CosmicClash/scripts/verify_control_plane_integration.sh

#!/usr/bin/env bash
set -euo pipefail

# Real end-to-end verification: a real PostgreSQL instance, the real Go
# api.Service wired exactly like cmd/control-plane (except for auth -- see
# below), and a real headless Godot process driving ControlPlaneClient over
# an actual network connection. Every other test of this boundary is either
# a Go unit test with a mocked HTTP layer or a GDScript unit test with no
# network at all; this is the one place that proves the wire format the two
# languages actually agree on, not just that each side's own tests pass.
#
# Uses server/cmd/testkit-api rather than the real cmd/control-plane binary:
# that binary has no way to authenticate a Steam Web API ticket without a
# real Steam backend, which this sandbox cannot provide (see
# multiplayer-next.md task 8.7). testkit-api is wired identically otherwise
# and is never referenced by any Dockerfile stage or Kubernetes manifest --
# see its own file header for why that bypass is confined to a distinctly
# named, obviously-not-production binary rather than a flag on the real one.

root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$root_dir"

godot_bin="${GODOT_BIN:-godot}"
container_name="cosmic-clash-control-plane-integration"
database="cosmic_clash_test"
user="cosmic_clash_test"
password="cosmic_clash_test"
pg_port="55434"
api_port="18099"
logs_dir="$(mktemp -d "${TMPDIR:-/tmp}/cosmic-clash-control-plane.XXXXXX")"

testkit_pid=""
cleanup() {
  local status=$?
  if (( status != 0 )); then
    for log_file in "$logs_dir"/*.log; do
      [[ -f "$log_file" ]] || continue
      echo "--- $log_file" >&2
      cat "$log_file" >&2
    done
  fi
  [[ -n "$testkit_pid" ]] && kill "$testkit_pid" 2>/dev/null || true
  # Belt-and-suspenders after the go-run zombie above: make sure nothing is
  # left listening on this run's own port before the trap exits.
  lsof -ti "tcp:${api_port}" 2>/dev/null | xargs -r kill -9 2>/dev/null || true
  docker rm -f "$container_name" >/dev/null 2>&1 || true
  echo "Control-plane integration logs: $logs_dir"
}
trap cleanup EXIT

docker rm -f "$container_name" >/dev/null 2>&1 || true
docker run --rm -d --name "$container_name" \
  -e POSTGRES_DB="$database" \
  -e POSTGRES_USER="$user" \
  -e POSTGRES_PASSWORD="$password" \
  -p "${pg_port}:5432" postgres:17-alpine >/dev/null

for attempt in $(seq 1 30); do
  if docker exec "$container_name" pg_isready -U "$user" -d "$database" >/dev/null 2>&1; then
    break
  fi
  if [ "$attempt" = 30 ]; then
    echo "PostgreSQL did not become ready" >&2
    exit 1
  fi
  sleep 1
done

dsn="postgres://${user}:${password}@127.0.0.1:${pg_port}/${database}?sslmode=disable"

# `go run` wraps the real binary in a build/exec parent whose own PID does
# not reliably propagate a `kill` to the child it spawns -- confirmed the
# hard way: a prior run's leftover process survived cleanup, kept squatting
# on this exact port bound to an already-torn-down PostgreSQL container, and
# silently intercepted the NEXT run's connection, turning a real login into
# an "http=401 unauthorized" failure with no indication the server it
# actually reached was a zombie from a previous run. Build once and run the
# real binary directly so its own PID is what gets killed.
go -C server build -o "$logs_dir/testkit-api" ./cmd/testkit-api
COSMIC_CLASH_POSTGRES_DSN="$dsn" "$logs_dir/testkit-api" --listen="127.0.0.1:${api_port}" --migrations="$root_dir/server/migrations" \
  >"$logs_dir/testkit-api.log" 2>&1 &
testkit_pid=$!

for attempt in $(seq 1 30); do
  if curl -sSf "http://127.0.0.1:${api_port}/healthz" >/dev/null 2>&1; then
    break
  fi
  if [ "$attempt" = 30 ]; then
    echo "testkit-api did not become ready" >&2
    exit 1
  fi
  sleep 1
done

"$godot_bin" --headless --path Game res://tests/control_plane_smoke.tscn -- \
  --control-plane-url="http://127.0.0.1:${api_port}" \
  >"$logs_dir/godot-client.log" 2>&1
status=$?

if [ "$status" -ne 0 ] || ! grep -q "^SMOKE PASS:" "$logs_dir/godot-client.log"; then
  echo "Control-plane integration FAILED (exit $status)" >&2
  cat "$logs_dir/godot-client.log" >&2
  exit 1
fi

echo "Control-plane integration PASS"