restrict v1

2026-10-18 21:14:59 +08:00
parent da7e76a7db
commit 6bd90779f8
23 changed files with 1754 additions and 1 deletions
@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+# 处置链路部署后自检（L1 停止分发 / L4 整页停用 / CLI 可用性）
+#
+# 为什么需要它：本机沙箱起不了 web（无 redis），L1/L4 的 HTTP 行为只能在服务器上验证。
+# 这个脚本把「施加处置 → 观察 HTTP → 自动撤销」串起来，避免手工操作忘了解除。
+#
+# 用法：
+#   BASE_URL=https://box-dev.example.com DOMAIN=<测试箱主域名> TAMABOX=/path/to/NekoBox \
+#     bash dev/devcheck-restrict.sh            # 只打印将要执行的命令（dry-run）
+#
+#   BASE_URL=... DOMAIN=... TAMABOX=... RUN=1 \
+#     bash dev/devcheck-restrict.sh            # 真正执行，结束时自动撤销
+#
+# 注意：
+#   - DOMAIN 必须是**测试箱主**，不要用真实用户；脚本会临时施加 L4/L1 再撤销。
+#   - 站点默认语言可能是 ja，页面文案断言按日文/英文各查一次，避免误判「没生效」。
+#   - 只依赖 CLI 与 curl，不需要 psql 凭据。
+
+set -uo pipefail
+
+BASE_URL=${BASE_URL:?need BASE_URL, e.g. https://box-dev.example.com}
+DOMAIN=${DOMAIN:?need DOMAIN, a TEST box domain only}
+TAMABOX=${TAMABOX:-./NekoBox}
+RUN=${RUN:-0}
+DAYS=${DAYS:-1}
+
+pass=0
+fail=0
+restricted=0
+
+say() { printf '%s\n' "$*"; }
+
+check() {
+	local name=$1 want=$2 got=$3
+	if [ "$want" = "$got" ]; then
+		say "  PASS  $name (=$got)"
+		pass=$((pass + 1))
+	else
+		say "  FAIL  $name (want $want, got $got)"
+		fail=$((fail + 1))
+	fi
+}
+
+code() { curl -s -o /dev/null -w '%{http_code}' --max-time 10 "$1"; }
+
+do_restrict() {
+	restricted=1
+	if [ "$RUN" = 1 ]; then
+		"$TAMABOX" restrict --domain "$DOMAIN" --level "$1" --days "$DAYS" --reason "deploy self-check" --yes
+	else
+		say "  [dry-run] $TAMABOX restrict --domain $DOMAIN --level $1 --days $DAYS --reason 'deploy self-check' --yes"
+	fi
+}
+
+cleanup() {
+	if [ "$RUN" = 1 ] && [ "$restricted" = 1 ]; then
+		say ""
+		say "== 兜底撤销（无论中途是否失败）=="
+		"$TAMABOX" unrestrict --domain "$DOMAIN" || true
+	fi
+}
+trap cleanup EXIT
+
+say "== 0. 二进制是否包含新命令 =="
+if "$TAMABOX" --help 2>&1 | grep -q 'restrict'; then
+	say "  PASS  restrict 命令存在"
+	pass=$((pass + 1))
+else
+	say "  FAIL  二进制里没有 restrict —— 构建的是旧代码（注意入口是根目录 tamabox.go，或用 ./cmd/）"
+	fail=$((fail + 1))
+	say ""
+	say "结果: 无法继续，先修构建入口。"
+	exit 1
+fi
+
+say ""
+say "== 1. 基线：处置前箱主页应可访问 =="
+base=$(code "$BASE_URL/_/$DOMAIN")
+check "box page before restrict" 200 "$base"
+
+say ""
+say "== 2. L4 整页停用 =="
+do_restrict L4
+sleep 1
+check "box page under L4" 302 "$(code "$BASE_URL/_/$DOMAIN")"
+check "restricted page" 200 "$(code "$BASE_URL/restricted")"
+if [ "$RUN" = 1 ]; then
+	body=$(curl -sL --max-time 10 "$BASE_URL/_/$DOMAIN")
+	if printf '%s' "$body" | grep -qE '一時的に利用できません|temporarily unavailable|暫時無法存取|暂时不可访问'; then
+		say "  PASS  restricted page copy rendered"
+		pass=$((pass + 1))
+	else
+		say "  FAIL  restricted page copy not found (检查 i18n 与模板是否部署)"
+		fail=$((fail + 1))
+	fi
+else
+	say "  [dry-run] 跳过文案断言"
+fi
+
+say ""
+say "== 3. L1 停止分发：页面恢复、分享卡被拦 =="
+do_restrict L1
+sleep 1
+check "box page under L1" 200 "$(code "$BASE_URL/_/$DOMAIN")"
+
+qid=$(curl -s --max-time 10 "$BASE_URL/_/$DOMAIN" | grep -o "/_/$DOMAIN/[0-9]\+" | head -1 | grep -o '[0-9]\+$')
+if [ -n "${qid:-}" ]; then
+	check "share card under L1 (qid=$qid)" 302 "$(code "$BASE_URL/_/$DOMAIN/$qid/share-card")"
+else
+	say "  SKIP  该箱主没有已公开回答，无法验证分享卡（换一个有已答问题的测试箱主）"
+fi
+
+say ""
+say "== 4. 撤销 =="
+if [ "$RUN" = 1 ]; then
+	"$TAMABOX" unrestrict --domain "$DOMAIN"
+	restricted=0
+	check "box page after unrestrict" 200 "$(code "$BASE_URL/_/$DOMAIN")"
+else
+	say "  [dry-run] $TAMABOX unrestrict --domain $DOMAIN"
+fi
+
+say ""
+say "== 结果: PASS=$pass FAIL=$fail =="
+if [ "$fail" -gt 0 ]; then
+	say "有失败项，把上面输出 + 服务日志（journalctl / docker logs 里搜 'Failed to query user restriction'）一起发我。"
+	exit 1
+fi
+say "全部通过。仍需人工手测两项：L2（回答应保存为私密）、L3（回答应被拒绝）。"