39 lines
2.9 KiB
Bash
39 lines
2.9 KiB
Bash
#!/usr/bin/env bash
|
|
# Row 74 (#1568): the Console in preview mode, driven with curl on loopback only.
|
|
# Run from a worktree with the candidate applied: bash demo.sh <worktree> <scratch>.
|
|
# No system config (MOSAIC_CONFIG names a missing file), so the bus routes answer
|
|
# not-configured once past the sign-in check; the board flag names a closed port.
|
|
set -u
|
|
TREE=$1 SCRATCH=$2
|
|
NAME=mosaic-preview.woltje.com HEADER=X-authentik-uid
|
|
ID=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef # a stand-in; ops-01 sends the real id
|
|
LOG=$SCRATCH/demo-server.txt
|
|
cd "$TREE" || exit 1
|
|
echo "== partial flag set, refused at start"
|
|
MOSAIC_CONFIG=$SCRATCH/no-config.json node packages/webui/src/cli.mjs serve --port 0 --public-host "$NAME" --auth-header "$HEADER"; echo "exit $?"
|
|
MOSAIC_CONFIG=$SCRATCH/no-config.json node packages/webui/src/cli.mjs serve --port 0 \
|
|
--board http://127.0.0.1:9 --public-host "$NAME" --auth-header "$HEADER" --allow-user "$ID" > "$LOG" 2>&1 &
|
|
PID=$!
|
|
trap 'kill "$PID" 2>/dev/null' EXIT
|
|
for _ in $(seq 50); do grep -q '^Mosaic Console' "$LOG" && break; sleep 0.1; done
|
|
cat "$LOG"
|
|
PORT=$(sed -n 's|^Mosaic Console: http://127.0.0.1:\([0-9]*\)/$|\1|p' "$LOG")
|
|
U=http://127.0.0.1:$PORT
|
|
c() { local what=$1 out; shift; out=$(curl -s -w '\n%{http_code}' "$@"); printf '%-42s %s %.110s\n' "$what" "${out##*$'\n'}" "$(printf '%s' "${out%$'\n'*}" | tr -d '\n')"; }
|
|
echo "== refusals"
|
|
c "wrong Host" -H "Host: evil.example" -H "$HEADER: $ID" "$U/api/bus/inbox"
|
|
c "public name with a port" -H "Host: $NAME:443" -H "$HEADER: $ID" "$U/api/bus/inbox"
|
|
c "wrong Origin" -H "Host: $NAME" -H "$HEADER: $ID" -H "Origin: https://evil.example" "$U/api/bus/inbox"
|
|
c "missing header" -H "Host: $NAME" "$U/api/bus/inbox"
|
|
c "wrong user" -H "Host: $NAME" -H "$HEADER: ${ID%?}0" "$U/api/bus/inbox"
|
|
c "POST /api/seen, signed in" -H "Host: $NAME" -H "$HEADER: $ID" -H 'Content-Type: application/json' -d '{"seen":true}' "$U/api/seen"
|
|
c "POST /api/reply, signed in" -H "Host: $NAME" -H "$HEADER: $ID" -H 'Content-Type: application/json' -d '{"agent":"p/a","text":"x"}' "$U/api/reply"
|
|
c "POST /api/reply, loopback Host" -H 'Content-Type: application/json' -d '{"agent":"p/a","text":"x"}' "$U/api/reply"
|
|
echo "== allowed"
|
|
c "GET /healthz, signed in, lowercase header" -H "Host: $NAME" -H "x-authentik-uid: $ID" -H "Origin: https://$NAME" "$U/healthz"
|
|
c "GET /api/config, signed in" -H "Host: $NAME" -H "$HEADER: $ID" "$U/api/config"
|
|
c "GET / (the page), signed in" -H "Host: $NAME" -H "$HEADER: $ID" "$U/"
|
|
c "GET /api/bus/inbox, signed in (no bus)" -H "Host: $NAME" -H "$HEADER: $ID" "$U/api/bus/inbox"
|
|
c "GET /api/board, signed in (board down)" -H "Host: $NAME" -H "$HEADER: $ID" "$U/api/board"
|
|
c "GET /healthz, loopback, no header" "$U/healthz"
|