fix(§22.4a): scope RFCView entry-detail fetch to its collection (v0.52.1)
The §9 deployed-environment E2E harness (0.52.0), run against a PPE host
with per-collection-isolated content, surfaced a latent multi-collection
bug: RFCView computed the collection id from the route but called
getRFC(pid, slug) without it, so a named-collection entry was always
fetched via the project default-collection route — which 404s for an entry
that exists only in a named collection ("Error: Not found"; metadata panel
absent). Local/Tier-1 stacks masked it (same slug also reachable via the
default collection). Thread cid through all three getRFC call sites; re-run
the load effect on collection change.
Harness/test-infra (not in the deployed artifact):
- e2e: pre-record cookie consent via addInitScript (lib/fixtures.js) so the
bottom-fixed consent banner can't intercept catalog row-select clicks on
the slower deployed edge.
- testing/seed-ppe.sh: fail loudly on any non-2xx Gitea response (a
swallowed 403 org-repo create had reached the deploy as a 502).
- testing/ppe-deploy-and-test.sh: seed via the Keychain admin token
(write:organization needed to create the PPE repos); store the E2E secret
newline-free; read EXPECT_VERSION from VERSION.
Patch bump 0.52.0 → 0.52.1; CHANGELOG updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ben Stull
@@ -23,7 +23,7 @@ set -euo pipefail
|
||||
REPO_ROOT="$HOME/git/wiggleverse.org/ben.stull/rfc-app"
|
||||
FLOTILLA="$HOME/git/wiggleverse.org/wiggleverse/flotilla-core/.venv/bin/flotilla-core"
|
||||
PPE_HOST="https://rfc-ppe.wiggleverse.org"
|
||||
EXPECT_VERSION="0.52.0"
|
||||
EXPECT_VERSION="$(cat "$REPO_ROOT/VERSION")"
|
||||
BOT_SECRET_PROJECT="wiggleverse-ohm"
|
||||
BOT_SECRET_ID="ohm-rfc-app-gitea-bot-token"
|
||||
E2E_SECRET_PROJECT="rfc-app-ppe"
|
||||
@@ -38,10 +38,19 @@ if ! gcloud secrets list --project="$E2E_SECRET_PROJECT" --limit=1 >/dev/null 2>
|
||||
fi
|
||||
echo "gcloud OK"
|
||||
|
||||
echo "== 1. create + seed PPE repos (bot token; never echoed) =="
|
||||
GITEA_TOKEN="$(gcloud secrets versions access latest --secret="$BOT_SECRET_ID" --project="$BOT_SECRET_PROJECT")" \
|
||||
echo "== 1. create + seed PPE repos (Keychain admin token; never echoed) =="
|
||||
# Seeding CREATES the two org repos (rfc-registry-ppe, rfc-app-ppe-content),
|
||||
# which needs a write:organization-scoped token. The SM bot token is
|
||||
# write:repository only (org create → 403), so use the operator's Keychain
|
||||
# admin PAT (wgl-gitea-token-<host>, legacy fallback ohm-gitea-token). The
|
||||
# token stays in the env var — never echoed (§6.3).
|
||||
SEED_TOKEN="$(security find-generic-password -s "wgl-gitea-token-git.wiggleverse.org" -w 2>/dev/null \
|
||||
|| security find-generic-password -s "ohm-gitea-token" -w 2>/dev/null)"
|
||||
[ -n "$SEED_TOKEN" ] || { echo "no Keychain Gitea token found" >&2; exit 1; }
|
||||
GITEA_TOKEN="$SEED_TOKEN" \
|
||||
RESEED="${RESEED:-1}" \
|
||||
bash "$REPO_ROOT/testing/seed-ppe.sh"
|
||||
unset SEED_TOKEN GITEA_TOKEN
|
||||
|
||||
echo "== 2. ensure E2E test-auth secret exists =="
|
||||
if gcloud secrets describe "$E2E_SECRET_ID" --project="$E2E_SECRET_PROJECT" >/dev/null 2>&1; then
|
||||
@@ -49,7 +58,12 @@ if gcloud secrets describe "$E2E_SECRET_ID" --project="$E2E_SECRET_PROJECT" >/de
|
||||
"$FLOTILLA" secret bind rfc-app-ppe E2E_TEST_AUTH_SECRET "$E2E_SECRET_PROJECT/$E2E_SECRET_ID@latest"
|
||||
else
|
||||
echo "creating E2E secret (random, via stdin — bytes never echoed)"
|
||||
openssl rand -hex 32 | "$FLOTILLA" secret set rfc-app-ppe E2E_TEST_AUTH_SECRET
|
||||
# `printf %s "$(...)"` stores EXACTLY 64 hex bytes with NO trailing newline.
|
||||
# A bare `openssl rand -hex 32 | ...` stores 65 bytes (the trailing \n),
|
||||
# which then rode into the VM .env and made the server's secret differ from
|
||||
# the runner's command-substitution-stripped value → /auth/test/login 404
|
||||
# (compare_digest mismatch). Keep it newline-free.
|
||||
printf '%s' "$(openssl rand -hex 32)" | "$FLOTILLA" secret set rfc-app-ppe E2E_TEST_AUTH_SECRET
|
||||
fi
|
||||
|
||||
echo "== 3. deploy rfc-app-ppe =="
|
||||
|
||||
+25
-11
@@ -44,6 +44,22 @@ RESEED="${RESEED:-0}"
|
||||
|
||||
api() { curl -s -H "Authorization: token $TOKEN" "$@"; }
|
||||
|
||||
# mutate <method> <url> <json> <ok_code> <label>
|
||||
# Performs an authenticated write and FAILS LOUDLY on any non-<ok_code>
|
||||
# response. `api` uses `curl -s` (no -f), so without this a 403/409/etc.
|
||||
# returns exit 0 with an error JSON body — which once let a swallowed 403
|
||||
# (org-repo create needs write:organization) sail past as "created…" and
|
||||
# only surfaced as a 502 at deploy time. Never let an HTTP error be silent.
|
||||
mutate() {
|
||||
_m="$1"; _u="$2"; _d="$3"; _ok="$4"; _lbl="$5"
|
||||
_resp=$(api -X "$_m" "$_u" -H 'Content-Type: application/json' -d "$_d" -w '\n%{http_code}')
|
||||
_code=$(printf '%s' "$_resp" | tail -n1)
|
||||
if [ "$_code" != "$_ok" ]; then
|
||||
echo "seed-ppe: $_lbl FAILED (http $_code): $(printf '%s' "$_resp" | sed '$d' | head -c 300)" >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
echo "seed-ppe: target $GITEA org=$ORG registry=$REGISTRY_REPO content=$CONTENT_REPO project=$PROJECT_ID"
|
||||
|
||||
ensure_repo() {
|
||||
@@ -52,9 +68,9 @@ ensure_repo() {
|
||||
return 0
|
||||
fi
|
||||
echo "seed-ppe: creating repo $ORG/$1 (private)"
|
||||
api -X POST "$GITEA/api/v1/orgs/$ORG/repos" -H 'Content-Type: application/json' \
|
||||
-d "{\"name\":\"$1\",\"auto_init\":true,\"default_branch\":\"main\",\"private\":true}" >/dev/null \
|
||||
|| { echo "seed-ppe: failed to create $1" ; exit 1; }
|
||||
mutate POST "$GITEA/api/v1/orgs/$ORG/repos" \
|
||||
"{\"name\":\"$1\",\"auto_init\":true,\"default_branch\":\"main\",\"private\":true}" \
|
||||
201 "create repo $ORG/$1 (org-repo create needs a write:organization token)"
|
||||
}
|
||||
|
||||
# file_sha <repo> <path> -> prints the blob sha if the file exists, else empty
|
||||
@@ -73,20 +89,18 @@ put_file() {
|
||||
if [ -n "$_sha" ]; then
|
||||
if [ "$_force" = "1" ]; then
|
||||
echo "seed-ppe: updating $_repo/$_path"
|
||||
api -X PUT "$GITEA/api/v1/repos/$ORG/$_repo/contents/$_path" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "{\"message\":\"reseed $_path\",\"content\":\"$_b64\",\"sha\":\"$_sha\",\"branch\":\"main\"}" >/dev/null \
|
||||
|| echo "seed-ppe: update $_repo/$_path failed, continuing"
|
||||
mutate PUT "$GITEA/api/v1/repos/$ORG/$_repo/contents/$_path" \
|
||||
"{\"message\":\"reseed $_path\",\"content\":\"$_b64\",\"sha\":\"$_sha\",\"branch\":\"main\"}" \
|
||||
200 "update $_repo/$_path"
|
||||
else
|
||||
echo "seed-ppe: $_repo/$_path exists, leaving as-is"
|
||||
fi
|
||||
return 0
|
||||
fi
|
||||
echo "seed-ppe: creating $_repo/$_path"
|
||||
api -X POST "$GITEA/api/v1/repos/$ORG/$_repo/contents/$_path" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "{\"message\":\"seed $_path\",\"content\":\"$_b64\",\"branch\":\"main\"}" >/dev/null \
|
||||
|| { echo "seed-ppe: create $_repo/$_path failed" ; exit 1; }
|
||||
mutate POST "$GITEA/api/v1/repos/$ORG/$_repo/contents/$_path" \
|
||||
"{\"message\":\"seed $_path\",\"content\":\"$_b64\",\"branch\":\"main\"}" \
|
||||
201 "create $_repo/$_path"
|
||||
}
|
||||
|
||||
ensure_repo "$REGISTRY_REPO"
|
||||
|
||||
Reference in New Issue
Block a user