gitea-mcp-forward-auth/scripts/test-registry-image.sh

#!/usr/bin/env bash

set -euo pipefail

REGISTRY_HOST="gitea.nehmer.net"
OWNER="torben"
IMAGE_NAME="gitea-mcp-auth-proxy"
TAG="latest"
USERNAME="torben"
RUNTIME=""
REQUIRED_LABELS=()

log_ts() {
  date '+%Y-%m-%d %H:%M:%S'
}

log_info() {
  printf '[%s] [INFO] %s\n' "$(log_ts)" "$*"
}

log_ok() {
  printf '[%s] [ OK ] %s\n' "$(log_ts)" "$*"
}

log_warn() {
  printf '[%s] [WARN] %s\n' "$(log_ts)" "$*" >&2
}

log_fail() {
  printf '[%s] [FAIL] %s\n' "$(log_ts)" "$*" >&2
}

usage() {
  cat <<'EOF'
Usage: scripts/test-registry-image.sh [options]

Pulls the published container image from the Gitea registry, starts it locally
with the committed demo hashes, and verifies expected HTTP responses.

Options:
  --tag <tag>                Image tag to test (default: latest)
  --runtime <docker|podman>  Container runtime to use (auto-detect by default)
  --username <user>          Registry username (default: torben)
  --require-label <key>      Require image label to exist
  --require-label <k=v>      Require image label to equal a specific value
  -h, --help                 Show this help

Examples:
  scripts/test-registry-image.sh
  scripts/test-registry-image.sh --tag v1.2.3
  scripts/test-registry-image.sh --require-label org.opencontainers.image.source
EOF
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --tag)
      TAG="${2:-}"
      shift 2
      ;;
    --runtime)
      RUNTIME="${2:-}"
      shift 2
      ;;
    --username)
      USERNAME="${2:-}"
      shift 2
      ;;
    --require-label)
      REQUIRED_LABELS+=("${2:-}")
      shift 2
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      echo "Unknown argument: $1" >&2
      usage >&2
      exit 1
      ;;
  esac
done

if [[ -z "$TAG" ]]; then
  log_fail "Tag must not be empty"
  exit 1
fi

if [[ -z "$RUNTIME" ]]; then
  if command -v docker >/dev/null 2>&1; then
    RUNTIME="docker"
    log_info "Runtime auto-detected: docker"
  elif command -v podman >/dev/null 2>&1; then
    RUNTIME="podman"
    log_info "Runtime auto-detected: podman"
  else
    log_fail "Neither docker nor podman is available"
    exit 1
  fi
fi

if ! command -v "$RUNTIME" >/dev/null 2>&1; then
  log_fail "Container runtime not found: $RUNTIME"
  exit 1
fi

if ! command -v curl >/dev/null 2>&1; then
  log_fail "curl is required"
  exit 1
fi

log_info "Using runtime: $RUNTIME"

script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
repo_root="$(cd "$script_dir/.." && pwd)"
hash_dir="$repo_root/demo/token-hashes"

if [[ ! -d "$hash_dir" ]]; then
  log_fail "Demo hash directory not found: $hash_dir"
  exit 1
fi

image_ref="$REGISTRY_HOST/$OWNER/$IMAGE_NAME:$TAG"
container_name="authproxy-registry-test-$$"
container_id=""
host_port=""
tmp_dir=""
auth_mode=""

cleanup() {
  local exit_code=$?
  if [[ -n "$container_id" ]]; then
    log_info "Cleaning up container: $container_id"
    "$RUNTIME" rm -f "$container_id" >/dev/null 2>&1 || true
  fi
  if [[ -n "$tmp_dir" && -d "$tmp_dir" ]]; then
    log_info "Removing temporary auth directory"
    rm -rf "$tmp_dir"
  fi
  exit "$exit_code"
}
trap cleanup EXIT

tmp_dir="$(mktemp -d)"
log_info "Created temporary workspace: $tmp_dir"

if [[ "$RUNTIME" == "docker" ]]; then
  auth_mode="docker_config"
  mkdir -p "$tmp_dir/docker-config"
  log_info "Auth mode: docker with temporary DOCKER_CONFIG"
elif [[ "$RUNTIME" == "podman" ]]; then
  auth_mode="podman_auth_file"
  log_info "Auth mode: podman with temporary REGISTRY_AUTH_FILE"
else
  log_fail "Unsupported runtime: $RUNTIME"
  exit 1
fi

log_info "Test image: $image_ref"
log_info "Demo hash source: $hash_dir"

printf 'Registry password for %s@%s: ' "$USERNAME" "$REGISTRY_HOST" >&2
stty -echo
IFS= read -r registry_password
stty echo
printf '\n' >&2

if [[ -z "$registry_password" ]]; then
  log_fail "Empty password/token is not allowed"
  exit 1
fi

log_info "Logging in to registry (credentials are not printed)"
if [[ "$auth_mode" == "docker_config" ]]; then
  printf '%s' "$registry_password" | \
    env DOCKER_CONFIG="$tmp_dir/docker-config" \
    "$RUNTIME" login "$REGISTRY_HOST" --username "$USERNAME" --password-stdin >/dev/null
elif [[ "$auth_mode" == "podman_auth_file" ]]; then
  printf '%s' "$registry_password" | \
    env REGISTRY_AUTH_FILE="$tmp_dir/podman-auth.json" \
    "$RUNTIME" login "$REGISTRY_HOST" --username "$USERNAME" --password-stdin >/dev/null
fi
unset registry_password
log_ok "Registry login successful"

log_info "Pulling image: $image_ref"
if [[ "$auth_mode" == "docker_config" ]]; then
  env DOCKER_CONFIG="$tmp_dir/docker-config" "$RUNTIME" pull "$image_ref" >/dev/null
else
  env REGISTRY_AUTH_FILE="$tmp_dir/podman-auth.json" "$RUNTIME" pull "$image_ref" >/dev/null
fi
log_ok "Image pull complete"

for required_label in "${REQUIRED_LABELS[@]}"; do
  log_info "Validating required label: $required_label"
  label_key="$required_label"
  label_expected=""
  if [[ "$required_label" == *=* ]]; then
    label_key="${required_label%%=*}"
    label_expected="${required_label#*=}"
  fi

  label_value="$("$RUNTIME" image inspect "$image_ref" --format "{{ index .Config.Labels \"$label_key\" }}" 2>/dev/null || true)"
  if [[ -z "$label_value" || "$label_value" == "<no value>" ]]; then
    log_fail "Required image label missing: $label_key"
    exit 1
  fi
  if [[ -n "$label_expected" && "$label_value" != "$label_expected" ]]; then
    log_fail "Image label mismatch for $label_key: expected $label_expected, got $label_value"
    exit 1
  fi
  log_ok "Label check passed: $label_key=$label_value"
done

log_info "Starting container from image"
container_id="$($RUNTIME run -d \
  --name "$container_name" \
  -p 127.0.0.1::8080 \
  -e AUTH_PROXY_LISTEN_ADDR=:8080 \
  -e AUTH_PROXY_TOKEN_HASHES_DIR=/token-hashes \
  -e AUTH_PROXY_LOG_LEVEL=debug \
  -v "$hash_dir:/token-hashes:ro" \
  "$image_ref")"
log_ok "Container started: $container_id"

host_port="$($RUNTIME port "$container_id" 8080/tcp | awk -F: 'NR==1 {print $NF}')"
if [[ -z "$host_port" ]]; then
  log_fail "Failed to determine mapped host port"
  "$RUNTIME" logs "$container_id" >&2 || true
  exit 1
fi

base_url="http://127.0.0.1:$host_port"
log_info "Container is reachable at: $base_url"

wait_for_health() {
  local attempt http_code
  log_info "Waiting for health endpoint to return 200"
  for attempt in $(seq 1 30); do
    http_code="$(curl -s -o /dev/null -w '%{http_code}' "$base_url/healthz" || true)"
    if [[ "$http_code" == "200" ]]; then
      log_ok "Health endpoint is ready after $attempt attempt(s)"
      return 0
    fi
    log_info "Health attempt $attempt/30 returned: $http_code"
    sleep 1
  done
  return 1
}

assert_status() {
  local expected=$1
  local description=$2
  shift 2
  local http_code
  http_code="$(curl -s -o /dev/null -w '%{http_code}' "$@")"
  if [[ "$http_code" != "$expected" ]]; then
    log_fail "$description expected $expected, got $http_code"
    "$RUNTIME" logs "$container_id" >&2 || true
    exit 1
  fi
  log_ok "$description -> $http_code"
}

if ! wait_for_health; then
  log_fail "Container did not become healthy: $image_ref"
  "$RUNTIME" logs "$container_id" >&2 || true
  exit 1
fi

log_info "Running HTTP assertions"
assert_status 200 "healthz" "$base_url/healthz"
assert_status 401 "missing token" "$base_url/"
assert_status 401 "wrong token" -H "Authorization: Bearer wrong" "$base_url/"
assert_status 200 "demo-token-1" -H "Authorization: Bearer demo-token-1" "$base_url/"

log_ok "Registry image test succeeded: $image_ref"