42 lines
1.1 KiB
Bash
Executable File
42 lines
1.1 KiB
Bash
Executable File
#!/usr/bin/env sh
|
|
set -eu
|
|
|
|
if [ ! -f .env ]; then
|
|
echo "missing .env; copy .env.example and set development values" >&2
|
|
exit 1
|
|
fi
|
|
|
|
set -a
|
|
. ./.env
|
|
set +a
|
|
|
|
docker compose down --volumes --remove-orphans
|
|
docker compose up --build -d --wait
|
|
|
|
docker compose exec -T nginx nginx -V 2>&1 |
|
|
grep -q -- '--with-http_auth_request_module'
|
|
docker compose exec -T nginx nginx -T 2>&1 |
|
|
grep -q 'proxy_pass_request_body off'
|
|
|
|
app_container_id="$(docker compose ps -q app)"
|
|
published_app_port="$(docker inspect "$app_container_id" \
|
|
--format '{{with (index .NetworkSettings.Ports "8081/tcp")}}{{json .}}{{end}}')"
|
|
if [ -n "$published_app_port" ]; then
|
|
echo "backend port 8081 must not be published on the host" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if docker compose exec -T nginx wget -q -O /dev/null \
|
|
--header 'X-Auth-Request-User: spoofed-admin' \
|
|
http://app:8081/edge/me 2>/dev/null; then
|
|
echo "backend accepted a forged identity without the internal token" >&2
|
|
exit 1
|
|
fi
|
|
|
|
npm --prefix e2e ci
|
|
E2E_USERNAME=regular-user \
|
|
E2E_PASSWORD="$REGULAR_USER_PASSWORD" \
|
|
npm --prefix e2e run test:pattern4
|
|
|
|
echo "AP4 hardened Nginx auth_request edge flow verified"
|