NPM: canonical 301 for www sankofa/phoenix/the-order; E2E pass on 301/308
- update-npmplus-proxy-hosts-api.sh: optional advanced_config 301 via 5th/6th args; wire www.the-order → https://the-order.sankofa.nexus; document OSJ portal and the_order repo path - update-sankofa-npmplus-proxy-hosts.sh: same 301 for www rows via 4th pipe field - verify-end-to-end-routing.sh: www.the-order in inventory; treat 301/308 as HTTPS pass for www.sankofa, www.phoenix, www.the-order - configure-npmplus-domains.js: comment — avoid duplicate redirection UI rows for Sankofa www - AGENTS.md, ALL_VMIDS_ENDPOINTS.md, E2E_ENDPOINTS_LIST.md: Order portal and www redirect notes Made-with: Cursor
This commit is contained in:
defiQUG
@@ -34,6 +34,9 @@ PUBLIC_IP_FOURTH="${PUBLIC_IP_FOURTH:-76.53.10.40}"
|
||||
ACCEPT_ANY_DNS="${ACCEPT_ANY_DNS:-0}"
|
||||
# Use system resolver (e.g. /etc/hosts) instead of dig @8.8.8.8 — set when running from LAN with generate-e2e-hosts.sh entries
|
||||
E2E_USE_SYSTEM_RESOLVER="${E2E_USE_SYSTEM_RESOLVER:-0}"
|
||||
# openssl s_client has no built-in connect timeout; wrap to avoid hangs (private/wss hosts).
|
||||
E2E_OPENSSL_TIMEOUT="${E2E_OPENSSL_TIMEOUT:-15}"
|
||||
E2E_OPENSSL_X509_TIMEOUT="${E2E_OPENSSL_X509_TIMEOUT:-5}"
|
||||
if [ "$E2E_USE_SYSTEM_RESOLVER" = "1" ]; then
|
||||
ACCEPT_ANY_DNS=1
|
||||
log_info "E2E_USE_SYSTEM_RESOLVER=1: using getent (respects /etc/hosts); ACCEPT_ANY_DNS=1"
|
||||
@@ -77,7 +80,8 @@ declare -A DOMAIN_TYPES_ALL=(
|
||||
["www.sankofa.nexus"]="web"
|
||||
["phoenix.sankofa.nexus"]="web"
|
||||
["www.phoenix.sankofa.nexus"]="web"
|
||||
["the-order.sankofa.nexus"]="web"
|
||||
["the-order.sankofa.nexus"]="web" # OSJ portal (secure auth); app: ~/projects/the_order
|
||||
["www.the-order.sankofa.nexus"]="web" # 301 → https://the-order.sankofa.nexus
|
||||
["studio.sankofa.nexus"]="web"
|
||||
["rpc.public-0138.defi-oracle.io"]="rpc-http"
|
||||
["rpc.defi-oracle.io"]="rpc-http"
|
||||
@@ -162,11 +166,15 @@ else
|
||||
fi
|
||||
|
||||
# Domains that are optional when any test fails (off-LAN, 502, unreachable); fail → skip so run passes.
|
||||
_PUB_OPTIONAL_WHEN_FAIL="dapp.d-bis.org mifos.d-bis.org explorer.d-bis.org dbis-admin.d-bis.org dbis-api.d-bis.org dbis-api-2.d-bis.org secure.d-bis.org sankofa.nexus www.sankofa.nexus phoenix.sankofa.nexus www.phoenix.sankofa.nexus the-order.sankofa.nexus www.the-order.sankofa.nexus studio.sankofa.nexus mim4u.org www.mim4u.org secure.mim4u.org training.mim4u.org rpc-http-pub.d-bis.org rpc.d-bis.org rpc2.d-bis.org rpc.public-0138.defi-oracle.io rpc.defi-oracle.io ws.rpc.d-bis.org ws.rpc2.d-bis.org"
|
||||
_PRIV_OPTIONAL_WHEN_FAIL="rpc-http-prv.d-bis.org rpc-ws-prv.d-bis.org rpc-fireblocks.d-bis.org ws.rpc-fireblocks.d-bis.org"
|
||||
if [[ -z "${E2E_OPTIONAL_WHEN_FAIL:-}" ]]; then
|
||||
if [[ "$PROFILE" == "private" ]]; then
|
||||
E2E_OPTIONAL_WHEN_FAIL="rpc-http-prv.d-bis.org rpc-ws-prv.d-bis.org rpc-fireblocks.d-bis.org ws.rpc-fireblocks.d-bis.org"
|
||||
E2E_OPTIONAL_WHEN_FAIL="$_PRIV_OPTIONAL_WHEN_FAIL"
|
||||
elif [[ "$PROFILE" == "all" ]]; then
|
||||
E2E_OPTIONAL_WHEN_FAIL="$_PRIV_OPTIONAL_WHEN_FAIL $_PUB_OPTIONAL_WHEN_FAIL"
|
||||
else
|
||||
E2E_OPTIONAL_WHEN_FAIL="dapp.d-bis.org mifos.d-bis.org explorer.d-bis.org dbis-admin.d-bis.org dbis-api.d-bis.org dbis-api-2.d-bis.org secure.d-bis.org sankofa.nexus www.sankofa.nexus phoenix.sankofa.nexus www.phoenix.sankofa.nexus the-order.sankofa.nexus studio.sankofa.nexus mim4u.org www.mim4u.org secure.mim4u.org training.mim4u.org rpc-http-pub.d-bis.org rpc.d-bis.org rpc2.d-bis.org rpc.public-0138.defi-oracle.io rpc.defi-oracle.io ws.rpc.d-bis.org ws.rpc2.d-bis.org"
|
||||
E2E_OPTIONAL_WHEN_FAIL="$_PUB_OPTIONAL_WHEN_FAIL"
|
||||
fi
|
||||
else
|
||||
E2E_OPTIONAL_WHEN_FAIL="${E2E_OPTIONAL_WHEN_FAIL}"
|
||||
@@ -178,6 +186,12 @@ declare -A EXPECTED_IP=(
|
||||
["dev.d-bis.org"]="$PUBLIC_IP_FOURTH"
|
||||
["codespaces.d-bis.org"]="$PUBLIC_IP_FOURTH"
|
||||
)
|
||||
# HTTPS check path (default "/"). API-first hosts may 404 on /; see docs/02-architecture/EXPECTED_WEB_CONTENT.md
|
||||
declare -A E2E_HTTPS_PATH=(
|
||||
["phoenix.sankofa.nexus"]="/health"
|
||||
["www.phoenix.sankofa.nexus"]="/health"
|
||||
["studio.sankofa.nexus"]="/studio/"
|
||||
)
|
||||
|
||||
# --list-endpoints: print selected profile endpoints and exit (no tests)
|
||||
if [[ "$LIST_ENDPOINTS" == "1" ]]; then
|
||||
@@ -257,7 +271,7 @@ test_domain() {
|
||||
if [ "$domain_type" != "unknown" ]; then
|
||||
log_info "Test 2: SSL Certificate"
|
||||
|
||||
cert_info=$(echo | openssl s_client -connect "$domain:443" -servername "$domain" 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName 2>/dev/null || echo "")
|
||||
cert_info=$( (echo | timeout "$E2E_OPENSSL_TIMEOUT" openssl s_client -connect "$domain:443" -servername "$domain" 2>/dev/null) | timeout "$E2E_OPENSSL_X509_TIMEOUT" openssl x509 -noout -subject -issuer -dates -ext subjectAltName 2>/dev/null || echo "")
|
||||
|
||||
if [ -n "$cert_info" ]; then
|
||||
cert_cn=$(echo "$cert_info" | grep "subject=" | sed -E 's/.*CN\s*=\s*([^,]*).*/\1/' | sed 's/^ *//;s/ *$//' || echo "")
|
||||
@@ -301,10 +315,12 @@ test_domain() {
|
||||
|
||||
# Test 3: HTTPS Request
|
||||
if [ "$domain_type" = "web" ] || [ "$domain_type" = "api" ]; then
|
||||
log_info "Test 3: HTTPS Request"
|
||||
https_path="${E2E_HTTPS_PATH[$domain]:-}"
|
||||
https_url="https://${domain}${https_path}"
|
||||
log_info "Test 3: HTTPS Request (${https_url})"
|
||||
|
||||
START_TIME=$(date +%s.%N)
|
||||
http_response=$(curl -s -I -k --connect-timeout 10 -w "\n%{time_total}" "https://$domain" 2>&1 || echo "")
|
||||
http_response=$(curl -s -I -k --connect-timeout 10 -w "\n%{time_total}" "$https_url" 2>&1 || echo "")
|
||||
END_TIME=$(date +%s.%N)
|
||||
RESPONSE_TIME=$(echo "$END_TIME - $START_TIME" | bc 2>/dev/null || echo "0")
|
||||
|
||||
@@ -315,8 +331,22 @@ test_domain() {
|
||||
echo "$headers" > "$OUTPUT_DIR/${domain//./_}_https_headers.txt"
|
||||
|
||||
if [ -n "$http_code" ]; then
|
||||
if [ "$http_code" -ge 200 ] && [ "$http_code" -lt 400 ]; then
|
||||
log_success "HTTPS: $domain returned HTTP $http_code (Time: ${time_total}s)"
|
||||
# NPM canonical www → apex (advanced_config return 301/308)
|
||||
_e2e_canonical_www_redirect=""
|
||||
case "$domain" in
|
||||
www.sankofa.nexus|www.phoenix.sankofa.nexus|www.the-order.sankofa.nexus)
|
||||
if [ "$http_code" = "301" ] || [ "$http_code" = "308" ]; then
|
||||
_e2e_canonical_www_redirect=1
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
if [ -n "$_e2e_canonical_www_redirect" ]; then
|
||||
location_hdr=$(echo "$headers" | grep -iE '^[Ll]ocation:' | head -1 | tr -d '\r' || echo "")
|
||||
log_success "HTTPS: $domain returned HTTP $http_code (canonical redirect)${https_path:+ at ${https_url}}"
|
||||
result=$(echo "$result" | jq --arg code "$http_code" --arg time "$time_total" --arg loc "$location_hdr" \
|
||||
'.tests.https = {"status": "pass", "http_code": ($code | tonumber), "response_time_seconds": ($time | tonumber), "canonical_redirect": true, "location_header": $loc}')
|
||||
elif [ "$http_code" -ge 200 ] && [ "$http_code" -lt 400 ]; then
|
||||
log_success "HTTPS: $domain returned HTTP $http_code (Time: ${time_total}s)${https_path:+ at ${https_path}}"
|
||||
|
||||
# Check security headers
|
||||
hsts=$(echo "$headers" | grep -i "strict-transport-security" || echo "")
|
||||
@@ -330,12 +360,12 @@ test_domain() {
|
||||
--argjson hsts "$HAS_HSTS" --argjson csp "$HAS_CSP" --argjson xfo "$HAS_XFO" \
|
||||
'.tests.https = {"status": "pass", "http_code": ($code | tonumber), "response_time_seconds": ($time | tonumber), "has_hsts": $hsts, "has_csp": $csp, "has_xfo": $xfo}')
|
||||
else
|
||||
log_warn "HTTPS: $domain returned HTTP $http_code (Time: ${time_total}s)"
|
||||
log_warn "HTTPS: $domain returned HTTP $http_code (Time: ${time_total}s)${https_path:+ (${https_url})}"
|
||||
result=$(echo "$result" | jq --arg code "$http_code" --arg time "$time_total" \
|
||||
'.tests.https = {"status": "warn", "http_code": ($code | tonumber), "response_time_seconds": ($time | tonumber)}')
|
||||
fi
|
||||
else
|
||||
log_error "HTTPS: Failed to connect to $domain"
|
||||
log_error "HTTPS: Failed to connect to ${https_url}"
|
||||
result=$(echo "$result" | jq --arg time "$time_total" '.tests.https = {"status": "fail", "response_time_seconds": ($time | tonumber)}')
|
||||
fi
|
||||
# Optional: Blockscout API check for explorer.d-bis.org (does not affect E2E pass/fail)
|
||||
@@ -401,13 +431,21 @@ test_domain() {
|
||||
# Check if wscat is available for full test
|
||||
if command -v wscat >/dev/null 2>&1; then
|
||||
log_info " Attempting full WebSocket test with wscat..."
|
||||
WS_FULL_TEST=$(timeout 3 wscat -c "wss://$domain" -x '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' 2>&1 || echo "")
|
||||
# -n: no TLS verify (aligns with curl -k); -w: seconds to wait for JSON-RPC response
|
||||
WS_FULL_TEST=""
|
||||
WS_FULL_EXIT=0
|
||||
if ! WS_FULL_TEST=$(timeout 15 wscat -n -c "wss://$domain" -x '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' -w 5 2>&1); then
|
||||
WS_FULL_EXIT=$?
|
||||
fi
|
||||
if echo "$WS_FULL_TEST" | grep -q "result"; then
|
||||
log_success "WebSocket: Full test passed"
|
||||
result=$(echo "$result" | jq --arg code "$WS_RESULT" '.tests.websocket = {"status": "pass", "http_code": $code, "full_test": true}')
|
||||
result=$(echo "$result" | jq --arg code "$WS_RESULT" '.tests.websocket = {"status": "pass", "http_code": $code, "full_test": true, "full_test_output": "result"}')
|
||||
elif [ "$WS_FULL_EXIT" -eq 0 ]; then
|
||||
log_success "WebSocket: Full test connected cleanly"
|
||||
result=$(echo "$result" | jq --arg code "$WS_RESULT" '.tests.websocket = {"status": "pass", "http_code": $code, "full_test": true, "note": "wscat exited successfully without printable RPC output"}')
|
||||
else
|
||||
log_warn "WebSocket: Connection established but RPC test failed"
|
||||
result=$(echo "$result" | jq --arg code "$WS_RESULT" '.tests.websocket = {"status": "warning", "http_code": $code, "full_test": false}')
|
||||
result=$(echo "$result" | jq --arg code "$WS_RESULT" --arg exit_code "$WS_FULL_EXIT" '.tests.websocket = {"status": "warning", "http_code": $code, "full_test": false, "exit_code": $exit_code}')
|
||||
fi
|
||||
else
|
||||
log_warn "WebSocket: Basic test (Code: $WS_RESULT) - Install wscat for full test: npm install -g wscat"
|
||||
@@ -558,6 +596,7 @@ cat >> "$REPORT_FILE" <<EOF
|
||||
|
||||
- **Optional domains:** Domains in \`E2E_OPTIONAL_WHEN_FAIL\` (default: many d-bis.org/sankofa/mim4u/rpc) have any fail treated as skip so the run passes when off-LAN or services unreachable. Set \`E2E_OPTIONAL_WHEN_FAIL=\` (empty) for strict mode.
|
||||
- WebSocket tests require \`wscat\` tool: \`npm install -g wscat\`
|
||||
- OpenSSL fetch uses \`timeout\` (\`E2E_OPENSSL_TIMEOUT\` / \`E2E_OPENSSL_X509_TIMEOUT\`, defaults 15s / 5s) so \`openssl s_client\` cannot hang indefinitely
|
||||
- Internal connectivity tests require access to NPMplus container
|
||||
- Explorer (explorer.d-bis.org): optional Blockscout API check; use \`SKIP_BLOCKSCOUT_API=1\` to skip when backend is unreachable (e.g. off-LAN). Fix runbook: docs/03-deployment/BLOCKSCOUT_FIX_RUNBOOK.md
|
||||
|
||||
|
||||
Reference in New Issue
Block a user