tegwick
7b4b75089c
Some checks failed
Use-case regression gate / usecase-regressions (push) Has been cancelled
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
84 lines
3.7 KiB
Python
84 lines
3.7 KiB
Python
"""Only synthetic loopback peers; never accept an endpoint from input."""
|
|
|
|
import json
|
|
import ssl
|
|
import sys
|
|
import time
|
|
import urllib.error
|
|
import urllib.request
|
|
from pathlib import Path
|
|
|
|
|
|
def run(v):
|
|
assert __debug__
|
|
assert {p.name for p in Path('/sys/class/net').iterdir()} == {'lo'}
|
|
assert len(Path('/proc/net/route').read_text().splitlines()) == 1
|
|
tls = ssl.create_default_context(cadata=v['certificate'])
|
|
opener = urllib.request.build_opener(urllib.request.ProxyHandler({}),
|
|
urllib.request.HTTPSHandler(context=tls))
|
|
|
|
def call(url, data=None, token=None):
|
|
headers = {'Content-Type': 'application/json'}
|
|
if token:
|
|
headers['Authorization'] = 'Bearer ' + token
|
|
try:
|
|
return opener.open(urllib.request.Request(
|
|
url, data=json.dumps(data).encode() if data else None,
|
|
headers=headers), timeout=2)
|
|
except urllib.error.HTTPError as error:
|
|
return error
|
|
|
|
if v['mode'] == 'prepare_issuer_bind':
|
|
with call('http://127.0.0.1:17170/auth/simple/login', {
|
|
'username': 'admin', 'password': v['admin_password']}) as response:
|
|
token = json.load(response)['token']
|
|
|
|
def graphql(query, variables=None):
|
|
with call('http://127.0.0.1:17170/api/graphql', {
|
|
'query': query, 'variables': variables or {}}, token=token) as response:
|
|
body = json.load(response)
|
|
assert not body.get('errors')
|
|
return body['data']
|
|
graphql('mutation($u:CreateUserInput!){createUser(user:$u){id}}', {'u': {
|
|
'id': 'svc-issuer', 'email': 'svc-issuer@example.test', 'displayName': 'svc-issuer'}})
|
|
groups = graphql('{groups{id displayName}}')['groups']
|
|
group = next(g['id'] for g in groups if g['displayName'] == 'lldap_strict_readonly')
|
|
graphql('mutation($u:String!,$g:Int!){addUserToGroup(userId:$u,groupId:$g){ok}}',
|
|
{'u': 'svc-issuer', 'g': group})
|
|
tenant_group = graphql('mutation($n:String!){createGroup(name:$n){id}}',
|
|
{'n': 'tenant:coulomb:users'})['createGroup']['id']
|
|
graphql('mutation($u:String!,$g:Int!){addUserToGroup(userId:$u,groupId:$g){ok}}',
|
|
{'u': 'alice', 'g': tenant_group})
|
|
return {'admin_token': token}
|
|
if v['mode'] == 'directory_check':
|
|
def accepted(password):
|
|
with call('http://127.0.0.1:17170/auth/simple/login', {
|
|
'username': 'alice', 'password': password}) as response:
|
|
return response.status == 200
|
|
return {'old_password_accepted': accepted(v['old_password']),
|
|
'new_password_accepted': accepted(v['new_password'])}
|
|
urls = (['http://127.0.0.1:8080/.well-known/openid-configuration',
|
|
'http://127.0.0.1:8089/fixture/state', 'http://127.0.0.1:8000/healthz']
|
|
if v['mode'] == 'app_ready' else
|
|
['http://127.0.0.1:8088/health', 'https://127.0.0.1:9091/api/health'])
|
|
for url in urls:
|
|
for _ in range(120):
|
|
try:
|
|
with call(url) as response:
|
|
if response.status == 200:
|
|
break
|
|
except OSError:
|
|
pass
|
|
time.sleep(.25)
|
|
else:
|
|
raise RuntimeError('fixture_startup')
|
|
return {'status': 'peers_ready', 'loopback_and_absent_routes_verified': True,
|
|
'native_tls_verified_with_fixture_ca': True}
|
|
|
|
|
|
if __name__ == '__main__':
|
|
try:
|
|
print(json.dumps(run(json.load(sys.stdin))))
|
|
except Exception as exc:
|
|
print(json.dumps({'status': 'peer_check_failed', 'failure_type': type(exc).__name__}))
|
|
raise SystemExit(1)
|