restrict v2

dev/devcheck-restrict.sh

@@ -74,28 +74,48 @@ else
 fi
 
 say ""
-say "== 1. 基线：处置前箱主页应可访问 =="
+say "== 1. 基线：处置前箱主页必须可访问 =="
 base=$(code "$BASE_URL/_/$DOMAIN")
-check "box page before restrict" 200 "$base"
+if [ "$base" != 200 ]; then
+	say "  FAIL  基线不是 200（got $base），后续断言全部无意义，已中止。"
+	say ""
+	say "  302 的常见原因（按概率排序）："
+	say "    1) 域名不存在或账号已停用 —— 先确认 DOMAIN 拼写。查一个真实域名："
+	say "       curl -s $BASE_URL/explore | grep -o 'href=\"/_/[^\"]*\"' | head -5"
+	say "       或在库上执行：select domain from users where deleted_at is null order by id desc limit 5;"
+	say "    2) 该箱主设置了页面密码 —— 此时首页是 200（渲染密码页），不是 302。"
+	say ""
+	say "  注意：302 不能证明任何处置生效。上次自检就出现过「箱主不存在 → 302」被误判成 L4 生效。"
+	exit 1
+fi
+say "  PASS  box page = 200"
+
+say ""
+say "== 1b. 停用页是否部署（与处置无关，dry-run 也验）=="
+check "restricted page reachable" 200 "$(code "$BASE_URL/restricted")"
+body=$(curl -sL --max-time 10 "$BASE_URL/restricted")
+if printf '%s' "$body" | grep -qE '一時的に利用できません|temporarily unavailable|暫時無法存取|暂时不可访问'; then
+	say "  PASS  restricted page copy rendered"
+	pass=$((pass + 1))
+else
+	say "  FAIL  restricted page copy not found（i18n 或模板没部署上）"
+	fail=$((fail + 1))
+fi
+
+if [ "$RUN" != 1 ]; then
+	say ""
+	say "== dry-run：不做状态断言 =="
+	say "  状态没有被改动，断言 L4/L1 只会得到误导性结果。"
+	say "  基线已确认可访问，用 RUN=1 重跑以执行真实验证："
+	say "  RUN=1 BASE_URL=$BASE_URL DOMAIN=$DOMAIN TAMABOX=$TAMABOX bash $0"
+	exit 0
+fi
 
 say ""
 say "== 2. L4 整页停用 =="
 do_restrict L4
 sleep 1
 check "box page under L4" 302 "$(code "$BASE_URL/_/$DOMAIN")"
-check "restricted page" 200 "$(code "$BASE_URL/restricted")"
-if [ "$RUN" = 1 ]; then
-	body=$(curl -sL --max-time 10 "$BASE_URL/_/$DOMAIN")
-	if printf '%s' "$body" | grep -qE '一時的に利用できません|temporarily unavailable|暫時無法存取|暂时不可访问'; then
-		say "  PASS  restricted page copy rendered"
-		pass=$((pass + 1))
-	else
-		say "  FAIL  restricted page copy not found (检查 i18n 与模板是否部署)"
-		fail=$((fail + 1))
-	fi
-else
-	say "  [dry-run] 跳过文案断言"
-fi
 
 say ""
 say "== 3. L1 停止分发：页面恢复、分享卡被拦 =="