Rocky
d0abe27623
Introduce versioned official content workflows and privacy-safe keyboard analytics, while preventing repeat DeviceCheck sign-ins from incorrectly restricting eligible accounts.
Local Docker smoke verification
Run from any directory:
/Users/rocky/Documents/OSGAccountServer/deploy/smoke-local.sh
Requirements: Docker with Compose v2, curl, openssl, and Python 3.
The runner builds the current checkout, creates an isolated MySQL 8.4 project, generates one-time keys and administrator credentials, and uses an internal Docker network. Apple, DeepSeek, and Volcengine endpoints point to the container's closed loopback port, so no provider request can leave the project.
The checks cover:
- successful Flyway V1-V8 history and
/health/ready; - hidden admin routes without the trusted edge header;
- TOTP login, cookies, CSRF, role denial, core reads, grants, and logout;
- a 101-row ledger fixture that requires a second cursor page;
- an exact per-table runtime grant matrix;
- denied
UPDATEandDELETEon ledger, audit, and grant history.
Containers, the named volume, the local smoke image, cookie jars, generated keys, and administrator credentials are removed on exit. On failure, only recent container status and logs remain in the printed temporary diagnostics path.