Phase 8: overrides (shared keycode + versioned admin lock/unlock/grant API)
Build on Phases 1–7. Adds the two override paths from AGENTS.md §4 FR-10/FR-11: the shared device keycode and the versioned admin HTTP API the separate Kotlin admin app will call. - store: migration 004 adds state.grant_until and a settings table. New overrides.go records every override in `overrides` and verifies the shared keycode (bcrypt; one code for every device, §10 rule 3). ExpireLocks also clears an expired grant, and NextScheduleBoundary includes the grant end so a device re-locks on time. - effective state: a grant unlocks a device inside a schedule window; a manual lock clears a grant and a grant clears a manual lock. The retained config payload gains grant_until (additive, v stays 1). - web: /api/v1/admin/... (list, state, lock, unlock, grant) guarded by CONTROL_ADMIN_API_TOKEN, separate from the session login, plus the on-device keycode endpoint POST /api/v1/device/override with per-address throttling. A state change is published retained before the API responds. - cmd/control: `keycode` subcommand and start-up seeding from CONTROL_DEVICE_KEYCODE_HASH. - deploy/verify-phase8.sh + `make verify-phase8` prove the definition of done: an API lock reaches a real broker subscriber in well under a second. - Version 0.6.0-phase8 (compose, Makefile, docs). Measured on .13: the lock reached the TLS broker subscriber in 7 ms (handler 1 ms, request to retained publish accepted). Tests: go vet ./... and go test -count=1 ./... pass in golang:1.25-alpine. Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
143
deploy/verify-phase8.sh
Executable file
143
deploy/verify-phase8.sh
Executable file
@@ -0,0 +1,143 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# Phase 8 definition of done: prove that a lock issued through the admin API
|
||||
# reaches a device in under one second.
|
||||
#
|
||||
# It issues POST /api/v1/admin/devices/<id>/lock and measures the time from the
|
||||
# request to the moment a real broker subscriber receives the retained
|
||||
# restrict/<device>/config message over the 8883 TLS plane. Nothing shared is
|
||||
# restarted or reconfigured: it only needs the Control Service (and its broker
|
||||
# link) already running, the admin API token, and a device account from
|
||||
# deploy/mosquitto/clients.env.
|
||||
#
|
||||
# Usage:
|
||||
# make verify-phase8
|
||||
# DEVICE_ID=2 deploy/verify-phase8.sh
|
||||
#
|
||||
# The device is unlocked again at the end, so the proof leaves no lock behind.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
cd "$(dirname "$0")/.."
|
||||
|
||||
SERVICE_URL="${CONTROL_BASE_URL:-http://127.0.0.1:8791}"
|
||||
CA_FILE="${MQTT_CA_FILE:-deploy/mosquitto/tls/ca.crt}"
|
||||
CLIENTS_FILE="${MQTT_CLIENTS_FILE:-deploy/mosquitto/clients.env}"
|
||||
ENV_FILE="${CONTROL_ENV_FILE:-environment.d/control-service.env}"
|
||||
MQTT_IMAGE="${MQTT_IMAGE:-eclipse-mosquitto:latest}"
|
||||
DEVICE_ID="${DEVICE_ID:-}"
|
||||
|
||||
die() { echo "verify-phase8: $*" >&2; exit 1; }
|
||||
|
||||
# The token may be exported or live in the service env file. Never echo it.
|
||||
TOKEN="${CONTROL_ADMIN_API_TOKEN:-}"
|
||||
if [[ -z "$TOKEN" && -f "$ENV_FILE" ]]; then
|
||||
TOKEN="$(grep -E '^CONTROL_ADMIN_API_TOKEN=' "$ENV_FILE" | head -1 | cut -d= -f2- || true)"
|
||||
fi
|
||||
[[ -n "$TOKEN" ]] || die "set CONTROL_ADMIN_API_TOKEN or add it to $ENV_FILE"
|
||||
|
||||
[[ -f "$CA_FILE" ]] || die "missing CA file $CA_FILE"
|
||||
[[ -f "$CLIENTS_FILE" ]] || die "missing device credentials $CLIENTS_FILE"
|
||||
|
||||
api() {
|
||||
# api <method> <path> [json-body]
|
||||
local method="$1" path="$2" body="${3:-}"
|
||||
if [[ -n "$body" ]]; then
|
||||
curl -sS -X "$method" -H "Authorization: Bearer $TOKEN" \
|
||||
-H 'Content-Type: application/json' -d "$body" "$SERVICE_URL$path"
|
||||
else
|
||||
curl -sS -X "$method" -H "Authorization: Bearer $TOKEN" "$SERVICE_URL$path"
|
||||
fi
|
||||
}
|
||||
|
||||
# Pick a device.
|
||||
if [[ -n "$DEVICE_ID" ]]; then
|
||||
devices_json="$(api GET "/api/v1/admin/devices/$DEVICE_ID")"
|
||||
echo "$devices_json" | jq -e '.ok == true' >/dev/null || die "device $DEVICE_ID not found: $devices_json"
|
||||
else
|
||||
devices_json="$(api GET /api/v1/admin/devices)"
|
||||
echo "$devices_json" | jq -e '.ok == true and (.devices | length > 0)' >/dev/null \
|
||||
|| die "no devices: $devices_json"
|
||||
DEVICE_ID="$(echo "$devices_json" | jq -r '.devices[0].id')"
|
||||
fi
|
||||
|
||||
device_name="$(echo "$devices_json" | jq -r --argjson id "$DEVICE_ID" \
|
||||
'(.device // (.devices[] | select(.id==$id))).name')"
|
||||
topic="$(echo "$devices_json" | jq -r --argjson id "$DEVICE_ID" \
|
||||
'(.device // (.devices[] | select(.id==$id))).topic')"
|
||||
[[ "$topic" == restrict/*/config ]] || die "unexpected device topic: $topic"
|
||||
|
||||
# The device token is the middle topic level; its password is in clients.env.
|
||||
token="${topic#restrict/}"; token="${token%/config}"
|
||||
password="$(awk -F'\t' -v t="$topic" '$3==t {print $2}' "$CLIENTS_FILE" | head -1)"
|
||||
[[ -n "$password" ]] || die "no broker account for $topic in $CLIENTS_FILE"
|
||||
|
||||
echo "device: $device_name (id $DEVICE_ID)"
|
||||
echo "topic: $topic"
|
||||
echo "service: $SERVICE_URL"
|
||||
|
||||
WORK="$(mktemp -d)"
|
||||
SUB_NAME="verify-phase8-sub-$$"
|
||||
cleanup() {
|
||||
timeout 20 docker rm -f "$SUB_NAME" >/dev/null 2>&1 || true
|
||||
rm -rf "$WORK"
|
||||
# Leave the device as we found it: no lock from this proof.
|
||||
timeout 20 curl -sS -X POST -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
|
||||
-d '{}' "$SERVICE_URL/api/v1/admin/devices/$DEVICE_ID/unlock" >/dev/null 2>&1 || true
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
# A real subscriber on the device's own TLS credentials. %U is a Unix timestamp
|
||||
# with sub-second precision, so the receipt can be measured on the same clock.
|
||||
: > "$WORK/sub.log"
|
||||
timeout 60 docker run --rm -d --name "$SUB_NAME" --network host \
|
||||
-v "$PWD/$CA_FILE:/tls/ca.crt:ro" -v "$WORK:/out" \
|
||||
--entrypoint sh "$MQTT_IMAGE" -c \
|
||||
"exec mosquitto_sub -h 127.0.0.1 -p 8883 --cafile /tls/ca.crt \
|
||||
-u '$token' -P '$password' -t '$topic' -F '%U|%t|%p' > /out/sub.log 2>/out/sub.err" \
|
||||
>/dev/null
|
||||
|
||||
# The retained config arrives at once, so its arrival proves the subscriber is
|
||||
# connected and will see the lock.
|
||||
for _ in $(seq 1 100); do
|
||||
[[ -s "$WORK/sub.log" ]] && break
|
||||
sleep 0.1
|
||||
done
|
||||
[[ -s "$WORK/sub.log" ]] || die "subscriber never received the retained config: $(cat "$WORK/sub.err" 2>/dev/null)"
|
||||
before_lines="$(wc -l < "$WORK/sub.log")"
|
||||
echo "retained before lock:"
|
||||
tail -1 "$WORK/sub.log" | cut -c1-160
|
||||
|
||||
# Issue the lock and time it.
|
||||
t0="$(date +%s.%N)"
|
||||
http="$(curl -sS -o "$WORK/resp.json" -w '%{http_code} %{time_total}' \
|
||||
-X POST -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
|
||||
-d '{"minutes":30}' "$SERVICE_URL/api/v1/admin/devices/$DEVICE_ID/lock")"
|
||||
t_after_curl="$(date +%s.%N)"
|
||||
|
||||
# Wait for the new retained message to reach the subscriber.
|
||||
for _ in $(seq 1 100); do
|
||||
[[ "$(wc -l < "$WORK/sub.log")" -gt "$before_lines" ]] && break
|
||||
sleep 0.01
|
||||
done
|
||||
t_after_recv="$(date +%s.%N)"
|
||||
received="$(tail -1 "$WORK/sub.log")"
|
||||
t_recv="$(echo "$received" | cut -d'|' -f1)"
|
||||
|
||||
lat="$(awk -v a="$t0" -v b="$t_recv" 'BEGIN { printf "%.0f", (b-a)*1000 }')"
|
||||
wall="$(awk -v a="$t0" -v b="$t_after_recv" 'BEGIN { printf "%.0f", (b-a)*1000 }')"
|
||||
|
||||
echo
|
||||
echo "request: POST $SERVICE_URL/api/v1/admin/devices/$DEVICE_ID/lock {\"minutes\":30}"
|
||||
echo "response: HTTP $(echo "$http" | cut -d' ' -f1) after $(echo "$http" | cut -d' ' -f2) s"
|
||||
echo " $(cat "$WORK/resp.json")"
|
||||
echo
|
||||
echo "delivered: $received"
|
||||
echo
|
||||
echo "LATENCY (request -> subscriber receipt): ${lat} ms"
|
||||
echo "LATENCY (upper bound, poll included): ${wall} ms"
|
||||
|
||||
if [[ "$lat" -ge 1000 ]]; then
|
||||
die "lock took ${lat} ms, which is not under one second"
|
||||
fi
|
||||
echo "PASS: lock reached the device in ${lat} ms"
|
||||
Reference in New Issue
Block a user