ljwx-health/scripts/smoke-authenticated-k3s.sh

#!/usr/bin/env bash

set -euo pipefail

BASE_URL="${SMOKE_BASE_URL:-https://health-admin.lingjingwanxiang.cn}"
USERNAME="${SMOKE_USERNAME:-}"
PASSWORD="${SMOKE_PASSWORD:-}"
PASSWORD_SHA256="${SMOKE_PASSWORD_SHA256:-}"
LOGIN_PATH="${SMOKE_LOGIN_PATH:-/api/auth/user_name}"
VERIFY_USERINFO_PATH="${SMOKE_VERIFY_USERINFO_PATH:-/api/auth/user_info}"
LOGOUT_PATH="${SMOKE_LOGOUT_PATH:-/api/auth/logout}"

# Auth-required business endpoints in current deployment.
BUSINESS_ENDPOINTS_CSV="${SMOKE_BUSINESS_ENDPOINTS:-/api/health/profile/test,/api/health/profile/baseline/generate?userId=1&days=7}"
BUSINESS_METHODS_CSV="${SMOKE_BUSINESS_METHODS:-GET,POST}"

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

PASS_COUNT=0
FAIL_COUNT=0

ok() {
  echo -e "${GREEN}[PASS]${NC} $1"
  PASS_COUNT=$((PASS_COUNT + 1))
}

warn() {
  echo -e "${YELLOW}[WARN]${NC} $1"
}

bad() {
  echo -e "${RED}[FAIL]${NC} $1"
  FAIL_COUNT=$((FAIL_COUNT + 1))
}

info() {
  echo -e "${BLUE}[INFO]${NC} $1"
}

need_cmd() {
  if ! command -v "$1" >/dev/null 2>&1; then
    echo -e "${RED}[FATAL]${NC} missing required command: $1"
    exit 2
  fi
}

split_csv_to_array() {
  local input="$1"
  local -n output_arr=$2
  IFS=',' read -r -a output_arr <<<"$input"
}

resolve_password_sha256() {
  if [[ -n "${PASSWORD_SHA256}" ]]; then
    echo "${PASSWORD_SHA256}"
    return 0
  fi

  if [[ -z "${PASSWORD}" ]]; then
    return 1
  fi

  if command -v sha256sum >/dev/null 2>&1; then
    printf "%s" "${PASSWORD}" | sha256sum | awk '{print $1}'
    return 0
  fi

  if command -v shasum >/dev/null 2>&1; then
    printf "%s" "${PASSWORD}" | shasum -a 256 | awk '{print $1}'
    return 0
  fi

  return 1
}

json_field_or_empty() {
  local file="$1"
  local field="$2"
  jq -r "${field} // empty" "${file}" 2>/dev/null || true
}

need_cmd curl
need_cmd jq

if [[ -z "${USERNAME}" ]]; then
  echo -e "${RED}[FATAL]${NC} SMOKE_USERNAME is required"
  exit 2
fi

PASSWORD_SHA256="$(resolve_password_sha256 || true)"
if [[ -z "${PASSWORD_SHA256}" ]]; then
  echo -e "${RED}[FATAL]${NC} set SMOKE_PASSWORD_SHA256 or SMOKE_PASSWORD"
  exit 2
fi

if [[ ${#PASSWORD_SHA256} -ne 64 ]]; then
  echo -e "${RED}[FATAL]${NC} password sha256 length must be 64, got ${#PASSWORD_SHA256}"
  exit 2
fi

split_csv_to_array "${BUSINESS_ENDPOINTS_CSV}" BUSINESS_ENDPOINTS
split_csv_to_array "${BUSINESS_METHODS_CSV}" BUSINESS_METHODS

if [[ ${#BUSINESS_ENDPOINTS[@]} -eq 0 ]]; then
  echo -e "${RED}[FATAL]${NC} no business endpoints configured"
  exit 2
fi

if [[ ${#BUSINESS_METHODS[@]} -ne ${#BUSINESS_ENDPOINTS[@]} ]]; then
  echo -e "${RED}[FATAL]${NC} SMOKE_BUSINESS_METHODS count (${#BUSINESS_METHODS[@]}) != endpoints count (${#BUSINESS_ENDPOINTS[@]})"
  exit 2
fi

echo "========================================"
echo "Authenticated Smoke Check (k3s public)"
echo "========================================"
info "base_url=${BASE_URL}"
info "username=${USERNAME}"
info "login_path=${LOGIN_PATH}"

LOGIN_PAYLOAD="$(jq -nc --arg u "${USERNAME}" --arg p "${PASSWORD_SHA256}" '{userName:$u,password:$p}')"
LOGIN_HTTP_CODE="$(curl -sk -o /tmp/smoke_login.json -w "%{http_code}" \
  -H "Content-Type: application/json" \
  -d "${LOGIN_PAYLOAD}" \
  "${BASE_URL}${LOGIN_PATH}")"
LOGIN_APP_CODE="$(json_field_or_empty /tmp/smoke_login.json '.code')"
LOGIN_MSG="$(json_field_or_empty /tmp/smoke_login.json '.message')"
TOKEN="$(json_field_or_empty /tmp/smoke_login.json '.data.token')"

if [[ "${LOGIN_HTTP_CODE}" == "200" && "${LOGIN_APP_CODE}" == "200" && -n "${TOKEN}" ]]; then
  ok "login success (http=${LOGIN_HTTP_CODE}, appCode=${LOGIN_APP_CODE})"
else
  bad "login failed (http=${LOGIN_HTTP_CODE}, appCode=${LOGIN_APP_CODE:-N/A}, msg=${LOGIN_MSG:-N/A})"
fi

if [[ -n "${TOKEN}" ]]; then
  USERINFO_HTTP_CODE="$(curl -sk -o /tmp/smoke_userinfo.json -w "%{http_code}" \
    -H "Authorization: Bearer ${TOKEN}" \
    "${BASE_URL}${VERIFY_USERINFO_PATH}")"
  USERINFO_APP_CODE="$(json_field_or_empty /tmp/smoke_userinfo.json '.code')"
  USERINFO_NAME="$(json_field_or_empty /tmp/smoke_userinfo.json '.data.userName')"
  if [[ "${USERINFO_HTTP_CODE}" == "200" && "${USERINFO_APP_CODE}" == "200" ]]; then
    ok "auth verify success (${VERIFY_USERINFO_PATH}, user=${USERINFO_NAME:-unknown})"
  else
    bad "auth verify failed (${VERIFY_USERINFO_PATH}, http=${USERINFO_HTTP_CODE}, appCode=${USERINFO_APP_CODE:-N/A})"
  fi
else
  bad "skip auth verify due to missing token"
fi

for i in "${!BUSINESS_ENDPOINTS[@]}"; do
  method="$(echo "${BUSINESS_METHODS[$i]}" | tr '[:lower:]' '[:upper:]')"
  endpoint="${BUSINESS_ENDPOINTS[$i]}"
  http_code="$(curl -sk -X "${method}" -o /tmp/smoke_business.json -w "%{http_code}" \
    -H "Authorization: Bearer ${TOKEN}" \
    "${BASE_URL}${endpoint}")"
  app_code="$(json_field_or_empty /tmp/smoke_business.json '.code')"
  msg="$(json_field_or_empty /tmp/smoke_business.json '.message')"
  if [[ "${http_code}" == "200" && "${app_code}" == "200" ]]; then
    ok "business ${method} ${endpoint} success"
  else
    bad "business ${method} ${endpoint} failed (http=${http_code}, appCode=${app_code:-N/A}, msg=${msg:-N/A})"
  fi
done

if [[ -n "${TOKEN}" ]]; then
  LOGOUT_HTTP_CODE="$(curl -sk -o /tmp/smoke_logout.json -w "%{http_code}" \
    -X POST \
    -H "Authorization: Bearer ${TOKEN}" \
    "${BASE_URL}${LOGOUT_PATH}")"
  LOGOUT_APP_CODE="$(json_field_or_empty /tmp/smoke_logout.json '.code')"
  if [[ "${LOGOUT_HTTP_CODE}" == "200" && "${LOGOUT_APP_CODE}" == "200" ]]; then
    ok "logout success"
  else
    warn "logout not strict-fail (http=${LOGOUT_HTTP_CODE}, appCode=${LOGOUT_APP_CODE:-N/A})"
  fi
fi

echo "----------------------------------------"
echo "PASS: ${PASS_COUNT}"
echo "FAIL: ${FAIL_COUNT}"
echo "----------------------------------------"

if [[ "${FAIL_COUNT}" -gt 0 ]]; then
  exit 1
fi

exit 0