Jakub Zych
dd167466d2
- PHP protocol cases, one subtest per PHP method: TestPKCEVerifier, TestRedirectURIMatch, TestTokenIssuer, TestAuthCodeLifecycle, TestPKCEAndReplay, TestConsentCSRF (cases 1-5) - Go-only behaviour: discovery bytes, JWKS shapes, PEM parsing, ES256 and mixed rings, validation order, repeated parameters, PHP encoding, resume, switch account, JSON consent, client authentication, uniform userinfo 401, pairwise subjects, opt-in refresh, kind isolation, flavour dispatch, SetOIDCBackend checks, MCP refuses openid - every name required by the gate's go stage
620 lines
26 KiB
Bash
Executable File
620 lines
26 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# check-phase19.4: fail-closed gate for Phase 19.4, the OpenID Connect
|
|
# provider on wristband. It proves the phase across four repositories:
|
|
# this framework (wristband's OIDC flavour and its MCP flavour unchanged,
|
|
# tide's form capture, the docs), the shared OAuth server plugin, the shared
|
|
# user plugin (its additive exports) and the application that runs the MCP
|
|
# flavour (its OAuth suites, unchanged behaviour).
|
|
#
|
|
# Stages:
|
|
# go go vet ./... and go test -short ./... here, then the
|
|
# Docker-free wristband and tide suites by required name.
|
|
# plugin go vet ./... and go test -short ./... in the OAuth server
|
|
# plugin, then its Docker-free suites by required name.
|
|
# userplugin go vet and go test -short of the user plugin (through the
|
|
# application workspace), its Docker-free suites by required
|
|
# name, and the additive check: since the user plugin's last
|
|
# commit before the phase, no line declaring an exported func,
|
|
# method or type was removed from a non-test .go file.
|
|
# fonoteka the application's MCP flavour (D-09): go vet of the app and
|
|
# its domain plugin, go test -short of the domain plugin and
|
|
# its Docker-free OAuth suites by required name.
|
|
# docker Docker host only: the testcontainers (Postgres) suites by
|
|
# required name in the OAuth server plugin, the user plugin and
|
|
# the application's OAuth suites. The application's unrelated
|
|
# admin route allowlist test is not part of this phase and is
|
|
# not run here (deferred-items.md).
|
|
# parity the PHP parity replay (D-14): with recorded flows it runs
|
|
# TestPHPParityReplay and TestIDTokenShapeParity with
|
|
# PHASE194_REQUIRE_PARITY=1 (Docker host); without recordings
|
|
# it prints NOT RUN parity (D-14 unproven) and passes unless
|
|
# PHASE194_REQUIRE_PARITY=1. By the D-14 amendment of
|
|
# 2026-10-19 the recording is deferred to the cutover of the
|
|
# PHP reference site, so NOT RUN does not hold the verdict.
|
|
# docs the decision note's dependency names, TestDocsTree,
|
|
# summer docs:build --check, and no wristband source, OAuth
|
|
# server docs page or plugin file naming a consuming
|
|
# application.
|
|
#
|
|
# A stage exits non-zero on a failing command, or on a go test -json run that
|
|
# fails, skips a test (a subtest included), matches zero tests, prints "no
|
|
# tests to run" or misses a required name (a subtest pass never counts for
|
|
# its parent's name). --self-test proves the detectors on planted output and
|
|
# the docker and parity NOT RUN rules on a faked host.
|
|
#
|
|
# --all runs self-test, go, plugin, userplugin, fonoteka and docs, then
|
|
# docker when a Docker daemon answers (NOT RUN docker otherwise, a failure
|
|
# with PHASE194_REQUIRE_DOCKER=1), then parity (NOT RUN parity without
|
|
# recordings, a failure with PHASE194_REQUIRE_PARITY=1).
|
|
#
|
|
# Environment overrides (default: the sibling checkouts next to this
|
|
# repository): PHASE194_ROOT (this repository), OAUTHSERVER_PLUGIN,
|
|
# USER_PLUGIN, FONOTEKA (the application workspace), PHASE194_USER_BASE
|
|
# (the user plugin commit the additive check compares against).
|
|
set -euo pipefail
|
|
|
|
unset FORCE_COLOR
|
|
export NO_COLOR=1
|
|
|
|
ROOT="${PHASE194_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
|
|
OAUTHSERVER_PLUGIN="${OAUTHSERVER_PLUGIN:-$ROOT/../sm-oauthserver-plugin}"
|
|
FONOTEKA="${FONOTEKA:-$ROOT/../fono""teka.go}"
|
|
USER_PLUGIN="${USER_PLUGIN:-$FONOTEKA/plugins/golem15/user}"
|
|
# The user plugin's last commit before this phase (19-04).
|
|
USER_BASE="${PHASE194_USER_BASE:-c077029}"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Required test names. Each list runs with -run '^(a|b|...)$' and every name
|
|
# must pass; a name that skips or does not run fails the stage.
|
|
|
|
# go stage: wristband's OIDC flavour, its MCP regression and tide (-short).
|
|
WRISTBAND_TESTS=(
|
|
# Plan 01 tracer and smokes.
|
|
TestOIDCTracerSmoke
|
|
TestOIDCAuthorizeStartSmoke TestOIDCResumeDecideSwitchSmoke TestKindIsolationSmoke
|
|
TestPHPRedirectEncodingSmoke
|
|
TestOIDCTokenErrorsSmoke TestOIDCReplayRevokesSmoke TestOIDCUserInfoSmoke
|
|
TestMixedKeyRingSmoke TestPairwiseSubjectSmoke TestOIDCRefreshOptInSmoke
|
|
TestDefaultOptionsResourceEmpty ExampleNewOIDCServer
|
|
# Plan 03 security review pins.
|
|
TestOIDCCodeBindingSmoke TestOIDCLogsCarryNoCredentials TestOIDCSubjectIsRandomSmoke
|
|
# MCP flavour unchanged (D-07): the phase 08 coverage suite.
|
|
TestPhase08Coverage
|
|
# Plan 04: the PHP protocol cases, one subtest per PHP method.
|
|
TestPKCEVerifier TestRedirectURIMatch TestTokenIssuer TestAuthCodeLifecycle
|
|
TestPKCEAndReplay TestConsentCSRF
|
|
# Plan 04: Go-only behaviour.
|
|
TestDiscoveryFields TestJWKSShapes TestKeyPEMParsing TestES256Ring TestMixedRingJWKS
|
|
TestAuthorizeValidationOrder TestRepeatedQueryParams TestPHPQueryEncoding
|
|
TestResumeAndSilentConsent TestSwitchAccount TestConsentJSONOperations
|
|
TestOIDCClientAuthentication TestUserInfoUniform401 TestPairwiseSubjects TestRefreshOptIn
|
|
TestKindIsolation TestFlavourHandlers TestSetOIDCBackendValidation TestMCPRefusesOpenID
|
|
)
|
|
TIDE_TESTS=(TestCaptureResponseFormField)
|
|
|
|
# plugin stage: the OAuth server plugin's Docker-free suites (-short).
|
|
PLUGIN_TESTS=(
|
|
TestAdminSurfaceHidesCredentials
|
|
TestImportKeyDirErrorsNameNoKey
|
|
TestParityFixturesHoldNoSecrets
|
|
)
|
|
PLUGIN_CONSOLE_TESTS=()
|
|
|
|
# userplugin stage: the user plugin's Docker-free suites (-short), by
|
|
# package pattern relative to the application workspace.
|
|
USER_CLASSES_TESTS=()
|
|
USER_ROOT_TESTS=()
|
|
|
|
# fonoteka stage: the application's Docker-free OAuth suites (-short).
|
|
APP_OAUTH_TESTS=(
|
|
TestOAuthMetadataAssembled TestOAuthMetadataRouteIsolation TestOAuthMetadataIssuerTracksAppURL
|
|
)
|
|
|
|
# docker stage: testcontainers suites.
|
|
DOCKER_PLUGIN_TESTS=(
|
|
# Plan 02.
|
|
TestOIDCFlowSmoke TestKeyRingFirstKeyRaceSmoke
|
|
TestConsentPageBrandingSmoke TestLoginHandoffAndSwitchSmoke TestBucketKeysSmoke TestRouteGuardSmoke
|
|
TestAuthorizationsSmoke TestUserCascadeSmoke TestMCPStoreSmoke
|
|
TestRelyingPartyInterop
|
|
# Plan 03.
|
|
TestImportWinterCutoverSmoke TestClientsAdminSmoke TestBrandingAdminSmoke
|
|
TestRotateAndPruneSmoke TestScheduleSmoke TestTokenLimitsSmoke
|
|
)
|
|
DOCKER_PLUGIN_CONSOLE_TESTS=()
|
|
DOCKER_USER_CLASSES_TESTS=()
|
|
DOCKER_USER_ROOT_TESTS=()
|
|
# The application's OAuth suites on Postgres (D-09), the explicit resource
|
|
# of plan 01 included.
|
|
DOCKER_APP_OAUTH_TESTS=(
|
|
TestOAuthResourceExplicit
|
|
TestPhase8RedAuthorizeApp TestOAuthAuthorizeAssembled TestOAuthAuthorizeInvalidRequestsCreateNoPendingRows
|
|
TestOAuthAuthorizeRawRouteSurface
|
|
TestPhase8RedConsentApp TestOAuthConsentCrossUserIsNotFound TestOAuthConsentScopeCeilingViaShow
|
|
TestOAuthConsentEmptySubmittedScopeIntersectionIs422 TestOAuthDenyRedirectsAccessDeniedAndConsumesRequest
|
|
TestOAuthConsentMissingHandleIsNotFoundWithNoRequest TestOAuthConsentSurfaceIsolation
|
|
TestPhase8RedLifecycleApp TestConnectedAppsListEmptyThenPopulatedWithManualCount
|
|
TestConnectedAppsRevokeForeignAndMissingAndManualShareExact404
|
|
TestConnectedAppsRevokeKillsAccessAndRefreshThenDisappearsFromList TestOAuthConnectedAppsSurfaceIsolation
|
|
TestPhase8RedRegistrationApp TestOAuthRegisterAssembled TestOAuthRegisterOversizedAndWrongContentType
|
|
TestOAuthRawRegistrationSurface
|
|
TestPhase8RedMCPMe TestOAuthToolsMePositiveAndNegativeContract TestOAuthToolsMeRouteIsolation
|
|
TestOAuthMetadataAuthorizeWithoutClientIsLocalErrorAndRegisterExists
|
|
TestOAuthConsentIntersectionGrantsOnlyOriginallyRequestedScopes
|
|
TestOAuthConsentCollectionIDsAlwaysServerResolvedActivePin TestOAuthConsentSecondConsentOnSameRequestIDFails
|
|
TestOAuthConsentShowExactKeySet
|
|
TestOAuthRevocationRotatedPredecessorIsDeadAfterConnectedAppRevoke
|
|
TestOAuthRevocationRotatedTokenLeavesExactlyOneConnectedApp
|
|
TestOAuthRevocationManualTokenRouteKillsRefreshChain TestOAuthRevocationSecondGrantSurvivesRevokingFirst
|
|
TestOAuthRevocationListsSignalEachOtherExcludingOAuthFromManual
|
|
TestOAuthRevocationReadingOutsideAllowListRouteNotYetPorted
|
|
TestOAuthTokenSurfaceIsolationCoverage TestPhase08Coverage
|
|
)
|
|
|
|
# parity stage.
|
|
PARITY_TESTS=(TestPHPParityReplay TestIDTokenShapeParity)
|
|
# The todo that carries the deferred PHP recording (split so this file does
|
|
# not name the site).
|
|
PARITY_TODO=".planning/todos/pending/2026-10-19-record-php-oidc-parity-against-wave""path.md"
|
|
|
|
# docs stage: names of consuming applications (split so this file does not
|
|
# match itself), the decision note and the dependency names it must carry.
|
|
APP_NAMES=("fono""teka" "p[lł]yta""rium" "grzy""by" "summercms""io" "wave""path" "stu""dia")
|
|
DECISION_NOTE=".planning/notes/2026-10-19-oidc-on-wristband-golang-jwt.md"
|
|
DECISION_NAMES=("golang-jwt/jwt/v5" "coreos/go-oidc/v3" "zitadel")
|
|
|
|
usage() {
|
|
cat >&2 <<'EOF'
|
|
usage:
|
|
check-phase19.4.sh --self-test
|
|
check-phase19.4.sh go | plugin | userplugin | fonoteka | docker | parity | docs
|
|
check-phase19.4.sh --go | --plugin | --userplugin | --fonoteka | --docker | --parity | --docs
|
|
check-phase19.4.sh --all
|
|
EOF
|
|
exit 2
|
|
}
|
|
|
|
# detect_go reads go test -json. Exit 1 fail/build, 2 skip, 3 zero/no-tests,
|
|
# 4 non-JSON, 5 missing required name.
|
|
detect_go() {
|
|
python3 - "$1" <<'PY'
|
|
import json, os, sys
|
|
path = sys.argv[1]
|
|
require = [n for n in os.environ.get("REQUIRE_TESTS", "").split() if n]
|
|
passed = set()
|
|
failed = []
|
|
with open(path, encoding="utf-8", errors="replace") as fh:
|
|
for raw in fh:
|
|
line = raw.strip()
|
|
if not line.startswith("{"):
|
|
continue
|
|
try:
|
|
ev = json.loads(line)
|
|
except json.JSONDecodeError:
|
|
print("refuse: non-json test output", file=sys.stderr)
|
|
sys.exit(4)
|
|
action = ev.get("Action")
|
|
test = ev.get("Test") or ""
|
|
pkg = ev.get("Package") or ev.get("ImportPath") or ""
|
|
if action == "build-fail" or (action == "fail" and ev.get("FailedBuild")):
|
|
print(f"refuse: build failed {pkg}", file=sys.stderr)
|
|
sys.exit(1)
|
|
text = ev.get("Output") or ""
|
|
if action == "output" and "no tests to run" in text:
|
|
print(f"refuse: no tests to run in {pkg}", file=sys.stderr)
|
|
sys.exit(3)
|
|
if action == "skip" and test:
|
|
print(f"refuse: skipped {pkg} {test}", file=sys.stderr)
|
|
sys.exit(2)
|
|
if action == "fail":
|
|
failed.append(f"{pkg} {test}".strip())
|
|
if action == "pass" and test:
|
|
passed.add(test)
|
|
if failed:
|
|
print("refuse: failed " + ", ".join(failed), file=sys.stderr)
|
|
sys.exit(1)
|
|
if not passed:
|
|
print("refuse: zero tests", file=sys.stderr)
|
|
sys.exit(3)
|
|
missing = [n for n in require if n not in passed]
|
|
if missing:
|
|
print("refuse: required tests did not pass: " + ", ".join(missing), file=sys.stderr)
|
|
sys.exit(5)
|
|
PY
|
|
}
|
|
|
|
# go_json DIR ARGS... runs go test -json ARGS in DIR (the workspace of a
|
|
# sibling repository) and checks the stream with detect_go.
|
|
go_json() {
|
|
local dir="$1"
|
|
shift
|
|
local log err rc=0 dc=0
|
|
log="$(mktemp)"
|
|
err="$(mktemp)"
|
|
(cd "$dir" && go test -json "$@") >"$log" 2>"$err" || rc=$?
|
|
detect_go "$log" || dc=$?
|
|
if [[ "$rc" -ne 0 || "$dc" -ne 0 ]]; then
|
|
cat "$err" >&2 || true
|
|
grep -v '^{' "$log" | tail -n 40 >&2 || true
|
|
python3 -c 'import json,sys
|
|
for raw in open(sys.argv[1], errors="replace"):
|
|
try: ev = json.loads(raw)
|
|
except ValueError: continue
|
|
if ev.get("Action") == "output" and ("FAIL" in ev.get("Output", "") or "SKIP" in ev.get("Output", "") or "_test.go:" in ev.get("Output", "")):
|
|
sys.stderr.write(ev["Output"])' "$log" 2>&1 | tail -n 40 >&2 || true
|
|
rm -f "$log" "$err"
|
|
echo "refuse: go test $* in $dir (test=$rc detect=$dc)" >&2
|
|
return 1
|
|
fi
|
|
echo "go: $(grep -c '"Action":"pass","Package":"[^"]*","Test":"[^"/]*","Elapsed"' "$log") top-level tests passed in $dir ($*)"
|
|
rm -f "$log" "$err"
|
|
}
|
|
|
|
# go_named DIR PACKAGES FLAGS NAME... runs exactly the named top-level tests
|
|
# and requires every one of them to pass. PACKAGES and FLAGS are word-split.
|
|
go_named() {
|
|
local dir="$1" pkgs="$2" flags="$3"
|
|
shift 3
|
|
if [[ "$#" -eq 0 ]]; then
|
|
echo "refuse: go_named $pkgs in $dir without required names" >&2
|
|
return 1
|
|
fi
|
|
local names=("$@") regex
|
|
regex="^($(IFS='|'; echo "${names[*]}"))\$"
|
|
# shellcheck disable=SC2086
|
|
REQUIRE_TESTS="${names[*]}" go_json "$dir" $flags -count=1 -run "$regex" $pkgs
|
|
}
|
|
|
|
# go_short DIR PACKAGES runs go test -short PACKAGES in DIR; on failure it
|
|
# prints the tail of the output and fails.
|
|
go_short() {
|
|
local dir="$1" pkgs="${2:-./...}" out
|
|
# shellcheck disable=SC2086
|
|
if ! out="$(cd "$dir" && go test -count=1 -short $pkgs 2>&1)"; then
|
|
printf '%s\n' "$out" | grep -v '^ok ' | tail -n 60 >&2
|
|
echo "refuse: go test -short $pkgs in $dir" >&2
|
|
return 1
|
|
fi
|
|
echo "short: $dir ($pkgs)"
|
|
}
|
|
|
|
go_vet() {
|
|
local dir="$1"
|
|
shift
|
|
(cd "$dir" && go vet "$@")
|
|
echo "vet: $dir ($*)"
|
|
}
|
|
|
|
require_dir() {
|
|
[[ -d "$1" ]] || {
|
|
echo "refuse: $2 $1 not found" >&2
|
|
return 1
|
|
}
|
|
}
|
|
|
|
expect_detector() {
|
|
local detector="$1" name="$2" want="$3" payload="$4" log dc=0
|
|
log="$(mktemp)"
|
|
printf '%s\n' "$payload" >"$log"
|
|
"$detector" "$log" >/dev/null 2>&1 || dc=$?
|
|
rm -f "$log"
|
|
if [[ "$dc" -ne "$want" ]]; then
|
|
echo "refuse: self-test $detector $name: exit $dc, want $want" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
# expect_mode NAME WANT_EXIT WANT_TEXT MODE ENV... runs this script in MODE
|
|
# with ENV and checks its exit status and that its output carries WANT_TEXT.
|
|
expect_mode() {
|
|
local name="$1" want="$2" text="$3" mode="$4"
|
|
shift 4
|
|
local out rc=0
|
|
out="$(env "$@" bash "${BASH_SOURCE[0]}" "$mode" 2>&1)" || rc=$?
|
|
if [[ "$rc" -ne "$want" ]] || ! grep -qF -- "$text" <<<"$out"; then
|
|
printf '%s\n' "$out" | tail -n 10 >&2
|
|
echo "refuse: self-test $name: exit $rc (want $want), output must carry \"$text\"" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
run_self_test() {
|
|
bash -n "${BASH_SOURCE[0]}"
|
|
|
|
expect_detector detect_go pass 0 '{"Action":"pass","Package":"p","Test":"TestOIDCTracerSmoke"}'
|
|
expect_detector detect_go fail 1 '{"Action":"pass","Package":"p","Test":"TestA"}
|
|
{"Action":"fail","Package":"p","Test":"TestPKCEAndReplay"}'
|
|
expect_detector detect_go package-fail 1 '{"Action":"pass","Package":"p","Test":"TestA"}
|
|
{"Action":"fail","Package":"p"}'
|
|
expect_detector detect_go build 1 '{"Action":"build-fail","ImportPath":"p"}'
|
|
expect_detector detect_go skip 2 '{"Action":"pass","Package":"p","Test":"TestA"}
|
|
{"Action":"skip","Package":"p","Test":"TestOIDCFlowSmoke"}'
|
|
expect_detector detect_go subtest-skip 2 '{"Action":"skip","Package":"p","Test":"TestAuthorizeStart/rejects_unknown_client"}
|
|
{"Action":"pass","Package":"p","Test":"TestAuthorizeStart"}'
|
|
expect_detector detect_go zero 3 '{"Action":"pass","Package":"p"}'
|
|
expect_detector detect_go no-tests 3 '{"Action":"output","Package":"p","Output":"testing: warning: no tests to run\n"}
|
|
{"Action":"pass","Package":"p"}'
|
|
expect_detector detect_go nonjson 4 '{"Action":"pass",'
|
|
REQUIRE_TESTS="TestOIDCTracerSmoke TestPHPMethodMap" expect_detector detect_go missing-named 5 \
|
|
'{"Action":"pass","Package":"p","Test":"TestOIDCTracerSmoke"}'
|
|
REQUIRE_TESTS="TestKeyRing" expect_detector detect_go prefix-is-not-the-test 5 \
|
|
'{"Action":"pass","Package":"p","Test":"TestKeyRingPreviousAppKey"}'
|
|
REQUIRE_TESTS="TestKeyRing" expect_detector detect_go subtest-is-not-the-test 5 \
|
|
'{"Action":"pass","Package":"p","Test":"TestOuter/TestKeyRing"}
|
|
{"Action":"pass","Package":"p","Test":"TestOther"}'
|
|
|
|
# The NOT RUN rules, on a faked host: a docker binary that never answers,
|
|
# and an OAuth server plugin whose flows carry no recording.
|
|
local tmp
|
|
tmp="$(mktemp -d)"
|
|
mkdir -p "$tmp/bin" "$tmp/plugin/testdata/parity/flows"
|
|
printf '#!/bin/sh\nexit 1\n' >"$tmp/bin/docker"
|
|
chmod +x "$tmp/bin/docker"
|
|
printf 'version: 1\nsteps:\n - id: a\n request:\n method: GET\n path: "/"\n' >"$tmp/plugin/testdata/parity/flows/a.yaml"
|
|
expect_mode docker-not-run 0 "NOT RUN docker" --docker-gate PATH="$tmp/bin:$PATH" PHASE194_REQUIRE_DOCKER=0
|
|
expect_mode docker-required 1 "FAIL docker" --docker-gate PATH="$tmp/bin:$PATH" PHASE194_REQUIRE_DOCKER=1
|
|
expect_mode docker-stage-needs-daemon 1 "needs a reachable Docker daemon" --docker PATH="$tmp/bin:$PATH"
|
|
expect_mode parity-not-run 0 "NOT RUN parity: D-14 unproven" --parity OAUTHSERVER_PLUGIN="$tmp/plugin" PHASE194_REQUIRE_PARITY=0
|
|
expect_mode parity-required 1 "PHASE194_REQUIRE_PARITY=1" --parity OAUTHSERVER_PLUGIN="$tmp/plugin" PHASE194_REQUIRE_PARITY=1
|
|
if parity_recorded "$tmp/plugin/testdata/parity/flows"; then
|
|
rm -rf "$tmp"
|
|
echo "refuse: self-test parity_recorded accepted a spec flow without responses" >&2
|
|
return 1
|
|
fi
|
|
printf ' response:\n status: 200\n' >>"$tmp/plugin/testdata/parity/flows/a.yaml"
|
|
if ! parity_recorded "$tmp/plugin/testdata/parity/flows"; then
|
|
rm -rf "$tmp"
|
|
echo "refuse: self-test parity_recorded missed a recorded flow" >&2
|
|
return 1
|
|
fi
|
|
rm -rf "$tmp"
|
|
|
|
# The additive check refuses a removed export and accepts additions.
|
|
local diff_bad diff_ok
|
|
diff_bad=$'--- a/classes/x.go\n+++ b/classes/x.go\n-func RequestUser(r *http.Request) (*User, error) {\n+func requestUser(r *http.Request) (*User, error) {'
|
|
diff_ok=$'--- a/classes/x.go\n+++ b/classes/x.go\n+func AvatarURL(u *User, size int) string {\n-func helper() {}\n-\t// func Old() is gone'
|
|
if [[ -z "$(removed_exports <<<"$diff_bad")" ]]; then
|
|
echo "refuse: self-test removed_exports missed a removed exported func" >&2
|
|
return 1
|
|
fi
|
|
if [[ -n "$(removed_exports <<<"$diff_ok")" ]]; then
|
|
echo "refuse: self-test removed_exports refused an additive diff" >&2
|
|
return 1
|
|
fi
|
|
for line in '-type DeactivatingEvent struct {' '-func (u *User) AvatarURL(size int) string {' '-func (User) Name() string {'; do
|
|
if [[ -z "$(removed_exports <<<"$line")" ]]; then
|
|
echo "refuse: self-test removed_exports missed: $line" >&2
|
|
return 1
|
|
fi
|
|
done
|
|
|
|
local mode
|
|
for mode in self-test go plugin userplugin fonoteka docker parity docs all; do
|
|
grep -q -- "^ --$mode" "${BASH_SOURCE[0]}" || {
|
|
echo "refuse: missing mode --$mode" >&2
|
|
return 1
|
|
}
|
|
done
|
|
echo "phase19.4 self-test passed"
|
|
}
|
|
|
|
run_go() {
|
|
go_vet "$ROOT" ./...
|
|
go_short "$ROOT"
|
|
go_named "$ROOT" ./modules/wristband -short "${WRISTBAND_TESTS[@]}"
|
|
go_named "$ROOT" ./modules/tide -short "${TIDE_TESTS[@]}"
|
|
echo "phase19.4 go passed"
|
|
}
|
|
|
|
run_plugin() {
|
|
require_dir "$OAUTHSERVER_PLUGIN" "OAuth server plugin"
|
|
go_vet "$OAUTHSERVER_PLUGIN" ./...
|
|
# The Docker suites skip here and run by name in the docker stage.
|
|
go_short "$OAUTHSERVER_PLUGIN"
|
|
go_named "$OAUTHSERVER_PLUGIN" . -short "${PLUGIN_TESTS[@]}"
|
|
if ((${#PLUGIN_CONSOLE_TESTS[@]})); then
|
|
go_named "$OAUTHSERVER_PLUGIN" ./console -short "${PLUGIN_CONSOLE_TESTS[@]}"
|
|
fi
|
|
echo "phase19.4 plugin passed"
|
|
}
|
|
|
|
# removed_exports reads a unified diff and prints every removed line that
|
|
# declares an exported func, method or type.
|
|
removed_exports() {
|
|
grep -E '^-(func ([A-Z]|\([^)]*\) [A-Z])|type [A-Z])' | grep -vE '^--- ' || true
|
|
}
|
|
|
|
run_userplugin() {
|
|
require_dir "$USER_PLUGIN" "user plugin"
|
|
require_dir "$FONOTEKA" "application workspace"
|
|
go_vet "$FONOTEKA" ./plugins/golem15/user/...
|
|
go_short "$FONOTEKA" ./plugins/golem15/user/...
|
|
if ((${#USER_CLASSES_TESTS[@]})); then
|
|
go_named "$FONOTEKA" ./plugins/golem15/user/classes -short "${USER_CLASSES_TESTS[@]}"
|
|
fi
|
|
if ((${#USER_ROOT_TESTS[@]})); then
|
|
go_named "$FONOTEKA" ./plugins/golem15/user -short "${USER_ROOT_TESTS[@]}"
|
|
fi
|
|
# D-05: additive only. git's status is captured before any filtering, so
|
|
# an unknown base or a broken checkout fails here instead of reading as
|
|
# an empty diff.
|
|
local diff rc=0 removed
|
|
diff="$(git -C "$USER_PLUGIN" diff "$USER_BASE" -- '*.go' ':(exclude)*_test.go' 2>&1)" || rc=$?
|
|
if [[ "$rc" -ne 0 ]]; then
|
|
printf '%s\n' "$diff" | tail -n 5 >&2
|
|
echo "refuse: git diff $USER_BASE in $USER_PLUGIN failed (exit $rc)" >&2
|
|
return 1
|
|
fi
|
|
removed="$(removed_exports <<<"$diff")"
|
|
if [[ -n "$removed" ]]; then
|
|
printf '%s\n' "$removed" >&2
|
|
echo "refuse: the user plugin removed or changed exported declarations since $USER_BASE (D-05: additive only)" >&2
|
|
return 1
|
|
fi
|
|
echo "additive: no exported func, method or type removed from the user plugin since $USER_BASE ($(grep -cE '^\+(func|type) ' <<<"$diff" || true) declarations added)"
|
|
echo "phase19.4 userplugin passed"
|
|
}
|
|
|
|
run_fonoteka() {
|
|
require_dir "$FONOTEKA" "application workspace"
|
|
go_vet "$FONOTEKA" ./... ./plugins/golem15/fono""teka/...
|
|
go_short "$FONOTEKA" ./plugins/golem15/fono""teka/...
|
|
go_named "$FONOTEKA" ./plugins/golem15/fono""teka -short "${APP_OAUTH_TESTS[@]}"
|
|
echo "phase19.4 fonoteka passed"
|
|
}
|
|
|
|
docker_up() {
|
|
command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1
|
|
}
|
|
|
|
run_docker() {
|
|
if ! docker_up; then
|
|
echo "refuse: the docker stage needs a reachable Docker daemon (testcontainers); run it on a Docker host" >&2
|
|
return 1
|
|
fi
|
|
require_dir "$OAUTHSERVER_PLUGIN" "OAuth server plugin"
|
|
require_dir "$FONOTEKA" "application workspace"
|
|
go_named "$OAUTHSERVER_PLUGIN" . "-timeout 30m" "${DOCKER_PLUGIN_TESTS[@]}"
|
|
if ((${#DOCKER_PLUGIN_CONSOLE_TESTS[@]})); then
|
|
go_named "$OAUTHSERVER_PLUGIN" ./console "-timeout 20m" "${DOCKER_PLUGIN_CONSOLE_TESTS[@]}"
|
|
fi
|
|
if ((${#DOCKER_USER_CLASSES_TESTS[@]})); then
|
|
go_named "$FONOTEKA" ./plugins/golem15/user/classes "-timeout 20m" "${DOCKER_USER_CLASSES_TESTS[@]}"
|
|
fi
|
|
if ((${#DOCKER_USER_ROOT_TESTS[@]})); then
|
|
go_named "$FONOTEKA" ./plugins/golem15/user "-timeout 20m" "${DOCKER_USER_ROOT_TESTS[@]}"
|
|
fi
|
|
go_named "$FONOTEKA" ./plugins/golem15/fono""teka "-timeout 20m" "${DOCKER_APP_OAUTH_TESTS[@]}"
|
|
echo "phase19.4 docker passed"
|
|
}
|
|
|
|
# docker_gate is the docker step of --all: run the stage when a daemon
|
|
# answers, fail with PHASE194_REQUIRE_DOCKER=1, print NOT RUN otherwise.
|
|
docker_gate() {
|
|
if docker_up; then
|
|
if bash "${BASH_SOURCE[0]}" --docker; then
|
|
echo "PASS docker"
|
|
return 0
|
|
fi
|
|
echo "FAIL docker"
|
|
return 1
|
|
fi
|
|
if [[ "${PHASE194_REQUIRE_DOCKER:-0}" == "1" ]]; then
|
|
echo "FAIL docker: no reachable Docker daemon and PHASE194_REQUIRE_DOCKER=1"
|
|
return 1
|
|
fi
|
|
cat >&2 <<'EOF'
|
|
************************************************************************
|
|
NOT RUN docker: no reachable Docker daemon on this host.
|
|
The testcontainers suites (Postgres) of the OAuth server plugin, the user
|
|
plugin and the application did NOT run. Run on a Docker host before
|
|
/msd-verify-work:
|
|
bash scripts/check-phase19.4.sh docker
|
|
************************************************************************
|
|
EOF
|
|
echo "NOT RUN docker (Docker-host only; see the notice above)"
|
|
}
|
|
|
|
# parity_recorded DIR is true when any flow under DIR carries a recorded
|
|
# response (summer parity:record writes one per step).
|
|
parity_recorded() {
|
|
local dir="$1"
|
|
[[ -d "$dir" ]] || return 1
|
|
grep -qE '^[[:space:]]+response:' "$dir"/*.yaml 2>/dev/null
|
|
}
|
|
|
|
run_parity() {
|
|
local flows="$OAUTHSERVER_PLUGIN/testdata/parity/flows"
|
|
require_dir "$flows" "parity flows"
|
|
if parity_recorded "$flows"; then
|
|
if ! docker_up; then
|
|
echo "refuse: the parity flows are recorded and their replay needs a reachable Docker daemon" >&2
|
|
return 1
|
|
fi
|
|
PHASE194_REQUIRE_PARITY=1 go_named "$OAUTHSERVER_PLUGIN" . "-timeout 30m" "${PARITY_TESTS[@]}"
|
|
echo "PASS parity: the PHP recordings replay against the Go plugin (D-14)"
|
|
return 0
|
|
fi
|
|
if [[ "${PHASE194_REQUIRE_PARITY:-0}" == "1" ]]; then
|
|
echo "FAIL parity: no PHP recordings under $flows and PHASE194_REQUIRE_PARITY=1" >&2
|
|
return 1
|
|
fi
|
|
cat >&2 <<EOF
|
|
************************************************************************
|
|
NOT RUN parity: D-14 unproven. No PHP recordings under
|
|
$flows
|
|
so TestPHPParityReplay and TestIDTokenShapeParity did not run. By the
|
|
D-14 amendment of 2026-10-19 the recording is deferred to the cutover of
|
|
the PHP reference site and does not hold this phase's verdict:
|
|
$PARITY_TODO
|
|
PHASE194_REQUIRE_PARITY=1 makes this stage fail.
|
|
************************************************************************
|
|
EOF
|
|
echo "NOT RUN parity: D-14 unproven (no PHP recordings; deferred, see $PARITY_TODO)"
|
|
}
|
|
|
|
run_docs() {
|
|
local name
|
|
for name in "${DECISION_NAMES[@]}"; do
|
|
if ! grep -qF -- "$name" "$ROOT/$DECISION_NOTE"; then
|
|
echo "refuse: the decision note $DECISION_NOTE does not name $name" >&2
|
|
return 1
|
|
fi
|
|
done
|
|
echo "note: $DECISION_NOTE names ${DECISION_NAMES[*]}"
|
|
go_named "$ROOT" ./cmd/summer "" TestDocsTree
|
|
(cd "$ROOT" && go run ./cmd/summer docs:build --check)
|
|
require_dir "$OAUTHSERVER_PLUGIN" "OAuth server plugin"
|
|
local pattern hits files=()
|
|
pattern="$(IFS='|'; echo "${APP_NAMES[*]}")"
|
|
while IFS= read -r -d '' f; do
|
|
files+=("$f")
|
|
done < <(find "$ROOT/modules/wristband" -type f -name '*.go' ! -name '*_test.go' -print0)
|
|
files+=("$ROOT/modules/wristband/README.md" "$ROOT/docs/services/oauth-server.md")
|
|
while IFS= read -r -d '' f; do
|
|
files+=("$f")
|
|
done < <(find "$OAUTHSERVER_PLUGIN" -type f \( -name '*.go' -o -name '*.md' -o -name '*.yaml' -o -name '*.tmpl' -o -name '*.htm' \) ! -path '*/.git/*' -print0)
|
|
hits="$(grep -inHE "$pattern" "${files[@]}" || true)"
|
|
if [[ -n "$hits" ]]; then
|
|
printf '%s\n' "$hits" | head -n 20 >&2
|
|
echo "refuse: a wristband source, the OAuth server docs page or a plugin file names a consuming application" >&2
|
|
return 1
|
|
fi
|
|
echo "names: ${#files[@]} files checked, no consuming application named"
|
|
echo "phase19.4 docs passed"
|
|
}
|
|
|
|
run_all() {
|
|
local stage
|
|
for stage in self-test go plugin userplugin fonoteka docs; do
|
|
if bash "${BASH_SOURCE[0]}" "--$stage"; then
|
|
echo "PASS $stage"
|
|
else
|
|
echo "FAIL $stage"
|
|
exit 1
|
|
fi
|
|
done
|
|
docker_gate || exit 1
|
|
if bash "${BASH_SOURCE[0]}" --parity; then
|
|
:
|
|
else
|
|
echo "FAIL parity"
|
|
exit 1
|
|
fi
|
|
echo "Phase 19.4 gate passed"
|
|
}
|
|
|
|
case "${1:---all}" in
|
|
--self-test | self-test) run_self_test ;;
|
|
--go | go) run_go ;;
|
|
--plugin | plugin) run_plugin ;;
|
|
--userplugin | userplugin) run_userplugin ;;
|
|
--fonoteka | fonoteka) run_fonoteka ;;
|
|
--docker | docker) run_docker ;;
|
|
--docker-gate) docker_gate ;;
|
|
--parity | parity) run_parity ;;
|
|
--docs | docs) run_docs ;;
|
|
--all | all) run_all ;;
|
|
*) usage ;;
|
|
esac
|