test.sh

#!/usr/bin/env bash
# ============================================================================
# PSP Router — Server Test Script
# ============================================================================
# Sends test requests directly to OpenResty on port 8081 and ASSERTS the
# results. Exits non-zero if anything fails, so it is usable in CI or as a
# post-deploy gate.
#
# Usage:
#   sudo bash test.sh
#   sudo bash test.sh 127.0.0.1:8081     # custom host:port
# ============================================================================
set -uo pipefail          # NOT -e: a failing assertion must not abort the run

HOST="${1:-127.0.0.1:8081}"

GREEN='\033[0;32m'
RED='\033[0;31m'
YELLOW='\033[0;33m'
NC='\033[0m'

PASSED=0
FAILED=0
SKIPPED=0

pass() { echo -e "  ${GREEN}PASS${NC} $1"; PASSED=$((PASSED + 1)); }
fail() { echo -e "  ${RED}FAIL${NC} $1"; FAILED=$((FAILED + 1)); }
skip() { echo -e "  ${YELLOW}SKIP${NC} $1"; SKIPPED=$((SKIPPED + 1)); }

# assert_status <expected> <label> <curl args...>
assert_status() {
    local expected="$1"; shift
    local label="$1"; shift
    local got
    got=$(curl -s -o /dev/null -w '%{http_code}' "$@" 2>/dev/null) || got=""
    if [ "$got" = "$expected" ]; then
        pass "${label} → ${got}"
    else
        fail "${label} → ${got:-connection refused} (expected ${expected})"
    fi
}

echo "=== PSP Router — Test Suite ==="
echo "Target: ${HOST}"
echo ""

# ── 1. Health check ────────────────────────────────────────────────────────
echo "1. Health check"
assert_status 200 "GET /health" "http://${HOST}/health"

# Everything below needs the service up.
if [ "$FAILED" -ne 0 ]; then
    echo ""
    echo -e "${RED}OpenResty is not responding — skipping the rest.${NC}"
    echo "  Start it with: sudo bash deploy.sh"
    exit 1
fi

# ── 2. URI patterns configured ─────────────────────────────────────────────
# The single most common cause of "installed but nothing routes": an empty
# pattern list matches nothing, and non-matching requests are deliberately
# never logged, so the failure is completely silent.
echo "2. URI patterns configured"
SETTINGS=$(curl -s "http://${HOST}/admin/api/settings" 2>/dev/null) || SETTINGS=""
# Every pattern is a JSON string starting with the anchor, so count '"^'.
# Do NOT try to slice out the patterns array with [^]]* — the patterns contain
# character classes like ([a-zA-Z0-9_-]+), so the first ']' ends the match early
# and only the first pattern gets counted.
# Matching on '^' rather than '^/' because the API JSON-escapes slashes ("^\/api").
PATTERN_COUNT=$(printf '%s' "$SETTINGS" | grep -o '"\^' | wc -l | tr -d ' ')
if [ "${PATTERN_COUNT:-0}" -gt 0 ]; then
    pass "${PATTERN_COUNT} URI pattern(s) configured"
else
    fail "no URI patterns configured — the router will match nothing and log nothing"
    echo "       Fix: add patterns at http://${HOST}/admin/settings"
fi

# ── 3-5. Passthrough cases — all must return 460 ───────────────────────────
# 460 is the router saying "not mine, let the local app handle it". Stock nginx
# turns it into a normal request; hitting OpenResty directly you see the 460.
echo "3. Unknown PSP (expect passthrough 460)"
assert_status 460 "POST /api/1.0/notification/unknown_psp" \
    -X POST "http://${HOST}/api/1.0/notification/unknown_psp" \
    -H 'Content-Type: application/json' -d '{}'

echo "4. Known PSP, no body (expect passthrough 460)"
assert_status 460 "POST /api/1.0/notification/acmepay (no body)" \
    -X POST "http://${HOST}/api/1.0/notification/acmepay"

echo "5. Unknown env_code=9 (expect passthrough 460)"
assert_status 460 "POST acmepay ref=93126999 (env_code=9)" \
    -X POST "http://${HOST}/api/0.1/user/transfer/deposit/confirm/acmepay" \
    -H 'Content-Type: application/json' \
    -d '{"ref":"93126999","amount":50.00,"currency":"EUR","status":"approved"}'

# ── 6. Routing works for a REAL configured route ───────────────────────────
# Built from whatever is actually registered rather than a hardcoded id, so
# this stays meaningful on any deployment. Uses the dry-run endpoint: it
# exercises the full decode+lookup pipeline without needing the upstream to be
# reachable (a live request to a missing upstream would 502 and tell us
# nothing about routing).
echo "6. Routing pipeline against a configured route"
# Split the JSON array into one object per line so a rule's "enabled" flag and
# its "name"/"paths" stay together — picking a disabled rule would fail the test
# for the wrong reason.
PSP_RULE=$(curl -s "http://${HOST}/admin/api/psp-rules" 2>/dev/null \
      | sed 's/},/}\n/g' | grep '"enabled":true' | grep '"format":"json"' | head -1)
PSP=$(printf '%s' "$PSP_RULE" | grep -o '"name":"[^"]*"' | head -1 | cut -d'"' -f4)
# Use a top-level path (no dot) so the test body stays flat JSON.
PSP_PATH=$(printf '%s' "$PSP_RULE" | grep -o '"paths":\[[^]]*\]' \
      | grep -o '"[a-zA-Z0-9_]*"' | tr -d '"' | grep -v '^paths$' | head -1)
ROUTE_KEY=$(curl -s "http://${HOST}/admin/api/stage-routes" 2>/dev/null \
      | sed 's/},/}\n/g' | grep '"enabled":true' \
      | grep -o '"key":"stage:[0-9]*"' | head -1 | cut -d'"' -f4)

if [ -z "$PSP" ] || [ -z "$PSP_PATH" ]; then
    skip "no enabled JSON PSP rule configured — add one at /admin/psp-rules"
elif [ -z "$ROUTE_KEY" ]; then
    skip "no enabled stage route configured — add one at /admin/routes"
else
    KEY="${ROUTE_KEY#stage:}"
    COMPOSITE="1${#KEY}${KEY}999"
    RESULT=$(curl -s -X POST "http://${HOST}/admin/api/test" \
        -H 'Content-Type: application/json' \
        -d "{\"uri\":\"/api/1.0/notification/${PSP}\",\"body\":\"{\\\"${PSP_PATH}\\\":\\\"${COMPOSITE}\\\"}\"}" \
        2>/dev/null)
    if printf '%s' "$RESULT" | grep -q '"result":"routed"'; then
        pass "psp=${PSP} ${PSP_PATH}=${COMPOSITE} → routed (${ROUTE_KEY})"
    else
        REASON=$(printf '%s' "$RESULT" | grep -o '"result":"[^"]*"' | head -1 | cut -d'"' -f4)
        fail "psp=${PSP} ${PSP_PATH}=${COMPOSITE} → ${REASON:-no result} (expected routed)"
        echo "       Check the URI patterns and the route for ${ROUTE_KEY}"
    fi
fi

# ── 7. Recent logs ─────────────────────────────────────────────────────────
echo ""
echo "=== Recent OpenResty logs ==="
LOGFILE="/usr/local/openresty/nginx/logs/error.log"
if [ -f "$LOGFILE" ]; then
    tail -10 "$LOGFILE"
else
    echo "  No log file at ${LOGFILE}"
fi

# ── Summary ────────────────────────────────────────────────────────────────
echo ""
echo "=== Summary ==="
echo -e "  ${GREEN}passed:${NC} ${PASSED}   ${RED}failed:${NC} ${FAILED}   ${YELLOW}skipped:${NC} ${SKIPPED}"
if [ "$FAILED" -ne 0 ]; then
    echo -e "${RED}FAILED${NC}"
    exit 1
fi
if [ "$SKIPPED" -ne 0 ]; then
    # Exit non-zero: nothing failed, but the end-to-end routing check never ran,
    # which is exactly the state a half-configured install leaves behind. A CI
    # gate that treated this as success would be worthless.
    echo -e "${YELLOW}No failures, but ${SKIPPED} check(s) were SKIPPED.${NC}"
    echo "  Routing has NOT been proven end to end. Configure the missing pieces above"
    echo "  and re-run before treating this install as verified."
    exit 2
fi
echo -e "${GREEN}All checks passed.${NC}"
exit 0