Something went wrong. Try again.
Identities for entities did.bot
agent llm did
Something went wrong. Try again.
Shell
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175#!/usr/bin/env bash# The policy dashboard against real servers: two didbot-pds processes, the# built site on a third port, and both halves of the scenario run against them.## What runs here that nothing else runs:## 1. crates/didbot-swarm/tests/policy_rollout.rs -- an operator signs in over# OAuth, deploys a policy and a binding with one applyWrites, nudges the# server they operate, and watches a write that policy refuses be refused# by the policy's own reason. Needs both servers; skips without them.# 2. policy-site/tests/e2e-policy.mjs -- the built page in a real Chrome,# comparing the digest its own wasm computes over those two records with# the digest the governed server published. Needs Chrome; skips without it.## Opt-in, not a commit hook: it compiles, starts servers, and wants a browser.# scripts/ci.sh runs it when DIDBOT_E2E=1.## Usage: scripts/test-policy-e2e.shset -euo pipefail
cd "$(dirname "$0")/.."
if [ "$#" -ne 0 ]; then echo "usage: $0" >&2 exit 2fi
# shellcheck source=scripts/dev-pidfile.sh. scripts/dev-pidfile.sh
say() { printf '\n\033[1m=== %s ===\033[0m\n' "$1" >&2; }
WORK="$(mktemp -d "${TMPDIR:-/tmp}/didbot-policy-e2e.XXXXXX")"# One stable place for the page's screenshots, overwritten each run, so the# evidence outlives the working directory below.SHOTS="${DIDBOT_E2E_SHOTS:-${TMPDIR:-/tmp}/didbot-policy-e2e-shots}"PIDS=()
# Every child is killed on the way out, however this ends: a failed assertion# leaves two servers and a Vite process behind otherwise, and the next run# picks different ports and leaves two more. Each is started under `setsid`, so# signalling the negative pid reaches the whole group -- `npm run preview` is a# wrapper around the process that actually holds the port.cleanup() { local status=$? for pid in ${PIDS[@]+"${PIDS[@]}"}; do kill -TERM "-$pid" 2>/dev/null || kill -TERM "$pid" 2>/dev/null || true done for pid in ${PIDS[@]+"${PIDS[@]}"}; do wait "$pid" 2>/dev/null || true done forget_pid policy-e2e-operator "${OPERATOR_PORT:-0}" forget_pid policy-e2e-governed "${GOVERNED_PORT:-0}" if [ "$status" -ne 0 ]; then echo "test-policy-e2e: failed; logs are in $WORK" >&2 else rm -rf "$WORK" fi exit "$status"}trap cleanup EXIT INT TERM
# A port nobody chose: the kernel hands one out and we take the number. Two# runs at once, or a run alongside a dev stack on 3000, never collide.free_port() { python3 - <<'PY'import sockets = socket.socket()s.bind(("127.0.0.1", 0))print(s.getsockname()[1])s.close()PY}
# Waits for a server to answer /health, naming it if it never does.await_health() { local name="$1" base="$2" log="$3" waited=0 while ! curl -sf "$base/health" >/dev/null 2>&1; do waited=$((waited + 1)) if [ "$waited" -gt 200 ]; then echo "test-policy-e2e: $name never answered at $base" >&2 tail -30 "$log" >&2 return 1 fi sleep 0.25 done}
export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-$PWD/target}"
say "build: didbot-pds and the test that drives it"cargo build --quiet -p didbot-serve --bin didbot-pdscargo build --quiet --tests -p didbot-swarmPDS="$CARGO_TARGET_DIR/debug/didbot-pds"
say "build: policy-site/dist, the page and the wasm it checks with"scripts/build-policy-site.sh
OPERATOR_PORT="$(free_port)"GOVERNED_PORT="$(free_port)"SITE_PORT="$(free_port)"# Separate zones so the two servers are two deployments and not one seen# twice. Both are under .localhost, which resolves without a resolver and is# where didbot-pds mints with no attestation claim.OPERATOR_URL="http://opzone.localhost:$OPERATOR_PORT"GOVERNED_URL="http://govzone.localhost:$GOVERNED_PORT"SITE_URL="http://127.0.0.1:$SITE_PORT"
say "the operator's server on $OPERATOR_PORT"claim_port policy-e2e-operator "$OPERATOR_PORT" didbot-pds# DIDBOT_PDS_DATA= asks for a server that holds nothing past this run; see# scripts/dev-pds.sh, which documents the empty value.DIDBOT_PDS_DATA= NO_COLOR=1 setsid "$PDS" \ --port "$OPERATOR_PORT" --zone opzone.localhost --estop-socket none \ >"$WORK/operator.log" 2>&1 &PIDS+=($!)record_pid policy-e2e-operator "$OPERATOR_PORT" "$!"await_health "the operator's server" "$OPERATOR_URL" "$WORK/operator.log"
# The operator's own account, minted before the governed server starts because# that server is started knowing whose repository to read.curl -sf -X POST "$OPERATOR_URL/xrpc/bot.did.provisionAgent" \ -H 'content-type: application/json' -d '{"agentId":"operator"}' \ >"$WORK/operator-account.json"read -r OPERATOR_DID OPERATOR_TOKEN <<EOF$(python3 -c 'import json,sys; a=json.load(open(sys.argv[1])); print(a["did"], a["agentToken"])' "$WORK/operator-account.json")EOFecho "operator: $OPERATOR_DID" >&2
say "the governed server on $GOVERNED_PORT, operated by that account"claim_port policy-e2e-governed "$GOVERNED_PORT" didbot-pdsDIDBOT_PDS_DATA= NO_COLOR=1 setsid "$PDS" \ --port "$GOVERNED_PORT" --zone govzone.localhost --estop-socket none \ --owner "$OPERATOR_DID" \ >"$WORK/governed.log" 2>&1 &PIDS+=($!)record_pid policy-e2e-governed "$GOVERNED_PORT" "$!"await_health "the governed server" "$GOVERNED_URL" "$WORK/governed.log"
say "the site on $SITE_PORT"# `vite preview` and not a plain file server: it serves dist/ with the deployed# CSP and runs infra/policy-site/viewer-request.js over every path, so a route# like /rollouts resolves the way CloudFront resolves it. 127.0.0.1 and not# localhost, because the atproto loopback client redirects to the former.setsid npm --prefix policy-site run preview -- --port "$SITE_PORT" --strictPort \ >"$WORK/site.log" 2>&1 &PIDS+=($!)waited=0while ! curl -sf "$SITE_URL/" >/dev/null 2>&1; do waited=$((waited + 1)) if [ "$waited" -gt 200 ]; then echo "test-policy-e2e: the site never answered at $SITE_URL" >&2 tail -30 "$WORK/site.log" >&2 exit 1 fi sleep 0.25done
say "the scenario: deploy, roll out, enforce"DIDBOT_E2E_OPERATOR_URL="$OPERATOR_URL" \DIDBOT_E2E_GOVERNED_URL="$GOVERNED_URL" \DIDBOT_E2E_OPERATOR_DID="$OPERATOR_DID" \DIDBOT_E2E_OPERATOR_TOKEN="$OPERATOR_TOKEN" \DIDBOT_E2E_OUT="$WORK/deployed.json" \ cargo test --quiet -p didbot-swarm --test policy_rollout -- --nocapture
say "the page: the digest it computes, in a real browser"DIDBOT_E2E_SITE_URL="$SITE_URL" \DIDBOT_E2E_DEPLOYED="$WORK/deployed.json" \DIDBOT_E2E_SHOTS="$SHOTS" \ node --test policy-site/tests/e2e-policy.mjs
say "done"echo "screenshots: $SHOTS" >&2