[stable33] fix(behat): stop nested develop/pdf fetches causing cURL 52 flakes

tests/integration/config/behat.yml

@@ -16,7 +16,11 @@ default:
       base_url: http://mailpit:8025
     PhpBuiltin\Server:
       runAs: www-data
-      workers: 10
+      # Keep the minimum workers needed for occasional nested HTTP to the same
+      # PHP built-in server (single-process deadlocks on self-requests). Prefer
+      # inline <SMALL_VALID_PDF_BASE64> fixtures over url→/develop/pdf to avoid load-driven
+      # cURL 52 flakes from higher PHP_CLI_SERVER_WORKERS values.
+      workers: 2
     jarnaiz\JUnitFormatter\JUnitFormatterExtension:
       filename: report.xml
       outputDir: '%paths.base%/../output/'

tests/integration/features/account/signature.feature

@@ -257,7 +257,7 @@ Feature: account/signature
     And sending "post" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/identify_methods"
       | value | (string)[{"name":"email","enabled":true,"mandatory":true,"can_create_account":false}] |
     And sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | signers | [{"identifyMethods":[{"method":"email","value":"signer@test.coop"}]}] |
       | name | document |
     When as user ""

tests/integration/features/bootstrap/FeatureContext.php

@@ -7,6 +7,7 @@
  */
 
 use Behat\Gherkin\Node\TableNode;
+use Behat\Hook\AfterSuite;
 use Behat\Hook\BeforeScenario;
 use Behat\Hook\BeforeSuite;
 use Behat\Step\Given;
@@ -25,10 +26,17 @@ class FeatureContext extends NextcloudApiContext implements OpenedEmailStorageAw
 	#[BeforeSuite()]
 	public static function beforeSuite(BeforeSuiteScope $scope):void {
 		parent::beforeSuite($scope);
+		FixtureHttpServer::start();
 		self::runCommand('config:system:set debug --value true --type boolean');
+		self::runCommand('config:system:set allow_local_remote_servers --value true --type boolean');
 		self::runCommand('app:enable --force notifications');
 	}
 
+	#[AfterSuite()]
+	public static function afterSuite(): void {
+		FixtureHttpServer::stop();
+	}
+
 	#[BeforeScenario()]
 	public static function beforeScenario(): void {
 		parent::beforeScenario();
@@ -50,6 +58,8 @@ protected function parseText(string $text): string {
 		$fields = $this->fields;
 		$fields['BASE_URL'] = $this->baseUrl . '/index.php';
 		$fields['TSA_URL'] = getenv('LIBRESIGN_TSA_URL') ?: 'https://freetsa.org/tsr';
+		$fields['SMALL_VALID_PDF_BASE64'] = $this->getSmallValidPdfBase64();
+		$fields['SMALL_VALID_PDF_URL'] = FixtureHttpServer::getSmallValidPdfUrl();
 		foreach ($fields as $key => $value) {
 			$patterns[] = '/<' . $key . '>/';
 			$replacements[] = $value;
@@ -59,6 +69,19 @@ protected function parseText(string $text): string {
 		return $text;
 	}
 
+	/**
+	 * Inline PDF fixture for Behat requests that do not need to exercise url download.
+	 *
+	 * Prefer this over url→the Behat Nextcloud server. For url coverage use <SMALL_VALID_PDF_URL>,
+	 * which is served by FixtureHttpServer on a separate local port.
+	 */
+	private function getSmallValidPdfBase64(): string {
+		$pdfPath = __DIR__ . '/../../../php/fixtures/pdfs/small_valid.pdf';
+		$contents = file_get_contents($pdfPath);
+		Assert::assertNotFalse($contents, 'Demo PDF fixture missing: ' . $pdfPath);
+		return 'data:application/pdf;base64,' . base64_encode($contents);
+	}
+
 	#[Given('I fetch the signer UUID from opened email')]
 	public function iFetchTheLinkOnOpenedEmail(): void {
 		if (!$this->openedEmailStorage->hasOpenedEmail()) {

tests/integration/features/bootstrap/FixtureHttpServer.php

@@ -0,0 +1,107 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+/**
+ * Serves Behat PDF fixtures on a separate PHP built-in server.
+ *
+ * This must not be the same process as the Nextcloud Behat server, so
+ * request-signature can exercise {"url": ...} without nested self-HTTP.
+ */
+final class FixtureHttpServer {
+	private static string $pid = '0';
+	private static string $host = '127.0.0.1';
+	private static int $port = 0;
+	private static string $documentRoot = '';
+
+	public static function start(): void {
+		if (self::isRunning()) {
+			return;
+		}
+
+		self::$documentRoot = realpath(__DIR__ . '/../../../php/fixtures/pdfs');
+		if (self::$documentRoot === false || !is_file(self::$documentRoot . '/small_valid.pdf')) {
+			throw new RuntimeException('PDF fixture directory or small_valid.pdf is missing.');
+		}
+
+		self::$port = self::findOpenPort(self::$host);
+		$cmd = sprintf(
+			'php -S %s:%d -t %s > /dev/null 2>&1 & echo $!',
+			escapeshellarg(self::$host),
+			self::$port,
+			escapeshellarg(self::$documentRoot)
+		);
+
+		self::$pid = trim((string)shell_exec($cmd));
+		if (self::$pid === '' || !ctype_digit(self::$pid)) {
+			throw new RuntimeException('Failed to start fixture HTTP server process.');
+		}
+
+		for ($attempt = 0; $attempt < 30; $attempt++) {
+			usleep(100000);
+			$socket = @fsockopen(self::$host, self::$port);
+			if (is_resource($socket)) {
+				fclose($socket);
+				register_shutdown_function(static function (): void {
+					self::stop();
+				});
+				return;
+			}
+		}
+
+		self::stop();
+		throw new RuntimeException('Fixture HTTP server did not become ready in time.');
+	}
+
+	public static function stop(): void {
+		if (self::isRunning()) {
+			exec('kill ' . self::$pid);
+		}
+		self::$pid = '0';
+		self::$port = 0;
+	}
+
+	public static function getSmallValidPdfUrl(): string {
+		if (!self::isRunning() || self::$port <= 0) {
+			throw new RuntimeException('Fixture HTTP server is not running.');
+		}
+
+		return sprintf('http://%s:%d/small_valid.pdf', self::$host, self::$port);
+	}
+
+	private static function isRunning(): bool {
+		if (self::$pid === '' || self::$pid === '0') {
+			return false;
+		}
+
+		exec(sprintf('ps %d', (int)self::$pid), $result);
+
+		return count($result) > 1;
+	}
+
+	private static function findOpenPort(string $host): int {
+		$server = @stream_socket_server('tcp://' . $host . ':0', $errno, $errstr);
+		if ($server === false) {
+			throw new RuntimeException('Unable to allocate local port for fixture HTTP server: ' . $errstr);
+		}
+
+		$name = stream_socket_get_name($server, false);
+		fclose($server);
+
+		if (!is_string($name) || !str_contains($name, ':')) {
+			throw new RuntimeException('Unable to detect allocated local port for fixture HTTP server.');
+		}
+
+		$parts = explode(':', $name);
+		$port = (int)end($parts);
+		if ($port <= 0) {
+			throw new RuntimeException('Invalid allocated port for fixture HTTP server.');
+		}
+
+		return $port;
+	}
+}

tests/integration/features/file/envelope.feature

@@ -6,7 +6,7 @@ Feature: envelope
     And sending "post" to ocs "/apps/libresign/api/v1/admin/certificate/openssl"
       | rootCert | {"commonName":"test"} |
     When sending "post" to ocs "/apps/libresign/api/v1/file"
-      | files | [{"url":"<BASE_URL>/apps/libresign/develop/pdf"},{"url":"<BASE_URL>/apps/libresign/develop/pdf"}] |
+      | files | [{"base64":"<SMALL_VALID_PDF_BASE64>"},{"base64":"<SMALL_VALID_PDF_BASE64>"}] |
       | name | Contract Package |
     Then the response should have a status code 422
     And the response should be a JSON array with the following mandatory values
@@ -43,7 +43,7 @@ Feature: envelope
     And sending "post" to ocs "/apps/libresign/api/v1/admin/certificate/openssl"
       | rootCert | {"commonName":"test"} |
     When sending "post" to ocs "/apps/libresign/api/v1/file"
-      | files | [{"url":"<BASE_URL>/apps/libresign/develop/pdf"},{"url":"<BASE_URL>/apps/libresign/develop/pdf"},{"url":"<BASE_URL>/apps/libresign/develop/pdf"}] |
+      | files | [{"base64":"<SMALL_VALID_PDF_BASE64>"},{"base64":"<SMALL_VALID_PDF_BASE64>"},{"base64":"<SMALL_VALID_PDF_BASE64>"}] |
       | name | Too Many Files |
     Then the response should have a status code 422
     And the response should be a JSON array with the following mandatory values
@@ -55,7 +55,7 @@ Feature: envelope
     And sending "post" to ocs "/apps/libresign/api/v1/admin/certificate/openssl"
       | rootCert | {"commonName":"test"} |
     When sending "post" to ocs "/apps/libresign/api/v1/file"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | name | Single Document |
     Then the response should have a status code 200
     And the response should be a JSON array with the following mandatory values

tests/integration/features/file/list.feature

@@ -6,7 +6,7 @@ Feature: file-list
     And set the email of user "signer1" to "signer1@domain.test"
     And set the email of user "signer2" to ""
     And sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | signers | [{"identifyMethods":[{"method":"email","value":"signer1@domain.test"}]},{"identifyMethods":[{"method":"account","value":"signer2"}]}] |
       | name | document |
     And the response should have a status code 200
@@ -47,25 +47,25 @@ Feature: file-list
     And sending "post" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/identify_methods"
       | value | (string)[{"name":"email","enabled":true,"mandatory":true,"can_create_account":false}] |
     And sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | signers | [{"identifyMethods":[{"method":"email","value":"signer1@domain.test"}]}] |
       | name | document |
     And the response should have a status code 200
     And sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | signers | [{"identifyMethods":[{"method":"email","value":"signer1@domain.test"}]}] |
       | name | document |
     And the response should have a status code 200
     And sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | signers | [{"identifyMethods":[{"method":"email","value":"signer1@domain.test"}]}] |
       | name | document |
     And sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | signers | [{"identifyMethods":[{"method":"email","value":"signer1@domain.test"}]}] |
       | name | document |
     And sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | signers | [{"identifyMethods":[{"method":"email","value":"signer1@domain.test"}]}] |
       | name | document |
     And the response should have a status code 200

tests/integration/features/file/thumbnail.feature

@@ -6,7 +6,7 @@ Feature: file-thumbnail
     And sending "post" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/identify_methods"
       | value | (string)[{"name":"account","enabled":true,"mandatory":true}] |
     And sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | signers | [{"identifyMethods":[{"method":"account","value":"signer1"}]}] |
       | name | document |
     And the response should have a status code 200

tests/integration/features/file/validate.feature

@@ -5,7 +5,7 @@ Feature: validate
     And sending "post" to ocs "/apps/libresign/api/v1/admin/certificate/openssl"
       | rootCert | {"commonName":"test"} |
     When sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | signers | [{"identifyMethods":[{"method":"account","value":"admin"}]},{"identifyMethods":[{"method":"account","value":"signer1"}]}] |
       | status | 0 |
       | name | Visible elements validation |
@@ -71,7 +71,7 @@ Feature: validate
       | value | (string)[{"name":"account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":true}}}] |
     And user "signer1" exists
     When sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | signers | [{"identifyMethods":[{"method":"account","value":"signer1"}]}] |
       | name | Document Name |
     Then the response should have a status code 200
@@ -115,7 +115,7 @@ Feature: validate
     And sending "delete" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/make_validation_url_private"
 
     When sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | signers | [{"identifyMethods":[{"method":"account","value":"admin"}]}] |
       | name | document |
     And the response should have a status code 200

tests/integration/features/notification/custom_message_notification.feature

@@ -15,7 +15,7 @@ Feature: Custom message for signers
 
   Scenario: Account method - default message without custom description
     When sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | name | Document without custom message |
       | signers | [{"identifyMethods":[{"method":"account","value":"signer1"}]}] |
     Then the response should have a status code 200
@@ -25,7 +25,7 @@ Feature: Custom message for signers
 
   Scenario: Account method - custom description in email
     When sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | name | Document with custom message |
       | signers | [{"identifyMethods":[{"method":"account","value":"signer1"}],"description":"Please review section 3 and the appendix before signing."}] |
     Then the response should have a status code 200
@@ -36,14 +36,14 @@ Feature: Custom message for signers
 
   Scenario: Email method - default notification
     When sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | name | Document for email method |
       | signers | [{"identifyMethods":[{"method":"email","value":"external@domain.test"}],"displayName":"External Signer"}] |
     Then the response should have a status code 200
 
   Scenario: Email method - custom description via reminder
     Given sending "post" to ocs "/apps/libresign/api/v1/request-signature"
-      | file | {"url":"<BASE_URL>/apps/libresign/develop/pdf"} |
+      | file | {"base64":"<SMALL_VALID_PDF_BASE64>"} |
       | name | Document for email with description |
       | signers | [{"identifyMethods":[{"method":"email","value":"external@domain.test"}],"displayName":"External Signer","description":"Urgent: Please sign by end of day."}] |
     And the response should have a status code 200