costa-rica: add read-only prod smoke test + gitignored .deploy.conf (yoloforever cycle 1) — TK-10346

f1ed844b1c4d7e299eee0f917f03328e484907af · 2026-08-07 13:25:47 -0700 · Steve

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
A scripts/smoke-prod.sh

Diff

commit f1ed844b1c4d7e299eee0f917f03328e484907af
Author: Steve <steve@designerwallcoverings.com>
Date:   Fri Aug 7 13:25:47 2026 -0700

    costa-rica: add read-only prod smoke test + gitignored .deploy.conf (yoloforever cycle 1) — TK-10346
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .gitignore            |  2 ++
 scripts/smoke-prod.sh | 44 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/.gitignore b/.gitignore
index 2edcc4a..a7f1488 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,6 +10,8 @@ build/
 .next/
 data/raw/
 data/cache/
+# deploy config — holds DEPLOY_HOST (prod IP); gitignored per the /deploy skill spec
+.deploy.conf
 # editor / refactor snapshot junk — never commit, never serve
 *.bak
 *.bak.*
diff --git a/scripts/smoke-prod.sh b/scripts/smoke-prod.sh
new file mode 100755
index 0000000..50e9d0a
--- /dev/null
+++ b/scripts/smoke-prod.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# smoke-prod.sh — READ-ONLY prod smoke test for the Costa Rica marketplace.
+# Hits public (non-gated) endpoints on the live site and asserts they respond
+# correctly. Makes NO writes (no register/login/booking) — safe to run anytime,
+# e.g. after a deploy or as a canary. Exit 0 = all green, non-zero = a failure.
+#
+# Usage:  scripts/smoke-prod.sh [BASE]
+#   BASE defaults to https://costarica.agentabrams.com
+#   Override for a local check:  scripts/smoke-prod.sh http://127.0.0.1:9791
+set -u
+BASE="${1:-https://costarica.agentabrams.com}"
+fail=0
+
+check() { # name  url  expected_code  [must_contain]
+  local name="$1" url="$2" want="$3" needle="${4:-}"
+  local body code
+  body=$(curl -s -w $'\n%{http_code}' --max-time 15 "$url" 2>/dev/null)
+  code=$(printf '%s' "$body" | tail -1)
+  body=$(printf '%s' "$body" | sed '$d')
+  if [ "$code" != "$want" ]; then
+    echo "FAIL  $name — got HTTP $code, want $want ($url)"; fail=1; return
+  fi
+  if [ -n "$needle" ] && ! printf '%s' "$body" | grep -q "$needle"; then
+    echo "FAIL  $name — HTTP $want but missing '$needle' ($url)"; fail=1; return
+  fi
+  echo "OK    $name — HTTP $code${needle:+ (contains '$needle')}"
+}
+
+echo "== Costa Rica marketplace smoke — $BASE =="
+# 1) Public health endpoint must be 200.
+check "api health"        "$BASE/api/app/health"    200
+# 2) Public listings endpoint (optionalAuth) must serve JSON, not 5xx.
+check "public listings"   "$BASE/api/app/listings"  200
+# 3) Front door is admin-gated → 401 with a Basic realm is the CORRECT healthy state.
+#    (The realm is in the WWW-Authenticate response header, not the body.)
+gate_hdr=$(curl -sI --max-time 15 "$BASE/" 2>/dev/null)
+if printf '%s' "$gate_hdr" | grep -qiE '^HTTP/.* 401' && printf '%s' "$gate_hdr" | grep -qi 'www-authenticate: *Basic'; then
+  echo "OK    front-door gate — HTTP 401 + Basic realm (admin gate healthy)"
+else
+  echo "FAIL  front-door gate — expected 401 + WWW-Authenticate: Basic ($BASE/)"; fail=1
+fi
+
+if [ "$fail" -eq 0 ]; then echo "== ALL GREEN =="; else echo "== SMOKE FAILED =="; fi
+exit "$fail"

← 4c5d521 costa-rica: test coverage for security-critical untested cod · back to Costa Rica · costa-rica: untrack .deploy.conf (prod IP) + .playwright-mcp 46aa26d →