Jakub Zych
9b811f6042
Add scripts/check-phase16.3.sh with fail-closed go/admin/docs/postgres stages, detector self-tests and NOT RUN postgres without Docker. Co-authored-by: Cursor <cursoragent@cursor.com>
379 lines
17 KiB
Bash
Executable File
379 lines
17 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# Phase 16.3 fail-closed gate: personal API tokens with scopes (summercms.go
|
||
# bouncer/party/lagoon/cabana + admin SPA) and the Journal token matrix
|
||
# (sm-journal-plugin).
|
||
#
|
||
# Stages:
|
||
# go go vet in both Go repositories; the Docker-free framework and
|
||
# Journal token suites by required name (Journal root with -short).
|
||
# admin the admin SPA typecheck and full vitest suite with required
|
||
# account token case names.
|
||
# docs TestDocsTree, summer docs:build --check, check-admin-openapi.sh
|
||
# --check, check-admin-dist.sh.
|
||
# postgres Docker host only: lagoon migration, cabana account/CLI/guard and
|
||
# OpenAPI conformance, Journal token matrix. Without a reachable
|
||
# Docker daemon this stage fails.
|
||
#
|
||
# Every stage exits non-zero on a failing command; a go test -json run that
|
||
# fails, skips, matches zero tests, prints "no tests to run" or misses a named
|
||
# required test; a vitest JSON report with a failed, skipped or todo test, a
|
||
# failed file, no passing test or a missing required file or test. --self-test
|
||
# proves the detectors fail on planted output.
|
||
#
|
||
# --all runs self-test, go, admin and docs, then postgres when a Docker daemon
|
||
# answers. When none does, --all says so loudly (NOT RUN postgres) and the
|
||
# Docker suites stay a manual step for a Docker host:
|
||
# bash scripts/check-phase16.3.sh postgres
|
||
# Set PHASE163_REQUIRE_POSTGRES=1 to make --all fail instead.
|
||
#
|
||
# Environment overrides: PHASE163_ROOT (this repository), JOURNAL (default
|
||
# ../sm-journal-plugin).
|
||
set -euo pipefail
|
||
|
||
unset FORCE_COLOR
|
||
export NO_COLOR=1
|
||
|
||
ROOT="${PHASE163_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
|
||
JOURNAL="${JOURNAL:-$ROOT/../sm-journal-plugin}"
|
||
|
||
# Framework Docker-free tests that must pass by name.
|
||
FRAMEWORK_RUN='^(TestPrincipalScopeNotSerialized)$'
|
||
FRAMEWORK_REQUIRE=(TestPrincipalScopeNotSerialized)
|
||
CABANA_RUN='^(TestScopeMatch|TestAllowsScope|TestTokenScopeCompile|TestScopeOverlap|TestScopeCoversAll|TestAPITokenMint|TestParseTokenExpiry|TestValidateTokenRequest|TestBackendTokenGuard|TestTokenLastUsedDebounce|TestResolveBackend|TestTokenRouteGates|TestInteractiveOnly|TestTokenCommandsRegistered|TestTokenTracerSmoke|TestTokenGatesSmoke)$'
|
||
CABANA_REQUIRE=(
|
||
TestScopeMatch TestAllowsScope TestTokenScopeCompile TestScopeOverlap TestScopeCoversAll
|
||
TestAPITokenMint TestParseTokenExpiry TestValidateTokenRequest
|
||
TestBackendTokenGuard TestTokenLastUsedDebounce TestResolveBackend
|
||
TestTokenRouteGates TestInteractiveOnly TestTokenCommandsRegistered
|
||
TestTokenTracerSmoke TestTokenGatesSmoke
|
||
)
|
||
CMD_RUN='^(TestDocsTree)$'
|
||
CMD_REQUIRE=(TestDocsTree)
|
||
JOURNAL_SHORT_RUN='^(TestJournalTokenScopes)$'
|
||
JOURNAL_SHORT_REQUIRE=(TestJournalTokenScopes)
|
||
|
||
# Docker-host suites.
|
||
PG_LAGOON_RUN='^(TestBackendAPITokensMigration|TestBackendAdminMetadataColumn|TestPhase09MigrationsFreshRollback)$'
|
||
PG_LAGOON_REQUIRE=(TestBackendAPITokensMigration TestBackendAdminMetadataColumn TestPhase09MigrationsFreshRollback)
|
||
PG_CABANA_RUN='^(TestAccountTokens|TestTokenCommands|TestBackendTokenPostgres|TestPhase10OpenAPIConformance)$'
|
||
PG_CABANA_REQUIRE=(TestAccountTokens TestTokenCommands TestBackendTokenPostgres TestPhase10OpenAPIConformance)
|
||
PG_JOURNAL_RUN='^(TestJournalTokens|TestJournalTokenTracer|TestJournalTokenExpansion)$'
|
||
PG_JOURNAL_REQUIRE=(TestJournalTokens TestJournalTokenTracer TestJournalTokenExpansion)
|
||
|
||
ADMIN_FILES=(
|
||
tests/account/ApiTokensPanel.test.ts
|
||
tests/account/ApiTokenCreateDialog.test.ts
|
||
)
|
||
ADMIN_REQUIRE=(
|
||
"ApiTokensPanel tracer: list, create, show once, hide"
|
||
"ApiTokensPanel list states shows skeleton then the empty block"
|
||
"ApiTokensPanel list states shows the alert and hides the toggle when the load fails"
|
||
"ApiTokensPanel row anatomy renders name, hint aria-label, chips and meta line order"
|
||
"ApiTokensPanel revoke runs DELETE through the shared confirm and toasts success"
|
||
"ApiTokenCreateDialog plaintext lifetime clears plaintext from the DOM and toasts after Done (hide)"
|
||
"ApiTokenCreateDialog plaintext lifetime clears plaintext after Esc-confirm close and reopening starts at step 1"
|
||
"ApiTokenCreateDialog plaintext lifetime copy success announces; clipboard failure selects and alerts"
|
||
"ApiTokenCreateDialog plaintext lifetime Esc before copying asks and cancel keeps step 2"
|
||
"ApiTokenCreateDialog step 1 focuses the name input on open"
|
||
"ApiTokenCreateDialog step 1 star checked disables others; unchecking restores without picks; no preselection"
|
||
"ApiTokenCreateDialog step 1 busy disables fieldset, buttons, Esc and overlay and ignores a second submit"
|
||
"ApiTokenCreateDialog step 2 copy success flashes for two seconds and announces politely"
|
||
"ApiTokenCreateDialog step 2 focuses Copy token when entering step 2"
|
||
)
|
||
|
||
usage() {
|
||
cat >&2 <<'EOF'
|
||
usage:
|
||
check-phase16.3.sh --self-test
|
||
check-phase16.3.sh go | admin | docs | postgres
|
||
check-phase16.3.sh --go | --admin | --docs | --postgres
|
||
check-phase16.3.sh --all
|
||
EOF
|
||
exit 2
|
||
}
|
||
|
||
# detect_go reads go test -json. Exit 1 fail/build, 2 skip, 3 zero/no-tests,
|
||
# 4 non-JSON, 5 missing required name.
|
||
detect_go() {
|
||
python3 - "$1" <<'PY'
|
||
import json, os, sys
|
||
path = sys.argv[1]
|
||
require = [n for n in os.environ.get("REQUIRE_TESTS", "").split() if n]
|
||
passed = set()
|
||
failed = []
|
||
with open(path, encoding="utf-8", errors="replace") as fh:
|
||
for raw in fh:
|
||
line = raw.strip()
|
||
if not line.startswith("{"):
|
||
continue
|
||
try:
|
||
ev = json.loads(line)
|
||
except json.JSONDecodeError:
|
||
print("refuse: non-json test output", file=sys.stderr)
|
||
sys.exit(4)
|
||
action = ev.get("Action")
|
||
test = ev.get("Test") or ""
|
||
pkg = ev.get("Package") or ev.get("ImportPath") or ""
|
||
if action == "build-fail" or (action == "fail" and ev.get("FailedBuild")):
|
||
print(f"refuse: build failed {pkg}", file=sys.stderr)
|
||
sys.exit(1)
|
||
text = ev.get("Output") or ""
|
||
if action == "output" and "no tests to run" in text:
|
||
print(f"refuse: no tests to run in {pkg}", file=sys.stderr)
|
||
sys.exit(3)
|
||
if action == "skip" and test:
|
||
print(f"refuse: skipped {pkg} {test}", file=sys.stderr)
|
||
sys.exit(2)
|
||
if action == "fail":
|
||
failed.append(f"{pkg} {test}".strip())
|
||
if action == "pass" and test:
|
||
passed.add(test)
|
||
if failed:
|
||
print("refuse: failed " + ", ".join(failed), file=sys.stderr)
|
||
sys.exit(1)
|
||
if not passed:
|
||
print("refuse: zero tests", file=sys.stderr)
|
||
sys.exit(3)
|
||
missing = [n for n in require if n not in passed]
|
||
if missing:
|
||
print("refuse: required tests did not pass: " + ", ".join(missing), file=sys.stderr)
|
||
sys.exit(5)
|
||
PY
|
||
}
|
||
|
||
# detect_vitest reads a vitest --reporter=json report. Exit 1 a failed test
|
||
# or file or an unsuccessful run, 2 a skipped or todo test, 3 no passing
|
||
# test, 4 an unreadable report, 5 a missing required file or test.
|
||
detect_vitest() {
|
||
python3 - "$1" <<'PY'
|
||
import json, os, sys
|
||
path = sys.argv[1]
|
||
files = [n for n in os.environ.get("REQUIRE_FILES", "").split("\n") if n.strip()]
|
||
names = [n for n in os.environ.get("REQUIRE_NAMES", "").split("\n") if n.strip()]
|
||
try:
|
||
with open(path, encoding="utf-8") as fh:
|
||
report = json.load(fh)
|
||
except (OSError, ValueError) as err:
|
||
print(f"refuse: unreadable vitest report: {err}", file=sys.stderr)
|
||
sys.exit(4)
|
||
results = report.get("testResults") or []
|
||
bad = [r.get("name", "?") for r in results if r.get("status") != "passed"]
|
||
if bad or report.get("numFailedTests", 0) or report.get("numFailedTestSuites", 0) or report.get("success") is not True:
|
||
print("refuse: failed " + ", ".join(bad or ["run"]), file=sys.stderr)
|
||
sys.exit(1)
|
||
if report.get("numPendingTests", 0) or report.get("numTodoTests", 0):
|
||
print(f"refuse: {report.get('numPendingTests', 0)} skipped, {report.get('numTodoTests', 0)} todo", file=sys.stderr)
|
||
sys.exit(2)
|
||
passed = set()
|
||
by_file = {}
|
||
for r in results:
|
||
for a in r.get("assertionResults") or []:
|
||
status = a.get("status")
|
||
if status != "passed":
|
||
print(f"refuse: {status} {a.get('fullName')}", file=sys.stderr)
|
||
sys.exit(2 if status in ("skipped", "pending", "todo") else 1)
|
||
passed.add(a.get("fullName", ""))
|
||
by_file[r.get("name", "")] = by_file.get(r.get("name", ""), 0) + 1
|
||
if report.get("numPassedTests", 0) < 1 or not passed:
|
||
print("refuse: no passing tests", file=sys.stderr)
|
||
sys.exit(3)
|
||
missing = [f for f in files if not any(name.endswith("/" + f) and count > 0 for name, count in by_file.items())]
|
||
missing += [n for n in names if n not in passed]
|
||
if missing:
|
||
print("refuse: required files or tests did not pass: " + "; ".join(missing), file=sys.stderr)
|
||
sys.exit(5)
|
||
print(f"vitest: {report.get('numPassedTests')} passed in {len(results)} files")
|
||
PY
|
||
}
|
||
|
||
go_json() {
|
||
local dir="$1"
|
||
shift
|
||
local log err rc=0 dc=0
|
||
log="$(mktemp)"
|
||
err="$(mktemp)"
|
||
(cd "$dir" && go test -json "$@") >"$log" 2>"$err" || rc=$?
|
||
detect_go "$log" || dc=$?
|
||
if [[ "$rc" -ne 0 || "$dc" -ne 0 ]]; then
|
||
cat "$err" >&2 || true
|
||
grep -v '^{' "$log" | tail -n 40 >&2 || true
|
||
python3 -c 'import json,sys
|
||
for raw in open(sys.argv[1], errors="replace"):
|
||
try: ev = json.loads(raw)
|
||
except ValueError: continue
|
||
if ev.get("Action") == "output" and ("FAIL" in ev.get("Output", "") or "_test.go:" in ev.get("Output", "")):
|
||
sys.stderr.write(ev["Output"])' "$log" 2>&1 | tail -n 40 >&2 || true
|
||
rm -f "$log" "$err"
|
||
echo "refuse: go test $* in $dir (test=$rc detect=$dc)" >&2
|
||
return 1
|
||
fi
|
||
echo "go: $(grep -c '"Action":"pass","Package":"[^"]*","Test":"[^"/]*","Elapsed"' "$log") top-level tests passed in $dir ($*)"
|
||
rm -f "$log" "$err"
|
||
}
|
||
|
||
vitest_json() {
|
||
local dir="$1" report out rc=0 dc=0
|
||
report="$(mktemp)"
|
||
out="$(mktemp)"
|
||
(cd "$dir" && ./node_modules/.bin/vitest run --reporter=json --outputFile="$report") >"$out" 2>&1 || rc=$?
|
||
detect_vitest "$report" || dc=$?
|
||
if [[ "$rc" -ne 0 || "$dc" -ne 0 ]]; then
|
||
grep -E 'FAIL|Error|×' "$out" | tail -n 40 >&2 || true
|
||
rm -f "$report" "$out"
|
||
echo "refuse: vitest in $dir (test=$rc detect=$dc)" >&2
|
||
return 1
|
||
fi
|
||
rm -f "$report" "$out"
|
||
}
|
||
|
||
expect_detector() {
|
||
local detector="$1" name="$2" want="$3" payload="$4" log dc=0
|
||
log="$(mktemp)"
|
||
printf '%s\n' "$payload" >"$log"
|
||
"$detector" "$log" >/dev/null 2>&1 || dc=$?
|
||
rm -f "$log"
|
||
if [[ "$dc" -ne "$want" ]]; then
|
||
echo "refuse: self-test $detector $name: exit $dc, want $want" >&2
|
||
return 1
|
||
fi
|
||
}
|
||
|
||
run_self_test() {
|
||
bash -n "${BASH_SOURCE[0]}"
|
||
|
||
expect_detector detect_go pass 0 '{"Action":"pass","Package":"p","Test":"TestScopeMatch"}'
|
||
expect_detector detect_go fail 1 '{"Action":"pass","Package":"p","Test":"TestA"}
|
||
{"Action":"fail","Package":"p","Test":"TestBackendTokenGuard"}'
|
||
expect_detector detect_go package-fail 1 '{"Action":"pass","Package":"p","Test":"TestA"}
|
||
{"Action":"fail","Package":"p"}'
|
||
expect_detector detect_go build 1 '{"Action":"build-fail","ImportPath":"p"}'
|
||
expect_detector detect_go skip 2 '{"Action":"pass","Package":"p","Test":"TestA"}
|
||
{"Action":"skip","Package":"p","Test":"TestAccountTokens"}'
|
||
expect_detector detect_go zero 3 '{"Action":"pass","Package":"p"}'
|
||
expect_detector detect_go no-tests 3 '{"Action":"output","Package":"p","Output":"testing: warning: no tests to run\n"}
|
||
{"Action":"pass","Package":"p"}'
|
||
expect_detector detect_go nonjson 4 '{"Action":"pass",'
|
||
REQUIRE_TESTS="TestScopeMatch TestJournalTokens" expect_detector detect_go missing-named 5 \
|
||
'{"Action":"pass","Package":"p","Test":"TestScopeMatch"}'
|
||
REQUIRE_TESTS="TestScope" expect_detector detect_go prefix-is-not-the-test 5 \
|
||
'{"Action":"pass","Package":"p","Test":"TestScopeMatch"}'
|
||
|
||
local vok='{"success":true,"numPassedTests":2,"numFailedTests":0,"numFailedTestSuites":0,"numPendingTests":0,"numTodoTests":0,"testResults":[{"name":"/r/tests/account/ApiTokensPanel.test.ts","status":"passed","assertionResults":[{"fullName":"ApiTokensPanel tracer: list, create, show once, hide","status":"passed"},{"fullName":"ApiTokenCreateDialog plaintext lifetime clears plaintext from the DOM and toasts after Done (hide)","status":"passed"}]}]}'
|
||
expect_detector detect_vitest pass 0 "$vok"
|
||
REQUIRE_FILES='tests/account/ApiTokensPanel.test.ts' REQUIRE_NAMES='ApiTokensPanel tracer: list, create, show once, hide' expect_detector detect_vitest named 0 "$vok"
|
||
expect_detector detect_vitest failed-test 1 '{"success":false,"numPassedTests":1,"numFailedTests":1,"testResults":[{"name":"/r/a.test.ts","status":"failed","assertionResults":[{"fullName":"x","status":"failed"}]}]}'
|
||
expect_detector detect_vitest failed-file 1 '{"success":false,"numPassedTests":0,"numFailedTests":0,"numFailedTestSuites":1,"testResults":[{"name":"/r/a.test.ts","status":"failed","assertionResults":[]}]}'
|
||
expect_detector detect_vitest unsuccessful 1 '{"success":false,"numPassedTests":1,"numFailedTests":0,"testResults":[{"name":"/r/a.test.ts","status":"passed","assertionResults":[{"fullName":"x","status":"passed"}]}]}'
|
||
expect_detector detect_vitest skipped 2 '{"success":true,"numPassedTests":1,"numPendingTests":1,"testResults":[{"name":"/r/a.test.ts","status":"passed","assertionResults":[{"fullName":"x","status":"passed"},{"fullName":"y","status":"skipped"}]}]}'
|
||
expect_detector detect_vitest todo 2 '{"success":true,"numPassedTests":1,"numTodoTests":1,"testResults":[{"name":"/r/a.test.ts","status":"passed","assertionResults":[{"fullName":"x","status":"passed"}]}]}'
|
||
expect_detector detect_vitest zero 3 '{"success":true,"numPassedTests":0,"testResults":[]}'
|
||
expect_detector detect_vitest unreadable 4 'not json'
|
||
REQUIRE_FILES='tests/account/ApiTokenCreateDialog.test.ts' expect_detector detect_vitest missing-file 5 "$vok"
|
||
REQUIRE_NAMES='missing case' expect_detector detect_vitest missing-name 5 "$vok"
|
||
|
||
local mode
|
||
for mode in self-test go admin docs postgres all; do
|
||
grep -q -- "^ --$mode" "${BASH_SOURCE[0]}" || {
|
||
echo "refuse: missing mode --$mode" >&2
|
||
return 1
|
||
}
|
||
done
|
||
echo "phase16.3 self-test passed"
|
||
}
|
||
|
||
require_dir() {
|
||
[[ -d "$1" ]] || {
|
||
echo "refuse: $2 $1 not found" >&2
|
||
return 1
|
||
}
|
||
}
|
||
|
||
run_go() {
|
||
require_dir "$JOURNAL" "Journal plugin"
|
||
(cd "$ROOT" && go vet ./modules/bouncer ./modules/party ./modules/lagoon ./modules/cabana ./cmd/summer)
|
||
REQUIRE_TESTS="${FRAMEWORK_REQUIRE[*]}" go_json "$ROOT" -count=1 -run "$FRAMEWORK_RUN" ./modules/bouncer
|
||
REQUIRE_TESTS= go_json "$ROOT" -count=1 ./modules/party
|
||
REQUIRE_TESTS="${CABANA_REQUIRE[*]}" go_json "$ROOT" -count=1 -run "$CABANA_RUN" ./modules/cabana
|
||
REQUIRE_TESTS="${CMD_REQUIRE[*]}" go_json "$ROOT" -count=1 -run "$CMD_RUN" ./cmd/summer
|
||
go -C "$JOURNAL" vet ./...
|
||
REQUIRE_TESTS="${JOURNAL_SHORT_REQUIRE[*]}" go_json "$JOURNAL" -short -count=1 -run "$JOURNAL_SHORT_RUN" .
|
||
echo "phase16.3 go passed"
|
||
}
|
||
|
||
run_admin() {
|
||
(cd "$ROOT/admin" && ./node_modules/.bin/vue-tsc --noEmit)
|
||
REQUIRE_FILES="$(printf '%s\n' "${ADMIN_FILES[@]}")" REQUIRE_NAMES="$(printf '%s\n' "${ADMIN_REQUIRE[@]}")" vitest_json "$ROOT/admin"
|
||
echo "phase16.3 admin passed"
|
||
}
|
||
|
||
run_docs() {
|
||
REQUIRE_TESTS="TestDocsTree" go_json "$ROOT" -count=1 -run '^TestDocsTree$' ./cmd/summer
|
||
(cd "$ROOT" && go run ./cmd/summer docs:build --check)
|
||
bash "$ROOT/scripts/check-admin-openapi.sh" --check
|
||
bash "$ROOT/scripts/check-admin-dist.sh"
|
||
echo "phase16.3 docs passed"
|
||
}
|
||
|
||
docker_up() {
|
||
command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1
|
||
}
|
||
|
||
run_postgres() {
|
||
require_dir "$JOURNAL" "Journal plugin"
|
||
if ! docker_up; then
|
||
echo "refuse: the postgres stage needs a reachable Docker daemon (testcontainers); run it on a Docker host" >&2
|
||
return 1
|
||
fi
|
||
REQUIRE_TESTS="${PG_LAGOON_REQUIRE[*]}" go_json "$ROOT" -count=1 -timeout 15m -run "$PG_LAGOON_RUN" ./modules/lagoon
|
||
REQUIRE_TESTS="${PG_CABANA_REQUIRE[*]}" go_json "$ROOT" -count=1 -timeout 15m -run "$PG_CABANA_RUN" ./modules/cabana
|
||
REQUIRE_TESTS="${PG_JOURNAL_REQUIRE[*]}" go_json "$JOURNAL" -count=1 -timeout 20m -run "$PG_JOURNAL_RUN" .
|
||
echo "phase16.3 postgres passed"
|
||
}
|
||
|
||
run_all() {
|
||
local stage
|
||
for stage in self-test go admin docs; do
|
||
if bash "${BASH_SOURCE[0]}" "--$stage"; then
|
||
echo "PASS $stage"
|
||
else
|
||
echo "FAIL $stage"
|
||
exit 1
|
||
fi
|
||
done
|
||
if docker_up; then
|
||
if bash "${BASH_SOURCE[0]}" --postgres; then
|
||
echo "PASS postgres"
|
||
else
|
||
echo "FAIL postgres"
|
||
exit 1
|
||
fi
|
||
elif [[ "${PHASE163_REQUIRE_POSTGRES:-0}" == "1" ]]; then
|
||
echo "FAIL postgres: no reachable Docker daemon and PHASE163_REQUIRE_POSTGRES=1"
|
||
exit 1
|
||
else
|
||
cat >&2 <<'EOF'
|
||
************************************************************************
|
||
NOT RUN postgres: no reachable Docker daemon on this host.
|
||
The testcontainers suites (TestBackendAPITokensMigration,
|
||
TestAccountTokens, TestTokenCommands, TestBackendTokenPostgres,
|
||
TestPhase10OpenAPIConformance, TestJournalTokens, TestJournalTokenTracer,
|
||
TestJournalTokenExpansion) did NOT run.
|
||
Run on a Docker host before /msd-verify-work:
|
||
bash scripts/check-phase16.3.sh postgres
|
||
************************************************************************
|
||
EOF
|
||
echo "NOT RUN postgres (Docker-host only; see the notice above)"
|
||
fi
|
||
echo "Phase 16.3 gate passed"
|
||
}
|
||
|
||
case "${1:---all}" in
|
||
--self-test | self-test) run_self_test ;;
|
||
--go | go) run_go ;;
|
||
--admin | admin) run_admin ;;
|
||
--docs | docs) run_docs ;;
|
||
--postgres | postgres) run_postgres ;;
|
||
--all | all) run_all ;;
|
||
*) usage ;;
|
||
esac
|