gti
d21a9d1140
git-subtree-dir: fiscal git-subtree-mainline:d95165fc8fgit-subtree-split:102ba84500
48 lines
2.7 KiB
Python
48 lines
2.7 KiB
Python
"""Post-deploy proof through the PUBLIC panel: the default release is served as the real installer EXE (not a zip)
|
|
with the published sha256. Creates a throwaway LOCAL admin + an E2E installation, revokes/deactivates both after
|
|
(never deleted: audit FKs). Run inside the Hub container: python central/scripts/verify_release_download.py <version>"""
|
|
import hashlib
|
|
import sys
|
|
import time
|
|
|
|
import httpx
|
|
from sqlalchemy.orm import Session
|
|
|
|
sys.path.insert(0, "central")
|
|
from app.db import engine # noqa: E402
|
|
from app.human_auth import hash_password # noqa: E402
|
|
from app.models import AdminUser, AgentRelease, Tenant # noqa: E402
|
|
|
|
BASE = "https://gtifiscal.gtigrupo.com.br"
|
|
PASSWORD = "Verify-tmp-2026!x"
|
|
want = sys.argv[1]
|
|
user = f"e2e-verify-{int(time.time())}"
|
|
with Session(engine) as db:
|
|
rel = db.query(AgentRelease).filter_by(version=want, platform="windows", architecture="x64").one()
|
|
default = db.query(AgentRelease).filter_by(status="PUBLISHED").order_by(AgentRelease.created_at.desc()).first()
|
|
assert rel.status == "PUBLISHED" and default.id == rel.id, f"default release is {default.version}, expected {want}"
|
|
tenant = db.query(Tenant).filter(Tenant.source == "GTI_GERENCIADOR", Tenant.active.is_(True), Tenant.external_client_id.isnot(None)).order_by(Tenant.id).first()
|
|
assert tenant, "no active Gerenciador-mirrored client to attach the throwaway installation to"
|
|
db.add(AdminUser(username=user, password_hash=hash_password(PASSWORD), is_active=True, auth_source="LOCAL")); db.flush()
|
|
client_id, release_id, sha, name = tenant.external_client_id, rel.id, rel.sha256, rel.filename
|
|
db.commit()
|
|
try:
|
|
c = httpx.Client(follow_redirects=False, timeout=120)
|
|
assert c.post(f"{BASE}/login", data={"username": user, "password": PASSWORD}).status_code == 303
|
|
csrf = c.cookies.get("gti_csrf")
|
|
r = c.post(f"{BASE}/agents/new", data={"csrf_token": csrf, "client_id": client_id, "display_name": "E2E-VERIFY Servidor", "release_id": release_id})
|
|
assert r.status_code == 303, r.status_code
|
|
uuid = r.headers["location"].rsplit("/", 1)[-1]
|
|
d = c.get(f"{BASE}/agents/pending/{uuid}/download")
|
|
disp = d.headers.get("content-disposition", "")
|
|
assert d.status_code == 200 and name in disp and name.endswith(".exe"), (d.status_code, disp)
|
|
assert d.content[:2] == b"MZ", "not a Windows executable"
|
|
got = hashlib.sha256(d.content).hexdigest()
|
|
assert got == sha, "sha256 mismatch"
|
|
print(f"DOWNLOAD_IS_EXE=true filename={name} SHA256_MATCH=true size={len(d.content)}")
|
|
c.post(f"{BASE}/agents/pending/{uuid}/revoke", data={"csrf_token": csrf})
|
|
finally:
|
|
with Session(engine) as db:
|
|
db.query(AdminUser).filter_by(username=user).update({"is_active": False}); db.commit()
|
|
print("VERIFY_DOWNLOAD=PASS")
|