fix(gateway): refresh replay URLs and advertise public ingress ports

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

Author: mrunalp

crates/openshell-cli/tests/sandbox_create_lifecycle_integration.rs

@@ -3501,30 +3501,32 @@ async fn sandbox_create_json_stdout_is_parseable() {
 
 #[tokio::test]
 async fn sandbox_create_json_uses_dedicated_ingress_port() {
-    let server = run_server().await;
-    server
-        .openshell
-        .state
-        .service_ingress_port
-        .store(8082, Ordering::SeqCst);
-    let result = run_cli_sandbox_create(
-        &server,
-        "dedicated-ingress",
-        &["--output=json", "--expose=4500", "--detach"],
-    )
-    .await;
-    assert!(
-        result.status.success(),
-        "{}",
-        String::from_utf8_lossy(&result.stderr)
-    );
-    let value: serde_json::Value = serde_json::from_slice(&result.stdout).unwrap();
-    assert_eq!(
-        value["service_urls"],
-        serde_json::json!({
-            "": "https://default--sandbox.openshell.localhost:8082/"
-        })
-    );
+    for port in [8082, 32082] {
+        let server = run_server().await;
+        server
+            .openshell
+            .state
+            .service_ingress_port
+            .store(port, Ordering::SeqCst);
+        let result = run_cli_sandbox_create(
+            &server,
+            "dedicated-ingress",
+            &["--output=json", "--expose=4500", "--detach"],
+        )
+        .await;
+        assert!(
+            result.status.success(),
+            "{}",
+            String::from_utf8_lossy(&result.stderr)
+        );
+        let value: serde_json::Value = serde_json::from_slice(&result.stdout).unwrap();
+        assert_eq!(
+            value["service_urls"],
+            serde_json::json!({
+                "": format!("https://default--sandbox.openshell.localhost:{port}/")
+            })
+        );
+    }
 }
 
 #[tokio::test]

crates/openshell-core/src/config.rs

@@ -197,6 +197,10 @@ pub struct Config {
     /// primary listener serves control-plane operations only.
     pub service_bind_address: Option<SocketAddr>,
 
+    /// Optional externally reachable service port, overriding the listener port
+    /// in generated URLs (for example, a `NodePort` or reverse proxy).
+    pub service_public_port: Option<u16>,
+
     /// Address to bind the unauthenticated health endpoint to.
     ///
     /// When `None`, the dedicated health listener is disabled.
@@ -304,7 +308,7 @@ pub struct ServiceRoutingConfig {
     pub enable_loopback_service_http: bool,
 }
 
-/// gRPC response metadata advertising a dedicated service ingress port.
+/// gRPC response metadata advertising an explicitly configured service port.
 /// Clients use this port for service URLs instead of the control-plane
 /// endpoint's externally forwarded port when this is set.
 pub const SERVICE_PORT_METADATA_KEY: &str = "openshell-service-port";
@@ -885,6 +889,7 @@ impl Config {
             name: DEFAULT_GATEWAY_NAME.to_string(),
             bind_address: default_bind_address(),
             service_bind_address: None,
+            service_public_port: None,
             health_bind_address: None,
             metrics_bind_address: None,
             log_level: default_log_level(),
@@ -936,6 +941,14 @@ impl Config {
         self.service_bind_address.unwrap_or(self.bind_address)
     }
 
+    /// Explicit service port clients should use instead of a forwarded
+    /// control-plane port. Shared mode retains legacy client behavior by default.
+    #[must_use]
+    pub fn advertised_service_port(&self) -> Option<u16> {
+        self.service_public_port
+            .or_else(|| self.service_bind_address.map(|address| address.port()))
+    }
+
     #[must_use]
     pub const fn with_health_bind_address(mut self, addr: SocketAddr) -> Self {
         self.health_bind_address = Some(addr);

crates/openshell-server/src/cli.rs

@@ -491,6 +491,8 @@ fn prepare_server_config_with_drivers(
     );
 
     validate_listener_ports(bind, service_bind, health_bind, metrics_bind)?;
+    config.service_public_port = file_gateway.and_then(|g| g.service_public_port);
+    validate_service_public_port(config.service_public_port)?;
     if let Some(addr) = service_bind {
         config = config.with_service_bind_address(addr);
     }
@@ -1020,6 +1022,7 @@ fn validate_preflight_semantics(
         "service_port",
         || gateway.service_bind_address,
     );
+    validate_service_public_port(gateway.service_public_port)?;
     let health_bind = resolve_aux_listener(
         args.bind_address,
         args.health_port,
@@ -1065,6 +1068,15 @@ fn validate_listener_ports(
     Ok(())
 }
 
+fn validate_service_public_port(port: Option<u16>) -> Result<()> {
+    if port == Some(0) {
+        return Err(miette::miette!(
+            "service_public_port requires a nonzero port"
+        ));
+    }
+    Ok(())
+}
+
 fn resolve_config_path(args: &RunArgs) -> Result<Option<PathBuf>> {
     if let Some(path) = args.config.clone() {
         return Ok(Some(path));
@@ -2373,6 +2385,10 @@ mod tests {
                 "service-listener-zero",
                 "[openshell]\nversion = 2\n[openshell.gateway]\nservice_bind_address = '0.0.0.0:0'\ndisable_tls = true\n",
             ),
+            (
+                "service-public-port-zero",
+                "[openshell]\nversion = 2\n[openshell.gateway]\nservice_public_port = 0\ndisable_tls = true\n",
+            ),
             (
                 "driver-selector",
                 "[openshell]\nversion = 2\n[openshell.gateway]\ncompute_driver = 'secret-driver-marker'\ndisable_tls = true\n",
@@ -3170,6 +3186,35 @@ service_bind_address = '0.0.0.0:8082'
         );
     }
 
+    #[test]
+    fn service_public_port_is_loaded_without_rebinding_the_listener() {
+        let _lock = ENV_LOCK
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("gateway.toml");
+        std::fs::write(
+            &path,
+            "[openshell]\nversion = 2\n[openshell.gateway]\nservice_bind_address = '0.0.0.0:8082'\nservice_public_port = 32082\ndisable_tls = true\n",
+        )
+        .unwrap();
+        let _config = EnvVarGuard::set("OPENSHELL_GATEWAY_CONFIG", path.to_str().unwrap());
+        let _service_port = EnvVarGuard::remove("OPENSHELL_SERVICE_PORT");
+        let _legacy = EnvVarGuard::remove("OPENSHELL_DRIVERS");
+        let registry = test_registry("shared", false);
+        let (mut args, matches) = parse_with_args(&[
+            "openshell-gateway",
+            "--db-url",
+            "sqlite::memory:",
+            "--compute-driver",
+            "shared",
+        ]);
+        let prepared =
+            super::prepare_server_config_with_drivers(&mut args, &matches, &registry).unwrap();
+        assert_eq!(prepared.config.service_address().port(), 8082);
+        assert_eq!(prepared.config.advertised_service_port(), Some(32082));
+    }
+
     #[test]
     fn service_listener_rejects_zero_and_collisions_with_all_other_ports() {
         let primary = "127.0.0.1:8080".parse().unwrap();

crates/openshell-server/src/config_file.rs

@@ -96,6 +96,8 @@ pub struct GatewayFileSection {
     #[serde(default)]
     pub service_bind_address: Option<SocketAddr>,
     #[serde(default)]
+    pub service_public_port: Option<u16>,
+    #[serde(default)]
     pub health_bind_address: Option<SocketAddr>,
     #[serde(default)]
     pub metrics_bind_address: Option<SocketAddr>,

crates/openshell-server/src/grpc/mutation_replay.rs

@@ -121,7 +121,13 @@ pub(super) trait Mutation: Message + Default + Send + Sync + 'static {
         request: Request<Self>,
     ) -> Result<Response<Self::Output>, Status>;
     fn capture(response: &Response<Self::Output>) -> Result<Success, Status>;
-    async fn restore(store: &Store, success: Success) -> Result<Self::Output, Status>;
+    /// Preserve the admitted effects and resource identity, while rendering
+    /// transport-dependent fields from the current gateway configuration.
+    async fn restore(
+        store: &Store,
+        config: &openshell_core::Config,
+        success: Success,
+    ) -> Result<Self::Output, Status>;
 }
 
 /// Empty IDs preserve the existing RPC contract, including cancellation.
@@ -300,7 +306,8 @@ async fn execute_owned<M: Mutation>(
                 return Err(replay_unavailable());
             }
             let success = previous.success.ok_or_else(uncertain)?;
-            let mut response = Response::new(M::restore(&state.store, success).await?);
+            let mut response =
+                Response::new(M::restore(&state.store, &state.config, success).await?);
             response.metadata_mut().insert(
                 "openshell-replayed",
                 "true".parse().expect("static metadata"),
@@ -693,7 +700,11 @@ macro_rules! resource_mutation {
             fn capture(response: &Response<Self::Output>) -> Result<Success, Status> {
                 resource_success(response.get_ref().$field.as_ref())
             }
-            async fn restore(store: &Store, success: Success) -> Result<Self::Output, Status> {
+            async fn restore(
+                store: &Store,
+                _config: &openshell_core::Config,
+                success: Success,
+            ) -> Result<Self::Output, Status> {
                 Ok($resp {
                     $field: Some(restore_resource(store, success).await?),
                 })
@@ -729,7 +740,11 @@ macro_rules! deletion_mutation {
                     outcome: response.get_ref().outcome,
                 })
             }
-            async fn restore(_store: &Store, success: Success) -> Result<Self::Output, Status> {
+            async fn restore(
+                _store: &Store,
+                _config: &openshell_core::Config,
+                success: Success,
+            ) -> Result<Self::Output, Status> {
                 let Success::Deletion { outcome } = success else {
                     return Err(replay_unavailable());
                 };