ochenstarik/randomayzer
1
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions
randomayzer/docs/VK_REAL_SMOKE_TEST.md

6 KiB
Raw Blame History

VK live smoke test

The smoke tool checks the configured application and VK account without placing tokens or cookies in command arguments or output. It only accepts loopback HTTP or the approved https://random.ochenstarik.ru origin and a regular environment file with mode 0600. The domain run requires proxy Basic Auth in that file.

Prepare the local run

  1. Start the app with its normal local credentials, then log in from a browser at the configured loopback URL.

  2. Complete the browser consent flow described in B below.

  3. Create a file outside the repository, for example ~/.vk-smoke.env, and restrict it to the owner:

    umask 077
touch ~/.vk-smoke.env
chmod 600 ~/.vk-smoke.env

  4. Add one unquoted KEY=value per line. Do not add VK access tokens or client secrets. The session cookie is sensitive and must remain in this 0600 file.

    VK_SMOKE_BASE_URL=http://localhost:3100
VK_SMOKE_SESSION_COOKIE=randomayzer_session=<copy-from-the-local-browser-after-login>
VK_SMOKE_PROXY_AUTH=<proxy-user>:<proxy-password>
VK_SMOKE_PUBLIC_POST_URL=https://vk.com/wall-<public-community-id>_<post-id>
VK_SMOKE_PRIVATE_POST_URL=https://vk.com/wall-<restricted-community-id>_<post-id>
VK_SMOKE_GROUP_ID=<community-id-for-subscription-check>
VK_SMOKE_CREATE_GIVEAWAY=YES

    For the domain run, set VK_SMOKE_BASE_URL=https://random.ochenstarik.ru and provide VK_SMOKE_PROXY_AUTH. Proxy credentials are used only by curl from the protected temporary config. VK_SMOKE_PRIVATE_POST_URL and VK_SMOKE_GROUP_ID are optional when those checks are not part of the run. Remove their lines to skip the related checks. Set VK_SMOKE_CREATE_GIVEAWAY=YES only when a smoke-test giveaway may be created.

  5. Run:

    ./tools/vk-smoke.sh ~/.vk-smoke.env

The script prints PASS, FAIL, SKIP, or MANUAL for checks A–H and exits nonzero when any executed check fails. It keeps response bodies and HTTP headers in a private temporary directory and removes that directory on exit. It does not print profile or participant data. A successful run of F creates a real giveaway record; G imports participants and H reimports them with the subscription condition. Choose a known test post and community.

Checks

  • A. OAuth start: verifies that /api/auth/vk/start redirects to VK ID and requests PKCE S256.
  • B. Browser consent: manual. Open /api/auth/vk/start, approve the consent screen, and confirm the browser returns to /api/auth/vk/callback. Confirm the app session is authenticated before copying the session cookie into the protected smoke file. The script never treats the browser step as passed.
  • C. Session: confirms /api/auth/me returns an authenticated profile.
  • D. Public post: checks authenticated preview for the configured public post and requires effectiveCapabilities.accessMode to equal PUBLIC_SERVICE.
  • E. Restricted post: checks preview for the configured restricted post and requires the resolved auth mode to be USER. The chosen post must be visible to the organizer.
  • F. Giveaway creation: creates a test giveaway from the successful public preview when explicitly enabled.
  • G. Participant import: checks that likes and comments import successfully.
  • H. Subscription check: reimports participants with groups.isMember for the configured group and accepts only a complete successful response.

Follow-up checks retained from the original checklist

These checks are intentionally manual. A–H are the script's current automation boundary; later checks are never reported as passed by the script.

  • I. Snapshot locking: lock the imported participant snapshot and verify the returned counts and hashes are present. Do not change or infer the deterministic proof/hash contract from this smoke run.
  • J. Deterministic draw: run one draw from the locked snapshot and confirm the result is returned. The implementation's algorithm is outside this smoke checklist; do not use this as evidence to alter or revalidate the protected proof format.
  • K. Public audit: open /api/giveaways/<id>/verify in a private browser window without a session and confirm the public verification response succeeds without exposing organizer or participant-private data.
  • L. Token refresh: use an authorized test account after its access token expires, or a controlled test credential with a known expiry, and confirm the next authorized VK request either refreshes successfully or reports reauthentication. Do not force expiry by editing stored credentials on a live database.
  • M. Logout: log out, confirm the session cookie is cleared, then confirm /api/auth/me returns unauthenticated.

Safe behavior for unsupported and unknown VK behavior

  • Community manager detection is disabled unless a complete, supported check is implemented. Choosing a manager-exclusion rule is rejected with an explanation; the app does not mark unknown users as non-managers.
  • Repost eligibility remains unsupported. The app rejects a repost requirement and explains that it cannot verify it for private profiles.
  • Pagination fails the import when an empty or short page arrives before VK's reported total, when the total is missing, or when the page limit is reached before the total. The import route saves participants only after all fetch and enrichment work succeeds, so a failed import does not replace the previous participant list.
  • The current provider does not call VK execute; it fetches pages with ordinary methods. Its batching limits and behavior remain UNVERIFIED and are not inferred from third-party examples.
  • VK can change data while an offset-based import is running. Completeness checks detect short or missing pages against the returned total but cannot prove a stable point-in-time set. That behavior remains UNVERIFIED pending official contract confirmation or a live test.

No test credentials, cookies, or tokens belong in the repository. Use only a throwaway session cookie in the protected local file and delete that file after testing.