Проект разделен на два репозитория

2026-08-14 15:42:45 +03:00
parent e06a77ee1d
commit bbef7a30c9
521 changed files with 2597 additions and 2302 deletions
@@ -0,0 +1,71 @@
+#!/bin/sh
+set -eu
+cd "$(dirname "$0")/../.."
+
+CONFIG_FILE=${CONFIG_FILE:-.env}
+SECRETS_LAUNCHER=${SECRETS_LAUNCHER:-deployment/secrets/han-secrets}
+if [ "${HAN_SECRETS_ACTIVE:-0}" != "1" ]; then
+  [ -x "$SECRETS_LAUNCHER" ] || {
+    echo "Secret launcher is required: $SECRETS_LAUNCHER" >&2
+    exit 66
+  }
+  exec "$SECRETS_LAUNCHER" run --config "$CONFIG_FILE" -- "$0" "$@"
+fi
+if [ -n "${HAN_RUNTIME_SECRET_MANIFEST:-}" ]; then
+  ./scripts/validate-env "$CONFIG_FILE" --runtime-manifest "$HAN_RUNTIME_SECRET_MANIFEST"
+else
+  ./scripts/validate-env "$CONFIG_FILE" --runtime-env
+fi
+
+env_value() {
+  python3 - "$CONFIG_FILE" "$1" <<'PY'
+import sys
+from pathlib import Path
+
+path, wanted = sys.argv[1:]
+for raw in Path(path).read_text(encoding="utf-8").splitlines():
+    line = raw.strip()
+    if not line or line.startswith("#") or "=" not in line:
+        continue
+    key, value = line.split("=", 1)
+    if key.strip() == wanted:
+        value = value.strip()
+        if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
+            value = value[1:-1]
+        print(value)
+        break
+else:
+    raise SystemExit(f"missing environment variable: {wanted}")
+PY
+}
+
+PUBLIC_HOST=$(env_value PUBLIC_HOST)
+PUBLIC_WEB_URL=$(env_value PUBLIC_WEB_URL)
+KEYCLOAK_REALM=$(env_value KEYCLOAK_REALM)
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+http_code=$(curl -sS -o /dev/null -w '%{http_code}' "http://${PUBLIC_HOST}/")
+[ "$http_code" = "308" ] || { echo "Expected HTTP 308, got $http_code" >&2; exit 1; }
+curl -fsS "${PUBLIC_WEB_URL}/api/v1/public/app-config" -o "$tmp/app-config.json"
+curl -fsS "${PUBLIC_WEB_URL}/api/v1/public/content" -o "$tmp/content.json"
+curl -fsS "${PUBLIC_WEB_URL}/auth/realms/${KEYCLOAK_REALM}/.well-known/openid-configuration" -o "$tmp/oidc.json"
+
+internal_code=$(curl -sS -o /dev/null -w '%{http_code}' "${PUBLIC_WEB_URL}/internal/safety/v1/messages/check")
+[ "$internal_code" = "404" ] || { echo "Public /internal returned $internal_code, expected 404" >&2; exit 1; }
+sms_internal_code=$(curl -sS -o /dev/null -w '%{http_code}' "${PUBLIC_WEB_URL}/internal/sms/v1/messages/00000000-0000-0000-0000-000000000000")
+[ "$sms_internal_code" = "404" ] || { echo "Public SMS internal API returned $sms_internal_code, expected 404" >&2; exit 1; }
+sms_callback_code=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
+  -H 'Content-Type: application/json' --data '[]' \
+  "${PUBLIC_WEB_URL}/callbacks/idgtl/sms")
+[ "$sms_callback_code" = "403" ] || { echo "SMS callback without provider IP returned $sms_callback_code, expected 403" >&2; exit 1; }
+
+headers=$(curl -fsSI "${PUBLIC_WEB_URL}/")
+printf '%s' "$headers" | grep -qi '^x-content-type-options: nosniff'
+printf '%s' "$headers" | grep -qi '^x-request-id:'
+printf '%s' "$headers" | grep -qi '^content-security-policy:'
+
+openssl s_client -connect "${PUBLIC_HOST}:443" -servername "$PUBLIC_HOST" </dev/null 2>/dev/null \
+  | openssl x509 -noout -checkend 604800
+echo "Public edge smoke passed."