ReviewOS
Reload

also looking at this

loghqorg/loghq

Re-deploy loghq: post-deploy smoke test for the new login contract

#8
Merged glennmichael123 wants to merge main into production
1 file +15 -12
.github/workflows/deploy.ymlmodified+15-12
@@ -297,21 +297,24 @@ jobs:
297297 probe "/login" 200
298298
299299 # 4. Sign-in issues a session cookie. This is the regression that shipped
300 # green: page actions could not set cookies at all on the stx the app
301 # resolved, so login 303'd to /dashboard with no Set-Cookie and the
302 # dashboard bounced straight back. A 303 alone proves nothing.
303 hdrs="$(curl -sS -D - -o /dev/null -X POST "${URL}/login" \
300 # green once: a login that reported success and set no usable cookie,
301 # so the dashboard bounced straight back. Success alone proves nothing.
302 # Login is now the JSON API action at /api/auth/login (200 + Set-Cookie),
303 # not the old page-action 303, and the cookie is the unified auth-token.
304 body="$(jq -nc --arg e "$SMOKE_EMAIL" --arg p "$SMOKE_PASSWORD" '{email:$e,password:$p}')"
305 hdrs="$(curl -sS -D - -o /dev/null -X POST "${URL}/api/auth/login" \
304306 --max-time 20 \
305 --data-urlencode "email=${SMOKE_EMAIL}" \
306 --data-urlencode "password=${SMOKE_PASSWORD}")"
307 echo "$hdrs" | grep -qiE '^HTTP/[0-9.]+ 303' \
308 || { echo "::error::POST /login did not 303"; echo "$hdrs" | grep -iE '^HTTP/' ; exit 1; }
309 echo "$hdrs" | grep -qiE '^set-cookie: *loghq_token=' \
310 || { echo "::error::POST /login set no loghq_token cookie"; exit 1; }
311 echo " POST /login -> 303 + loghq_token cookie"
307 -H 'Content-Type: application/json' \
308 -H 'Accept: application/json' \
309 --data "$body")"
310 echo "$hdrs" | grep -qiE '^HTTP/[0-9.]+ 200' \
311 || { echo "::error::POST /api/auth/login did not 200"; echo "$hdrs" | grep -iE '^HTTP/' ; exit 1; }
312 echo "$hdrs" | grep -qiE '^set-cookie: *auth-token=' \
313 || { echo "::error::POST /api/auth/login set no auth-token cookie"; exit 1; }
314 echo " POST /api/auth/login -> 200 + auth-token cookie"
312315
313316 # 5. The token the cookie carries is really a session, not just a string.
314 TOKEN="$(echo "$hdrs" | grep -iE '^set-cookie: *loghq_token=' | head -1 | sed -E 's/.*loghq_token=([^;]*).*/\1/' | tr -d '\r')"
317 TOKEN="$(echo "$hdrs" | grep -iE '^set-cookie: *auth-token=' | head -1 | sed -E 's/.*auth-token=([^;]*).*/\1/' | tr -d '\r')"
315318 me="$(curl -sS -o /dev/null -w '%{http_code}' --max-time 20 "${URL}/api/me" -H "Authorization: Bearer ${TOKEN}")"
316319 echo " GET /api/me -> $me"
317320 [ "$me" = "200" ] || { echo "::error::/api/me returned $me for a freshly issued token"; exit 1; }