test: build and verify addon runtime
This commit is contained in:
Dennis Juhler Aagaard
Executable
+290
@@ -0,0 +1,290 @@
|
||||
#!/usr/bin/env bash
|
||||
set -Eeuo pipefail
|
||||
|
||||
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
image="homeassistant-stelloauth-addon:test"
|
||||
run_id="$(date +%s)-$$"
|
||||
first_container="stelloauth-runtime-${run_id}-first"
|
||||
second_container="stelloauth-runtime-${run_id}-second"
|
||||
tmp_dir="$(mktemp -d)"
|
||||
artifacts_dir="${repo_root}/artifacts"
|
||||
options_file="${tmp_dir}/options.json"
|
||||
|
||||
sentinels=(
|
||||
"sentinel-email@example.invalid"
|
||||
"SENTINEL_PASSWORD_9a34"
|
||||
"SENTINEL_COOKIE_7b21"
|
||||
"SENTINEL_OAUTH_CODE_5c88"
|
||||
"SENTINEL_ACCESS_TOKEN_1d62"
|
||||
"SENTINEL_REFRESH_TOKEN_4e73"
|
||||
)
|
||||
|
||||
cleanup() {
|
||||
set +e
|
||||
for container in "$first_container" "$second_container"; do
|
||||
if docker container inspect "$container" >/dev/null 2>&1; then
|
||||
if [ "$(docker inspect --format '{{.State.Running}}' "$container" 2>/dev/null)" = "true" ]; then
|
||||
docker stop --time 10 "$container" >/dev/null 2>&1
|
||||
fi
|
||||
docker rm "$container" >/dev/null 2>&1
|
||||
fi
|
||||
done
|
||||
rm -r "$tmp_dir"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
fail() {
|
||||
printf 'runtime test failed: %s\n' "$*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
write_options() {
|
||||
python3 - "$options_file" <<'PY'
|
||||
import json
|
||||
import pathlib
|
||||
import sys
|
||||
|
||||
options = {
|
||||
"queue_timeout": "60s",
|
||||
"rate_limit_count": 5,
|
||||
"rate_limit_duration": "1h",
|
||||
}
|
||||
pathlib.Path(sys.argv[1]).write_text(
|
||||
json.dumps(options, separators=(",", ":")) + "\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
PY
|
||||
}
|
||||
|
||||
start_container() {
|
||||
local container="$1"
|
||||
docker run --detach \
|
||||
--name "$container" \
|
||||
--platform linux/amd64 \
|
||||
--mount "type=bind,src=${options_file},dst=/data/options.json,readonly" \
|
||||
--publish 127.0.0.1::8080 \
|
||||
"$image" >/dev/null
|
||||
}
|
||||
|
||||
host_port() {
|
||||
local container="$1"
|
||||
local mapping
|
||||
mapping="$(docker port "$container" 8080/tcp)"
|
||||
[ -n "$mapping" ] || fail "container 8080 has no host mapping"
|
||||
printf '%s\n' "${mapping##*:}"
|
||||
}
|
||||
|
||||
probe_root() {
|
||||
local port="$1"
|
||||
python3 - "$port" <<'PY'
|
||||
import sys
|
||||
import urllib.request
|
||||
|
||||
opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
|
||||
with opener.open(f"http://127.0.0.1:{sys.argv[1]}/", timeout=2) as response:
|
||||
if response.status != 200:
|
||||
raise SystemExit(f"root status {response.status}")
|
||||
response.read()
|
||||
PY
|
||||
}
|
||||
|
||||
wait_ready() {
|
||||
local container="$1"
|
||||
local port="$2"
|
||||
local deadline=$((SECONDS + 90))
|
||||
while (( SECONDS < deadline )); do
|
||||
if [ "$(docker inspect --format '{{.State.Running}}' "$container")" != "true" ]; then
|
||||
docker logs "$container" >&2
|
||||
fail "$container exited during readiness"
|
||||
fi
|
||||
if docker logs "$container" 2>&1 | grep -Fq "Stelloauth listening on 0.0.0.0:8080"; then
|
||||
if probe_root "$port" >/dev/null 2>&1; then
|
||||
return
|
||||
fi
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
docker logs "$container" >&2
|
||||
fail "$container did not become ready within 90 seconds"
|
||||
}
|
||||
|
||||
assert_loopback_cdp_listener() {
|
||||
local container="$1"
|
||||
local artifact="$2"
|
||||
docker exec "$container" cat /proc/net/tcp > "$artifact"
|
||||
docker exec -i "$container" python3 - <<'PY'
|
||||
expected = f"0100007F:{9222:04X}"
|
||||
wildcard = f"00000000:{9222:04X}"
|
||||
if expected != "0100007F:2406":
|
||||
raise SystemExit(f"unexpected 9222 hexadecimal encoding: {expected}")
|
||||
|
||||
listeners = set()
|
||||
with open("/proc/net/tcp", encoding="ascii") as handle:
|
||||
next(handle)
|
||||
for line in handle:
|
||||
fields = line.split()
|
||||
if len(fields) >= 4 and fields[3] == "0A":
|
||||
listeners.add(fields[1].upper())
|
||||
|
||||
if expected not in listeners:
|
||||
raise SystemExit(f"missing loopback CDP listener {expected}: {sorted(listeners)}")
|
||||
if wildcard in listeners:
|
||||
raise SystemExit(f"wildcard CDP listener present: {wildcard}")
|
||||
PY
|
||||
}
|
||||
|
||||
probe_and_close_cdp() {
|
||||
local container="$1"
|
||||
docker exec -i "$container" python3 - <<'PY'
|
||||
import json
|
||||
import urllib.request
|
||||
|
||||
opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
|
||||
version_url = "http://127.0.0.1:9222/json/version?fingerprint=runtime-readiness"
|
||||
close_url = "http://127.0.0.1:9222/fingerprint/runtime-readiness/close"
|
||||
with opener.open(version_url, timeout=10) as response:
|
||||
if response.status != 200:
|
||||
raise SystemExit(f"CDP version status {response.status}")
|
||||
document = json.load(response)
|
||||
websocket_url = document.get("webSocketDebuggerUrl")
|
||||
if not isinstance(websocket_url, str) or not websocket_url:
|
||||
raise SystemExit("CDP response lacks webSocketDebuggerUrl")
|
||||
request = urllib.request.Request(close_url, data=b"", method="POST")
|
||||
with opener.open(request, timeout=10) as response:
|
||||
if response.status != 200:
|
||||
raise SystemExit(f"CDP close status {response.status}")
|
||||
response.read()
|
||||
PY
|
||||
}
|
||||
|
||||
post_invalid_worker() {
|
||||
local port="$1"
|
||||
local response_artifact="$2"
|
||||
python3 - "$port" "$response_artifact" <<'PY'
|
||||
import json
|
||||
import pathlib
|
||||
import sys
|
||||
import urllib.error
|
||||
import urllib.request
|
||||
|
||||
port, artifact = sys.argv[1:]
|
||||
body = {
|
||||
"url": (
|
||||
"https://example.invalid/am/oauth2/authorize"
|
||||
"?redirect_uri=sentinel%3A%2F%2Fcallback"
|
||||
"&code=SENTINEL_OAUTH_CODE_5c88"
|
||||
"&access_token=SENTINEL_ACCESS_TOKEN_1d62"
|
||||
"&refresh_token=SENTINEL_REFRESH_TOKEN_4e73"
|
||||
"&cookie=SENTINEL_COOKIE_7b21"
|
||||
),
|
||||
"email": "sentinel-email@example.invalid",
|
||||
"password": "SENTINEL_PASSWORD_9a34",
|
||||
"cookie": "SENTINEL_COOKIE_7b21",
|
||||
"oauth_code": "SENTINEL_OAUTH_CODE_5c88",
|
||||
"access_token": "SENTINEL_ACCESS_TOKEN_1d62",
|
||||
"refresh_token": "SENTINEL_REFRESH_TOKEN_4e73",
|
||||
}
|
||||
request = urllib.request.Request(
|
||||
f"http://127.0.0.1:{port}/worker",
|
||||
data=json.dumps(body, separators=(",", ":")).encode(),
|
||||
headers={"Content-Type": "application/json"},
|
||||
method="POST",
|
||||
)
|
||||
opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
|
||||
try:
|
||||
with opener.open(request, timeout=10) as response:
|
||||
status = response.status
|
||||
response_body = response.read()
|
||||
except urllib.error.HTTPError as error:
|
||||
status = error.code
|
||||
response_body = error.read()
|
||||
if status != 400:
|
||||
raise SystemExit(f"invalid worker status {status}, want 400")
|
||||
pathlib.Path(artifact).write_bytes(response_body)
|
||||
PY
|
||||
}
|
||||
|
||||
assert_no_9222_mapping() {
|
||||
local container="$1"
|
||||
local mapping
|
||||
mapping="$(docker port "$container" 9222/tcp 2>/dev/null || true)"
|
||||
[ -z "$mapping" ] || fail "container 9222 is mapped: $mapping"
|
||||
}
|
||||
|
||||
scan_logs() {
|
||||
local container="$1"
|
||||
local log_file="${tmp_dir}/${container}.log"
|
||||
docker logs "$container" > "$log_file" 2>&1
|
||||
for sentinel in "${sentinels[@]}"; do
|
||||
if grep -Fq "$sentinel" "$log_file"; then
|
||||
fail "$container logs contain sentinel $sentinel"
|
||||
fi
|
||||
done
|
||||
if grep -Fq "worker OAuth request" "$log_file"; then
|
||||
fail "$container began an OAuth flow for the rejected worker body"
|
||||
fi
|
||||
}
|
||||
|
||||
stop_and_assert() {
|
||||
local container="$1"
|
||||
local timing_artifact="$2"
|
||||
local started_ns ended_ns elapsed state
|
||||
started_ns="$(python3 -c 'import time; print(time.monotonic_ns())')"
|
||||
docker stop --time 10 "$container" >/dev/null
|
||||
ended_ns="$(python3 -c 'import time; print(time.monotonic_ns())')"
|
||||
elapsed="$(python3 - "$started_ns" "$ended_ns" <<'PY'
|
||||
import sys
|
||||
print((int(sys.argv[2]) - int(sys.argv[1])) / 1_000_000_000)
|
||||
PY
|
||||
)"
|
||||
printf 'seconds=%s\n' "$elapsed" > "$timing_artifact"
|
||||
python3 - "$elapsed" <<'PY'
|
||||
import sys
|
||||
if float(sys.argv[1]) > 10.0:
|
||||
raise SystemExit(f"container stop exceeded 10 seconds: {sys.argv[1]}")
|
||||
PY
|
||||
state="$(docker inspect --format '{{.State.Status}} {{.State.ExitCode}}' "$container")"
|
||||
[ "$state" = "exited 0" ] || fail "$container state is $state, want exited 0"
|
||||
}
|
||||
|
||||
mkdir -p "$artifacts_dir"
|
||||
write_options
|
||||
|
||||
if [ "${SKIP_BUILD:-0}" != "1" ]; then
|
||||
docker buildx build \
|
||||
--platform linux/amd64 \
|
||||
--build-arg BUILD_ARCH=amd64 \
|
||||
--load \
|
||||
--tag "$image" \
|
||||
"$repo_root/stelloauth"
|
||||
fi
|
||||
|
||||
start_container "$first_container"
|
||||
first_port="$(host_port "$first_container")"
|
||||
wait_ready "$first_container" "$first_port"
|
||||
assert_no_9222_mapping "$first_container"
|
||||
assert_loopback_cdp_listener "$first_container" "${artifacts_dir}/runtime-proc-net-tcp.txt"
|
||||
probe_and_close_cdp "$first_container"
|
||||
post_invalid_worker "$first_port" "${artifacts_dir}/runtime-invalid-worker-response.json"
|
||||
scan_logs "$first_container"
|
||||
stop_and_assert "$first_container" "${artifacts_dir}/runtime-first-stop.txt"
|
||||
scan_logs "$first_container"
|
||||
|
||||
start_container "$second_container"
|
||||
second_port="$(host_port "$second_container")"
|
||||
wait_ready "$second_container" "$second_port"
|
||||
assert_no_9222_mapping "$second_container"
|
||||
assert_loopback_cdp_listener "$second_container" "${artifacts_dir}/runtime-restart-proc-net-tcp.txt"
|
||||
probe_and_close_cdp "$second_container"
|
||||
|
||||
sleep 5
|
||||
docker stats --no-stream "$second_container" > "${artifacts_dir}/runtime-docker-stats.txt"
|
||||
docker top "$second_container" > "${artifacts_dir}/runtime-docker-top.txt"
|
||||
docker image inspect "$image" --format '{{.Size}}' > "${artifacts_dir}/runtime-image-size-bytes.txt"
|
||||
docker image inspect "$image" --format '{{json .Config.ExposedPorts}}' > "${artifacts_dir}/runtime-image-exposed-ports.json"
|
||||
docker inspect "$second_container" --format '{{json .HostConfig.PortBindings}}' > "${artifacts_dir}/runtime-host-port-bindings.json"
|
||||
|
||||
stop_and_assert "$second_container" "${artifacts_dir}/runtime-second-stop.txt"
|
||||
scan_logs "$second_container"
|
||||
|
||||
printf 'runtime acceptance PASS: root, CDP, loopback bind, invalid worker, redaction, stop, restart\n'
|
||||
Reference in New Issue
Block a user