lilleman
1d198acc97
The from-scratch dev login was broken: open the banner's http://localhost:3000, sign in as the seeded admin, and you landed on http://127.0.0.1:3000/error "Page not found". Root cause: the banner/APP_URL said localhost but kratos.yml hard-coded 127.0.0.1, and a host-scoped Kratos CSRF cookie can't cross localhost<->127.0.0.1, so the cross-host login POST lost it; Kratos redirected to its error sink, which the app had no route for (404). Make APP_URL the single source of truth for the public host: - Canonical-host redirect (app.ts): when APP_URL is set, an off-host GET/HEAD visitor is 308'd to it (path+query kept) before a flow starts, so the browser, the themed forms and the cross-origin Kratos POST share one cookie host. After /public/ so static/health checks stay host-agnostic; GET/HEAD only so a 308 never replays a cross-host POST. - Opt-in (no NODE_ENV / no magic default): unset => no redirect, so a prod deploy that forgets APP_URL can't bounce real users to a stale default. The dev stack sets it. - kratos.yml browser URLs default to localhost (match APP_URL's dev value) and derive from ${APP_URL} via compose.override.yml; SERVE_PUBLIC_BASE_URL keeps the dev Ory port. - Real /error page (views/error.ejs) replaces the catch-all 404 for genuine flow errors. Tests-first: config (opt-in/validated), app (308 on mismatch, no-redirect on match, static host-agnostic, POST untouched, /error page), updated kratos.test host pins. New devstack regression (e2e/devstack-login.spec + compose.e2e-devstack.yml) drives the plain docker-compose-up topology on the host network: login from localhost works and 127.0.0.1 is canonicalised; wired into scripts/ci.sh. typecheck + 360 units + full ci.sh (visual 10 · auth 1 · oauth 2 · full 7 · devstack 2) green.
60 lines
3.4 KiB
Bash
Executable File
60 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# The full CI gate (todo §8): typecheck → unit tests → every E2E suite, each against a FRESH stack
|
|
# that is always torn down. One reproducible command — run it locally or wire it into your CI
|
|
# service. Docker-only (it drives `docker compose`; node/npm/tsc run inside containers, never the host).
|
|
#
|
|
# bash scripts/ci.sh
|
|
#
|
|
# Exits non-zero on the first failure. Each E2E suite OWNS a clean stack — never point two suites at
|
|
# one backend (auth-refresh revokes the admin's sessions; full-flow writes users/groups/roles to Keto).
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
step() { printf '\n\033[1;34m==> %s\033[0m\n' "$1"; }
|
|
|
|
# Pins that MUST move in lockstep: a browser/runner mismatch yields confusing E2E failures.
|
|
step "Playwright pin lockstep (Dockerfile.e2e image == e2e/package.json @playwright/test)"
|
|
# `|| true` so a no-match doesn't trip `set -e`/`pipefail` before the explicit check below can report.
|
|
img=$(grep -oE 'playwright:v[0-9.]+' Dockerfile.e2e | grep -oE '[0-9.]+$' || true)
|
|
pkg=$(grep -oE '"@playwright/test": "[0-9.]+"' e2e/package.json | grep -oE '[0-9.]+' || true)
|
|
[ -n "$img" ] && [ "$img" = "$pkg" ] || { echo "Playwright pin mismatch/unreadable: image v$img vs @playwright/test $pkg"; exit 1; }
|
|
echo "ok ($img)"
|
|
|
|
step "Typecheck"
|
|
docker compose run --rm --no-deps web npm run typecheck
|
|
|
|
step "Unit tests"
|
|
units=$(docker compose run --rm --no-deps web npm test 2>&1) || { echo "$units"; exit 1; }
|
|
echo "$units" | grep -E '^. (tests|pass|fail) ' || true
|
|
# Sanity floor: catch a glob that matches too few files (a full empty glob already exits non-zero above).
|
|
count=$(echo "$units" | grep -oE 'tests [0-9]+' | grep -oE '[0-9]+' | head -1 || true)
|
|
[ "${count:-0}" -ge 50 ] || { echo "only ${count:-0} unit tests ran — test glob broken?"; exit 1; }
|
|
|
|
# Run one E2E suite against its OWN named stack, then always tear it down (even on failure). The
|
|
# per-suite project name keeps a flaky teardown from leaking containers/volumes into the next suite.
|
|
e2e() {
|
|
step "E2E: $1"
|
|
local proj="plainpages-e2e-$(basename "$1" .yml | tr '.' '-')" # dots aren't valid in a compose project name
|
|
local rc=0
|
|
docker compose -p "$proj" -f compose.yml -f "$1" run --build --rm e2e || rc=$?
|
|
docker compose -p "$proj" -f compose.yml -f "$1" down -v >/dev/null 2>&1 || true
|
|
[ "$rc" -eq 0 ] || { echo "E2E suite $1 failed (exit $rc)"; exit "$rc"; }
|
|
}
|
|
|
|
e2e compose.e2e.yml # visual / design-system parity (Ory-free)
|
|
e2e compose.e2e-auth.yml # token timeout + silent re-mint
|
|
e2e compose.e2e-oauth.yml # OAuth2 login + consent
|
|
e2e compose.e2e-full.yml # full browser flow: login (password + SSO), menu, CRUD, plugin, logout
|
|
|
|
# Dev-stack login regression — runs against the PLAIN `docker compose up` topology (base + override)
|
|
# with the runner on the HOST network, so it can't use the shared e2e() helper (which merges only
|
|
# compose.yml + the suite). Needs host networking + the host ports 3000/4433 free (Linux CI).
|
|
step "E2E: compose.e2e-devstack.yml (dev-stack login: localhost works + 127.0.0.1 canonicalised)"
|
|
devstack_files=(-f compose.yml -f compose.override.yml -f compose.e2e-devstack.yml)
|
|
rc=0
|
|
docker compose -p plainpages-e2e-devstack "${devstack_files[@]}" run --build --rm e2e || rc=$?
|
|
docker compose -p plainpages-e2e-devstack "${devstack_files[@]}" down -v >/dev/null 2>&1 || true
|
|
[ "$rc" -eq 0 ] || { echo "E2E suite compose.e2e-devstack.yml failed (exit $rc)"; exit "$rc"; }
|
|
|
|
step "ALL GREEN"
|