Sam Rolfe
4f233a8012
Build on Phases 1–7. Adds the two override paths from AGENTS.md §4 FR-10/FR-11: the shared device keycode and the versioned admin HTTP API the separate Kotlin admin app will call. - store: migration 004 adds state.grant_until and a settings table. New overrides.go records every override in `overrides` and verifies the shared keycode (bcrypt; one code for every device, §10 rule 3). ExpireLocks also clears an expired grant, and NextScheduleBoundary includes the grant end so a device re-locks on time. - effective state: a grant unlocks a device inside a schedule window; a manual lock clears a grant and a grant clears a manual lock. The retained config payload gains grant_until (additive, v stays 1). - web: /api/v1/admin/... (list, state, lock, unlock, grant) guarded by CONTROL_ADMIN_API_TOKEN, separate from the session login, plus the on-device keycode endpoint POST /api/v1/device/override with per-address throttling. A state change is published retained before the API responds. - cmd/control: `keycode` subcommand and start-up seeding from CONTROL_DEVICE_KEYCODE_HASH. - deploy/verify-phase8.sh + `make verify-phase8` prove the definition of done: an API lock reaches a real broker subscriber in well under a second. - Version 0.6.0-phase8 (compose, Makefile, docs). Measured on .13: the lock reached the TLS broker subscriber in 7 ms (handler 1 ms, request to retained publish accepted). Tests: go vet ./... and go test -count=1 ./... pass in golang:1.25-alpine. Co-Authored-By: Paperclip <noreply@paperclip.ing>
144 lines
5.6 KiB
Bash
Executable File
144 lines
5.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Phase 8 definition of done: prove that a lock issued through the admin API
|
|
# reaches a device in under one second.
|
|
#
|
|
# It issues POST /api/v1/admin/devices/<id>/lock and measures the time from the
|
|
# request to the moment a real broker subscriber receives the retained
|
|
# restrict/<device>/config message over the 8883 TLS plane. Nothing shared is
|
|
# restarted or reconfigured: it only needs the Control Service (and its broker
|
|
# link) already running, the admin API token, and a device account from
|
|
# deploy/mosquitto/clients.env.
|
|
#
|
|
# Usage:
|
|
# make verify-phase8
|
|
# DEVICE_ID=2 deploy/verify-phase8.sh
|
|
#
|
|
# The device is unlocked again at the end, so the proof leaves no lock behind.
|
|
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")/.."
|
|
|
|
SERVICE_URL="${CONTROL_BASE_URL:-http://127.0.0.1:8791}"
|
|
CA_FILE="${MQTT_CA_FILE:-deploy/mosquitto/tls/ca.crt}"
|
|
CLIENTS_FILE="${MQTT_CLIENTS_FILE:-deploy/mosquitto/clients.env}"
|
|
ENV_FILE="${CONTROL_ENV_FILE:-environment.d/control-service.env}"
|
|
MQTT_IMAGE="${MQTT_IMAGE:-eclipse-mosquitto:latest}"
|
|
DEVICE_ID="${DEVICE_ID:-}"
|
|
|
|
die() { echo "verify-phase8: $*" >&2; exit 1; }
|
|
|
|
# The token may be exported or live in the service env file. Never echo it.
|
|
TOKEN="${CONTROL_ADMIN_API_TOKEN:-}"
|
|
if [[ -z "$TOKEN" && -f "$ENV_FILE" ]]; then
|
|
TOKEN="$(grep -E '^CONTROL_ADMIN_API_TOKEN=' "$ENV_FILE" | head -1 | cut -d= -f2- || true)"
|
|
fi
|
|
[[ -n "$TOKEN" ]] || die "set CONTROL_ADMIN_API_TOKEN or add it to $ENV_FILE"
|
|
|
|
[[ -f "$CA_FILE" ]] || die "missing CA file $CA_FILE"
|
|
[[ -f "$CLIENTS_FILE" ]] || die "missing device credentials $CLIENTS_FILE"
|
|
|
|
api() {
|
|
# api <method> <path> [json-body]
|
|
local method="$1" path="$2" body="${3:-}"
|
|
if [[ -n "$body" ]]; then
|
|
curl -sS -X "$method" -H "Authorization: Bearer $TOKEN" \
|
|
-H 'Content-Type: application/json' -d "$body" "$SERVICE_URL$path"
|
|
else
|
|
curl -sS -X "$method" -H "Authorization: Bearer $TOKEN" "$SERVICE_URL$path"
|
|
fi
|
|
}
|
|
|
|
# Pick a device.
|
|
if [[ -n "$DEVICE_ID" ]]; then
|
|
devices_json="$(api GET "/api/v1/admin/devices/$DEVICE_ID")"
|
|
echo "$devices_json" | jq -e '.ok == true' >/dev/null || die "device $DEVICE_ID not found: $devices_json"
|
|
else
|
|
devices_json="$(api GET /api/v1/admin/devices)"
|
|
echo "$devices_json" | jq -e '.ok == true and (.devices | length > 0)' >/dev/null \
|
|
|| die "no devices: $devices_json"
|
|
DEVICE_ID="$(echo "$devices_json" | jq -r '.devices[0].id')"
|
|
fi
|
|
|
|
device_name="$(echo "$devices_json" | jq -r --argjson id "$DEVICE_ID" \
|
|
'(.device // (.devices[] | select(.id==$id))).name')"
|
|
topic="$(echo "$devices_json" | jq -r --argjson id "$DEVICE_ID" \
|
|
'(.device // (.devices[] | select(.id==$id))).topic')"
|
|
[[ "$topic" == restrict/*/config ]] || die "unexpected device topic: $topic"
|
|
|
|
# The device token is the middle topic level; its password is in clients.env.
|
|
token="${topic#restrict/}"; token="${token%/config}"
|
|
password="$(awk -F'\t' -v t="$topic" '$3==t {print $2}' "$CLIENTS_FILE" | head -1)"
|
|
[[ -n "$password" ]] || die "no broker account for $topic in $CLIENTS_FILE"
|
|
|
|
echo "device: $device_name (id $DEVICE_ID)"
|
|
echo "topic: $topic"
|
|
echo "service: $SERVICE_URL"
|
|
|
|
WORK="$(mktemp -d)"
|
|
SUB_NAME="verify-phase8-sub-$$"
|
|
cleanup() {
|
|
timeout 20 docker rm -f "$SUB_NAME" >/dev/null 2>&1 || true
|
|
rm -rf "$WORK"
|
|
# Leave the device as we found it: no lock from this proof.
|
|
timeout 20 curl -sS -X POST -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
|
|
-d '{}' "$SERVICE_URL/api/v1/admin/devices/$DEVICE_ID/unlock" >/dev/null 2>&1 || true
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
# A real subscriber on the device's own TLS credentials. %U is a Unix timestamp
|
|
# with sub-second precision, so the receipt can be measured on the same clock.
|
|
: > "$WORK/sub.log"
|
|
timeout 60 docker run --rm -d --name "$SUB_NAME" --network host \
|
|
-v "$PWD/$CA_FILE:/tls/ca.crt:ro" -v "$WORK:/out" \
|
|
--entrypoint sh "$MQTT_IMAGE" -c \
|
|
"exec mosquitto_sub -h 127.0.0.1 -p 8883 --cafile /tls/ca.crt \
|
|
-u '$token' -P '$password' -t '$topic' -F '%U|%t|%p' > /out/sub.log 2>/out/sub.err" \
|
|
>/dev/null
|
|
|
|
# The retained config arrives at once, so its arrival proves the subscriber is
|
|
# connected and will see the lock.
|
|
for _ in $(seq 1 100); do
|
|
[[ -s "$WORK/sub.log" ]] && break
|
|
sleep 0.1
|
|
done
|
|
[[ -s "$WORK/sub.log" ]] || die "subscriber never received the retained config: $(cat "$WORK/sub.err" 2>/dev/null)"
|
|
before_lines="$(wc -l < "$WORK/sub.log")"
|
|
echo "retained before lock:"
|
|
tail -1 "$WORK/sub.log" | cut -c1-160
|
|
|
|
# Issue the lock and time it.
|
|
t0="$(date +%s.%N)"
|
|
http="$(curl -sS -o "$WORK/resp.json" -w '%{http_code} %{time_total}' \
|
|
-X POST -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
|
|
-d '{"minutes":30}' "$SERVICE_URL/api/v1/admin/devices/$DEVICE_ID/lock")"
|
|
t_after_curl="$(date +%s.%N)"
|
|
|
|
# Wait for the new retained message to reach the subscriber.
|
|
for _ in $(seq 1 100); do
|
|
[[ "$(wc -l < "$WORK/sub.log")" -gt "$before_lines" ]] && break
|
|
sleep 0.01
|
|
done
|
|
t_after_recv="$(date +%s.%N)"
|
|
received="$(tail -1 "$WORK/sub.log")"
|
|
t_recv="$(echo "$received" | cut -d'|' -f1)"
|
|
|
|
lat="$(awk -v a="$t0" -v b="$t_recv" 'BEGIN { printf "%.0f", (b-a)*1000 }')"
|
|
wall="$(awk -v a="$t0" -v b="$t_after_recv" 'BEGIN { printf "%.0f", (b-a)*1000 }')"
|
|
|
|
echo
|
|
echo "request: POST $SERVICE_URL/api/v1/admin/devices/$DEVICE_ID/lock {\"minutes\":30}"
|
|
echo "response: HTTP $(echo "$http" | cut -d' ' -f1) after $(echo "$http" | cut -d' ' -f2) s"
|
|
echo " $(cat "$WORK/resp.json")"
|
|
echo
|
|
echo "delivered: $received"
|
|
echo
|
|
echo "LATENCY (request -> subscriber receipt): ${lat} ms"
|
|
echo "LATENCY (upper bound, poll included): ${wall} ms"
|
|
|
|
if [[ "$lat" -ge 1000 ]]; then
|
|
die "lock took ${lat} ms, which is not under one second"
|
|
fi
|
|
echo "PASS: lock reached the device in ${lat} ms"
|