fix(conflict): restore HAPI HDX metadata fallback (#7589)

* test(conflict): reproduce HDX metadata WAF challenge

Model the empty 202 AWS WAF response that Railway receives when the metadata request uses a fake browser identity. Use the current official HDX resource label in the fixture.

* fix(conflict): identify HDX requests as HAPI client

HDX challenges the shared fake Chrome user agent from Railway egress. Load the existing HAPI application identifier and send it on both bounded HDX requests.

* test(conflict): assert HDX snapshot request identity

Author: koala73

scripts/_conflict-hapi.mjs

@@ -1,7 +1,6 @@
 import Papa from 'papaparse';
 
 import {
-  CHROME_UA,
   loadSharedConfig,
 } from './_seed-utils.mjs';
 
@@ -17,6 +16,8 @@ export const HAPI_HDX_METADATA_TIMEOUT_MS = 60_000;
 export const HAPI_HDX_SNAPSHOT_TIMEOUT_MS = 120_000;
 
 const ISO2_TO_ISO3 = loadSharedConfig('iso2-to-iso3.json');
+const HAPI_APP_IDENTIFIER_CONFIG = loadSharedConfig('hapi-app-identifier.json');
+const HAPI_HDX_USER_AGENT = `${HAPI_APP_IDENTIFIER_CONFIG.application}/1.0`;
 const ISO3_TO_ISO2 = new Map(
   Object.entries(ISO2_TO_ISO3).map(([iso2, iso3]) => [String(iso3).toUpperCase(), iso2]),
 );
@@ -227,7 +228,7 @@ export async function fetchHapiHdxSnapshotRows({
   const requestOptions = (accept, timeoutMs) => ({
     headers: {
       Accept: accept,
-      'User-Agent': CHROME_UA,
+      'User-Agent': HAPI_HDX_USER_AGENT,
     },
     signal: createTimeoutSignal(timeoutMs),
   });

tests/seed-conflict-intel-hapi-circuit-breaker.test.mjs

@@ -43,7 +43,7 @@ function hapiHdxResource(year) {
   return {
     id: `resource-${year}`,
     format: 'CSV',
-    name: `hdx_hapi_conflict_event_global_${year}.csv`,
+    name: `Global Coordination & Context: Conflict Events (${year})`,
     url: `https://data.humdata.org/dataset/example/resource/resource-${year}/download/hdx_hapi_conflict_event_global_${year}.csv`,
   };
 }
@@ -159,6 +159,40 @@ test('HAPI HDX gives snapshot downloads a longer bounded deadline than metadata'
   assert.strictEqual(fetchSignals[1], timeoutSignals[1]);
 });
 
+test('HAPI HDX metadata identity avoids the Railway WAF challenge', async () => {
+  let metadataCalls = 0;
+  const requestUserAgents = [];
+  const csv = hapiCsv(
+    'SDN,,,,,,,,,0,political_violence,12,3,2026-07-01,2026-07-31,dataset,resource,,',
+  );
+  const rows = await fetchHapiHdxSnapshotRows({
+    nowMs: NOW,
+    countryCodes: ['SD'],
+    fetchFn: async (input, options) => {
+      requestUserAgents.push(options.headers['User-Agent']);
+      if (String(input).includes('/api/3/action/package_show')) {
+        metadataCalls += 1;
+        if (options.headers['User-Agent'] !== 'wm-crisis-tracker/1.0') {
+          return new Response('', {
+            status: 202,
+            headers: {
+              'Content-Type': 'text/html',
+              'x-amzn-waf-action': 'challenge',
+            },
+          });
+        }
+        return Response.json(hapiHdxMetadata());
+      }
+      return new Response(csv, { headers: { 'Content-Type': 'text/csv' } });
+    },
+  });
+
+  assert.equal(metadataCalls, 1);
+  assert.deepEqual(requestUserAgents, ['wm-crisis-tracker/1.0', 'wm-crisis-tracker/1.0']);
+  assert.equal(rows.length, 1);
+  assert.equal(rows[0].location_code, 'SDN');
+});
+
 test('HAPI bulk rows are grouped by country and only the latest reference period is published', () => {
   const rows = [
     {