test(M00): 补充本地MQTT认证冒烟入口

2026-06-16 12:30:04 +08:00
parent 80cd20b2a5
commit a0b02ec01b
12 changed files with 151 additions and 19 deletions
@@ -1,5 +1,92 @@
 #!/usr/bin/env bash
 set -euo pipefail

-echo "MQTT smoke test placeholder. Configure host/user/password outside Git before use."
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

+if [ -f "${SCRIPT_DIR}/mqtt-smoke.env" ]; then
+  # shellcheck disable=SC1091
+  . "${SCRIPT_DIR}/mqtt-smoke.env"
+fi
+
+host="${QIPAI_MQTT_HOST:-127.0.0.1}"
+port="${QIPAI_MQTT_PORT:-1883}"
+protocol="${QIPAI_MQTT_PROTOCOL:-mqtt}"
+mqtt_version="${QIPAI_MQTT_VERSION:-3.1.1}"
+qos="${QIPAI_MQTT_QOS:-1}"
+client_id="qipai-device-smoke-$(date +%s)"
+allowed_publish_topic="${QIPAI_MQTT_ALLOWED_PUBLISH_TOPIC:-qipai/${client_id}/status}"
+allowed_subscribe_topic="${QIPAI_MQTT_ALLOWED_SUBSCRIBE_TOPIC:-qipai/${client_id}/command/#}"
+denied_subscribe_topic="${QIPAI_MQTT_DENIED_SUBSCRIBE_TOPIC:-\$SYS/#}"
+
+echo "INFO: MQTT smoke target ${protocol}://${host}:${port}, version ${mqtt_version}, qos ${qos}"
+
+if ! command -v mqttx >/dev/null 2>&1; then
+  echo "FAIL: mqttx CLI not found"
+  exit 1
+fi
+
+if [ -z "${QIPAI_MQTT_USERNAME:-}" ] || [ -z "${QIPAI_MQTT_PASSWORD:-}" ]; then
+  echo "SKIP: QIPAI_MQTT_USERNAME/QIPAI_MQTT_PASSWORD not configured in Git-ignored local env"
+  echo "INFO: service-level check remains available via scripts/dev/wsl/check-local-mqtt.sh"
+  exit 0
+fi
+
+common_args=(
+  --hostname "$host"
+  --port "$port"
+  --protocol "$protocol"
+  --mqtt-version "$mqtt_version"
+  --qos "$qos"
+  --username "$QIPAI_MQTT_USERNAME"
+  --password "$QIPAI_MQTT_PASSWORD"
+)
+
+echo "INFO: verifying allowed publish topic ${allowed_publish_topic}"
+mqttx pub "${common_args[@]}" \
+  --client-id "${client_id}-pub" \
+  --topic "$allowed_publish_topic" \
+  --message "{\"type\":\"smoke\",\"clientId\":\"${client_id}\"}" >/dev/null
+echo "PASS: allowed publish accepted"
+
+echo "INFO: verifying allowed subscribe topic ${allowed_subscribe_topic}"
+timeout 6 mqttx sub "${common_args[@]}" \
+  --client-id "${client_id}-sub" \
+  --topic "$allowed_subscribe_topic" \
+  --output-mode clean >/tmp/qipai-mqtt-smoke-sub.out 2>/tmp/qipai-mqtt-smoke-sub.err || true
+if grep -qiE "error|not authorized|unauthorized|connack.*5|refused" /tmp/qipai-mqtt-smoke-sub.err; then
+  echo "FAIL: allowed subscribe was rejected"
+  cat /tmp/qipai-mqtt-smoke-sub.err
+  exit 1
+fi
+echo "PASS: allowed subscribe connection did not report authorization failure"
+
+echo "INFO: verifying wrong password is rejected"
+if timeout 6 mqttx pub \
+  --hostname "$host" \
+  --port "$port" \
+  --protocol "$protocol" \
+  --mqtt-version "$mqtt_version" \
+  --qos "$qos" \
+  --username "$QIPAI_MQTT_USERNAME" \
+  --password "QIPAI_EXPECTED_BAD_PASSWORD" \
+  --client-id "${client_id}-badpass" \
+  --topic "$allowed_publish_topic" \
+  --message "bad-password-should-fail" >/tmp/qipai-mqtt-smoke-badpass.out 2>/tmp/qipai-mqtt-smoke-badpass.err; then
+  echo "FAIL: wrong password publish succeeded"
+  exit 1
+else
+  echo "PASS: wrong password rejected"
+fi
+
+echo "INFO: probing denied subscribe topic ${denied_subscribe_topic}"
+timeout 6 mqttx sub "${common_args[@]}" \
+  --client-id "${client_id}-deny" \
+  --topic "$denied_subscribe_topic" \
+  --output-mode clean >/tmp/qipai-mqtt-smoke-deny.out 2>/tmp/qipai-mqtt-smoke-deny.err || true
+if grep -qiE "not authorized|unauthorized|refused|error" /tmp/qipai-mqtt-smoke-deny.err; then
+  echo "PASS: denied topic produced authorization error"
+else
+  echo "WARN: denied topic did not produce a clear authorization error; verify ACL manually"
+fi
+
+echo "INFO: will-message and idempotency checks are not automated yet"