jacobh2
671c00d0d8
Build Kvitt images / build (push) Failing after 8m17s
Contract (SPEC §14.8): migration 0004_card_purchases.sql (server schema 4, byte-identical contract and server copies), E-36 to E-44 in contracts/openapi.yaml with the four new error codes and a 502 response, examples for every card body and error code, the match_card_purchase vectors (17 cases) with their Python reference in tools/contracts-check.py (157 checks), web/src/api/schema.d.ts regenerated; web/src/lib/vectors.test.ts lists match_card_purchase as not ported until K3 ports it (orchestrator's allowance). Server: src/cards/ with the provider registry (CP-1), the CardSource trait and its Enable Banking adapter (JWT RS256 kid = application id, /aspsps, /auth, /sessions, transactions with PSU headers for user-present fetches, CP-14 error mapping, CP-7 mapping), the windowed fetch (30-day windows newest first, split at the 100-row cap down to a day, de-duplication by provider_ref, continuation keys, WRONG_TRANSACTIONS_PERIOD ends the walk), CP-8 matching with the secondary rule, the background poller (06:45, 11:45, 16:45, 21:45, 4 per 24 hours, 2-hour skip, no backlog), the bilingual callback page (E-39), E-36 to E-38 and E-40 to E-44, link clearing in sync push step 7, attempt pruning at 04:00, the card_fetch log line with aggregates only, KVITT_EB_* configuration. Tests against a local stub (tests/cards_api/, 34 tests); the real API is never called. Infra: Pi compose mounts secrets/cards read-only and passes the two application ids; .env.example keys; dev stack stages infra/secrets/cards/; NPM block with the /cards/callback gate line and unlogged location (kvitt.conf and README step 4); README "Card purchases". Pre-commit hook bypassed (--no-verify, orchestrator's decision): the Android fast tests fail in :domain VectorFilesTest (and the full check in :data ExampleRoundTripTest) because they pin the contract's vector and example sets; matchCardPurchase and the card DTOs are K2's by design (contract-first landing; K2 lands next). Server, contracts-check and web gates are green. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
71 lines
2.7 KiB
Bash
71 lines
2.7 KiB
Bash
#!/usr/bin/env bash
|
|
# Shared helpers for the infra/dev scripts. Sourced, not run.
|
|
# shellcheck disable=SC2034 # variables are used by the scripts that source this file
|
|
|
|
dev_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
repo_root="$(cd "$dev_dir/../.." && pwd)"
|
|
|
|
# infra/dev/.env (git-ignored) when it exists, otherwise the committed example.
|
|
if [[ -f "$dev_dir/.env" ]]; then env_file="$dev_dir/.env"; else env_file="$dev_dir/.env.example"; fi
|
|
|
|
die() { printf '%s: %s\n' "$(basename "$0")" "$*" >&2; exit 1; }
|
|
|
|
# Value of KEY in the env file; DEFAULT (the compose.yaml default, optional) when unset or blank.
|
|
env_value() {
|
|
local v
|
|
v="$(sed -n "s/^$1=//p" "$env_file" | tail -n 1)"
|
|
printf '%s\n' "${v:-${2:-}}"
|
|
}
|
|
|
|
compose() {
|
|
docker compose -f "$dev_dir/compose.yaml" --env-file "$env_file" "$@"
|
|
}
|
|
|
|
# Resolve a path from the env file the way compose does: relative to infra/dev/.
|
|
dev_path() {
|
|
case "$1" in
|
|
/*) printf '%s\n' "$1" ;;
|
|
*) printf '%s\n' "$dev_dir/$1" ;;
|
|
esac
|
|
}
|
|
|
|
# The Mac's address on the interface that carries the default route (the home Wi-Fi).
|
|
lan_address() {
|
|
local iface
|
|
iface="$(route -n get default 2>/dev/null | awk '/interface:/ {print $2}')"
|
|
[[ -n "$iface" ]] && ipconfig getifaddr "$iface" 2>/dev/null
|
|
}
|
|
|
|
# Fill infra/dev/secrets/ (git-ignored, mounted read-only at /secrets) with only the FCM key and the card keys
|
|
# folder from KVITT_SECRETS_DIR, so the server container sees no other secret (D-117, D-175). Without the FCM key
|
|
# the server starts with push disabled (§10.4); see stage_card_keys for the card keys.
|
|
stage_fcm_key() {
|
|
local src stage="$dev_dir/secrets"
|
|
src="$(dev_path "$(env_value KVITT_SECRETS_DIR ../secrets)")/fcm-service-account.json"
|
|
install -d -m 0700 "$stage"
|
|
find "$stage" -mindepth 1 -maxdepth 1 ! -name fcm-service-account.json ! -name cards -exec rm -rf {} +
|
|
if [[ -f "$src" ]]; then
|
|
install -m 0600 "$src" "$stage/fcm-service-account.json"
|
|
else
|
|
rm -f "$stage/fcm-service-account.json"
|
|
echo "$(basename "$0"): no $src; the server starts with push disabled." >&2
|
|
fi
|
|
}
|
|
|
|
# Copy the Enable Banking keys of KVITT_SECRETS_DIR/cards/ (only *.pem) into infra/dev/secrets/cards/ (0700, keys
|
|
# 0600), replacing what was there. Without them card features are off, with one warning at start (§10.4, D-175).
|
|
stage_card_keys() {
|
|
local src stage="$dev_dir/secrets/cards" key
|
|
src="$(dev_path "$(env_value KVITT_SECRETS_DIR ../secrets)")/cards"
|
|
rm -rf "$stage"
|
|
install -d -m 0700 "$stage"
|
|
if [[ -d "$src" ]]; then
|
|
for key in "$src"/*.pem; do
|
|
[[ -f "$key" ]] && install -m 0600 "$key" "$stage/$(basename "$key")"
|
|
done
|
|
fi
|
|
if [[ -z "$(ls -A "$stage")" ]]; then
|
|
echo "$(basename "$0"): no keys in $src; the server starts with card features off." >&2
|
|
fi
|
|
}
|