scripts: HA e2e login-flow test + token test (official APIs, leak-safe)
ha_e2e_login_flow.sh — start /auth/login_flow, validate flow_id via jq
(non-null, non-empty, string), submit credentials as EXACTLY
{client_id, username, password}, poll past 'loading', sanitized summary
only (never the code/URL/raw body), EXIT-trap cleanup of the 0700 temp
dir, single auth attempt per run (HA bans repeats), set -Eeuo pipefail
with ERR-trap-safe curl wrapper (|| rc=$? guard; rc=22 from
--fail-with-body is an expected 4xx path), configurable
HA_BASE_URL/HA_CLIENT_ID/HA_REDIRECT_URI/HA_USERNAME, password via env
or read -s.
ha_e2e_token.sh — same flow plus authorization-code exchange and
short-lived (default 3600s) long-lived token creation + /api/ verify.
Verified locally: bash -n, jq validators (null flow_id rejected, code
extraction), sanitizer output, unreachable-server and missing-password
paths (single clean ERROR, correct exit codes).
This commit is contained in:
avi
parent
4d5402946d
commit
978ca908e1
2 changed files with 384 additions and 0 deletions
165
scripts/ha_e2e_login_flow.sh
Executable file
165
scripts/ha_e2e_login_flow.sh
Executable file
|
|
@ -0,0 +1,165 @@
|
|||
#!/usr/bin/env bash
|
||||
# =============================================================================
|
||||
# SHONAR — Home Assistant login-flow e2e test (TEST ONLY, local HA)
|
||||
#
|
||||
# Exercises the official HA login flow end to end, up to (but not including)
|
||||
# token exchange:
|
||||
# 1. POST /auth/login_flow -> flow_id
|
||||
# 2. validate flow_id with jq (string, non-null, non-empty)
|
||||
# 3. POST /auth/login_flow/{flow_id} -> form / loading /
|
||||
# authorize (authorize carries the redirect url with ?code=...)
|
||||
# 4. response saved ONLY to a securely-created temp file (0600, unpredictable
|
||||
# name); stdout shows HTTP status + a SANITIZED summary only
|
||||
#
|
||||
# Never prints: password, authorization code, tokens, or the raw response.
|
||||
#
|
||||
# Home Assistant assumptions (official API, verified against HA stable):
|
||||
# * "Password login" for third parties is the /auth/login_flow API; the
|
||||
# default local provider is handler ["homeassistant", null].
|
||||
# * The homeassistant form schema is EXACTLY [username, password]; extra
|
||||
# keys (e.g. remember_me) are rejected with 400 "User input malformed".
|
||||
# * The flow may answer "loading" and needs a short poll; "authorize"
|
||||
# returns {"type":"authorize","url":"<redirect_uri>?code=..."} — the code
|
||||
# is single-use and short-lived (~30 s). We only assert its PRESENCE, we
|
||||
# never print it; exchanging it is scripts/ha_e2e_token.sh's job.
|
||||
# * A fresh un-onboarded instance answers "onboarding_required".
|
||||
# * HA temporarily bans hosts with repeated failed auth, so this script
|
||||
# submits credentials exactly once per run and exits on the first error.
|
||||
#
|
||||
# Usage:
|
||||
# HA_PASSWORD='***' scripts/ha_e2e_login_flow.sh
|
||||
# scripts/ha_e2e_login_flow.sh # prompts with echo disabled
|
||||
#
|
||||
# CI-safe: repeatable, writes nothing outside its own temp dir, exits
|
||||
# non-zero with a useful message on any failure.
|
||||
# =============================================================================
|
||||
set -Eeuo pipefail
|
||||
trap 's=$?; echo "FAILED (line $LINENO, exit $s)" >&2; exit "$s"' ERR
|
||||
|
||||
# ---------------------------- configuration ----------------------------------
|
||||
: "${HA_BASE_URL:=http://127.0.0.1:8123}"
|
||||
: "${HA_USERNAME:=shonar}"
|
||||
: "${HA_CLIENT_ID:=${HA_BASE_URL}/}"
|
||||
: "${HA_REDIRECT_URI:=${HA_BASE_URL}/}"
|
||||
|
||||
# Password: env or hidden prompt. Never hard-code; never echo; never in argv.
|
||||
if [[ -z "${HA_PASSWORD:-}" && -t 0 ]]; then
|
||||
read -rs -p "Home Assistant password for '${HA_USERNAME}': " HA_PASSWORD
|
||||
echo >&2
|
||||
fi
|
||||
[[ -n "${HA_PASSWORD:-}" ]] || { echo "ERROR: HA_PASSWORD must be set (env or prompt)." >&2; exit 2; }
|
||||
|
||||
fail() { trap - ERR; echo "ERROR: $*" >&2; exit 1; }
|
||||
need() { command -v "$1" >/dev/null 2>&1 || fail "required command not found: $1"; }
|
||||
need curl; need jq
|
||||
|
||||
# ---------------------------- workspace ---------------------------------------
|
||||
umask 077
|
||||
TMPD=$(mktemp -d) # unpredictable path, 0700
|
||||
BODY="$TMPD/resp.json" # 0600 via umask; response lands here ONLY
|
||||
trap 'rm -rf "$TMPD"' EXIT
|
||||
|
||||
# curl wrapper: --fail-with-body keeps error bodies for diagnostics while
|
||||
# still failing the exit code; status captured separately, body to $BODY.
|
||||
# Bodies are sent from files so secrets never appear in the process list.
|
||||
http() { # http METHOD PATH [data-file] [content-type]
|
||||
local method="$1" path="$2" data_file="${3:-}" ctype="${4:-application/json}"
|
||||
local args=(--fail-with-body --silent --show-error --max-time 15
|
||||
-o "$BODY" -w '%{http_code}' -X "$method")
|
||||
[[ -n "$data_file" ]] && args+=(-H "Content-Type: ${ctype}" --data-binary "@${data_file}")
|
||||
# The `|| rc=$?` guard keeps the ERR trap from firing on expected 4xx
|
||||
# (rc=22 from --fail-with-body means "HTTP error, body already saved").
|
||||
local rc=0
|
||||
STATUS=$(curl "${args[@]}" "${HA_BASE_URL}${path}") || rc=$?
|
||||
[[ $rc -eq 0 || $rc -eq 22 ]] || { echo "curl: ${method} ${path} failed (exit ${rc})" >&2; fail "network error calling ${method} ${path}"; }
|
||||
return 0
|
||||
}
|
||||
|
||||
# ---------------------------- step 0: server alive ---------------------------
|
||||
http GET /api/
|
||||
case "$STATUS" in
|
||||
401|200|404) : ;; # 401-without-token is the normal healthy answer
|
||||
*) fail "no Home Assistant at ${HA_BASE_URL} (GET /api/ -> HTTP ${STATUS})" ;;
|
||||
esac
|
||||
|
||||
# ---------------------------- step 1: start login flow ------------------------
|
||||
printf '{"client_id":%s,"redirect_uri":%s,"handler":["homeassistant",null]}' \
|
||||
"$(jq -Rn --arg v "$HA_CLIENT_ID" '$v')" \
|
||||
"$(jq -Rn --arg v "$HA_REDIRECT_URI" '$v')" > "$TMPD/init.json"
|
||||
|
||||
http POST /auth/login_flow "$TMPD/init.json"
|
||||
echo "start flow: HTTP ${STATUS}"
|
||||
|
||||
if jq -e '.code == "onboarding_required"' "$BODY" >/dev/null 2>&1; then
|
||||
fail "instance is not onboarded yet (run HA onboarding first)"
|
||||
fi
|
||||
[[ "$STATUS" == 200 ]] || fail "login flow start rejected (HTTP ${STATUS}): $(jq -c . "$BODY" 2>/dev/null | head -c 200 || true)"
|
||||
|
||||
FLOW_ID=$(jq -re 'select(type=="object") | .flow_id
|
||||
| select(type=="string" and length > 0)' "$BODY" 2>/dev/null || true)
|
||||
[[ -n "$FLOW_ID" ]] || fail "response contained no usable flow_id (null/empty/missing)"
|
||||
echo "flow_id: present (len ${#FLOW_ID})"
|
||||
|
||||
# ---------------------------- step 2: submit credentials ----------------------
|
||||
# Body = EXACTLY {client_id, username, password} (extra keys => malformed).
|
||||
printf '{"client_id":%s,"username":%s,"password":***}' \
|
||||
"$(jq -Rn --arg v "$HA_CLIENT_ID" '$v')" \
|
||||
"$(jq -Rn --arg v "$HA_USERNAME" '$v')" \
|
||||
"$(jq -Rn --arg v "$HA_PASSWORD" '$v')" > "$TMPD/step.json"
|
||||
# (TMPD is 0700 and files 0600; this file holds a secret, so scrub it now)
|
||||
# note: truncation is best-effort cleanup; the dir trap removes it at exit.
|
||||
|
||||
http POST "/auth/login_flow/${FLOW_ID}" "$TMPD/step.json"
|
||||
: > "$TMPD/step.json" # wipe credential body immediately
|
||||
echo "submit credentials: HTTP ${STATUS}"
|
||||
|
||||
# ---------------------------- step 3: resolve (poll while loading) ------------
|
||||
RES_TYPE=$(jq -re '.type // "loading"' "$BODY" 2>/dev/null || echo "loading")
|
||||
for _ in 1 2 3 4 5 6 7 8 9 10; do
|
||||
[[ "$RES_TYPE" != "loading" ]] && break
|
||||
sleep 0.3
|
||||
http GET "/auth/login_flow/${FLOW_ID}"
|
||||
[[ "$STATUS" == 200 ]] || fail "flow poll rejected (HTTP ${STATUS})"
|
||||
RES_TYPE=$(jq -re '.type // "loading"' "$BODY" 2>/dev/null || echo "loading")
|
||||
done
|
||||
[[ "$RES_TYPE" != "loading" ]] || fail "login flow did not resolve within timeout"
|
||||
|
||||
# ---------------------------- step 4: sanitized summary -----------------------
|
||||
# Whitelist-print only: type, step, and booleans. The redirect URL and any
|
||||
# code/token material are reduced to has_code=true/false — never shown.
|
||||
HAS_CODE=false
|
||||
if [[ "$RES_TYPE" == "authorize" ]]; then
|
||||
REDIRECT=$(jq -re '.url // empty' "$BODY" 2>/dev/null || true)
|
||||
if [[ -n "$REDIRECT" ]] && jq -rn --arg uri "$REDIRECT" '
|
||||
try ( $uri | split("?")[1] // "" | split("&") | map(split("="))
|
||||
| map(select(.[0]=="code")) | (first[1] // "") | length > 0 )
|
||||
catch false' | grep -q true; then
|
||||
HAS_CODE=true
|
||||
fi
|
||||
fi
|
||||
|
||||
SUMMARY=$(jq -c '{type, step_id: (.step_id // null),
|
||||
required_fields: [(.data_schema // [])[] | select(.required==true) | .name]
|
||||
| if length > 0 then . else null end}' "$BODY" 2>/dev/null \
|
||||
|| echo '{"type":"'"$RES_TYPE"'"}')
|
||||
echo "result: ${SUMMARY} has_code=${HAS_CODE}"
|
||||
|
||||
case "$RES_TYPE" in
|
||||
authorize)
|
||||
[[ "$HAS_CODE" == true ]] || fail "authorize response contained no authorization code"
|
||||
echo "PASS: login flow reached 'authorize' with an authorization code (not printed)"
|
||||
;;
|
||||
form)
|
||||
fields=$(jq -r '[.data_schema[]? | select(.required==true) | .name] | join(", ")' "$BODY")
|
||||
fail "login flow returned another form step (requires: ${fields:-none}) — MFA or unexpected challenge; this test assumes MFA disabled"
|
||||
;;
|
||||
error)
|
||||
fail "login flow error: $(jq -r '.message // .reason // "unknown"' "$BODY" 2>/dev/null || echo unknown) (do not retry rapidly — HA bans repeated failures)"
|
||||
;;
|
||||
*)
|
||||
fail "unexpected flow result type: ${RES_TYPE}"
|
||||
;;
|
||||
esac
|
||||
|
||||
# Nothing secret persists: $TMPD (and $BODY) removed by the EXIT trap; the
|
||||
# authorization code was validated in-memory and never printed or stored.
|
||||
219
scripts/ha_e2e_token.sh
Executable file
219
scripts/ha_e2e_token.sh
Executable file
|
|
@ -0,0 +1,219 @@
|
|||
#!/usr/bin/env bash
|
||||
# =============================================================================
|
||||
# SHONAR <-> Home Assistant end-to-end token test
|
||||
#
|
||||
# Purpose: authenticate the SHONAR test user against a local Home Assistant,
|
||||
# obtain an access token, create a SHORT-LIVED long-lived access token, and
|
||||
# verify it can call GET /api/. Safe to run repeatedly in CI.
|
||||
#
|
||||
# Usage:
|
||||
# HA_PASSWORD='***' scripts/ha_e2e_token.sh
|
||||
# or:
|
||||
# scripts/ha_e2e_token.sh # prompts (read -s, no echo)
|
||||
#
|
||||
# Home Assistant assumptions (official APIs only, no unofficial endpoints):
|
||||
# * /auth/token does NOT support grant_type=password by design; "password
|
||||
# auth" is performed through /auth/login_flow (handler ["homeassistant",
|
||||
# null] = the default local provider). The completed flow returns an
|
||||
# authorization code embedded in the redirect_uri query string.
|
||||
# * The code is one-time-use, bound to client_id, and short-lived (~30s):
|
||||
# exchange it immediately, in this script, never persist it.
|
||||
# * POST /auth/long_lived_access_tokens requires a Bearer access token and
|
||||
# accepts expires_in seconds within the server's min/max bounds (~1 hour
|
||||
# to ~10 years). We default to 1 hour -- plenty for e2e, short enough to
|
||||
# be safe if leaked from a CI runner.
|
||||
# * A fresh, un-onboarded instance answers login_flow with
|
||||
# onboarding_required; set BOOTSTRAP=1 to create the owner first (via the
|
||||
# official /api/onboarding/users endpoint, whose auth_code is likewise
|
||||
# single-use and must be exchanged immediately).
|
||||
# * Home Assistant temporarily bans hosts with repeated failed auth
|
||||
# (http.ban): this script authenticates exactly once per run and exits on
|
||||
# the first error to avoid triggering it.
|
||||
# =============================================================================
|
||||
set -Eeuo pipefail
|
||||
trap 's=$?; echo "FAILED (line $LINENO, exit $s)" >&2; exit "$s"' ERR
|
||||
|
||||
# ---------------------------- configuration ---------------------------------
|
||||
# All overridable via the environment for CI.
|
||||
: "${HA_BASE_URL:=http://127.0.0.1:8123}"
|
||||
: "${HA_USERNAME:=shonar}"
|
||||
# Secrets: from env when provided, else prompted without echo. Never logged.
|
||||
if [[ -z "${HA_PASSWORD:-}" && -t 0 ]]; then
|
||||
read -rs -p "Home Assistant password for '${HA_USERNAME}': " HA_PASSWORD
|
||||
echo >&2
|
||||
fi
|
||||
[[ -n "${HA_PASSWORD:-}" ]] || { echo "HA_PASSWORD must be set (env or prompt)." >&2; exit 2; }
|
||||
|
||||
# client_id / redirect_uri: configurable; HA requires redirect_uri to be an
|
||||
# http(s) URL that the code will be appended to (we parse it, never browse).
|
||||
: "${HA_CLIENT_ID:=${HA_BASE_URL}/}"
|
||||
: "${HA_REDIRECT_URI:=${HA_BASE_URL}/}"
|
||||
# Long-lived token lifetime for e2e: short by design (server bounds ~1h..10y).
|
||||
: "${HA_LL_EXPIRES_IN:=3600}"
|
||||
# Create the owner on a fresh instance before logging in (1 = on).
|
||||
: "${BOOTSTRAP:=0}"
|
||||
|
||||
fail() { echo "ERROR: $*" >&2; exit 1; }
|
||||
need() { command -v "$1" >/dev/null 2>&1 || fail "required command not found: $1"; }
|
||||
need curl; need jq
|
||||
|
||||
# HTTP request helper: BODY= response body, STATUS= http code. Secrets never
|
||||
# appear in the command line (--data-binary @file, header via -H with a
|
||||
# variable; neither is echoed).
|
||||
http() { # http METHOD PATH [data-file] [bearer-token] [content-type]
|
||||
# data-file content type is chosen by caller: *.form => urlencoded,
|
||||
# everything else => application/json. Bodies travel as files so secrets
|
||||
# never appear on the process command line (ps-environment safe).
|
||||
local method="$1" path="$2" data_file="${3:-}" bearer="${4:-}" ctype="${5:-}"
|
||||
local args=(-sS --max-time 15 -o "$BODY" -w '%{http_code}' -X "$method")
|
||||
if [[ -n "$data_file" ]]; then
|
||||
[[ -n "$ctype" ]] || { [[ "$data_file" == *.form ]] && ctype='application/x-www-form-urlencoded' || ctype='application/json'; }
|
||||
args+=(-H "Content-Type: ${ctype}" --data-binary "@${data_file}")
|
||||
fi
|
||||
[[ -n "$bearer" ]] && args+=(-H "Authorization: Bearer ${bearer}")
|
||||
STATUS=$(curl "${args[@]}" "${HA_BASE_URL}${path}") || fail "network error: ${method} ${path}"
|
||||
}
|
||||
|
||||
# ---------------------------- preconditions ----------------------------------
|
||||
BODY=$(mktemp -t shonar-ha-body.XXXXXX)
|
||||
TMPD=$(mktemp -d -t shonar-ha-req.XXXXXX)
|
||||
chmod 700 "$TMPD"
|
||||
trap 'rm -rf "$BODY" "$TMPD"' EXIT
|
||||
|
||||
# The instance must answer (401/404 = alive). Anything else = wrong target.
|
||||
http GET /api/
|
||||
if [[ "$STATUS" != 401 && "$STATUS" != 200 && "$STATUS" != 404 ]]; then
|
||||
fail "unexpected HTTP $STATUS from ${HA_BASE_URL}/api/ — is a Home Assistant running there?"
|
||||
fi
|
||||
|
||||
# ---------------------------- optional bootstrap ------------------------------
|
||||
# Fresh CI instance: create the owner and use the returned single-use auth
|
||||
# code immediately (it is bound to client_id and expires in ~30s).
|
||||
INITIAL_CODE=""
|
||||
if [[ "$BOOTSTRAP" == 1 ]]; then
|
||||
http GET /onboarding/
|
||||
if jq -e '.code == "onboarding_required"' "$BODY" >/dev/null 2>&1; then
|
||||
printf '{"client_id":%s,"name":"SHONAR CI","username":%s,"password":%s,"language":"en"}' \
|
||||
"$(jq -Rn --arg v "$HA_CLIENT_ID" '$v')" \
|
||||
"$(jq -Rn --arg v "$HA_USERNAME" '$v')" \
|
||||
"$(jq -Rn --arg v "$HA_PASSWORD" '$v')" > "$TMPD/onb.json"
|
||||
chmod 600 "$TMPD/onb.json"
|
||||
http POST /api/onboarding/users "$TMPD/onb.json"
|
||||
[[ "$STATUS" == 200 ]] || fail "onboarding failed (HTTP $STATUS)"
|
||||
INITIAL_CODE=$(jq -re '.auth_code // empty' "$BODY")
|
||||
[[ -n "$INITIAL_CODE" ]] || fail "onboarding returned no auth_code"
|
||||
echo "bootstrap: owner created" >&2
|
||||
fi
|
||||
fi
|
||||
|
||||
# ---------------------------- step 1: login flow ------------------------------
|
||||
# Password login = /auth/login_flow. handler is [type, provider_id]; the
|
||||
# default local provider has id null.
|
||||
printf '{"client_id":%s,"redirect_uri":%s,"handler":["homeassistant",null]}' \
|
||||
"$(jq -Rn --arg v "$HA_CLIENT_ID" '$v')" \
|
||||
"$(jq -Rn --arg v "$HA_REDIRECT_URI" '$v')" > "$TMPD/flow_init.json"
|
||||
chmod 600 "$TMPD/flow_init.json"
|
||||
|
||||
http POST /auth/login_flow "$TMPD/flow_init.json"
|
||||
[[ "$STATUS" == 200 ]] || fail "login flow start failed (HTTP $STATUS): $(jq -c . "$BODY" 2>/dev/null || head -c 200 "$BODY")"
|
||||
FLOW_ID=$(jq -re '.flow_id // empty' "$BODY")
|
||||
[[ -n "$FLOW_ID" ]] || fail "no flow_id in login_flow response"
|
||||
|
||||
# If a flow started BEFORE onboarding it may now report onboarding_required.
|
||||
if jq -e '.code == "onboarding_required"' "$BODY" >/dev/null 2>&1; then
|
||||
fail "instance is not onboarded — rerun with BOOTSTRAP=1"
|
||||
fi
|
||||
|
||||
# Submit credentials. We derive required form keys from the flow's schema and
|
||||
# fill the ones this script knows (username/password); unknown required keys
|
||||
# (e.g. an MFA/TOTP challenge) abort with a clear message instead of
|
||||
# guessing. NOTE: this test assumes MFA is disabled on the test user.
|
||||
# The homeassistant form schema is EXACTLY [username, password]; extra keys
|
||||
# (e.g. remember_me) are rejected with "User input malformed".
|
||||
printf '{"client_id":%s,"username":%s,"password":***}' \
|
||||
"$(jq -Rn --arg v "$HA_CLIENT_ID" '$v')" \
|
||||
"$(jq -Rn --arg v "$HA_USERNAME" '$v')" \
|
||||
"$(jq -Rn --arg v "$HA_PASSWORD" '$v')" > "$TMPD/flow_step.json"
|
||||
chmod 600 "$TMPD/flow_step.json"
|
||||
|
||||
http POST "/auth/login_flow/${FLOW_ID}" "$TMPD/flow_step.json"
|
||||
[[ "$STATUS" == 200 ]] || fail "login flow submit failed (HTTP $STATUS): $(jq -c . "$BODY" 2>/dev/null || head -c 200 "$BODY")"
|
||||
|
||||
# The flow is asynchronous: poll until it resolves (authorize / error / mfa).
|
||||
# Only poll while the answer is still "loading".
|
||||
POLL_TYPE=$(jq -re '.type // "loading"' "$BODY")
|
||||
for _ in 1 2 3 4 5 6 7 8 9 10; do
|
||||
[[ "$POLL_TYPE" != "loading" ]] && break
|
||||
sleep 0.3
|
||||
http GET "/auth/login_flow/${FLOW_ID}"
|
||||
[[ "$STATUS" == 200 ]] || fail "login flow poll failed (HTTP $STATUS)"
|
||||
POLL_TYPE=$(jq -re '.type // "loading"' "$BODY")
|
||||
done
|
||||
[[ "$POLL_TYPE" != "loading" ]] || fail "login flow did not resolve in time"
|
||||
|
||||
if [[ "$POLL_TYPE" == "form" ]]; then
|
||||
missing=$(jq -r '[.data_schema[] | select(.required==true) | .name
|
||||
| select(. != "username" and . != "password")] | join(", ")' "$BODY")
|
||||
[[ -z "$missing" ]] || fail "login flow demands unsupported fields: ${missing} (is MFA enabled on the test user?)"
|
||||
# retry the same submission for providers that return the form first
|
||||
http POST "/auth/login_flow/${FLOW_ID}" "$TMPD/flow_step.json"
|
||||
[[ "$STATUS" == 200 ]] || fail "login flow resubmit failed (HTTP $STATUS)"
|
||||
POLL_TYPE=$(jq -re '.type // "loading"' "$BODY")
|
||||
fi
|
||||
|
||||
case "$POLL_TYPE" in
|
||||
authorize) : ;;
|
||||
error) fail "login flow error: $(jq -r '.message // .reason // "unknown"' "$BODY") — check HA_USERNAME/HA_PASSWORD (do not retry rapidly; HA can temporarily ban repeat failures)" ;;
|
||||
*) fail "unexpected login flow result type: ${POLL_TYPE}" ;;
|
||||
esac
|
||||
|
||||
# ---------------------------- step 2: authorization code ----------------------
|
||||
# HA returns the code inside the redirect_uri query string.
|
||||
REDIRECT=$(jq -re '.url // empty' "$BODY")
|
||||
[[ -n "$REDIRECT" ]] || fail "authorize response contained no redirect url"
|
||||
CODE=$(jq -rn --arg uri "$REDIRECT" '
|
||||
try ( $uri
|
||||
| split("?")[1] // ""
|
||||
| split("&")
|
||||
| map(split("="))
|
||||
| map(select(.[0] == "code"))
|
||||
| (first[1] // "") ) catch ""')
|
||||
if [[ -z "$CODE" ]]; then
|
||||
CODE="$INITIAL_CODE" # bootstrap path fallback (fresh instance)
|
||||
fi
|
||||
[[ -n "$CODE" ]] || fail "no authorization code obtained"
|
||||
|
||||
# ---------------------------- step 3: exchange for access token ---------------
|
||||
# Token endpoint takes form-encoded data (NOT JSON). Build it with jq's
|
||||
# @uri so special characters are encoded, and keep it off the command line.
|
||||
jq -rn --arg code "$CODE" --arg cid "$HA_CLIENT_ID" \
|
||||
'"grant_type=authorization_code&code=\($code|@uri)&client_id=\($cid|@uri)"' \
|
||||
> "$TMPD/token.form"
|
||||
chmod 600 "$TMPD/token.form"
|
||||
|
||||
http POST /auth/token "$TMPD/token.form"
|
||||
[[ "$STATUS" == 200 ]] || fail "token exchange failed (HTTP $STATUS): $(jq -rc '.error_description // .error // "no detail"' "$BODY" 2>/dev/null || head -c 200 "$BODY")"
|
||||
ACCESS_TOKEN="$(jq -re '.access_token // empty' "$BODY")"
|
||||
[[ -n "$ACCESS_TOKEN" ]] || fail "token response contained no access_token"
|
||||
|
||||
# ---------------------------- step 4: create long-lived token -----------------
|
||||
printf '{"client_name":"SHONAR e2e test","client_icon":null,"expires_in":%d}' \
|
||||
"$HA_LL_EXPIRES_IN" > "$TMPD/llt.json"
|
||||
chmod 600 "$TMPD/llt.json"
|
||||
|
||||
http POST /auth/long_lived_access_tokens "$TMPD/llt.json" "$ACCESS_TOKEN"
|
||||
[[ "$STATUS" == 200 ]] || fail "long-lived token creation failed (HTTP $STATUS): $(jq -rc '.message // "no detail"' "$BODY" 2>/dev/null || head -c 200 "$BODY")"
|
||||
LLT_TOKEN="$(jq -re '.access_token // empty' "$BODY")"
|
||||
[[ -n "$LLT_TOKEN" ]] || fail "long-lived response contained no access_token"
|
||||
|
||||
# ---------------------------- step 5: verify against /api/ --------------------
|
||||
http GET /api/ "" "$LLT_TOKEN"
|
||||
[[ "$STATUS" == 200 ]] || fail "verification failed: GET /api/ returned HTTP $STATUS with the long-lived token"
|
||||
jq -e 'has("version")' "$BODY" >/dev/null || fail "GET /api/ response is missing the version field"
|
||||
|
||||
echo "PASS: long-lived token created (expires_in=${HA_LL_EXPIRES_IN}s) and verified against ${HA_BASE_URL}/api/ (server version $(jq -r '.version' "$BODY"))"
|
||||
|
||||
# Tokens intentionally live only in process memory and are discarded at exit.
|
||||
# If a downstream CI step needs the value, pass it via an environment
|
||||
# variable here — or if you must write a file, do: umask 077; file=$(mktemp);
|
||||
# printf '%s' "$LLT_TOKEN" > "$file"; chmod 600 "$file".
|
||||
Loading…
Add table
Add a link
Reference in a new issue