|
| 1 | +#!/usr/bin/env bash |
| 2 | +# Hermetic container smoke test for the same-origin /api proxy. |
| 3 | +# |
| 4 | +# Builds the image, then stands up a stub upstream + the openconcho container on |
| 5 | +# a shared Docker network and asserts the proxy forwards correctly. Fully |
| 6 | +# self-contained — no external Honcho or tailnet needed. Local-only (requires a |
| 7 | +# Docker daemon); not part of PR CI, like the desktop cargo-check preflight. |
| 8 | +# |
| 9 | +# Idempotent: removes its own containers/network on entry and exit. Exits non-zero |
| 10 | +# on any failed assertion. |
| 11 | +# |
| 12 | +# Usage: make smoke-docker (or: bash docker/smoke-test.sh) |
| 13 | +set -euo pipefail |
| 14 | +cd "$(dirname "$0")/.." |
| 15 | + |
| 16 | +IMAGE="openconcho-web:smoke" |
| 17 | +NET="oc-smoke-net" |
| 18 | +UPSTREAM="oc-smoke-upstream" |
| 19 | +APP="oc-smoke-app" |
| 20 | +PORT="${SMOKE_PORT:-18080}" |
| 21 | +# Echo server: returns request method/path/headers as JSON for any verb. |
| 22 | +STUB_IMAGE="mendhak/http-https-echo:31" |
| 23 | +FAIL=0 |
| 24 | + |
| 25 | +cleanup() { |
| 26 | + docker rm -f "$APP" "$UPSTREAM" >/dev/null 2>&1 || true |
| 27 | + docker network rm "$NET" >/dev/null 2>&1 || true |
| 28 | +} |
| 29 | +trap cleanup EXIT |
| 30 | +cleanup |
| 31 | + |
| 32 | +wait_ready() { # url |
| 33 | + for _ in $(seq 1 30); do |
| 34 | + curl -fsS "$1" >/dev/null 2>&1 && return 0 |
| 35 | + sleep 0.5 |
| 36 | + done |
| 37 | + echo " FAIL: container did not become ready at $1" |
| 38 | + FAIL=1 |
| 39 | +} |
| 40 | + |
| 41 | +check() { # label expected actual |
| 42 | + if [ "$2" = "$3" ]; then echo " PASS: $1 ($3)"; else echo " FAIL: $1 — expected $2, got $3"; FAIL=1; fi |
| 43 | +} |
| 44 | + |
| 45 | +echo "==> build image" |
| 46 | +docker build -t "$IMAGE" . >/dev/null |
| 47 | + |
| 48 | +echo "==> create network + stub upstream" |
| 49 | +docker network create "$NET" >/dev/null |
| 50 | +docker run -d --name "$UPSTREAM" --network "$NET" -e HTTP_PORT=8080 "$STUB_IMAGE" >/dev/null |
| 51 | + |
| 52 | +echo "==> start openconcho (default-open allowlist)" |
| 53 | +docker run -d --name "$APP" --network "$NET" -p "$PORT:8080" \ |
| 54 | + -e "OPENCONCHO_DEFAULT_HONCHO_URL=http://$UPSTREAM:8080" "$IMAGE" >/dev/null |
| 55 | +wait_ready "http://localhost:$PORT/healthz" |
| 56 | + |
| 57 | +echo "==> assertions" |
| 58 | +check "healthz 200" 200 "$(curl -s -o /dev/null -w '%{http_code}' "http://localhost:$PORT/healthz")" |
| 59 | +check "SPA served 200" 200 "$(curl -s -o /dev/null -w '%{http_code}' "http://localhost:$PORT/")" |
| 60 | +check "config.js injected" 200 "$(curl -s -o /dev/null -w '%{http_code}' "http://localhost:$PORT/config.js")" |
| 61 | + |
| 62 | +# Proxy forwards POST /api/v3/test -> stub, stripping the /api prefix. |
| 63 | +body=$(curl -s "http://localhost:$PORT/api/v3/test" \ |
| 64 | + -H "X-Honcho-Upstream: http://$UPSTREAM:8080" -H 'content-type: application/json' -X POST -d '{}') |
| 65 | +if echo "$body" | grep -q '/v3/test'; then echo " PASS: /api forwards + strips prefix"; else echo " FAIL: forward/strip — body: $body"; FAIL=1; fi |
| 66 | +# Routing header must NOT leak to the upstream. |
| 67 | +if echo "$body" | grep -qi 'x-honcho-upstream'; then echo " FAIL: X-Honcho-Upstream leaked upstream"; FAIL=1; else echo " PASS: X-Honcho-Upstream cleared upstream"; fi |
| 68 | +# Missing routing header -> 421. |
| 69 | +check "missing header 421" 421 "$(curl -s -o /dev/null -w '%{http_code}' "http://localhost:$PORT/api/v3/test" -X POST -d '{}')" |
| 70 | + |
| 71 | +echo "==> restart with a non-matching allowlist" |
| 72 | +docker rm -f "$APP" >/dev/null |
| 73 | +docker run -d --name "$APP" --network "$NET" -p "$PORT:8080" \ |
| 74 | + -e "OPENCONCHO_UPSTREAM_ALLOWLIST=*.honcho.dev" "$IMAGE" >/dev/null |
| 75 | +wait_ready "http://localhost:$PORT/healthz" |
| 76 | +check "allowlist reject 403" 403 "$(curl -s -o /dev/null -w '%{http_code}' "http://localhost:$PORT/api/v3/test" \ |
| 77 | + -H "X-Honcho-Upstream: http://$UPSTREAM:8080" -X POST -d '{}')" |
| 78 | +reject=$(curl -s -D- -o /dev/null "http://localhost:$PORT/api/v3/test" \ |
| 79 | + -H "X-Honcho-Upstream: http://$UPSTREAM:8080" -X POST -d '{}' | grep -i 'X-Honcho-Proxy-Reject' | tr -d '\r') |
| 80 | +if echo "$reject" | grep -qi 'allowlist'; then echo " PASS: reject sentinel header present"; else echo " FAIL: missing reject sentinel — got: $reject"; FAIL=1; fi |
| 81 | + |
| 82 | +if [ "$FAIL" = 0 ]; then echo "==> SMOKE TEST PASSED"; else echo "==> SMOKE TEST FAILED"; exit 1; fi |
0 commit comments