patrickandClaude Sonnet 5
5b66a5cc4f
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (push) Canceled after 0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Canceled after 0s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Canceled after 0s
CI / Web (dms-browser) (push) Canceled after 0s
CI / Web (pdf-viewer) (push) Canceled after 0s
CI / Web (shl) (push) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
60 lines
2.8 KiB
Bash
Executable File
60 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# INT-18 Ende-zu-Ende: ein echter Kontodienst (Login, Modul-Token mit aud=mail,
|
|
# JWKS) auf dem Wegwerf-Cluster 17/coredev, die Mail-API prueft echte Tokens
|
|
# ueber ihre produktive moduleauth-Kette. Muster wie dms/scripts (im Root-
|
|
# Repo) e2e-core-dms.sh, aber nur der Kontodienst wird gebraucht (kein
|
|
# Policy-Dienst: die Mail-API kennt bislang keine RBAC-06-Rechtepruefung).
|
|
# usage (im Repo-Root, NEBEN mail/): mail/scripts/int18-e2e.sh
|
|
set -euo pipefail
|
|
|
|
cluster=/etc/nexarch-dev/core-cluster.sh
|
|
set -a
|
|
source /etc/nexarch-dev/core-dev.env
|
|
source /etc/nexarch-dev/tenant-dev.env
|
|
set +a
|
|
export PATH="$PATH:/usr/local/go/bin"
|
|
|
|
work="$(mktemp -d /tmp/nexarch-int18-e2e-XXXXXX)"
|
|
pids=()
|
|
cleanup() {
|
|
for p in "${pids[@]:-}"; do kill "$p" 2>/dev/null || true; done
|
|
"$cluster" stop || true
|
|
rm -rf "$work"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
password="e2e-$(head -c 12 /dev/urandom | od -An -tx1 | tr -d ' \n')"
|
|
jwt_secret="e2e-$(head -c 16 /dev/urandom | od -An -tx1 | tr -d ' \n')"
|
|
module_key_encryption_key="$(head -c 32 /dev/urandom | base64)"
|
|
session_key_encryption_key="$(head -c 32 /dev/urandom | base64)"
|
|
|
|
"$cluster" resettenant
|
|
for f in $(ls migrations/*.up.sql | sort); do
|
|
psql "$TEST_ADMIN_DSN" -q -v ON_ERROR_STOP=1 -f "$f" >/dev/null
|
|
done
|
|
for f in $(ls migrations/tenant/*.up.sql | sort); do
|
|
psql "$TEST_TENANT_DSN" -q -v ON_ERROR_STOP=1 -f "$f" >/dev/null
|
|
done
|
|
|
|
go build -o "$work/account-api" ./cmd/account-api
|
|
NEXARCH_E2E_TENANT_DSN="$TEST_TENANT_DSN" NEXARCH_E2E_PASSWORD="$password" go run ./scripts/e2e-seed
|
|
|
|
# mail als zusaetzliche, gueltige Zielangabe neben dms (Standard).
|
|
NEXARCH_ACCOUNT_TENANT_DSN="$TEST_TENANT_DSN" NEXARCH_ACCOUNT_TENANT_SLUG=acme NEXARCH_ACCOUNT_JWT_SECRET="$jwt_secret" \
|
|
NEXARCH_ACCOUNT_MODULE_KEY_ENCRYPTION_KEY="$module_key_encryption_key" NEXARCH_ACCOUNT_MODULE_KEY_REFRESH_SECONDS=1 \
|
|
NEXARCH_ACCOUNT_SESSION_KEY_ENCRYPTION_KEY="$session_key_encryption_key" NEXARCH_ACCOUNT_SESSION_KEY_REFRESH_SECONDS=1 \
|
|
NEXARCH_ACCOUNT_MODULE_AUDIENCES="dms,mail" \
|
|
NEXARCH_ACCOUNT_API_LISTEN_ADDR=127.0.0.1:8099 NEXARCH_ACCOUNT_MODULE_TOKEN_TTL_SECONDS=5 \
|
|
"$work/account-api" >"$work/account.log" 2>&1 &
|
|
pids+=($!)
|
|
|
|
for _ in $(seq 1 50); do curl -fsS http://127.0.0.1:8099/healthz >/dev/null 2>&1 && break; sleep 0.2; done
|
|
curl -fsS http://127.0.0.1:8099/healthz >/dev/null || { echo "account-api nicht erreichbar" >&2; tail -20 "$work/account.log" >&2; exit 1; }
|
|
|
|
# TEST_TENANT_DSN gilt fuer den Kontodienst-Nutzerstamm (Tenant "acme" hier,
|
|
# nicht "e2e" wie im DMS-Skript) — e2e-seed legt Nutzer unabhaengig vom Slug
|
|
# der Instanz an, der Slug bindet nur, welche Tokens der Kontodienst signiert.
|
|
cd mail
|
|
TEST_CORE_ACCOUNT_URL=http://127.0.0.1:8099 TEST_CORE_PASSWORD="$password" \
|
|
go test -count=1 -v -timeout 120s -run TestEndToEnd_RealCoreToken ./internal/mailapi/
|