test(08-01): add failing RFC 8414 metadata RED test and fail-closed verifier
- wristband.Server.Metadata is a compiling 501 stub; TestPhase8RedMetadata asserts the exact unwrapped PHP metadata document, headers and status and fails with the PHASE8_RED:metadata sentinel (D-06) - scripts/check-phase8-red.sh implements the shared go/shell RED contract for the rest of Phase 8: exact selected test/package failure plus sentinel, rejecting unrelated fail actions, compile/setup failures, panics, malformed JSON, missing/duplicate sentinels and zero selection (D-04/D-18)
This commit is contained in:
Jakub Zych
222
scripts/check-phase8-red.sh
Executable file
222
scripts/check-phase8-red.sh
Executable file
@@ -0,0 +1,222 @@
|
||||
#!/usr/bin/env bash
|
||||
# Fail-closed Phase 8 RED verifier (08-CONTEXT.md D-04/D-18; 08-01-PLAN.md
|
||||
# Task 1). Every later Phase 8 plan proves its RED test through this script
|
||||
# before implementing the matching GREEN, so its acceptance is intentionally
|
||||
# strict: it must accept exactly one deliberate, exact-sentinel behavior
|
||||
# failure and reject every other failure class (unrelated test/package,
|
||||
# compile/setup failure, panic, malformed output, or zero selection).
|
||||
#
|
||||
# D-01: standard library only. The `go` mode delegates JSON-event evaluation
|
||||
# to a small stdlib-only Go program (D-01 applies to the verifier too, not
|
||||
# just wristband) so this script never depends on jq or another JSON tool.
|
||||
#
|
||||
# Usage:
|
||||
# check-phase8-red.sh go <sentinel> <package> <test> -- <go test -json command...>
|
||||
# check-phase8-red.sh shell <sentinel> <stage> -- <command...>
|
||||
set -euo pipefail
|
||||
|
||||
usage() {
|
||||
cat >&2 <<'EOF'
|
||||
usage:
|
||||
check-phase8-red.sh go <sentinel> <package> <test> -- <go test -json command...>
|
||||
check-phase8-red.sh shell <sentinel> <stage> -- <command...>
|
||||
EOF
|
||||
exit 2
|
||||
}
|
||||
|
||||
refuse() {
|
||||
echo "REFUSE: $*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
[[ $# -ge 1 ]] || usage
|
||||
MODE="$1"
|
||||
shift
|
||||
|
||||
case "$MODE" in
|
||||
go)
|
||||
[[ $# -ge 4 ]] || usage
|
||||
SENTINEL="$1"
|
||||
PKG="$2"
|
||||
TEST="$3"
|
||||
shift 3
|
||||
[[ "${1:-}" == "--" ]] || usage
|
||||
shift
|
||||
[[ $# -ge 1 ]] || usage
|
||||
|
||||
OUT_FILE="$(mktemp)"
|
||||
CHECKER_FILE="$(mktemp --suffix=.go)"
|
||||
cleanup_go() { rm -f "$OUT_FILE" "$CHECKER_FILE"; }
|
||||
trap cleanup_go EXIT
|
||||
|
||||
set +e
|
||||
"$@" >"$OUT_FILE"
|
||||
set -e
|
||||
|
||||
cat >"$CHECKER_FILE" <<'GOEOF'
|
||||
// Command check-phase8-red-checker evaluates one go test -json event stream
|
||||
// against the Phase 8 fail-closed RED contract (08-01-PLAN.md Task 1). It is
|
||||
// intentionally stdlib-only (D-01) and is invoked by check-phase8-red.sh via
|
||||
// `go run`, never built into the module.
|
||||
package main
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
)
|
||||
|
||||
type event struct {
|
||||
Action string `json:"Action"`
|
||||
Package string `json:"Package"`
|
||||
Test string `json:"Test"`
|
||||
Output string `json:"Output"`
|
||||
FailedBuild string `json:"FailedBuild"`
|
||||
}
|
||||
|
||||
func refuse(format string, args ...any) {
|
||||
fmt.Fprintf(os.Stderr, "REFUSE: "+format+"\n", args...)
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
func main() {
|
||||
if len(os.Args) != 5 {
|
||||
refuse("usage: checker <sentinel> <package> <test> <output-file>")
|
||||
}
|
||||
sentinel, pkg, test, outPath := os.Args[1], os.Args[2], os.Args[3], os.Args[4]
|
||||
|
||||
f, err := os.Open(outPath)
|
||||
if err != nil {
|
||||
refuse("cannot open captured output: %v", err)
|
||||
}
|
||||
defer f.Close()
|
||||
|
||||
scanner := bufio.NewScanner(f)
|
||||
scanner.Buffer(make([]byte, 1<<20), 1<<24)
|
||||
|
||||
var (
|
||||
lineCount int
|
||||
selectedRun bool
|
||||
selectedFail bool
|
||||
packageFail bool
|
||||
sentinelCount int
|
||||
)
|
||||
|
||||
for scanner.Scan() {
|
||||
line := strings.TrimSpace(scanner.Text())
|
||||
if line == "" {
|
||||
continue
|
||||
}
|
||||
lineCount++
|
||||
|
||||
var e event
|
||||
if err := json.Unmarshal([]byte(line), &e); err != nil {
|
||||
refuse("malformed JSON event (not go test -json output): %s", line)
|
||||
}
|
||||
|
||||
if strings.Contains(e.Output, "panic:") {
|
||||
refuse("panic detected in test output: %s", strings.TrimSpace(e.Output))
|
||||
}
|
||||
if strings.Contains(e.Output, "[build failed]") || strings.Contains(e.Output, "[setup failed]") {
|
||||
refuse("compile/setup failure detected: %s", strings.TrimSpace(e.Output))
|
||||
}
|
||||
if e.FailedBuild != "" {
|
||||
refuse("build failure detected (FailedBuild=%s)", e.FailedBuild)
|
||||
}
|
||||
if e.Action == "build-fail" {
|
||||
refuse("build failure (build-fail action) for %s", e.Package)
|
||||
}
|
||||
|
||||
sentinelCount += strings.Count(e.Output, sentinel)
|
||||
|
||||
switch e.Action {
|
||||
case "run":
|
||||
if e.Test == test && e.Package == pkg {
|
||||
selectedRun = true
|
||||
}
|
||||
case "fail":
|
||||
switch {
|
||||
case e.Test == test && e.Package == pkg:
|
||||
selectedFail = true
|
||||
case e.Test == "" && e.Package == pkg:
|
||||
packageFail = true
|
||||
default:
|
||||
refuse("unrelated failure: package=%q test=%q", e.Package, e.Test)
|
||||
}
|
||||
}
|
||||
}
|
||||
if err := scanner.Err(); err != nil {
|
||||
refuse("reading captured output: %v", err)
|
||||
}
|
||||
|
||||
if lineCount == 0 {
|
||||
refuse("no JSON events observed (empty or non -json output)")
|
||||
}
|
||||
if !selectedRun {
|
||||
refuse("selected test %q in package %q never ran (zero selection or build/setup failure)", test, pkg)
|
||||
}
|
||||
if !selectedFail {
|
||||
refuse("selected test %q in package %q did not fail", test, pkg)
|
||||
}
|
||||
if !packageFail {
|
||||
refuse("package %q did not report a package-level failure", pkg)
|
||||
}
|
||||
if sentinelCount == 0 {
|
||||
refuse("sentinel %q was not observed in test output", sentinel)
|
||||
}
|
||||
if sentinelCount > 1 {
|
||||
refuse("sentinel %q observed %d times, expected exactly 1", sentinel, sentinelCount)
|
||||
}
|
||||
|
||||
fmt.Printf("PHASE8_RED_OK:%s\n", sentinel)
|
||||
}
|
||||
GOEOF
|
||||
|
||||
go run "$CHECKER_FILE" "$SENTINEL" "$PKG" "$TEST" "$OUT_FILE"
|
||||
;;
|
||||
|
||||
shell)
|
||||
[[ $# -ge 2 ]] || usage
|
||||
SENTINEL="$1"
|
||||
STAGE="$2"
|
||||
shift 2
|
||||
[[ "${1:-}" == "--" ]] || usage
|
||||
shift
|
||||
[[ $# -ge 1 ]] || usage
|
||||
|
||||
set +e
|
||||
OUT="$("$@" 2>&1)"
|
||||
STATUS=$?
|
||||
set -e
|
||||
|
||||
if [[ "$STATUS" -ne 86 ]]; then
|
||||
refuse "expected exit 86, got $STATUS"
|
||||
fi
|
||||
|
||||
EXPECTED_LINE="PHASE8_STAGE:${STAGE}:FAIL:${SENTINEL}"
|
||||
STAGE_LINE_COUNT=0
|
||||
MATCH_COUNT=0
|
||||
while IFS= read -r line; do
|
||||
[[ "$line" == PHASE8_STAGE:* ]] || continue
|
||||
STAGE_LINE_COUNT=$((STAGE_LINE_COUNT + 1))
|
||||
if [[ "$line" == "$EXPECTED_LINE" ]]; then
|
||||
MATCH_COUNT=$((MATCH_COUNT + 1))
|
||||
fi
|
||||
done <<<"$OUT"
|
||||
|
||||
if [[ "$MATCH_COUNT" -ne 1 ]]; then
|
||||
refuse "expected exactly one line '$EXPECTED_LINE', found $MATCH_COUNT"
|
||||
fi
|
||||
if [[ "$STAGE_LINE_COUNT" -ne 1 ]]; then
|
||||
refuse "unexpected additional PHASE8_STAGE lines (found $STAGE_LINE_COUNT total)"
|
||||
fi
|
||||
|
||||
echo "PHASE8_RED_OK:${SENTINEL}"
|
||||
;;
|
||||
|
||||
*)
|
||||
usage
|
||||
;;
|
||||
esac
|
||||
72
wristband/server.go
Normal file
72
wristband/server.go
Normal file
@@ -0,0 +1,72 @@
|
||||
// Package wristband implements the app-agnostic RFC 8414 / OAuth
|
||||
// authorization-server surface ported from Płytarium's hand-rolled PHP OAuth
|
||||
// server (08-CONTEXT.md D-05). It never imports an application package, a
|
||||
// GORM type, or any fonoteka model: every deployment-specific value (issuer,
|
||||
// scopes, endpoint paths, TTLs) arrives through Options, and every app-owned
|
||||
// concern (users, collections, persistence) stays out of this package.
|
||||
//
|
||||
// D-06: PHP's RFC-minimal response shapes are wristband's defaults. There
|
||||
// are no response hooks; callers cannot alter the wire bytes beyond the
|
||||
// values exposed on Options.
|
||||
package wristband
|
||||
|
||||
import "net/http"
|
||||
|
||||
// Options configures a Server's advertised endpoints and metadata values.
|
||||
// Every field has a PHP-parity default via DefaultOptions except Issuer,
|
||||
// which the caller must set from app.url with its trailing slash trimmed
|
||||
// exactly once (D-03). wristband never hardcodes an app's issuer.
|
||||
type Options struct {
|
||||
// Issuer is app.url with exactly one trailing slash trimmed by the
|
||||
// caller. Every metadata endpoint URL is built by appending a fixed
|
||||
// RFC path suffix to Issuer.
|
||||
Issuer string
|
||||
|
||||
// ServiceDocumentationPath is appended to Issuer for the metadata
|
||||
// service_documentation field. PHP default: "/help".
|
||||
ServiceDocumentationPath string
|
||||
|
||||
// ScopesSupported is the RFC 8414 scopes_supported list. PHP default:
|
||||
// ["read","write","ai","offline_access"].
|
||||
ScopesSupported []string
|
||||
|
||||
// TokenEndpointAuthMethodsSupported is the RFC 8414
|
||||
// token_endpoint_auth_methods_supported list. PHP default:
|
||||
// ["none","client_secret_post","client_secret_basic"].
|
||||
TokenEndpointAuthMethodsSupported []string
|
||||
|
||||
// AuthorizationResponseIssParameterSupported is the RFC 9207 metadata
|
||||
// capability flag. PHP default: true.
|
||||
AuthorizationResponseIssParameterSupported bool
|
||||
}
|
||||
|
||||
// DefaultOptions returns PHP-parity defaults for every metadata option
|
||||
// other than Issuer, which the caller must set from app.url.
|
||||
func DefaultOptions() Options {
|
||||
return Options{
|
||||
ServiceDocumentationPath: "/help",
|
||||
ScopesSupported: []string{"read", "write", "ai", "offline_access"},
|
||||
TokenEndpointAuthMethodsSupported: []string{"none", "client_secret_post", "client_secret_basic"},
|
||||
AuthorizationResponseIssParameterSupported: true,
|
||||
}
|
||||
}
|
||||
|
||||
// Server is the app-agnostic wristband authorization-server surface. It is
|
||||
// constructed with Options and never imports an application package.
|
||||
type Server struct {
|
||||
opts Options
|
||||
}
|
||||
|
||||
// NewServer constructs a Server from Options.
|
||||
func NewServer(opts Options) *Server {
|
||||
return &Server{opts: opts}
|
||||
}
|
||||
|
||||
// Metadata handles GET /.well-known/oauth-authorization-server, writing the
|
||||
// exact unwrapped RFC 8414 document (D-06).
|
||||
//
|
||||
// TODO(08-01 Task 2): wire the exact writer and PHP-parity document; this
|
||||
// stub intentionally does not yet satisfy TestPhase8RedMetadata.
|
||||
func (s *Server) Metadata(w http.ResponseWriter, r *http.Request) {
|
||||
w.WriteHeader(http.StatusNotImplemented)
|
||||
}
|
||||
39
wristband/server_test.go
Normal file
39
wristband/server_test.go
Normal file
@@ -0,0 +1,39 @@
|
||||
package wristband
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// TestPhase8RedMetadata is the Phase 8 Wave 1 RED anchor (08-CONTEXT.md
|
||||
// D-06). It asserts the exact unwrapped RFC 8414 metadata document recorded
|
||||
// from the live PHP fixture (parity/fixtures/routes/GET__.well-known_oauth-authorization-server_oauth.yaml)
|
||||
// and fails with the PHASE8_RED:metadata sentinel while Server.Metadata is a
|
||||
// stub. scripts/check-phase8-red.sh verifies this failure is fail-closed.
|
||||
func TestPhase8RedMetadata(t *testing.T) {
|
||||
opts := DefaultOptions()
|
||||
opts.Issuer = "https://plytarium.com"
|
||||
srv := NewServer(opts)
|
||||
|
||||
req := httptest.NewRequest(http.MethodGet, "/.well-known/oauth-authorization-server", nil)
|
||||
req.Header.Set("Accept", "application/json")
|
||||
rec := httptest.NewRecorder()
|
||||
srv.Metadata(rec, req)
|
||||
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("PHASE8_RED:metadata: status = %d, want %d", rec.Code, http.StatusOK)
|
||||
}
|
||||
|
||||
const want = `{"issuer":"https://plytarium.com","authorization_endpoint":"https://plytarium.com/oauth/mcp/authorize","token_endpoint":"https://plytarium.com/oauth/mcp/token","registration_endpoint":"https://plytarium.com/oauth/mcp/register","response_types_supported":["code"],"grant_types_supported":["authorization_code","refresh_token"],"code_challenge_methods_supported":["S256"],"token_endpoint_auth_methods_supported":["none","client_secret_post","client_secret_basic"],"scopes_supported":["read","write","ai","offline_access"],"service_documentation":"https://plytarium.com/help","authorization_response_iss_parameter_supported":true}`
|
||||
|
||||
if got := rec.Body.String(); got != want {
|
||||
t.Fatalf("PHASE8_RED:metadata: body mismatch\n got: %s\nwant: %s", got, want)
|
||||
}
|
||||
if ct := rec.Header().Get("Content-Type"); ct != "application/json" {
|
||||
t.Fatalf("PHASE8_RED:metadata: Content-Type = %q, want application/json", ct)
|
||||
}
|
||||
if cc := rec.Header().Get("Cache-Control"); cc != "no-cache, private" {
|
||||
t.Fatalf("PHASE8_RED:metadata: Cache-Control = %q, want \"no-cache, private\"", cc)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user