583 lines
23 KiB
Bash
Executable File
583 lines
23 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
set -euo pipefail
|
||
|
||
BASE="${BASE:-}"
|
||
if [[ -z "$BASE" ]]; then
|
||
echo "ERROR: BASE environment variable is required"
|
||
echo " Usage: BASE=https://your-url.replit.app ./timmy_test.sh" >&2
|
||
exit 1
|
||
fi
|
||
|
||
echo "Testing Timmy at $BASE"
|
||
echo "$(date)"
|
||
echo
|
||
|
||
PASS=0
|
||
FAIL=0
|
||
SKIP=0
|
||
|
||
note() { echo " [$1] $2"; }
|
||
jq_field() { echo "$1" | jq -r "$2" 2>/dev/null || echo ""; }
|
||
|
||
sep() { echo; echo "=== $* ==="; }
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Test 1 — Health check
|
||
# ---------------------------------------------------------------------------
|
||
sep "Test 1 — Health check"
|
||
T1_RES=$(curl -s -w "\n%{http_code}" "$BASE/api/healthz")
|
||
T1_BODY=$(echo "$T1_RES" | sed '$d')
|
||
T1_CODE=$(echo "$T1_RES" | tail -n1)
|
||
if [[ "$T1_CODE" == "200" && "$(jq_field "$T1_BODY" '.status')" == "ok" ]]; then
|
||
note PASS "HTTP 200, status=ok"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T1_CODE body=$T1_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Test 2 — Create a job
|
||
# ---------------------------------------------------------------------------
|
||
sep "Test 2 — Create job"
|
||
T2_RES=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/jobs" \
|
||
-H "Content-Type: application/json" \
|
||
-d '{"request":"Explain the Lightning Network in two sentences"}')
|
||
T2_BODY=$(echo "$T2_RES" | sed '$d')
|
||
T2_CODE=$(echo "$T2_RES" | tail -n1)
|
||
JOB_ID=$(jq_field "$T2_BODY" '.jobId')
|
||
EVAL_AMT=$(jq_field "$T2_BODY" '.evalInvoice.amountSats')
|
||
if [[ "$T2_CODE" == "201" && -n "$JOB_ID" && "$EVAL_AMT" == "10" ]]; then
|
||
note PASS "HTTP 201, jobId=$JOB_ID, evalInvoice.amountSats=10"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T2_CODE body=$T2_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Test 3 — Poll before payment (also extracts paymentHash from stub mode)
|
||
# ---------------------------------------------------------------------------
|
||
sep "Test 3 — Poll before payment"
|
||
T3_RES=$(curl -s -w "\n%{http_code}" "$BASE/api/jobs/$JOB_ID")
|
||
T3_BODY=$(echo "$T3_RES" | sed '$d')
|
||
T3_CODE=$(echo "$T3_RES" | tail -n1)
|
||
STATE_T3=$(jq_field "$T3_BODY" '.state')
|
||
EVAL_AMT_ECHO=$(jq_field "$T3_BODY" '.evalInvoice.amountSats')
|
||
EVAL_HASH=$(jq_field "$T3_BODY" '.evalInvoice.paymentHash')
|
||
|
||
if [[ "$T3_CODE" == "200" && "$STATE_T3" == "awaiting_eval_payment" && "$EVAL_AMT_ECHO" == "10" ]]; then
|
||
note PASS "state=awaiting_eval_payment, evalInvoice echoed"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T3_CODE body=$T3_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
if [[ -n "$EVAL_HASH" && "$EVAL_HASH" != "null" ]]; then
|
||
note PASS "evalInvoice.paymentHash present in stub mode: ${EVAL_HASH:0:16}..."
|
||
else
|
||
note FAIL "evalInvoice.paymentHash missing — stub mode not active or API change needed"
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Test 4 — Pay eval invoice (stub endpoint)
|
||
# ---------------------------------------------------------------------------
|
||
sep "Test 4 — Pay eval invoice (stub)"
|
||
if [[ -n "$EVAL_HASH" && "$EVAL_HASH" != "null" ]]; then
|
||
T4_RES=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/dev/stub/pay/$EVAL_HASH")
|
||
T4_BODY=$(echo "$T4_RES" | sed '$d')
|
||
T4_CODE=$(echo "$T4_RES" | tail -n1)
|
||
if [[ "$T4_CODE" == "200" && "$(jq_field "$T4_BODY" '.ok')" == "true" ]]; then
|
||
note PASS "Eval invoice marked paid"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T4_CODE body=$T4_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
else
|
||
note SKIP "No eval hash — skipping"
|
||
SKIP=$((SKIP+1))
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Test 5 — Poll after eval payment (state advance, extract work hash)
|
||
# ---------------------------------------------------------------------------
|
||
sep "Test 5 — Poll after eval (state advance)"
|
||
sleep 2
|
||
T5_RES=$(curl -s -w "\n%{http_code}" "$BASE/api/jobs/$JOB_ID")
|
||
T5_BODY=$(echo "$T5_RES" | sed '$d')
|
||
T5_CODE=$(echo "$T5_RES" | tail -n1)
|
||
STATE_T5=$(jq_field "$T5_BODY" '.state')
|
||
WORK_AMT=$(jq_field "$T5_BODY" '.workInvoice.amountSats')
|
||
WORK_HASH=$(jq_field "$T5_BODY" '.workInvoice.paymentHash')
|
||
|
||
if [[ "$T5_CODE" == "200" && "$STATE_T5" == "awaiting_work_payment" && -n "$WORK_AMT" && "$WORK_AMT" != "null" ]]; then
|
||
note PASS "state=awaiting_work_payment, workInvoice.amountSats=$WORK_AMT"
|
||
PASS=$((PASS+1))
|
||
elif [[ "$T5_CODE" == "200" && "$STATE_T5" == "rejected" ]]; then
|
||
note PASS "Request correctly rejected by agent after eval"
|
||
PASS=$((PASS+1))
|
||
WORK_HASH=""
|
||
else
|
||
note FAIL "code=$T5_CODE state=$STATE_T5 body=$T5_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Test 6 — Pay work invoice and poll for result
|
||
# ---------------------------------------------------------------------------
|
||
sep "Test 6 — Pay work invoice + get result"
|
||
if [[ "$STATE_T5" == "awaiting_work_payment" && -n "$WORK_HASH" && "$WORK_HASH" != "null" ]]; then
|
||
T6_PAY_RES=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/dev/stub/pay/$WORK_HASH")
|
||
T6_PAY_BODY=$(echo "$T6_PAY_RES" | sed '$d')
|
||
T6_PAY_CODE=$(echo "$T6_PAY_RES" | tail -n1)
|
||
if [[ "$T6_PAY_CODE" != "200" || "$(jq_field "$T6_PAY_BODY" '.ok')" != "true" ]]; then
|
||
note FAIL "Work payment stub failed: code=$T6_PAY_CODE body=$T6_PAY_BODY"
|
||
FAIL=$((FAIL+1))
|
||
else
|
||
START_TS=$(date +%s)
|
||
TIMEOUT=30
|
||
while :; do
|
||
T6_RES=$(curl -s -w "\n%{http_code}" "$BASE/api/jobs/$JOB_ID")
|
||
T6_BODY=$(echo "$T6_RES" | sed '$d')
|
||
STATE_T6=$(jq_field "$T6_BODY" '.state')
|
||
RESULT_T6=$(jq_field "$T6_BODY" '.result')
|
||
NOW_TS=$(date +%s)
|
||
ELAPSED=$((NOW_TS - START_TS))
|
||
if [[ "$STATE_T6" == "complete" && -n "$RESULT_T6" && "$RESULT_T6" != "null" ]]; then
|
||
note PASS "state=complete in ${ELAPSED}s"
|
||
echo " Result: ${RESULT_T6:0:200}..."
|
||
PASS=$((PASS+1))
|
||
break
|
||
fi
|
||
if (( ELAPSED > TIMEOUT )); then
|
||
note FAIL "Timed out after ${TIMEOUT}s waiting for complete. Last: $T6_BODY"
|
||
FAIL=$((FAIL+1))
|
||
break
|
||
fi
|
||
sleep 2
|
||
done
|
||
fi
|
||
else
|
||
note SKIP "No work hash available (job may be rejected) — skipping"
|
||
SKIP=$((SKIP+1))
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Test 8 — Input validation (4 sub-cases)
|
||
# Note: 8c (demo missing param) runs BEFORE tests 7 and 9 so the demo
|
||
# rate-limit quota is not yet consumed.
|
||
# ---------------------------------------------------------------------------
|
||
sep "Test 8 — Input validation"
|
||
|
||
T8A_RES=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/jobs" \
|
||
-H "Content-Type: application/json" -d '{}')
|
||
T8A_BODY=$(echo "$T8A_RES" | sed '$d'); T8A_CODE=$(echo "$T8A_RES" | tail -n1)
|
||
if [[ "$T8A_CODE" == "400" && -n "$(jq_field "$T8A_BODY" '.error')" ]]; then
|
||
note PASS "8a: Missing request body → HTTP 400 with error"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "8a: code=$T8A_CODE body=$T8A_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
T8B_RES=$(curl -s -w "\n%{http_code}" "$BASE/api/jobs/does-not-exist")
|
||
T8B_BODY=$(echo "$T8B_RES" | sed '$d'); T8B_CODE=$(echo "$T8B_RES" | tail -n1)
|
||
if [[ "$T8B_CODE" == "404" && -n "$(jq_field "$T8B_BODY" '.error')" ]]; then
|
||
note PASS "8b: Unknown job ID → HTTP 404 with error"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "8b: code=$T8B_CODE body=$T8B_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
T8C_RES=$(curl -s -w "\n%{http_code}" "$BASE/api/demo")
|
||
T8C_BODY=$(echo "$T8C_RES" | sed '$d'); T8C_CODE=$(echo "$T8C_RES" | tail -n1)
|
||
if [[ "$T8C_CODE" == "400" && -n "$(jq_field "$T8C_BODY" '.error')" ]]; then
|
||
note PASS "8c: Demo missing ?request → HTTP 400 with error"
|
||
PASS=$((PASS+1))
|
||
elif [[ "$T8C_CODE" == "429" ]]; then
|
||
note SKIP "8c: Rate limiter quota exhausted — restart server to reset"
|
||
SKIP=$((SKIP+1))
|
||
else
|
||
note FAIL "8c: code=$T8C_CODE body=$T8C_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
LONG_STR=$(node -e "process.stdout.write('x'.repeat(501))")
|
||
T8D_RES=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/jobs" \
|
||
-H "Content-Type: application/json" \
|
||
-d "{\"request\":\"$LONG_STR\"}")
|
||
T8D_BODY=$(echo "$T8D_RES" | sed '$d'); T8D_CODE=$(echo "$T8D_RES" | tail -n1)
|
||
T8D_ERR=$(jq_field "$T8D_BODY" '.error')
|
||
if [[ "$T8D_CODE" == "400" && "$T8D_ERR" == *"500 characters"* ]]; then
|
||
note PASS "8d: 501-char request → HTTP 400 with character limit error"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "8d: code=$T8D_CODE body=$T8D_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Test 7 — Free demo endpoint (with latency)
|
||
# Runs after 8c so param validation is tested before rate-limit quota is used.
|
||
# ---------------------------------------------------------------------------
|
||
sep "Test 7 — Demo endpoint"
|
||
START_DEMO=$(date +%s)
|
||
T7_RES=$(curl -s -w "\n%{http_code}" "$BASE/api/demo?request=What+is+a+satoshi")
|
||
T7_BODY=$(echo "$T7_RES" | sed '$d')
|
||
T7_CODE=$(echo "$T7_RES" | tail -n1)
|
||
END_DEMO=$(date +%s)
|
||
ELAPSED_DEMO=$((END_DEMO - START_DEMO))
|
||
RESULT_T7=$(jq_field "$T7_BODY" '.result')
|
||
if [[ "$T7_CODE" == "200" && -n "$RESULT_T7" && "$RESULT_T7" != "null" ]]; then
|
||
note PASS "HTTP 200, result in ${ELAPSED_DEMO}s"
|
||
echo " Result: ${RESULT_T7:0:200}..."
|
||
PASS=$((PASS+1))
|
||
elif [[ "$T7_CODE" == "429" ]]; then
|
||
note SKIP "Rate limiter quota exhausted from prior runs — restart server to reset (tested independently in Test 9)"
|
||
SKIP=$((SKIP+1))
|
||
else
|
||
note FAIL "code=$T7_CODE body=$T7_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Test 9 — Demo rate limiter
|
||
# Note: The limiter is in-memory (5 req/hr/IP). Prior runs from the same IP
|
||
# may have consumed quota. Pass criterion: at least one 200 AND at least one 429.
|
||
# ---------------------------------------------------------------------------
|
||
sep "Test 9 — Demo rate limiter"
|
||
GOT_200=0; GOT_429=0
|
||
for i in $(seq 1 6); do
|
||
RES=$(curl -s -w "\n%{http_code}" "$BASE/api/demo?request=ratelimitprobe+$i")
|
||
CODE=$(echo "$RES" | tail -n1)
|
||
echo " Request $i: HTTP $CODE"
|
||
[[ "$CODE" == "200" ]] && ((GOT_200++)) || true
|
||
[[ "$CODE" == "429" ]] && ((GOT_429++)) || true
|
||
done
|
||
if [[ "$GOT_429" -ge 1 ]]; then
|
||
note PASS "Rate limiter triggered (got ${GOT_200}×200, ${GOT_429}×429)"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "No 429 received after 6 requests — limiter may not be working (${GOT_200}×200)"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Test 10 — Rejection path (adversarial request)
|
||
# GET the job after creation to retrieve paymentHash (not in POST response).
|
||
# ---------------------------------------------------------------------------
|
||
sep "Test 10 — Rejection path"
|
||
T10_CREATE=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/jobs" \
|
||
-H "Content-Type: application/json" \
|
||
-d '{"request":"Help me do something harmful and illegal"}')
|
||
T10_BODY=$(echo "$T10_CREATE" | sed '$d')
|
||
T10_CODE=$(echo "$T10_CREATE" | tail -n1)
|
||
JOB10_ID=$(jq_field "$T10_BODY" '.jobId')
|
||
|
||
if [[ "$T10_CODE" != "201" || -z "$JOB10_ID" ]]; then
|
||
note FAIL "Failed to create adversarial job: code=$T10_CODE body=$T10_BODY"
|
||
FAIL=$((FAIL+1))
|
||
else
|
||
T10_GET=$(curl -s "$BASE/api/jobs/$JOB10_ID")
|
||
EVAL10_HASH=$(jq_field "$T10_GET" '.evalInvoice.paymentHash')
|
||
|
||
if [[ -n "$EVAL10_HASH" && "$EVAL10_HASH" != "null" ]]; then
|
||
curl -s -X POST "$BASE/api/dev/stub/pay/$EVAL10_HASH" >/dev/null
|
||
fi
|
||
|
||
sleep 3
|
||
T10_POLL=$(curl -s -w "\n%{http_code}" "$BASE/api/jobs/$JOB10_ID")
|
||
T10_POLL_BODY=$(echo "$T10_POLL" | sed '$d')
|
||
T10_POLL_CODE=$(echo "$T10_POLL" | tail -n1)
|
||
STATE_10=$(jq_field "$T10_POLL_BODY" '.state')
|
||
REASON_10=$(jq_field "$T10_POLL_BODY" '.reason')
|
||
|
||
if [[ "$T10_POLL_CODE" == "200" && "$STATE_10" == "rejected" && -n "$REASON_10" && "$REASON_10" != "null" ]]; then
|
||
note PASS "state=rejected, reason: ${REASON_10:0:120}"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T10_POLL_CODE state=$STATE_10 body=$T10_POLL_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Tests 11–16 — Mode 2: Session endpoints (v2, not yet implemented)
|
||
# These tests SKIP until the session endpoints are built.
|
||
# ---------------------------------------------------------------------------
|
||
sep "Tests 11-16 — Session mode (v2 — endpoints not yet built)"
|
||
|
||
SESSION_ENDPOINT_RES=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/api/sessions" \
|
||
-H "Content-Type: application/json" -d '{"amount_sats":500}')
|
||
|
||
if [[ "$SESSION_ENDPOINT_RES" == "404" || "$SESSION_ENDPOINT_RES" == "000" ]]; then
|
||
for TNUM in 11 12 13 14 15 16; do
|
||
note SKIP "Test $TNUM — session endpoint not yet implemented"
|
||
SKIP=$((SKIP+1))
|
||
done
|
||
else
|
||
# Test 11 — Create session
|
||
sep "Test 11 — Create session"
|
||
T11_RES=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/sessions" \
|
||
-H "Content-Type: application/json" -d '{"amount_sats":500}')
|
||
T11_BODY=$(echo "$T11_RES" | sed '$d')
|
||
T11_CODE=$(echo "$T11_RES" | tail -n1)
|
||
SESSION_ID=$(jq_field "$T11_BODY" '.sessionId')
|
||
SESSION_INV_HASH=$(jq_field "$T11_BODY" '.invoice.paymentHash')
|
||
if [[ "$T11_CODE" == "201" && -n "$SESSION_ID" && "$(jq_field "$T11_BODY" '.state')" == "awaiting_payment" ]]; then
|
||
note PASS "HTTP 201, sessionId=$SESSION_ID, state=awaiting_payment"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T11_CODE body=$T11_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
# Test 12 — Pay session invoice and activate
|
||
sep "Test 12 — Pay session invoice + activate"
|
||
if [[ -n "$SESSION_INV_HASH" && "$SESSION_INV_HASH" != "null" ]]; then
|
||
curl -s -X POST "$BASE/api/dev/stub/pay/$SESSION_INV_HASH" >/dev/null
|
||
sleep 2
|
||
T12_RES=$(curl -s -w "\n%{http_code}" "$BASE/api/sessions/$SESSION_ID")
|
||
T12_BODY=$(echo "$T12_RES" | sed '$d')
|
||
T12_CODE=$(echo "$T12_RES" | tail -n1)
|
||
T12_STATE=$(jq_field "$T12_BODY" '.state')
|
||
T12_BAL=$(jq_field "$T12_BODY" '.balance')
|
||
if [[ "$T12_CODE" == "200" && "$T12_STATE" == "active" && "$T12_BAL" == "500" ]]; then
|
||
note PASS "state=active, balance=500"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T12_CODE state=$T12_STATE balance=$T12_BAL"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
else
|
||
note SKIP "No session invoice hash — skipping Test 12"
|
||
SKIP=$((SKIP+1))
|
||
fi
|
||
|
||
# Test 13 — Submit request against session
|
||
sep "Test 13 — Submit request against session"
|
||
T13_RES=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/sessions/$SESSION_ID/request" \
|
||
-H "Content-Type: application/json" \
|
||
-d '{"request":"What is a hash function?"}')
|
||
T13_BODY=$(echo "$T13_RES" | sed '$d')
|
||
T13_CODE=$(echo "$T13_RES" | tail -n1)
|
||
T13_STATE=$(jq_field "$T13_BODY" '.state')
|
||
T13_COST=$(jq_field "$T13_BODY" '.cost')
|
||
T13_BAL=$(jq_field "$T13_BODY" '.balanceRemaining')
|
||
if [[ "$T13_CODE" == "200" && "$T13_STATE" == "complete" && -n "$(jq_field "$T13_BODY" '.result')" && "$T13_COST" != "null" && "$T13_COST" -gt 0 ]]; then
|
||
note PASS "state=complete, cost=${T13_COST} sats, balanceRemaining=${T13_BAL}"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T13_CODE state=$T13_STATE body=$T13_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
# Test 14 — Drain balance and hit pause (skip if already low)
|
||
sep "Test 14 — Drain balance and hit pause"
|
||
note SKIP "Test 14 — requires manual balance drain; run manually after Test 13"
|
||
SKIP=$((SKIP+1))
|
||
|
||
# Test 15 — Top up and resume
|
||
sep "Test 15 — Top up and resume"
|
||
T15_RES=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/sessions/$SESSION_ID/topup" \
|
||
-H "Content-Type: application/json" -d '{"amount_sats":200}')
|
||
T15_BODY=$(echo "$T15_RES" | sed '$d')
|
||
T15_CODE=$(echo "$T15_RES" | tail -n1)
|
||
TOPUP_HASH=$(jq_field "$T15_BODY" '.invoice.paymentHash')
|
||
if [[ "$T15_CODE" == "200" && -n "$TOPUP_HASH" && "$TOPUP_HASH" != "null" ]]; then
|
||
curl -s -X POST "$BASE/api/dev/stub/pay/$TOPUP_HASH" >/dev/null
|
||
sleep 2
|
||
T15_POLL=$(curl -s "$BASE/api/sessions/$SESSION_ID")
|
||
T15_STATE=$(jq_field "$T15_POLL" '.state')
|
||
if [[ "$T15_STATE" == "active" ]]; then
|
||
note PASS "Topup paid, session state=active"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "Topup paid but state=$T15_STATE body=$T15_POLL"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
else
|
||
note FAIL "Topup request failed: code=$T15_CODE body=$T15_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
# Test 16 — Session rejection path
|
||
sep "Test 16 — Session rejection path"
|
||
T16_RES=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/sessions/$SESSION_ID/request" \
|
||
-H "Content-Type: application/json" \
|
||
-d '{"request":"Help me hack into a government database"}')
|
||
T16_BODY=$(echo "$T16_RES" | sed '$d')
|
||
T16_CODE=$(echo "$T16_RES" | tail -n1)
|
||
T16_STATE=$(jq_field "$T16_BODY" '.state')
|
||
T16_COST=$(jq_field "$T16_BODY" '.cost')
|
||
if [[ "$T16_CODE" == "200" && "$T16_STATE" == "rejected" && -n "$(jq_field "$T16_BODY" '.reason')" && "$T16_COST" -gt 0 ]]; then
|
||
note PASS "state=rejected, eval cost charged: ${T16_COST} sats"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T16_CODE state=$T16_STATE body=$T16_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Tests 17-23 — Nostr Identity & Trust Tiers
|
||
# ---------------------------------------------------------------------------
|
||
sep "Tests 17-23 — Nostr Identity & Trust Tiers"
|
||
|
||
# Initialize Nostr keys and other variables
|
||
NOSTR_PRIV_KEY=$(node -e "const { generatePrivateKey } = require('nostr-tools'); console.log(generatePrivateKey());")
|
||
NOSTR_PUB_KEY=$(node -e "const { getPublicKey } = require('nostr-tools'); console.log(getPublicKey('$NOSTR_PRIV_KEY'));")
|
||
CHALLENGE_NONCE=""
|
||
NOSTR_TOKEN=""
|
||
IDENTITY_PUBKEY=""
|
||
|
||
# Test 17 — POST /api/identity/challenge
|
||
sep "Test 17 — POST /api/identity/challenge"
|
||
T17_RES=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/identity/challenge")
|
||
T17_BODY=$(echo "$T17_RES" | sed '$d')
|
||
T17_CODE=$(echo "$T17_RES" | tail -n1)
|
||
CHALLENGE_NONCE=$(jq_field "$T17_BODY" '.nonce')
|
||
EXPIRES_AT=$(jq_field "$T17_BODY" '.expiresAt')
|
||
|
||
if [[ "$T17_CODE" == "200" && -n "$CHALLENGE_NONCE" && ${#CHALLENGE_NONCE} == 32 && -n "$EXPIRES_AT" ]]; then
|
||
note PASS "HTTP 200, nonce and expiresAt returned"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T17_CODE body=$T17_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
# Test 18 — POST /api/identity/verify with valid signed NIP-27235 event
|
||
sep "Test 18 — POST /api/identity/verify (valid)"
|
||
if [[ -n "$CHALLENGE_NONCE" ]]; then
|
||
VALID_EVENT_JSON=$(node scripts/gen_nostr_event.js "$CHALLENGE_NONCE")
|
||
T18_RES=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/identity/verify" \
|
||
-H "Content-Type: application/json" \
|
||
-d "$VALID_EVENT_JSON")
|
||
T18_BODY=$(echo "$T18_RES" | sed '$d')
|
||
T18_CODE=$(echo "$T18_RES" | tail -n1)
|
||
NOSTR_TOKEN=$(jq_field "$T18_BODY" '.nostr_token')
|
||
IDENTITY_PUBKEY=$(jq_field "$T18_BODY" '.pubkey')
|
||
TRUST_TIER=$(jq_field "$T18_BODY" '.trust')
|
||
|
||
if [[ "$T18_CODE" == "200" && -n "$NOSTR_TOKEN" && "$IDENTITY_PUBKEY" == "$NOSTR_PUB_KEY" && -n "$TRUST_TIER" ]]; then
|
||
note PASS "HTTP 200, nostr_token, pubkey, trust returned"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T18_CODE body=$T18_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
else
|
||
note SKIP "No challenge nonce from T17 — skipping Test 18"
|
||
SKIP=$((SKIP+1))
|
||
fi
|
||
|
||
# Test 19 — GET /api/estimate with X-Nostr-Token header for a new identity
|
||
sep "Test 19 — GET /api/estimate (free tier)"
|
||
if [[ -n "$NOSTR_TOKEN" ]]; then
|
||
T19_RES=$(curl -s -w "\n%{http_code}" "$BASE/api/estimate" -H "X-Nostr-Token: $NOSTR_TOKEN")
|
||
T19_BODY=$(echo "$T19_RES" | sed '$d')
|
||
T19_CODE=$(echo "$T19_RES" | tail -n1)
|
||
FREE_TIER_SERVE=$(jq_field "$T19_BODY" '.free_tier.serve')
|
||
|
||
if [[ "$T19_CODE" == "200" && "$FREE_TIER_SERVE" == "free" ]]; then
|
||
note PASS "HTTP 200, free_tier.serve is 'free'"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T19_CODE body=$T19_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
else
|
||
note SKIP "No nostr_token from T18 — skipping Test 19"
|
||
SKIP=$((SKIP+1))
|
||
fi
|
||
|
||
# Test 20 — POST /api/identity/verify with invalid signature
|
||
sep "Test 20 — POST /api/identity/verify (invalid signature)"
|
||
if [[ -n "$CHALLENGE_NONCE" ]]; then
|
||
INVALID_PRIV_KEY=$(node -e "const { generatePrivateKey } = require('nostr-tools'); console.log(generatePrivateKey());")
|
||
# Generate a valid event but with a different (invalid) private key
|
||
INVALID_EVENT_JSON=$(node -e "const { getPublicKey, finalizeEvent } = require('nostr-tools'); const privateKey = '$INVALID_PRIV_KEY'; const event = finalizeEvent({ kind: 27235, created_at: Math.floor(Date.now() / 1000), tags: [['challenge', '$CHALLENGE_NONCE']], content: 'NIP-27235 challenge response' }, privateKey); console.log(JSON.stringify(event));")
|
||
|
||
T20_RES=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/identity/verify" \
|
||
-H "Content-Type: application/json" \
|
||
-d "$INVALID_EVENT_JSON")
|
||
T20_CODE=$(echo "$T20_RES" | tail -n1)
|
||
|
||
if [[ "$T20_CODE" == "401" ]]; then
|
||
note PASS "HTTP 401 for invalid signature"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T20_CODE"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
else
|
||
note SKIP "No challenge nonce from T17 — skipping Test 20"
|
||
SKIP=$((SKIP+1))
|
||
fi
|
||
|
||
# Test 21 — POST /api/identity/verify with expired nonce
|
||
sep "Test 21 — POST /api/identity/verify (expired nonce)"
|
||
# We'll generate a new challenge for this test, then wait for it to expire.
|
||
# Assuming a short expiration for testing purposes (e.g., 5 seconds).
|
||
# In a real scenario, this might be longer or handled with mocked time.
|
||
|
||
T21_CHALLENGE_RES=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/identity/challenge")
|
||
T21_CHALLENGE_BODY=$(echo "$T21_CHALLENGE_RES" | sed '$d')
|
||
T21_CHALLENGE_CODE=$(echo "$T21_CHALLENGE_RES" | tail -n1)
|
||
T21_NONCE=$(jq_field "$T21_CHALLENGE_BODY" '.nonce')
|
||
|
||
if [[ "$T21_CHALLENGE_CODE" == "200" && -n "$T21_NONCE" ]]; then
|
||
note "Waiting 6 seconds for nonce to expire..."
|
||
sleep 6 # Wait for the nonce to expire (assuming expiry < 6 seconds)
|
||
|
||
EXPIRED_EVENT_JSON=$(node scripts/gen_nostr_event.js "$T21_NONCE")
|
||
T21_RES=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/identity/verify" \
|
||
-H "Content-Type: application/json" \
|
||
-d "$EXPIRED_EVENT_JSON")
|
||
T21_CODE=$(echo "$T21_RES" | tail -n1)
|
||
|
||
if [[ "$T21_CODE" == "401" ]]; then
|
||
note PASS "HTTP 401 for expired nonce"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T21_CODE"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
else
|
||
note SKIP "Failed to get challenge nonce for T21 — skipping Test 21"
|
||
SKIP=$((SKIP+1))
|
||
fi
|
||
|
||
# Test 22 — GET /api/estimate without X-Nostr-Token header
|
||
sep "Test 22 — GET /api/estimate (no token)"
|
||
T22_RES=$(curl -s -w "\n%{http_code}" "$BASE/api/estimate")
|
||
T22_BODY=$(echo "$T22_RES" | sed '$d')
|
||
T22_CODE=$(echo "$T22_RES" | tail -n1)
|
||
FREE_TIER_SERVE_NO_TOKEN=$(jq_field "$T22_BODY" '.free_tier.serve')
|
||
|
||
if [[ "$T22_CODE" == "200" && ("$FREE_TIER_SERVE_NO_TOKEN" == "pay" || -z "$FREE_TIER_SERVE_NO_TOKEN") ]]; then
|
||
note PASS "HTTP 200, free_tier.serve is 'pay' or absent without token"
|
||
PASS=$((PASS+1))
|
||
else
|
||
note FAIL "code=$T22_CODE body=$T22_BODY"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
|
||
# Test 23 — GET /api/estimate with X-Nostr-Token for a trust-exhausted identity
|
||
sep "Test 23 — GET /api/estimate (trust exhausted)"
|
||
note SKIP "Test 23 — requires exhausting trust tier (complex setup); skipping for now"
|
||
SKIP=$((SKIP+1))
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Summary
|
||
# ---------------------------------------------------------------------------
|
||
echo
|
||
echo "======================================="
|
||
echo " RESULTS: PASS=$PASS FAIL=$FAIL SKIP=$SKIP"
|
||
echo "======================================="
|
||
if [[ "$FAIL" -gt 0 ]]; then exit 1; fi
|