test(release): verify Android production routes read-only

2026-07-29 03:34:21 +08:00
parent 99958f42fc
commit 2d5568f94b
5 changed files with 160 additions and 2 deletions
@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+base_url="${AUG1_PRODUCTION_API_URL:-https://peilian.njzhmj.top/prod-api}"
+base_url="${base_url%/}"
+[[ "$base_url" =~ ^https://[A-Za-z0-9.-]+(:[0-9]+)?(/[^[:space:]]*)?$ ]] || {
+  echo "verify-aug1-production-api-readonly: AUG1_PRODUCTION_API_URL must be an HTTPS URL" >&2
+  exit 1
+}
+
+read -r -d '' probes <<'PROBES' || true
+public_mobile_home|/api/aihr/mobile/home/user|200
+auth_mobile_me|/api/aihr/mobile/me|401
+auth_position_sop|/api/knowledge/position-sop|401
+auth_practice_scenarios|/api/train/practice/scenarios|401
+auth_direct_channels|/api/aihr/direct/channels|401
+auth_direct_mine|/api/aihr/direct/mine?pageNum=1&pageSize=1|401
+method_sms_login|/auth/mobile/sms-login|405
+method_knowledge_query|/api/knowledge/query|405
+method_knowledge_media|/api/knowledge/query-media|405
+method_resource_download_link|/api/knowledge/resources/0/download-link|405
+auth_answer_feedback|/api/knowledge/answer-feedback|401
+method_summary_card|/api/knowledge/summary-card|405
+method_practice_start|/api/train/practice/start|405
+method_practice_turn|/api/train/practice/turn|405
+method_practice_finish|/api/train/practice/finish|405
+method_agent_messages|/api/aihr/agent/messages|405
+method_agent_media|/api/aihr/agent/messages/media|405
+method_direct_feedback|/api/aihr/direct/feedback|405
+method_asr|/api/ai/asr|405
+method_tts|/api/ai/tts|405
+PROBES
+
+total=0
+public_count=0
+auth_count=0
+method_count=0
+
+while IFS='|' read -r label path expected_code; do
+  [[ -n "$label" ]] || continue
+  response="$(
+    curl -sS --max-time 15 \
+      -H 'Accept: application/json' \
+      -w $'\n__AUG1_HTTP__%{http_code}' \
+      "$base_url$path"
+  )" || {
+    echo "verify-aug1-production-api-readonly: GET failed for $label $path" >&2
+    exit 1
+  }
+  http_line="${response##*$'\n'__AUG1_HTTP__}"
+  body="${response%$'\n'__AUG1_HTTP__*}"
+  [[ "$http_line" == "200" ]] || {
+    echo "verify-aug1-production-api-readonly: $label expected HTTP 200, got $http_line" >&2
+    exit 1
+  }
+  business_code="$(
+    printf '%s' "$body" |
+      sed -nE 's/^[[:space:]]*\{[[:space:]]*"code"[[:space:]]*:[[:space:]]*([0-9]+).*/\1/p'
+  )"
+  [[ "$business_code" == "$expected_code" ]] || {
+    echo "verify-aug1-production-api-readonly: $label expected business code $expected_code, got ${business_code:-missing}" >&2
+    exit 1
+  }
+  echo "$label=HTTP/200 business/$business_code GET $path"
+  total=$((total + 1))
+  case "$expected_code" in
+    200) public_count=$((public_count + 1)) ;;
+    401) auth_count=$((auth_count + 1)) ;;
+    405) method_count=$((method_count + 1)) ;;
+    *)
+      echo "verify-aug1-production-api-readonly: unsupported expected code $expected_code" >&2
+      exit 1
+      ;;
+  esac
+done <<<"$probes"
+
+[[ "$total" -eq 20 ]] || {
+  echo "verify-aug1-production-api-readonly: expected 20 probes, ran $total" >&2
+  exit 1
+}
+[[ "$public_count" -eq 1 && "$auth_count" -eq 6 && "$method_count" -eq 13 ]] || {
+  echo "verify-aug1-production-api-readonly: unexpected probe distribution $public_count/$auth_count/$method_count" >&2
+  exit 1
+}
+
+echo "aug1_production_api_readonly=passed total=$total public=$public_count auth_closed=$auth_count method_closed=$method_count"
+echo "side_effects=GET-only; sms-code endpoint intentionally excluded; no login, token, upload or business POST"