71 lines
6.3 KiB
Markdown
71 lines
6.3 KiB
Markdown
# VK live smoke test
|
||
|
||
The smoke tool checks the configured application and VK account without placing tokens or cookies in command arguments or output. It only accepts loopback HTTP or the approved `https://random.ochenstarik.ru` origin and a regular environment file with mode `0600`. The domain run requires proxy Basic Auth in that file.
|
||
|
||
## Prepare the local run
|
||
|
||
1. Start the app with its normal local credentials, then log in from a browser at the configured loopback URL.
|
||
2. Complete the browser consent flow described in **B** below.
|
||
3. Create a file outside the repository, for example `~/.vk-smoke.env`, and restrict it to the owner:
|
||
|
||
```sh
|
||
umask 077
|
||
touch ~/.vk-smoke.env
|
||
chmod 600 ~/.vk-smoke.env
|
||
```
|
||
|
||
4. Add one unquoted `KEY=value` per line. Do not add VK access tokens or client secrets. The session cookie is sensitive and must remain in this `0600` file.
|
||
|
||
```text
|
||
VK_SMOKE_BASE_URL=http://localhost:3100
|
||
VK_SMOKE_SESSION_COOKIE=randomayzer_session=<copy-from-the-local-browser-after-login>
|
||
VK_SMOKE_PROXY_AUTH=<proxy-user>:<proxy-password>
|
||
VK_SMOKE_PUBLIC_POST_URL=https://vk.com/wall-<public-community-id>_<post-id>
|
||
VK_SMOKE_PRIVATE_POST_URL=https://vk.com/wall-<restricted-community-id>_<post-id>
|
||
VK_SMOKE_GROUP_ID=<community-id-for-subscription-check>
|
||
VK_SMOKE_CREATE_GIVEAWAY=YES
|
||
```
|
||
|
||
For the domain run, set `VK_SMOKE_BASE_URL=https://random.ochenstarik.ru` and provide `VK_SMOKE_PROXY_AUTH`. Proxy credentials are used only by curl from the protected temporary config. `VK_SMOKE_PRIVATE_POST_URL` and `VK_SMOKE_GROUP_ID` are optional when those checks are not part of the run. Remove their lines to skip the related checks. Set `VK_SMOKE_CREATE_GIVEAWAY=YES` only when a smoke-test giveaway may be created.
|
||
|
||
5. Run:
|
||
|
||
```sh
|
||
./tools/vk-smoke.sh ~/.vk-smoke.env
|
||
```
|
||
|
||
The server reports the actual provider mode; previews/imports must report `LIVE` for these checks to pass. Production refuses `USE_VK_MOCK=true`, and the production Compose profile explicitly disables it. G/H require nonempty participants: an empty import cannot prove that subscription calls ran.
|
||
|
||
The script prints `PASS`, `FAIL`, `SKIP`, or `MANUAL` for checks A–H and exits nonzero when any executed check fails. It keeps response bodies and HTTP headers in a private temporary directory and removes that directory on exit. It does not print profile or participant data. A successful run of F creates a real giveaway record; G imports participants and H reimports them with the subscription condition. Choose a known test post and community.
|
||
|
||
## Checks
|
||
|
||
- **A. OAuth start:** verifies that `/api/auth/vk/start` redirects to VK ID and requests PKCE S256.
|
||
- **B. Browser consent:** manual. Open `/api/auth/vk/start`, approve the consent screen, and confirm the browser returns to `/api/auth/vk/callback`. Confirm the app session is authenticated before copying the session cookie into the protected smoke file. The script never treats the browser step as passed.
|
||
- **C. Session:** confirms `/api/auth/me` returns an authenticated profile.
|
||
- **D. Public post:** checks authenticated preview for the configured public post and requires `effectiveCapabilities.accessMode` to equal `PUBLIC_SERVICE`.
|
||
- **E. Restricted post:** checks preview for the configured restricted post and requires the resolved auth mode to be `USER`. The chosen post must be visible to the organizer.
|
||
- **F. Giveaway creation:** creates a test giveaway from the successful public preview when explicitly enabled.
|
||
- **G. Participant import:** checks that likes and comments import successfully.
|
||
- **H. Subscription check:** reimports participants with `groups.isMember` for the configured group and accepts only a complete successful response.
|
||
|
||
## Follow-up checks retained from the original checklist
|
||
|
||
These checks are intentionally manual. A–H are the script's current automation boundary; later checks are never
|
||
reported as passed by the script.
|
||
|
||
- **I. Snapshot locking:** lock the imported participant snapshot and verify the returned counts and hashes are present. Do not change or infer the deterministic proof/hash contract from this smoke run.
|
||
- **J. Deterministic draw:** run one draw from the locked snapshot and confirm the result is returned. The implementation's algorithm is outside this smoke checklist; do not use this as evidence to alter or revalidate the protected proof format.
|
||
- **K. Public audit:** open `/api/giveaways/<id>/verify` in a private browser window without a session and confirm the public verification response succeeds without exposing organizer or participant-private data.
|
||
- **L. Token refresh:** use an authorized test account after its access token expires, or a controlled test credential with a known expiry, and confirm the next authorized VK request either refreshes successfully or reports reauthentication. Do not force expiry by editing stored credentials on a live database.
|
||
- **M. Logout:** log out, confirm the session cookie is cleared, then confirm `/api/auth/me` returns unauthenticated.
|
||
|
||
## Safe behavior for unsupported and unknown VK behavior
|
||
|
||
- Community manager detection is disabled unless a complete, supported check is implemented. Choosing a manager-exclusion rule is rejected with an explanation; the app does not mark unknown users as non-managers.
|
||
- Repost eligibility remains unsupported. The app rejects a repost requirement and explains that it cannot verify it for private profiles.
|
||
- Pagination fails the import when an empty or short page arrives before VK's reported total, when the total is missing, or when the page limit is reached before the total. The import route saves participants only after all fetch and enrichment work succeeds, so a failed import does not replace the previous participant list.
|
||
- The current provider does not call VK `execute`; it fetches pages with ordinary methods. Its batching limits and behavior remain **UNVERIFIED** and are not inferred from third-party examples.
|
||
- VK can change data while an offset-based import is running. Completeness checks detect short or missing pages against the returned total but cannot prove a stable point-in-time set. That behavior remains **UNVERIFIED** pending official contract confirmation or a live test.
|
||
|
||
No test credentials, cookies, or tokens belong in the repository. Use only a throwaway session cookie in the protected local file and delete that file after testing.
|