f22d0a5791
Source commit: 309831e1e021f962c118452336776fd9a94025f9 Public tree identity: sha256:6fa95c1745579bd6256dbeb3d476db0b07c2f24aa9213b0f7783ce1adfc8aca5
71 lines
4 KiB
JavaScript
71 lines
4 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
const assert = require("assert");
|
|
const fs = require("fs");
|
|
const path = require("path");
|
|
|
|
const repo = path.resolve(__dirname, "..");
|
|
const infraRepo = path.resolve(repo, "..", "michelpaulissen.com");
|
|
|
|
function read(relativePath, base = repo) {
|
|
return fs.readFileSync(path.join(base, relativePath), "utf8");
|
|
}
|
|
|
|
function expect(source, name, pattern) {
|
|
assert.match(source, pattern, `missing public browser login evidence: ${name}`);
|
|
}
|
|
|
|
const cliSource = read("crates/disasmer-cli/src/main.rs");
|
|
const cliSmoke = read("scripts/cli-browser-login-flow-smoke.js");
|
|
const publicAcceptance = read("scripts/acceptance-public.sh");
|
|
const phase2 = read("acceptance_criteria_phase2.md");
|
|
const base = read("acceptance_criteria.md");
|
|
|
|
for (const [name, source] of [
|
|
["base acceptance", base],
|
|
["phase 2 acceptance", phase2],
|
|
]) {
|
|
expect(source, `${name} released binary browser criterion`, /Public released binaries default to a real human browser\/account flow/);
|
|
}
|
|
|
|
expect(cliSource, "browser login start constant", /DEFAULT_BROWSER_LOGIN_START: &str = "https:\/\/disasmer\.michelpaulissen\.com\/auth\/browser\/start"/);
|
|
expect(cliSource, "default OIDC issuer", /DEFAULT_OIDC_ISSUER_URL: &str = "https:\/\/auth\.michelpaulissen\.com"/);
|
|
expect(cliSource, "fixed localhost callback", /BROWSER_CALLBACK_ADDR: &str = "127\.0\.0\.1:45173"/);
|
|
expect(cliSource, "diagnostic plan flag", /plan: bool/);
|
|
expect(cliSource, "interactive browser branch", /args\.browser && !args\.plan[\s\S]*execute_interactive_browser_login/);
|
|
expect(cliSource, "browser command override", /DISASMER_BROWSER_OPEN_COMMAND/);
|
|
expect(cliSource, "callback listener", /TcpListener::bind\(BROWSER_CALLBACK_ADDR\)/);
|
|
expect(cliSource, "callback completion", /execute_browser_login_completion_for_plan\(args, plan\)/);
|
|
expect(cliSmoke, "smoke uses fake browser opener", /DISASMER_BROWSER_OPEN_COMMAND/);
|
|
expect(cliSmoke, "smoke verifies callback code", /browser-smoke-code/);
|
|
expect(cliSmoke, "smoke verifies coordinator completion", /scoped_cli_session_received/);
|
|
expect(publicAcceptance, "public acceptance runs browser flow smoke", /node scripts\/cli-browser-login-flow-smoke\.js/);
|
|
|
|
if (fs.existsSync(infraRepo)) {
|
|
const stack = read("modules/stack.nix", infraRepo);
|
|
const hypervisor = read("hosts/hypervisor/default.nix", infraRepo);
|
|
const oauth = read("modules/oauth-bootstrap.nix", infraRepo);
|
|
const site = read("disasmer-site/index.html", infraRepo);
|
|
|
|
expect(stack, "Disasmer public host", /publicHost = "disasmer\.michelpaulissen\.com"/);
|
|
expect(stack, "Disasmer API port", /apiPort = 9443/);
|
|
expect(hypervisor, "nginx Disasmer vhost", /\$\{stack\.hosts\.disasmer\.publicHost\}/);
|
|
expect(hypervisor, "nginx Disasmer site root", /root = \.\.\/\.\.\/disasmer-site/);
|
|
expect(hypervisor, "nginx browser start route", /locations\."= \/auth\/browser\/start"\.return/);
|
|
expect(hypervisor, "nginx redirects to Authentik", /https:\/\/\$\{stack\.hosts\.authentik\.publicHost\}\/application\/o\/authorize/);
|
|
expect(hypervisor, "nginx passes state", /state=\$arg_state/);
|
|
expect(hypervisor, "nginx passes redirect URI", /redirect_uri=\$arg_redirect_uri/);
|
|
expect(hypervisor, "hosted service uses configured API port", /stack\.hosts\.disasmer\.apiPort/);
|
|
expect(oauth, "Disasmer Authentik provider", /name: disasmer-provider/);
|
|
expect(oauth, "Disasmer public OIDC client", /client_type: public/);
|
|
expect(oauth, "Disasmer client id", /client_id: \${disasmerClientId}/);
|
|
expect(oauth, "Disasmer localhost redirect", /http:\/\/127\.0\.0\.1:45173\/callback/);
|
|
expect(oauth, "Disasmer Authentik application", /slug: disasmer/);
|
|
expect(site, "barebones site describes CLI login", /disasmer login --browser/);
|
|
expect(site, "barebones site states UX deferral", /Layout and UX work are deferred/);
|
|
assert.doesNotMatch(site, /<style|stylesheet|\.css|style=|class=/i, "Disasmer dry-run site must remain barebones HTML with no CSS");
|
|
} else {
|
|
console.warn("Skipping VPS config checks because ../michelpaulissen.com is not present");
|
|
}
|
|
|
|
console.log("Public browser login contract smoke passed");
|