-  this->test_token(this->server_address_, this->server_port_);
+  // A token is already present. Connect the WebSocket directly rather than
+  // first probing the token over a separate HTTPS request: on memory-constrained
+  // targets (e.g. ESP32-C3) the back-to-back token-probe TLS handshake and the
+  // WebSocket TLS handshake fragment the heap, and the second fails to allocate
+  // (MBEDTLS_ERR_SSL_ALLOC_FAILED). The server validates the token on the
+  // upgrade itself; a 401 there is handled in on_error() (clears the token and
+  // re-requests access on the next reconnect). server_detected_/
+  // token_test_success_ are set so the on_disconnected() bad-token heuristic
+  // stays inert -- bad-token detection is now precise via the 401 status.
+  server_detected_ = true;
+  token_test_success_ = true;
+  this->connect_ws(this->server_address_, this->server_port_);
 }
 
 void SKWSClient::loop() {
   // No-op: esp_websocket_client handles data via event callbacks
 }
 
-void SKWSClient::test_token(const String server_address,
-                            const uint16_t server_port) {
-  String protocol = ssl_enabled_ ? "https://" : "http://";
-  String url = protocol + server_address + ":" + server_port +
-               "/signalk/v1/stream";
-  ESP_LOGD(__FILENAME__, "Testing token with url %s", url.c_str());
-
-  const String full_token = String("Bearer ") + auth_token_;
-  ESP_LOGD(__FILENAME__, "Authorization: %.8s...[redacted]", full_token.c_str());
-
-  esp_http_client_config_t config = {};
-  config.url = url.c_str();
-  config.timeout_ms = 10000;
-#ifdef SENSESP_SSL_SUPPORT
-  if (ssl_enabled_) {
-    config.crt_bundle_attach = tofu_crt_bundle_attach;
-    config.skip_cert_common_name_check = true;
-  }
-#endif
-
-  esp_http_client_handle_t client = esp_http_client_init(&config);
-  if (client == nullptr) {
-    ESP_LOGE(__FILENAME__, "Failed to initialize HTTP client");
-    set_connection_state(SKWSConnectionState::kSKWSDisconnected);
-    return;
-  }
-
-  esp_http_client_set_header(client, "Authorization", full_token.c_str());
-
-  // Use streaming API for GET request
-  esp_err_t err = esp_http_client_open(client, 0);
-  if (err != ESP_OK) {
-    ESP_LOGE(__FILENAME__, "Failed to open HTTP connection: %s", esp_err_to_name(err));
-    esp_http_client_cleanup(client);
-    set_connection_state(SKWSConnectionState::kSKWSDisconnected);
-    return;
-  }
-
-  int content_length = esp_http_client_fetch_headers(client);
-  int http_code = esp_http_client_get_status_code(client);
-
-  ESP_LOGD(__FILENAME__, "Testing resulted in http status %d", http_code);
-
-  // Read response body
-  String payload;
-  if (content_length > 0 && content_length < 4096) {
-    char* buffer = new char[content_length + 1];
-    int read_len = esp_http_client_read(client, buffer, content_length);
-    buffer[read_len > 0 ? read_len : 0] = '\0';
-    payload = String(buffer);
-    delete[] buffer;
-  } else {
-    // Chunked encoding or unknown/large content length - read in chunks
-    char buffer[512];
-    int read_len;
-    while ((read_len = esp_http_client_read(client, buffer, sizeof(buffer) - 1)) > 0) {
-      buffer[read_len] = '\0';
-      payload += String(buffer);
-      if (payload.length() > 4096) break;
-    }
-  }
-
-  esp_http_client_close(client);
-  esp_http_client_cleanup(client);
-
-  if (payload.length() > 0) {
-    ESP_LOGD(__FILENAME__, "Returned payload (%d bytes): %s",
-             payload.length(), payload.c_str());
-  }
-
-  if (http_code == 426) {
-    // HTTP status 426 is "Upgrade Required", which is the expected
-    // response for a websocket connection.
-    ESP_LOGD(__FILENAME__, "Attempting to connect to Signal K Websocket...");
-    server_detected_ = true;
-    token_test_success_ = true;
-    this->connect_ws(server_address, server_port);
-  } else if (http_code == 401) {
-    // Token is invalid/expired - clear it and request new access
-    // Keep client_id_ so we reuse the same device identity
-    ESP_LOGW(__FILENAME__, "Token rejected (401), requesting new access");
-    this->auth_token_ = NULL_AUTH_TOKEN;
-    this->save();
-    this->send_access_request(server_address, server_port);
-  } else if (http_code > 0) {
-    set_connection_state(SKWSConnectionState::kSKWSDisconnected);
-  } else {
-    ESP_LOGE(__FILENAME__, "HTTP request failed with code %d", http_code);
-    set_connection_state(SKWSConnectionState::kSKWSDisconnected);
-  }
-}
-
 void SKWSClient::send_access_request(const String server_address,
                                      const uint16_t server_port) {
   ESP_LOGD(__FILENAME__, "Sending access request (client_id=%s, ssl=%d)",

src/sensesp/signalk/signalk_ws_client.h

@@ -89,7 +89,9 @@ class SKWSClient : public FileSystemSaveable,
   // SKWSClient task methods
 
   void on_disconnected();
-  void on_error();
+  // handshake_status is the HTTP status of a failed WebSocket upgrade (0 if not
+  // applicable); a 401 means the auth token was rejected.
+  void on_error(int handshake_status);
   void on_connected();
   void on_receive_delta(uint8_t* payload, size_t length);
   void on_receive_updates(JsonDocument& message);
@@ -295,7 +297,6 @@ class SKWSClient : public FileSystemSaveable,
   /////////////////////////////////////////////////////////
   // SKWSClient task methods
 
-  void test_token(const String host, const uint16_t port);
   void send_access_request(const String host, const uint16_t port);
   void poll_access_request(const String host, const uint16_t port,
                            const String href);