Replace Python development tooling with Make and containerized shell

2026-09-12 23:14:34 +02:00
1 parent 23f7b78c3b
commit 1b8800ee73
@@ -0,0 +1,50 @@
+policies() (
+ root_token=$VAULT_TOKEN
+ identity=''
+ trap 'if [ -n "$identity" ]; then printf "{}" | VAULT_TOKEN=$identity vault auth/token/revoke-self POST >/dev/null; fi' EXIT
+ for service in bff notifications nats; do
+  directory="$STATE/agents/$service"
+  login=$(jq -n --rawfile role "$directory/role-id" --rawfile secret "$directory/secret-id" '{role_id:($role|rtrimstr("\n")),secret_id:($secret|rtrimstr("\n"))}' | vault auth/approle/login POST)
+  identity=$(printf '%s' "$login" | jq -er '.auth.client_token')
+  printf '%s' "$login" | jq '{token:.auth.client_token,paths:["kv/data/bootstrap/mongo","sys/init"]}' | vault sys/capabilities POST | jq -e '.data | all(.[]; .==["deny"])' >/dev/null || fail 'Service can access bootstrap credentials'
+  VAULT_TOKEN=$(printf '%s' "$login" | jq -er '.auth.client_token')
+  printf '{}' | vault auth/token/revoke-self POST >/dev/null
+  VAULT_TOKEN=$root_token
+  identity=''
+ done
+ echo 'PASS: service identities cannot read bootstrap credentials'
+)
+database_access() (
+ for role in bff notifications; do
+  database=sxchnge; forbidden=sxchnge_notifications
+  if [ "$role" = notifications ]; then database=sxchnge_notifications; forbidden=sxchnge; fi
+  vault "database/creds/$role" > "$WORK/lease"
+  trap 'jq "{lease_id:.lease_id}" "$WORK/lease" | vault sys/leases/revoke POST >/dev/null' EXIT
+  {
+   jq -r '"db.getSiblingDB(\"admin\").auth("+(.data.username|tojson)+","+(.data.password|tojson)+");"' "$WORK/lease"
+   printf 'const database="%s", forbidden="%s";\n' "$database" "$forbidden"
+   cat dev/mongo-check.js
+  } | mongo > "$WORK/check" || fail 'Mongo access/transaction check failed'
+  grep -q scope-ok "$WORK/check" || fail 'Mongo check incomplete'
+  jq '{lease_id:.lease_id,increment:"1h"}' "$WORK/lease" | vault sys/leases/renew POST | jq -e '.lease_duration>0' >/dev/null || fail 'Mongo renewal failed'
+  jq '{lease_id:.lease_id}' "$WORK/lease" | vault sys/leases/revoke POST >/dev/null
+  trap - EXIT
+  { admin_auth; jq -r '"print(admin.getUser("+(.data.username|tojson)+")===null);"' "$WORK/lease"; } | mongo > "$WORK/revoked" || fail 'Mongo revocation check failed'
+  grep -q true "$WORK/revoked" || fail 'Revoked Mongo user still exists'
+ done
+ echo 'PASS: Vault database issuance, isolated access, transaction commit/rollback, renewal and revocation'
+)
+infrastructure() {
+ compose ps --format json | jq -se '[.[] | select(.Service=="vault" or .Service=="mongo" or .Service=="nats")] | length==3 and all(.[];.Health=="healthy")' >/dev/null || fail 'Infrastructure is not healthy'
+ echo 'PASS: Vault, Mongo replica set and NATS JetStream are healthy'
+ policies
+ database_access
+}
+# Resolve through Docker DNS while verifying the certificate for localhost.
+https() { curl -sS --max-time 5 --cacert "$STATE/ca.pem" --connect-to localhost:5126:frontend:8443 "$@"; }
+product() {
+ compose ps --format json | jq -se 'length==6 and all(.[];.Health=="healthy")' >/dev/null || fail 'Expected six healthy services'
+ https -f https://localhost:5126/ >/dev/null
+ https -f https://localhost:5126/api/v1/health >/dev/null
+ echo 'PASS: six healthy services, frontend and proxied BFF use verified TLS; no email sent'
+}