mirror of
https://github.com/Stirling-Tools/Stirling-PDF.git
synced 2026-09-03 05:10:16 +03:00
203 lines
8.0 KiB
Bash
203 lines
8.0 KiB
Bash
#!/bin/sh
|
|
# Seeds a running stack (teams, users, S3 connection + policy). Idempotent; exits non-zero if a create fails.
|
|
# Auth uses the Bearer JWT from the login body, not a cookie - the global API key can't create teams.
|
|
set -u
|
|
|
|
BASE_URL="${BASE_URL:-http://localhost:8080}"
|
|
ADMIN_USER="${ADMIN_USER:-admin}"
|
|
ADMIN_PASS="${ADMIN_PASS:-stirling}"
|
|
USER_COUNT="${USER_COUNT:-40}"
|
|
USER_PASS="${USER_PASS:-Password123!}"
|
|
PGHOST="${PGHOST:-postgres}"
|
|
PGUSER="${PGUSER:-stirling}"
|
|
PGPASSWORD="${PGPASSWORD:-stirling}"
|
|
PGDATABASE="${PGDATABASE:-stirling}"
|
|
export PGPASSWORD
|
|
|
|
TEAMS="Engineering Finance Legal Operations"
|
|
|
|
log() { echo "[seed] $*"; }
|
|
psqlq() { psql -h "$PGHOST" -U "$PGUSER" -d "$PGDATABASE" -tAc "$1" 2>/dev/null | tr -d '[:space:]'; }
|
|
|
|
# --- wait for the load balancer to serve a healthy app -----------------------
|
|
log "waiting for $BASE_URL ..."
|
|
i=0
|
|
until curl -fsS "$BASE_URL/api/v1/info/status" 2>/dev/null | grep -q UP; do
|
|
i=$((i+1)); [ "$i" -gt 120 ] && { log "timed out waiting for API"; exit 1; }
|
|
sleep 3
|
|
done
|
|
log "API is up"
|
|
|
|
# --- admin login -> Bearer token ---------------------------------------------
|
|
code=$(curl -sS -o /tmp/login.json -w '%{http_code}' \
|
|
-X POST "$BASE_URL/api/v1/auth/login" \
|
|
-H 'Content-Type: application/json' \
|
|
-d "{\"username\":\"$ADMIN_USER\",\"password\":\"$ADMIN_PASS\"}")
|
|
log "admin login: HTTP $code"
|
|
[ "$code" = "200" ] || { log "login failed: $(cat /tmp/login.json)"; exit 1; }
|
|
TOKEN=$(jq -r '.session.access_token' </tmp/login.json)
|
|
[ -n "$TOKEN" ] && [ "$TOKEN" != "null" ] || { log "no access_token in login response"; exit 1; }
|
|
|
|
auth() { curl -sS -H "Authorization: Bearer $TOKEN" "$@"; }
|
|
|
|
errors=0
|
|
fail_note() { errors=$((errors+1)); log "ERROR: $*"; }
|
|
|
|
# The regression runner re-seeds an already-seeded stack, so every create is check-then-create by name.
|
|
find_id_by_name() { # $1=list path $2=name -> the existing id, or empty
|
|
auth "$BASE_URL$1" 2>/dev/null \
|
|
| jq -r --arg n "$2" '[.. | objects | select(.name? == $n) | .id?] | map(select(. != null)) | first // empty' 2>/dev/null
|
|
}
|
|
|
|
# --- teams -------------------------------------------------------------------
|
|
for t in $TEAMS; do
|
|
code=$(auth -o /dev/null -w '%{http_code}' -X POST "$BASE_URL/api/v1/team/create" \
|
|
--data-urlencode "name=$t")
|
|
case "$code" in
|
|
2*|409) log "team '$t': HTTP $code" ;;
|
|
*) fail_note "team '$t': HTTP $code" ;;
|
|
esac
|
|
done
|
|
|
|
# Resolve team ids from the DB (no admin list endpoint self-hosted).
|
|
seed_team_ids=""
|
|
for t in $TEAMS; do
|
|
id=$(psqlq "select team_id from teams where name='$t' limit 1")
|
|
[ -n "$id" ] && seed_team_ids="$seed_team_ids $id"
|
|
done
|
|
set -- $seed_team_ids
|
|
team_count=$#
|
|
log "seedable team ids:$seed_team_ids (count=$team_count)"
|
|
|
|
# --- users: spread across teams, first two are admins ------------------------
|
|
# The licence caps seats, so USER_COUNT is a target, not a promise: hitting the cap stops the
|
|
# loop and is reported, not counted as a failure. Every other rejection stays fatal.
|
|
created=0; failed=0; capped=""
|
|
n=1
|
|
while [ "$n" -le "$USER_COUNT" ]; do
|
|
uname=$(printf "user%02d@stirling.test" "$n")
|
|
role="ROLE_USER"; [ "$n" -le 2 ] && role="ROLE_ADMIN"
|
|
team_id=""
|
|
if [ "$team_count" -gt 0 ]; then
|
|
idx=$(( (n % team_count) + 1 )); team_id=$(eval echo "\${$idx}")
|
|
fi
|
|
code=$(auth -o /tmp/user.json -w '%{http_code}' -X POST "$BASE_URL/api/v1/user/admin/saveUser" \
|
|
--data-urlencode "username=$uname" \
|
|
--data-urlencode "password=$USER_PASS" \
|
|
--data-urlencode "role=$role" \
|
|
${team_id:+--data-urlencode "teamId=$team_id"} \
|
|
--data-urlencode "authType=WEB" \
|
|
--data-urlencode "forceChange=false")
|
|
body=$(cat /tmp/user.json)
|
|
case "$code" in
|
|
200|201) created=$((created+1));;
|
|
409) log "user $uname already exists";;
|
|
*)
|
|
case "$body" in
|
|
*"Maximum number of users reached"*|*"Available slots"*)
|
|
capped="$body"
|
|
break
|
|
;;
|
|
esac
|
|
failed=$((failed+1))
|
|
[ "$failed" -le 3 ] && log "user $uname failed HTTP $code: $body"
|
|
;;
|
|
esac
|
|
n=$((n+1))
|
|
done
|
|
if [ -n "$capped" ]; then
|
|
log "user seats exhausted after $created create(s); licence caps this stack below USER_COUNT=$USER_COUNT"
|
|
log " server said: $capped"
|
|
fi
|
|
log "users created: $created (failed: $failed, requested: $USER_COUNT)"
|
|
[ "$failed" -eq 0 ] || fail_note "$failed of $USER_COUNT user creates failed"
|
|
|
|
# --- S3 connection -> the in-cluster MinIO 'policy-data' bucket ---------------
|
|
conn_body=$(cat <<JSON
|
|
{"integrationType":"S3","name":"MinIO policy bucket","scope":"SERVER","enabled":true,"locked":false,"defaultAccess":"ORG_ALL",
|
|
"config":{"bucket":"policy-data","region":"us-east-1","endpoint":"http://minio:9000","accessKeyId":"minioadmin","secretAccessKey":"minioadmin","pathStyleAccess":true}}
|
|
JSON
|
|
)
|
|
conn_id=$(find_id_by_name "/api/v1/integrations" "MinIO policy bucket")
|
|
if [ -n "${conn_id:-}" ]; then
|
|
log "S3 connection already exists: id $conn_id"
|
|
else
|
|
conn_id=$(auth -X POST "$BASE_URL/api/v1/integrations" -H 'Content-Type: application/json' -d "$conn_body" \
|
|
| jq -r '.id // empty' 2>/dev/null)
|
|
log "S3 connection id: ${conn_id:-<none>}"
|
|
[ -n "${conn_id:-}" ] || fail_note "S3 connection was not created"
|
|
fi
|
|
|
|
# --- a scheduled S3 -> compress -> S3 policy ---------------------------------
|
|
if [ -n "${conn_id:-}" ]; then
|
|
src_body=$(cat <<JSON
|
|
{"name":"Incoming S3","type":"s3","enabled":true,
|
|
"options":{"connectionId":$conn_id,"prefix":"incoming/","mode":"consume"}}
|
|
JSON
|
|
)
|
|
src_id=$(find_id_by_name "/api/v1/sources" "Incoming S3")
|
|
if [ -n "${src_id:-}" ]; then
|
|
log "S3 source already exists: id $src_id"
|
|
else
|
|
src_id=$(auth -X POST "$BASE_URL/api/v1/sources" -H 'Content-Type: application/json' -d "$src_body" \
|
|
| jq -r '.id // empty' 2>/dev/null)
|
|
log "S3 source id: ${src_id:-<none>}"
|
|
[ -n "${src_id:-}" ] || fail_note "S3 source was not created"
|
|
fi
|
|
|
|
if [ -n "${src_id:-}" ]; then
|
|
# 'inputs', not the legacy {trigger, sourceIds}: Policy has no sourceIds field, so the old
|
|
# shape binds inputs=null and seeds a policy that watches nothing while still returning 200.
|
|
pol_body=$(cat <<JSON
|
|
{"name":"Compress incoming PDFs","enabled":true,
|
|
"inputs":[{"sourceId":"$src_id",
|
|
"trigger":{"type":"schedule","options":{"schedule":{"type":"every","count":5,"unit":"MINUTES"}}}}],
|
|
"steps":[{"operation":"/api/v1/misc/compress-pdf","parameters":{}}],
|
|
"output":{"type":"s3","options":{"connectionId":$conn_id,"prefix":"processed/"}}}
|
|
JSON
|
|
)
|
|
pol_id=$(find_id_by_name "/api/v1/policies" "Compress incoming PDFs")
|
|
if [ -n "${pol_id:-}" ]; then
|
|
log "policy already exists: id $pol_id"
|
|
else
|
|
code=$(auth -o /tmp/pol.json -w '%{http_code}' -X POST "$BASE_URL/api/v1/policies" \
|
|
-H 'Content-Type: application/json' -d "$pol_body")
|
|
log "policy create: HTTP $code $( [ "$code" != 200 ] && head -c 160 /tmp/pol.json )"
|
|
case "$code" in
|
|
2*|409) ;;
|
|
*) fail_note "policy create: HTTP $code" ;;
|
|
esac
|
|
fi
|
|
fi
|
|
|
|
# --- webhook source + policy (only if this build has the webhook type) -----
|
|
wh_body=$(cat <<JSON
|
|
{"name":"Partner webhook","type":"webhook","enabled":true,
|
|
"options":{"connectionId":$conn_id,"mode":"consume"}}
|
|
JSON
|
|
)
|
|
wh_id=$(find_id_by_name "/api/v1/sources" "Partner webhook")
|
|
if [ -n "${wh_id:-}" ]; then
|
|
log "webhook source already exists: id $wh_id"
|
|
else
|
|
wh=$(auth -o /tmp/wh.json -w '%{http_code}' -X POST "$BASE_URL/api/v1/sources" \
|
|
-H 'Content-Type: application/json' -d "$wh_body")
|
|
if [ "$wh" = "200" ] || [ "$wh" = "201" ]; then
|
|
wh_url=$(jq -r '.options.webhookId // empty' </tmp/wh.json 2>/dev/null)
|
|
log "webhook source created (deliver to /api/v1/webhooks/$wh_url)"
|
|
else
|
|
# Not counted as an error: builds without the webhook branch legitimately reject this type.
|
|
log "webhook source not created (HTTP $wh) - expected on builds without the webhook branch"
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
if [ "$errors" -gt 0 ]; then
|
|
log "seed FAILED with $errors error(s)."
|
|
exit 1
|
|
fi
|
|
|
|
log "seed complete."
|
|
log " login: $ADMIN_USER / $ADMIN_PASS at $BASE_URL"
|
|
log " users: user01..$(printf '%02d' "$USER_COUNT")@stirling.test / $USER_PASS"
|