mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-09-25 09:53:08 +02:00
Pontoporeia
7b6d79c133
- feat: creds-test.sh gum probe for SMTP vs PeerTube auth + PeerTubeService::probeAuth() - feat: app-token.sh gum probe for long-lived PeerTube app token (client_credentials) - docs: add copy-paste proof commands to demonstrate the SSO break to admins
140 lines
6.0 KiB
Bash
Executable File
140 lines
6.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# =============================================================================
|
|
# creds-test.sh — gum-powered interactive probe of the credentials shared by
|
|
# SMTP and PeerTube in the xamxam database.
|
|
#
|
|
# Probes two endpoints with the SAME stored username/password, going directly
|
|
# (bypassing any SSO portal):
|
|
# • SMTP — TCP connect + SMTP AUTH + disconnect (no mail sent)
|
|
# • PeerTube — OAuth2 "password" grant against <instance>/api/v1/users/token
|
|
#
|
|
# Every run is appended to a log without the plaintext password.
|
|
#
|
|
# Usage:
|
|
# scripts/creds-test.sh [--db <path>] [--instance <url>] [--channel <handle>]
|
|
# --instance / --channel override the stored values for the PeerTube probe
|
|
# --show-pwd reveal the decrypted password (interactive confirm)
|
|
#
|
|
# Exit code 0 => both probes succeeded; 1 => at least one failed.
|
|
# =============================================================================
|
|
set -uo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
PROBE="$SCRIPT_DIR/creds-probe.php"
|
|
LOG="$SCRIPT_DIR/../creds-test.log"
|
|
|
|
DB_PATH=""
|
|
INSTANCE=""
|
|
CHANNEL=""
|
|
SHOW_PWD=0
|
|
|
|
# ---- argument parsing --------------------------------------------------------
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--db) DB_PATH="$2"; shift 2 ;;
|
|
--instance) INSTANCE="$2"; shift 2 ;;
|
|
--channel) CHANNEL="$2"; shift 2 ;;
|
|
--show-pwd) SHOW_PWD=1; shift ;;
|
|
-h|--help)
|
|
gum style "Usage:" --bold
|
|
gum style " scripts/creds-test.sh [--db <path>] [--instance <url>] [--channel <handle>] [--show-pwd]"
|
|
exit 0 ;;
|
|
*) echo "Unknown arg: $1" >&2; exit 2 ;;
|
|
esac
|
|
done
|
|
|
|
# ---- preflight ---------------------------------------------------------------
|
|
command -v gum >/dev/null || { echo "gum is required (install via 'brew install gum' or the repo justfile)"; exit 2; }
|
|
command -v php >/dev/null || { echo "php is required"; exit 2; }
|
|
[[ -f "$PROBE" ]] || { echo "Missing helper: $PROBE"; exit 2; }
|
|
|
|
gum style "── XAMXAM · probe SMTP vs PeerTube ────────────────────────" \
|
|
--border double --padding "1 2" --foreground 212
|
|
|
|
# Default DB path: same layout as the PHP helpers.
|
|
DB_PATH="${DB_PATH:-$REPO_ROOT/app/storage/xamxam.db}"
|
|
if [[ ! -f "$DB_PATH" ]]; then
|
|
gum style "✗ Database not found: $DB_PATH" --foreground 196
|
|
exit 2
|
|
fi
|
|
|
|
PROBE_ARGS=(--db "$DB_PATH")
|
|
[[ -n "$INSTANCE" ]] && PROBE_ARGS+=(--instance "$INSTANCE")
|
|
[[ -n "$CHANNEL" ]] && PROBE_ARGS+=(--channel "$CHANNEL")
|
|
if [[ "$SHOW_PWD" -eq 1 ]]; then
|
|
# Interactive confirmation BEFORE we ever print a password.
|
|
if gum confirm "Show the decrypted password on screen? (it will NOT be logged)"; then
|
|
PROBE_ARGS+=(--with-pwd)
|
|
else
|
|
exit 130
|
|
fi
|
|
fi
|
|
|
|
# ---- run the probe ---------------------------------------------------------------
|
|
OUT="$(gum spin --spinner minidot --title "Probing SMTP + PeerTube …" \
|
|
-- php "$PROBE" "${PROBE_ARGS[@]}" 2>/tmp/creds-probe.err)"
|
|
RC=$?
|
|
if [[ -n "${OUT:-}" ]]; then
|
|
JSON="$OUT"
|
|
else
|
|
JSON='{}'
|
|
fi
|
|
|
|
# ---- decode ------------------------------------------------------------------
|
|
username=$(php -r 'echo json_decode($argv[1],true)["username"]??"";' "$JSON")
|
|
smtp_ok=$(php -r 'echo (json_decode($argv[1],true)["smtp"]["ok"]??false)?"1":"0";' "$JSON")
|
|
smtp_err=$(php -r 'echo json_decode($argv[1],true)["smtp"]["error"]??"";' "$JSON")
|
|
ptv_ok=$(php -r 'echo (json_decode($argv[1],true)["peertube"]["ok"]??false)?"1":"0";' "$JSON")
|
|
ptv_err=$(php -r 'echo json_decode($argv[1],true)["peertube"]["error"]??"";' "$JSON")
|
|
|
|
# ---- render with gum ---------------------------------------------------------
|
|
gum style "Username : $username" --foreground 214
|
|
[[ "$SHOW_PWD" -eq 1 ]] && gum style "Password : $(php -r 'echo json_decode($argv[1],true)["password"]??"";' "$JSON")" --foreground 214
|
|
|
|
gum style "SMTP" --padding "0 1" --foreground 240 --bold
|
|
if [[ "$smtp_ok" == "1" ]]; then
|
|
gum style " ✓ SMTP AUTH succeeded (connect + auth + close, no mail sent)" --foreground 42
|
|
else
|
|
gum style " ✗ SMTP failed: ${smtp_err}" --foreground 196
|
|
fi
|
|
|
|
gum style "PeerTube (direct OAuth password grant, no portal)" --padding "0 1" --foreground 240 --bold
|
|
if [[ "$ptv_ok" == "1" ]]; then
|
|
gum style " ✓ PeerTube issued an access token with these creds" --foreground 42
|
|
else
|
|
gum style " ✗ PeerTube failed: ${ptv_err}" --foreground 196
|
|
fi
|
|
|
|
# ---- verdict + log -------------------------------------------------------------
|
|
verdict="UNKNOWN"
|
|
if [[ "$ptv_ok" == "1" ]]; then verdict="PEERTUBE_TOKENS_OK"; fi
|
|
status_line="$verdict"
|
|
if [[ "$ptv_ok" == "0" && "$smtp_ok" == "1" ]]; then
|
|
status_line="SMTP_OK__PEERTUBE_BAD"
|
|
gum style "" --foreground 214
|
|
gum style " Root-cause hint:" --foreground 214 --bold
|
|
gum style " Credentials are valid (SMTP auth works), but PeerTube's password" --foreground 214
|
|
gum style " grant rejects them → the SSO/portal almost certainly broke PeerTube's" --foreground 214
|
|
gum style " direct API password-grant path, even though the same login works" --foreground 214
|
|
gum style " through portail.erg.be. See the curl repro in the PHP helper/todo." --foreground 214
|
|
elif [[ "$ptv_ok" == "0" && "$smtp_ok" == "0" ]]; then
|
|
status_line="BOTH_BAD"
|
|
gum style " Both probes failed → the stored credentials themselves are wrong/stale." --foreground 214
|
|
elif [[ "$ptv_ok" == "1" && "$smtp_ok" == "1" ]]; then
|
|
status_line="BOTH_OK"
|
|
gum style " Both SMTP and PeerTube accept these credentials." --foreground 42
|
|
fi
|
|
|
|
# ---- append to log (NEVER the password) -----------------------------------------
|
|
{
|
|
echo "===== $(date '+%Y-%m-%d %H:%M:%S') | $status_line | user=$username | db=$DB_PATH"
|
|
echo " SMTP : ok=$smtp_ok err=$(printf '%q' "$smtp_err")"
|
|
echo " PeerTube : ok=$ptv_ok err=$(printf '%q' "$ptv_err")"
|
|
} >> "$LOG"
|
|
gum style "" --foreground 240
|
|
gum style "Logged (no password stored) → $LOG" --foreground 240
|
|
|
|
# Exit 0 only when BOTH probes succeeded.
|
|
[[ "$smtp_ok" == "1" && "$ptv_ok" == "1" ]] && exit 0 || exit 1
|