| 1 | #!/usr/bin/env bash |
| 2 | # Mobile runtime surface smoke tests. |
| 3 | # Launches the compiled codewhale-tui binary on loopback ports and verifies |
| 4 | # the mobile control page, auth, API routes, and binding behaviour through |
| 5 | # real HTTP requests. |
| 6 | # |
| 7 | # Usage: ./scripts/mobile-smoke.sh |
| 8 | # Requires: curl, a built binary at target/release/codewhale-tui |
| 9 | # (the script will build it if cargo is available). |
| 10 | |
| 11 | set -euo pipefail |
| 12 | |
| 13 | SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" |
| 14 | REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)" |
| 15 | BINARY="${BINARY:-${REPO_ROOT}/target/release/codewhale-tui}" |
| 16 | PASS=0 |
| 17 | FAIL=0 |
| 18 | SERVER_PID="" |
| 19 | |
| 20 | # ── helpers ────────────────────────────────────────────────────────────────── |
| 21 | |
| 22 | log() { printf "\033[1;34m>>> %s\033[0m\n" "$*"; } |
| 23 | pass() { printf "\033[1;32m ✓ %s\033[0m\n" "$*"; PASS=$((PASS + 1)); } |
| 24 | fail() { printf "\033[1;31m ✗ %s\033[0m\n" "$*"; FAIL=$((FAIL + 1)); } |
| 25 | |
| 26 | cleanup() { |
| 27 | if [[ -n "$SERVER_PID" ]] && kill -0 "$SERVER_PID" 2>/dev/null; then |
| 28 | kill "$SERVER_PID" 2>/dev/null || true |
| 29 | wait "$SERVER_PID" 2>/dev/null || true |
| 30 | fi |
| 31 | } |
| 32 | trap cleanup EXIT |
| 33 | |
| 34 | pick_port() { |
| 35 | # Find a free TCP port on loopback. |
| 36 | python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1",0)); print(s.getsockname()[1]); s.close()' |
| 37 | } |
| 38 | |
| 39 | start_server() { |
| 40 | local port="$1"; shift |
| 41 | log "Starting server on port $port: $*" |
| 42 | "$BINARY" serve --port "$port" "$@" & |
| 43 | SERVER_PID=$! |
| 44 | # Wait for the server to become ready. |
| 45 | for _ in $(seq 1 30); do |
| 46 | if curl -sf --max-time 2 "http://127.0.0.1:${port}/health" >/dev/null 2>&1; then |
| 47 | return 0 |
| 48 | fi |
| 49 | sleep 0.3 |
| 50 | done |
| 51 | fail "Server did not become ready on port $port" |
| 52 | cleanup |
| 53 | return 1 |
| 54 | } |
| 55 | |
| 56 | stop_server() { |
| 57 | if [[ -n "$SERVER_PID" ]] && kill -0 "$SERVER_PID" 2>/dev/null; then |
| 58 | kill "$SERVER_PID" 2>/dev/null || true |
| 59 | wait "$SERVER_PID" 2>/dev/null || true |
| 60 | SERVER_PID="" |
| 61 | fi |
| 62 | } |
| 63 | |
| 64 | # assert_status METHOD PATH [HEADER_NAME:HEADER_VALUE] [JSON_BODY] EXPECTED_STATUS |
| 65 | assert_status() { |
| 66 | local method="$1" path="$2" header="" body="" expected="" |
| 67 | if [[ $# -eq 5 ]]; then |
| 68 | header="$3"; body="$4"; expected="$5" |
| 69 | elif [[ $# -eq 4 ]]; then |
| 70 | header="$3"; expected="$4" |
| 71 | else |
| 72 | expected="$3" |
| 73 | fi |
| 74 | |
| 75 | local url="http://127.0.0.1:${PORT}${path}" |
| 76 | local curl_args=(-sf --max-time 10 -o /dev/null -w '%{http_code}' -X "$method") |
| 77 | if [[ -n "$header" ]]; then |
| 78 | curl_args+=(-H "$header") |
| 79 | fi |
| 80 | if [[ -n "$body" ]]; then |
| 81 | curl_args+=(-H "Content-Type: application/json" --data "$body") |
| 82 | fi |
| 83 | |
| 84 | local actual |
| 85 | actual=$(curl "${curl_args[@]}" "$url" 2>/dev/null || true) |
| 86 | |
| 87 | if [[ "$actual" == "$expected" ]]; then |
| 88 | pass "$method $path → $expected" |
| 89 | else |
| 90 | fail "$method $path → expected $expected, got $actual" |
| 91 | fi |
| 92 | } |
| 93 | |
| 94 | # assert_body_contains METHOD PATH HEADER BODY_SUBSTRING |
| 95 | assert_body_contains() { |
| 96 | local method="$1" path="$2" header="$3" substring="$4" |
| 97 | local url="http://127.0.0.1:${PORT}${path}" |
| 98 | local curl_args=(-sf --max-time 10 -X "$method") |
| 99 | if [[ -n "$header" ]]; then |
| 100 | curl_args+=(-H "$header") |
| 101 | fi |
| 102 | |
| 103 | local body |
| 104 | body=$(curl "${curl_args[@]}" "$url" 2>/dev/null || true) |
| 105 | |
| 106 | if echo "$body" | grep -q "$substring"; then |
| 107 | pass "$method $path body contains '$substring'" |
| 108 | else |
| 109 | fail "$method $path body missing '$substring'" |
| 110 | fi |
| 111 | } |
| 112 | |
| 113 | assert_body_not_contains() { |
| 114 | local method="$1" path="$2" header="$3" substring="$4" |
| 115 | local url="http://127.0.0.1:${PORT}${path}" |
| 116 | local curl_args=(-sf --max-time 10 -X "$method") |
| 117 | if [[ -n "$header" ]]; then |
| 118 | curl_args+=(-H "$header") |
| 119 | fi |
| 120 | |
| 121 | local body |
| 122 | body=$(curl "${curl_args[@]}" "$url" 2>/dev/null || true) |
| 123 | |
| 124 | if echo "$body" | grep -q "$substring"; then |
| 125 | fail "$method $path body unexpectedly contains '$substring'" |
| 126 | else |
| 127 | pass "$method $path body does not contain '$substring'" |
| 128 | fi |
| 129 | } |
| 130 | |
| 131 | # ── build ──────────────────────────────────────────────────────────────────── |
| 132 | |
| 133 | if [[ ! -x "$BINARY" ]]; then |
| 134 | log "Binary not found; building codewhale-tui in release mode..." |
| 135 | cargo build -p codewhale-tui --release --locked |
| 136 | fi |
| 137 | |
| 138 | log "Using binary: $BINARY" |
| 139 | |
| 140 | # ── Test Group 1: Token auth ──────────────────────────────────────────────── |
| 141 | |
| 142 | TOKEN="smoke_test_token_$$" |
| 143 | PORT=$(pick_port) |
| 144 | |
| 145 | log "=== Test Group 1: Token auth ===" |
| 146 | start_server "$PORT" --mobile --auth-token "$TOKEN" |
| 147 | |
| 148 | assert_body_contains GET "/mobile" "" "Codewhale Mobile" |
| 149 | assert_body_not_contains GET "/mobile" "" "$TOKEN" |
| 150 | assert_status GET "/v1/threads/summary" 401 |
| 151 | assert_status GET "/v1/threads/summary" "Authorization: Bearer ${TOKEN}" 200 |
| 152 | assert_status POST "/v1/approvals/no_such_id" "Authorization: Bearer ${TOKEN}" '{"decision":"allow"}' 404 |
| 153 | |
| 154 | stop_server |
| 155 | |
| 156 | # ── Test Group 2: Insecure mode ───────────────────────────────────────────── |
| 157 | |
| 158 | PORT=$(pick_port) |
| 159 | |
| 160 | log "=== Test Group 2: Insecure mode (no token) ===" |
| 161 | start_server "$PORT" --mobile --insecure |
| 162 | |
| 163 | assert_body_contains GET "/mobile" "" "Codewhale Mobile" |
| 164 | assert_status GET "/v1/threads/summary" 200 |
| 165 | |
| 166 | stop_server |
| 167 | |
| 168 | # ── Test Group 3: Non-loopback binding rejection ──────────────────────────── |
| 169 | |
| 170 | PORT=$(pick_port) |
| 171 | |
| 172 | log "=== Test Group 3: Reject non-loopback mobile binding ===" |
| 173 | set +e |
| 174 | BIND_OUTPUT=$(python3 - "$BINARY" "$PORT" <<'PY' |
| 175 | import os |
| 176 | import signal |
| 177 | import subprocess |
| 178 | import sys |
| 179 | |
| 180 | probe = subprocess.Popen( |
| 181 | [sys.argv[1], "serve", "--host", "0.0.0.0", "--port", sys.argv[2], "--mobile", "--insecure"], |
| 182 | stdout=subprocess.PIPE, |
| 183 | stderr=subprocess.STDOUT, |
| 184 | start_new_session=True, |
| 185 | ) |
| 186 | try: |
| 187 | output, _ = probe.communicate(timeout=10) |
| 188 | except subprocess.TimeoutExpired: |
| 189 | try: |
| 190 | os.killpg(probe.pid, signal.SIGKILL) |
| 191 | except ProcessLookupError: |
| 192 | pass |
| 193 | output, _ = probe.communicate() |
| 194 | sys.stdout.buffer.write(output) |
| 195 | print("Non-loopback rejection probe timed out; terminated and reaped its process group.") |
| 196 | sys.exit(124) |
| 197 | sys.stdout.buffer.write(output) |
| 198 | sys.exit(probe.returncode) |
| 199 | PY |
| 200 | ) |
| 201 | BIND_STATUS=$? |
| 202 | set -e |
| 203 | |
| 204 | if [[ "$BIND_STATUS" -eq 124 ]]; then |
| 205 | fail "mobile did not reject a 0.0.0.0 binding within 10 seconds" |
| 206 | elif [[ "$BIND_STATUS" -ne 0 ]]; then |
| 207 | pass "mobile rejects a 0.0.0.0 binding" |
| 208 | else |
| 209 | fail "mobile unexpectedly accepted a 0.0.0.0 binding" |
| 210 | fi |
| 211 | |
| 212 | if echo "$BIND_OUTPUT" | grep -qi "loopback-only"; then |
| 213 | pass "rejection explains the loopback-only boundary" |
| 214 | else |
| 215 | fail "rejection missing loopback-only guidance" |
| 216 | fi |
| 217 | |
| 218 | # ── summary ────────────────────────────────────────────────────────────────── |
| 219 | |
| 220 | echo "" |
| 221 | log "Results: $PASS passed, $FAIL failed" |
| 222 | |
| 223 | if [[ "$FAIL" -gt 0 ]]; then |
| 224 | exit 1 |
| 225 | fi |
| 226 |