fix: drain packagist seed response body on error

Signed-off-by: anilb <epipav@gmail.com>

Author: epipav

services/apps/packages_worker/src/packagist/__tests__/listPackages.test.ts

@@ -115,4 +115,25 @@ describe('fetchPackagistPackageList', () => {
     )
     expect(await fetchPackagistPackageList()).toMatchObject({ kind: 'TRANSIENT', statusCode: 503 })
   })
+
+  // Regression: the seed's own error paths share the same 10-connection dispatcher as
+  // the stats/p2 fetches, so an undrained body here risks the same socket exhaustion.
+  it.each([
+    ['404', 404, 'NOT_FOUND'],
+    ['429', 429, 'RATE_LIMIT'],
+    ['503', 503, 'TRANSIENT'],
+  ])('drains the response body on a %s error', async (_status, statusCode, kind) => {
+    const cancel = vi.fn()
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue({
+        status: statusCode,
+        ok: false,
+        json: async () => ({}),
+        body: { cancel },
+      }),
+    )
+    expect(await fetchPackagistPackageList()).toMatchObject({ kind })
+    expect(cancel).toHaveBeenCalled()
+  })
 })

services/apps/packages_worker/src/packagist/fetchPackage.ts

@@ -36,8 +36,9 @@ export function describeFetchFailure(err: unknown): string {
 // An error-path response whose body is never read can pin its socket instead of
 // returning it to packagistDispatcher's pool (capped at 10 connections per origin) —
 // canceling it releases the connection for reuse. Best-effort: a failure here must
-// never mask the real error already being returned.
-async function discardBody(res: Response): Promise<void> {
+// never mask the real error already being returned. Exported for listPackages.ts,
+// which shares the same dispatcher and error-path risk.
+export async function discardBody(res: Response): Promise<void> {
   try {
     await res.body?.cancel()
   } catch {

services/apps/packages_worker/src/packagist/listPackages.ts

@@ -1,6 +1,11 @@
 import type { Dispatcher } from 'undici'
 
-import { buildPackagistUserAgent, describeFetchFailure, packagistDispatcher } from './fetchPackage'
+import {
+  buildPackagistUserAgent,
+  describeFetchFailure,
+  discardBody,
+  packagistDispatcher,
+} from './fetchPackage'
 import type { FetchError } from './types'
 
 const PACKAGIST_LIST = 'https://packagist.org/packages/list.json'
@@ -96,9 +101,18 @@ export async function fetchPackagistPackageList(): Promise<unknown | FetchError>
     }
 
     // Status classification: 404 NOT_FOUND, 429 RATE_LIMIT, other non-ok TRANSIENT
-    if (res.status === 404) return { kind: 'NOT_FOUND', message: 'list not found', statusCode: 404 }
-    if (res.status === 429) return { kind: 'RATE_LIMIT', message: 'rate limited', statusCode: 429 }
-    if (!res.ok) return { kind: 'TRANSIENT', message: `HTTP ${res.status}`, statusCode: res.status }
+    if (res.status === 404) {
+      await discardBody(res)
+      return { kind: 'NOT_FOUND', message: 'list not found', statusCode: 404 }
+    }
+    if (res.status === 429) {
+      await discardBody(res)
+      return { kind: 'RATE_LIMIT', message: 'rate limited', statusCode: 429 }
+    }
+    if (!res.ok) {
+      await discardBody(res)
+      return { kind: 'TRANSIENT', message: `HTTP ${res.status}`, statusCode: res.status }
+    }
 
     let json: unknown
     try {