101 lines
3.6 KiB
Bash
Executable file
101 lines
3.6 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ENV_FILE="${ENV_FILE:-/opt/ligbox-ops-platform/.env}"
|
|
if [[ -f "$ENV_FILE" ]]; then
|
|
set -a
|
|
# shellcheck disable=SC1090
|
|
source "$ENV_FILE"
|
|
set +a
|
|
fi
|
|
|
|
API="${API_URL:-http://10.10.10.122:8080}"
|
|
PASS="${DESK_BOOTSTRAP_PASSWORD:-805353}"
|
|
WEBHOOK_SECRET="${WEBHOOK_SECRET:-ligbox-ops-dev-secret}"
|
|
INTERNAL="${OPS_INTERNAL_TOKEN:-}"
|
|
|
|
echo "=== verify-auth.sh === API=$API"
|
|
|
|
fail() { echo "FAIL: $1"; exit 1; }
|
|
ok() { echo "OK: $1"; }
|
|
|
|
# Public health
|
|
curl -sf "$API/health" | grep -q '"status":"ok"' || fail "health"
|
|
ok "GET /health público"
|
|
|
|
# Protected without token
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' "$API/api/v1/desk/tickets")
|
|
[[ "$code" == "401" ]] || fail "desk/tickets sem token devia 401 (got $code)"
|
|
ok "desk/tickets sem token → 401"
|
|
|
|
login_token() {
|
|
local user=$1
|
|
curl -sf -X POST "$API/api/v1/auth/login" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"username\":\"$user\",\"password\":\"$PASS\"}" \
|
|
| python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])"
|
|
}
|
|
|
|
TOKEN_ROOT=$(login_token root)
|
|
TOKEN_ADMIN=$(login_token admin)
|
|
TOKEN_MINI=$(login_token mini)
|
|
TOKEN_NOC=$(login_token noc)
|
|
ok "login root/admin/mini/noc"
|
|
|
|
curl -sf -H "Authorization: Bearer $TOKEN_ROOT" "$API/api/v1/desk/tickets" | grep -q '"tickets"' || fail "root tickets"
|
|
ok "root GET tickets"
|
|
|
|
curl -sf -H "Authorization: Bearer $TOKEN_NOC" "$API/api/v1/desk/tickets" | grep -q '"tickets"' || fail "noc tickets read"
|
|
ok "noc GET tickets (masked)"
|
|
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' -X PATCH \
|
|
-H "Authorization: Bearer $TOKEN_NOC" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"status":"closed"}' \
|
|
"$API/api/v1/desk/tickets/1")
|
|
[[ "$code" == "403" ]] || fail "noc PATCH devia 403 (got $code)"
|
|
ok "noc PATCH ticket → 403"
|
|
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' -X POST \
|
|
-H "Authorization: Bearer $TOKEN_MINI" \
|
|
"$API/api/v1/audit/cycle")
|
|
[[ "$code" == "403" ]] || fail "mini audit cycle devia 403 (got $code)"
|
|
ok "mini POST audit/cycle → 403"
|
|
|
|
curl -sf -H "Authorization: Bearer $TOKEN_ADMIN" -X POST "$API/api/v1/audit/cycle" | grep -q 'audits_run\|domains_synced' || fail "admin audit cycle"
|
|
ok "admin POST audit/cycle"
|
|
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' \
|
|
-H "X-Ops-Internal-Token: $INTERNAL" \
|
|
-X POST "$API/api/v1/audit/cycle")
|
|
[[ "$code" == "200" ]] || fail "worker internal token (got $code)"
|
|
ok "worker X-Ops-Internal-Token audit/cycle"
|
|
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' \
|
|
-H "Authorization: Bearer $TOKEN_NOC" \
|
|
"$API/api/v1/onboard/sessions/test-session/timeline")
|
|
[[ "$code" == "403" ]] || fail "noc timeline devia 403 (got $code)"
|
|
ok "noc session timeline → 403"
|
|
|
|
curl -sf -H "Authorization: Bearer $TOKEN_MINI" \
|
|
"$API/api/v1/onboard/sessions/6fbd2387-14e6-4c85-a017-336f178bcb1a/timeline" | grep -q '"events"' || true
|
|
ok "mini session timeline (se sessão existir)"
|
|
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' \
|
|
-H "Authorization: Bearer $TOKEN_ADMIN" \
|
|
"$API/api/v1/auth/users")
|
|
[[ "$code" == "403" ]] || fail "admin list users devia 403 (got $code)"
|
|
ok "admin GET auth/users → 403"
|
|
|
|
curl -sf -H "Authorization: Bearer $TOKEN_ROOT" "$API/api/v1/auth/users" | grep -q '"users"' || fail "root list users"
|
|
ok "root GET auth/users"
|
|
|
|
# Webhook without JWT still works
|
|
curl -sf -X POST "$API/api/v1/webhooks/onboard" \
|
|
-H "Content-Type: application/json" \
|
|
-H "X-Webhook-Secret: $WEBHOOK_SECRET" \
|
|
-d '{"event":"account.created","domain":"auth-verify.ligbox","session_id":"auth-spec-003-verify"}' \
|
|
| grep -q '"accepted"' || fail "webhook onboard"
|
|
ok "webhook onboard sem JWT"
|
|
|
|
echo "=== verify-auth.sh PASSED ==="
|