homelab-frontend/k8s/tekton/scripts/integration-test.sh

#!/bin/sh
set -e

# Integration test runner for API gateway.
# Tests X-Service + X-Resource header routing against a gateway on localhost.
#
# Required env:
#   GW           — gateway base URL (e.g. http://localhost:8080)
#   RESULTS_DIR  — directory to write Tekton results

PASS=0; FAIL=0; TOTAL=0

assert() {
  NAME="$1"; EXPECT="$2"
  shift 2
  # remaining args are the full curl flags
  TOTAL=$((TOTAL + 1))
  CODE=$(curl -s -o /dev/null -w '%{http_code}' "$@" 2>/dev/null || echo "000")

  if [ "$CODE" = "$EXPECT" ]; then
    echo "  ✓ ${NAME} (${CODE})"
    PASS=$((PASS + 1))
  else
    echo "  ✗ ${NAME} — expected ${EXPECT}, got ${CODE}"
    FAIL=$((FAIL + 1))
  fi
}

# ── Wait for sidecar gateway to be fully ready ──
echo "⏳ Waiting for gateway sidecar..."
READY=false
for i in $(seq 1 60); do
  CODE=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
  if [ "$CODE" = "200" ]; then
    sleep 1
    C2=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
    C3=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
    if [ "$C2" = "200" ] && [ "$C3" = "200" ]; then
      READY=true
      echo "✓ Gateway ready (stable after 3 checks)"
      break
    fi
  fi
  sleep 2
done

if [ "$READY" = "false" ]; then
  echo "✗ Gateway never became ready"
  echo "fail" > "${RESULTS_DIR}/result"
  echo "0/0 gateway timeout" > "${RESULTS_DIR}/summary"
  exit 1
fi

echo ""
echo "═══ Integration Tests ═══"
echo ""

# ── Health (path-based, no headers) ──
echo "▸ Health"
assert "GET /healthz" 200 \
  -X GET "${GW}/healthz"
assert "GET /readyz" 200 \
  -X GET "${GW}/readyz"

# ── Routing: missing headers → 400 ──
echo "▸ Header validation"
assert "no X-Service → 400" 400 \
  -X GET "${GW}/"
assert "X-Service without X-Resource → 400" 400 \
  -X GET -H "X-Service: memory" "${GW}/"
assert "unknown service → 404" 404 \
  -X GET -H "X-Service: nonexistent" -H "X-Resource: foo" "${GW}/"

# ── Memory service (POST, no auth) ──
echo "▸ Memory service"
assert "memory/query (POST)" 200 \
  -X POST -H "X-Service: memory" -H "X-Resource: query" \
  -H "Content-Type: application/json" -d '{"query":"test"}' "${GW}/"
assert "memory/ingest (POST)" 200 \
  -X POST -H "X-Service: memory" -H "X-Resource: ingest" \
  -H "Content-Type: application/json" \
  -d '{"content":"integration test","metadata":{"source":"tekton"}}' "${GW}/"

# ── S3 service (GET, no auth → MinIO 403) ──
echo "▸ S3 service"
assert "s3/list-objects (GET → 403)" 403 \
  -X GET -H "X-Service: s3" -H "X-Resource: list-objects" "${GW}/"

# ── SQS service (GET, auth required → 401) ──
echo "▸ SQS service"
assert "sqs/list-queues (GET → 401)" 401 \
  -X GET -H "X-Service: sqs" -H "X-Resource: list-queues" "${GW}/"

# ── Workflow service (gRPC, GET) ──
echo "▸ Workflow service"
assert "workflow/list (GET → upstream err)" 502 \
  -X GET -H "X-Service: workflow" -H "X-Resource: list" "${GW}/"

# ── IAM service (GET, Authentik) ──
echo "▸ IAM service"
assert "iam/list-users (GET → Authentik redirect)" 302 \
  -X GET -H "X-Service: iam" -H "X-Resource: list-users" "${GW}/"

echo ""
echo "═══ Results: ${PASS}/${TOTAL} passed, ${FAIL} failed ═══"

# Write Tekton results
if [ "$FAIL" -eq 0 ]; then
  echo "pass" > "${RESULTS_DIR}/result"
else
  echo "fail" > "${RESULTS_DIR}/result"
fi
echo "${PASS}/${TOTAL} passed, ${FAIL} failed" > "${RESULTS_DIR}/summary"

[ "$FAIL" -eq 0 ]