62 lines
3.0 KiB
Bash
Executable File
62 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
PUBLIC_ENTRY="${PUBLIC_ENTRY:-https://cnnetmkt.top/}"
|
|
AUTH_ENTRY="${AUTH_ENTRY:-https://auth.cnnetmkt.top}"
|
|
CLIENT_ID="${CASDOOR_CLIENT_ID:-aios8a810963c1dd368a}"
|
|
CALLBACK="${CASDOOR_CALLBACK:-https://cnnetmkt.top/casdoor/callback/}"
|
|
AIHOST_HOST="${AIHOST_HOST:-aihost}"
|
|
HW_HOST="${HW_HOST:-hw.imruyi.top}"
|
|
|
|
fail() {
|
|
printf 'FAIL: %s\n' "$*" >&2
|
|
exit 1
|
|
}
|
|
|
|
CALLBACK_ENCODED="$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$CALLBACK")"
|
|
AUTH_URL="$AUTH_ENTRY/login/oauth/authorize?client_id=$CLIENT_ID&response_type=code&redirect_uri=$CALLBACK_ENCODED&scope=read&state=aios-portal&language=zh"
|
|
|
|
printf '== public redirect chain ==\n'
|
|
chain="$(curl -k -sS -L -I --max-redirs 4 "$PUBLIC_ENTRY")"
|
|
printf '%s\n' "$chain"
|
|
printf '%s\n' "$chain" | grep -F "Location: $AUTH_ENTRY/login/oauth/authorize" >/dev/null \
|
|
|| fail "public entry did not redirect to $AUTH_ENTRY"
|
|
if printf '%s\n' "$chain" | grep -F 'auth.h.imruyi.top:8443' >/dev/null; then
|
|
fail 'public chain still exposes backup auth domain'
|
|
fi
|
|
|
|
printf '\n== auth authorize http ==\n'
|
|
auth_headers="$(curl -k -sS -D - -o /tmp/aios-auth-primary-body --max-time 20 "$AUTH_URL")"
|
|
printf '%s\n' "$auth_headers"
|
|
printf '%s\n' "$auth_headers" | grep -F 'HTTP/' >/dev/null || fail 'auth endpoint returned no HTTP headers'
|
|
if grep -E '许可跳转列表|redirect.*not|not.*redirect' /tmp/aios-auth-primary-body >/dev/null 2>&1; then
|
|
fail 'auth body still contains redirect allow-list error text'
|
|
fi
|
|
|
|
if command -v ssh >/dev/null 2>&1; then
|
|
printf '\n== casdoor db redirect allow-list ==\n'
|
|
redirects="$(ssh "$AIHOST_HOST" "docker exec casdoor-postgres psql -U casdoor -d casdoor -Atc \"select redirect_uris from application where owner='admin' and name='aios-portal';\"" 2>/dev/null || true)"
|
|
if [ -n "$redirects" ]; then
|
|
printf '%s\n' "$redirects"
|
|
printf '%s\n' "$redirects" | grep -F "$CALLBACK" >/dev/null \
|
|
|| fail "Casdoor DB does not include $CALLBACK"
|
|
else
|
|
printf 'WARN: skipped Casdoor DB readback; set AIHOST_HOST to a reachable SSH target for a strict DB check.\n'
|
|
fi
|
|
|
|
printf '\n== ucc runtime env ==\n'
|
|
runtime_env="$(docker inspect user-control-web --format '{{range .Config.Env}}{{println .}}{{end}}' 2>/dev/null | grep -E 'UCC_PUBLIC_BASE_URL|CASDOOR_(PUBLIC|INTERNAL|INVITE_SYNC)_BASE_URL' || true)"
|
|
if [ -z "$runtime_env" ]; then
|
|
runtime_env="$(ssh "$HW_HOST" 'docker inspect user-control-web --format "{{range .Config.Env}}{{println .}}{{end}}" | grep -E "UCC_PUBLIC_BASE_URL|CASDOOR_(PUBLIC|INTERNAL|INVITE_SYNC)_BASE_URL"' 2>/dev/null || true)"
|
|
fi
|
|
if [ -n "$runtime_env" ]; then
|
|
printf '%s\n' "$runtime_env"
|
|
printf '%s\n' "$runtime_env" | grep -F "CASDOOR_PUBLIC_BASE_URL=$AUTH_ENTRY" >/dev/null \
|
|
|| fail 'UCC runtime CASDOOR_PUBLIC_BASE_URL is not primary auth domain'
|
|
else
|
|
printf 'WARN: skipped UCC runtime env readback; run on hw.imruyi.top or set HW_HOST to a reachable SSH target.\n'
|
|
fi
|
|
fi
|
|
|
|
printf '\nPASS: cnnetmkt primary auth route is canonical and callback is allowed.\n'
|