a2d2d24793
Delivery had two ambiguously-named outputs and always produced an archive, which made it unclear what actually gets uploaded/copied. - dist/1_cafe24_upload/ -> FTP-upload contents to the Cafe24 web host - dist/2_pi_install/ -> copy folder to the Pi, run ./install_offline.sh Archives are now opt-in: MAKE_ZIP=1 (Cafe24) / MAKE_TARBALL=1 (Pi). Docs and tests updated to the new paths. Tests: 165 pass, 2 skipped.
269 lines
15 KiB
Bash
Executable file
269 lines
15 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Build the Cafe24 upload package: a folder whose contents are dragged into the hosting
|
|
# account's FTP root as-is.
|
|
#
|
|
# THIS SCRIPT NEVER RUNS ON CAFE24. It runs here, on the build machine, and only produces a
|
|
# folder. The hosting account executes nothing — no shell, no composer, no installer: the
|
|
# operator uploads files over FTP and edits config.php. That is also why this lives under
|
|
# server/ and not deploy/ — deploy/ is the Raspberry Pi's, where scripts really are run as
|
|
# root on the target.
|
|
#
|
|
# Run on the BUILD machine (needs composer + php — dev-only tools, never on the host):
|
|
# server/deploy/build_cafe24_package.sh
|
|
#
|
|
# Output: dist/1_cafe24_upload/ and dist/move-detect-cafe24.zip
|
|
#
|
|
# dist/1_cafe24_upload/
|
|
# ├── move_detect_app/ -> UPLOAD to the FTP root. Not web-reachable.
|
|
# │ ├── config.php the ONLY file the operator edits
|
|
# │ ├── src/ vendor/ storage/snapshots/
|
|
# │ └── schema.sql import via phpMyAdmin, then DELETE from the host
|
|
# ├── www/
|
|
# │ └── move_detect/ -> UPLOAD into the existing www/. Reached at
|
|
# │ ├── index.php https://<domain>/move_detect/
|
|
# │ └── .htaccess _preflight.php assets/
|
|
# └── README-UPLOAD.md -> for the operator to read; not uploaded
|
|
#
|
|
# Two upload targets, and everything private is ONE folder. That matters on a shared account:
|
|
# this www/ already serves another site, so the FTP root may hold that site's files too —
|
|
# spraying src/, vendor/ and config.php across the root risks overwriting them (vendor/ and
|
|
# config.php are ordinary names in any PHP project).
|
|
#
|
|
# The app is mounted in a SUBDIRECTORY of www/ for the same reason: nothing secret may sit
|
|
# under a docroot the other site also serves. index.php finds move_detect_app/ by walking up
|
|
# rather than hardcoding '/..', and the URL prefix comes from SCRIPT_NAME, so this same
|
|
# package also works dropped straight into www/.
|
|
#
|
|
# APP_DIR= override the www/ subdirectory; empty mounts the app directly in www/.
|
|
# PRIVATE_DIR= override the private folder name (must match index.php's APP_PRIVATE_DIR).
|
|
set -euo pipefail
|
|
|
|
APP_DIR="${APP_DIR-move_detect}"
|
|
PRIVATE_DIR="${PRIVATE_DIR:-move_detect_app}"
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
SERVER="$REPO_ROOT/server"
|
|
OUT_DIR="${OUT_DIR:-$REPO_ROOT/dist}"
|
|
STAGE="$OUT_DIR/1_cafe24_upload"
|
|
ZIP="$OUT_DIR/move-detect-cafe24.zip"
|
|
|
|
command -v composer >/dev/null 2>&1 || { echo "ERROR: composer not found on the build machine." >&2; exit 1; }
|
|
command -v php >/dev/null 2>&1 || { echo "ERROR: php not found on the build machine." >&2; exit 1; }
|
|
|
|
echo ">> [1/6] clean stage: $STAGE"
|
|
rm -rf "$STAGE"
|
|
# WEB is where the app's own files land: www/move_detect by default, www/ when APP_DIR is
|
|
# empty. Everything else stays at the stage root = the FTP root = one level above www/.
|
|
WEB="$STAGE/www${APP_DIR:+/$APP_DIR}"
|
|
# PRIV holds everything that must never be web-reachable, in ONE folder so it cannot
|
|
# collide with the co-hosted site's files at the FTP root.
|
|
PRIV="$STAGE/$PRIVATE_DIR"
|
|
mkdir -p "$WEB" "$PRIV/src" "$PRIV/storage/snapshots"
|
|
|
|
echo ">> [2/6] generating the no-dev autoloader"
|
|
# public/index.php hard-requires ../vendor/autoload.php, so vendor/ MUST ship — the app has
|
|
# no runtime composer *packages* (composer.lock's "packages" is empty), but it does need
|
|
# composer's generated autoloader to map App\ -> src/.
|
|
#
|
|
# --no-dev is load-bearing, not tidiness: the working tree's vendor/ carries PHPUnit and a
|
|
# dev autoload_files.php that eagerly requires tests/Support/InMemoryRepositories.php on
|
|
# every request — a file this package deliberately excludes. Shipping it fatals every hit.
|
|
#
|
|
# --classmap-authoritative because src/Auth/Session.php declares three symbols
|
|
# (SessionStore, ArraySessionStore, PhpSessionStore) under one filename matching none of
|
|
# them; that is why composer.json carries an explicit classmap entry for it. Plain PSR-4
|
|
# would look for src/Auth/PhpSessionStore.php, miss, and fatal at index.php's
|
|
# `new PhpSessionStore()` — the 4th statement of every request.
|
|
#
|
|
# --no-interaction so a build box without a TTY cannot hang. Composer rewrites server/vendor/
|
|
# in place, so restore the dev autoloader on exit or local phpunit breaks.
|
|
restore_dev_autoloader() {
|
|
echo ">> restoring the dev autoloader in server/vendor (so local phpunit keeps working)"
|
|
( cd "$SERVER" && composer dump-autoload --no-interaction >/dev/null 2>&1 ) || true
|
|
}
|
|
trap restore_dev_autoloader EXIT
|
|
|
|
( cd "$SERVER" && composer dump-autoload --no-dev --classmap-authoritative --no-interaction )
|
|
|
|
# Precondition for everything below: this package stages ONLY composer's generated
|
|
# autoloader, which is correct exactly while the app has no runtime packages. The day
|
|
# someone adds one to composer.json's `require`, that staging silently omits its code and
|
|
# the host fatals on a missing class. Fail here, on the commit that adds the dependency,
|
|
# rather than on the hosting account.
|
|
php -r 'exit(json_decode(file_get_contents($argv[1]), true)["packages"] === [] ? 0 : 1);' \
|
|
"$SERVER/composer.lock" || {
|
|
echo "ERROR: composer.lock now lists runtime packages. This script stages only the" >&2
|
|
echo " autoloader, so their code would be missing from the package. Teach" >&2
|
|
echo " step [3/6] to stage the real vendor tree before shipping again." >&2
|
|
exit 1
|
|
}
|
|
|
|
echo ">> [3/6] staging vendor/ (autoloader only — no phpunit, no dev deps)"
|
|
mkdir -p "$PRIV/vendor/composer"
|
|
cp "$SERVER/vendor/autoload.php" "$PRIV/vendor/autoload.php"
|
|
# Copy only composer's own generated files, by name. A glob over vendor/* would drag in
|
|
# phpunit/, sebastian/, myclabs/ and friends.
|
|
for f in ClassLoader.php InstalledVersions.php autoload_classmap.php autoload_namespaces.php \
|
|
autoload_psr4.php autoload_real.php autoload_static.php platform_check.php; do
|
|
cp "$SERVER/vendor/composer/$f" "$PRIV/vendor/composer/$f"
|
|
done
|
|
cp "$SERVER/vendor/composer/LICENSE" "$PRIV/vendor/composer/" 2>/dev/null || true
|
|
|
|
# installed.php / installed.json are deliberately NOT copied. `dump-autoload` does not
|
|
# regenerate them — they are the package inventory written by the last `composer install`,
|
|
# so they still list every dev package (and its exact version, which is a free CVE shopping
|
|
# list for anyone who can read them). Nothing here needs them: autoload_real.php eagerly
|
|
# requires only platform_check.php, and Composer\InstalledVersions reads installed.php
|
|
# lazily, on a call this app never makes.
|
|
|
|
# Guard: the dev autoload_files.php requires tests/Support/InMemoryRepositories.php, which
|
|
# is not in this package. If it slipped through, every request 500s — fail the build loudly
|
|
# rather than ship it.
|
|
if [ -f "$PRIV/vendor/composer/autoload_files.php" ]; then
|
|
echo "ERROR: autoload_files.php present — that is the DEV autoloader (it requires tests/)." >&2
|
|
echo " composer dump-autoload --no-dev did not take effect." >&2
|
|
exit 1
|
|
fi
|
|
# Guard: no autoload map may point outside src/. Grep the maps that actually drive loading
|
|
# rather than the whole tree — InstalledVersions.php names PHPUnit in a docblock, which is
|
|
# harmless prose, and matching it would make this check cry wolf.
|
|
for map in autoload_classmap.php autoload_psr4.php autoload_static.php autoload_namespaces.php; do
|
|
if grep -qiE "phpunit|sebastian|myclabs|/tests/" "$PRIV/vendor/composer/$map"; then
|
|
echo "ERROR: $map references dev deps or tests/ — --no-dev did not take effect." >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
# Guard: no dev package directory may exist in the staged vendor/.
|
|
if find "$PRIV/vendor" -mindepth 1 -maxdepth 1 -type d ! -name composer | grep -q .; then
|
|
echo "ERROR: unexpected package directories under the staged vendor/:" >&2
|
|
find "$PRIV/vendor" -mindepth 1 -maxdepth 1 -type d ! -name composer >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo ">> [4/6] staging app source"
|
|
cp -r "$SERVER/src/." "$PRIV/src/"
|
|
cp -r "$SERVER/public/." "$WEB/"
|
|
cp "$SERVER/schema.sql" "$PRIV/schema.sql"
|
|
# The hardened DocumentRoot .htaccess replaces server/public/'s dev-local rewrite-only one.
|
|
cp "$SERVER/deploy/htaccess.www" "$WEB/.htaccess"
|
|
cp "$SERVER/deploy/config.template.php" "$PRIV/config.php"
|
|
cp "$SERVER/deploy/preflight.php" "$WEB/_preflight.php"
|
|
# .user.ini: display_errors=Off backstop for pre-parse errors (Cafe24 often ships On).
|
|
cp "$SERVER/deploy/user.ini" "$WEB/.user.ini"
|
|
cp "$SERVER/deploy/README-UPLOAD.md" "$STAGE/README-UPLOAD.md"
|
|
|
|
# `cp -r` above copies whatever is in server/src|public — defensively strip dev/tooling caches
|
|
# so a stray one (e.g. a tool that ran in the tree) can never ship inside the web-served
|
|
# package. Legit dotfiles (.htaccess/.user.ini/.gitkeep) are named explicitly, not globbed.
|
|
find "$WEB" "$PRIV" -depth \( -name '.ruff_cache' -o -name '.impeccable' -o -name '__pycache__' \
|
|
-o -name '.pytest_cache' -o -name '.mypy_cache' -o -name '.DS_Store' \
|
|
-o -name '.phpunit.result.cache' -o -name 'Thumbs.db' \) -exec rm -rf {} + 2>/dev/null || true
|
|
|
|
# storage/snapshots must exist and be writable. Nothing in src/ ever creates it, and the
|
|
# failure is silent rather than loud: IngestController does
|
|
# `if (file_put_contents(...) === false) continue;`, so a missing dir means the snapshot is
|
|
# dropped while the API still answers 201 to the edge device. The event row lands in MySQL
|
|
# with no image, the dashboard shows an event with no photo, and with display_errors=Off
|
|
# (correct for production) not even a warning survives. That is permanent evidence loss.
|
|
touch "$PRIV/storage/snapshots/.gitkeep"
|
|
# Build-local only. Neither zip nor FTP carries unix modes, so these do NOT reach the host —
|
|
# they are correct for someone who rsyncs the stage directly, and a no-op otherwise. The
|
|
# host-side modes are the operator's job (README-UPLOAD.md) and _preflight.php verifies the
|
|
# live value rather than trusting these.
|
|
chmod 750 "$PRIV/storage/snapshots"
|
|
chmod 600 "$PRIV/config.php"
|
|
|
|
echo ">> [5/6] verifying the package resolves every class index.php touches"
|
|
# Prove the autoloader works against the STAGED layout, not the repo's.
|
|
php -r '
|
|
$stage = $argv[1];
|
|
require $stage . "/vendor/autoload.php";
|
|
$classes = ["App\\Config", "App\\Http\\Router", "App\\Http\\Request", "App\\Http\\Response",
|
|
"App\\Db\\Database", "App\\Auth\\PhpSessionStore", "App\\Auth\\AuthController",
|
|
"App\\Auth\\CsrfController", "App\\Auth\\Rbac", "App\\Ingest\\IngestController",
|
|
"App\\Ingest\\EventValidator", "App\\Ingest\\ImageProcessor", "App\\Api\\ConfigController",
|
|
"App\\Api\\HeartbeatController", "App\\Dashboard\\EventListController",
|
|
"App\\Dashboard\\EventDetailController", "App\\Dashboard\\SnapshotProxy",
|
|
"App\\Dashboard\\ZoneConfigController", "App\\Geometry\\Polygon",
|
|
"App\\Repository\\Pdo\\PdoDeviceRepository", "App\\Repository\\Pdo\\PdoNonceRepository",
|
|
"App\\Repository\\Pdo\\PdoRateLimiterRepository", "App\\Repository\\Pdo\\PdoEventRepository",
|
|
"App\\Repository\\Pdo\\PdoSnapshotRepository", "App\\Repository\\Pdo\\PdoUserRepository",
|
|
"App\\Repository\\Pdo\\PdoZoneRepository", "App\\Repository\\Pdo\\PdoThresholdRepository",
|
|
"App\\Repository\\Pdo\\PdoAuditRepository"];
|
|
$missing = array_values(array_filter($classes, fn($c) => !class_exists($c) && !interface_exists($c)));
|
|
if ($missing) { fwrite(STDERR, "ERROR: unresolvable in the package: " . implode(", ", $missing) . "\n"); exit(1); }
|
|
echo " -> " . count($classes) . " classes resolve through the packaged autoloader\n";
|
|
' "$PRIV"
|
|
|
|
# Prove index.php ACTUALLY finds $PRIV from where it is mounted, at the real depth, rather
|
|
# than trusting that the tree looks right. This is the check that would have caught a
|
|
# hardcoded '/..' — the walk-up must cross www/ and land on the private folder.
|
|
php -r '
|
|
[$_, $web, $priv] = $argv;
|
|
$found = null;
|
|
$isAppRoot = fn(string $d) => is_file("$d/config.php") && is_file("$d/vendor/autoload.php")
|
|
&& is_file("$d/src/Config.php");
|
|
for ($dir = dirname($web), $i = 0; $i < 4; $i++) {
|
|
foreach (["$dir/move_detect_app", $dir] as $c) { if ($isAppRoot($c)) { $found = $c; break 2; } }
|
|
if (dirname($dir) === $dir) break;
|
|
$dir = dirname($dir);
|
|
}
|
|
if ($found === null) { fwrite(STDERR, "ERROR: index.php could not resolve the app root from $web\n"); exit(1); }
|
|
if (realpath($found) !== realpath($priv)) {
|
|
fwrite(STDERR, "ERROR: app root resolved to $found, expected $priv\n"); exit(1);
|
|
}
|
|
echo " -> index.php resolves its app root across www/ to " . basename($found) . "/\n";
|
|
' "$WEB" "$PRIV"
|
|
|
|
# Every staged .php must parse under the build php. Catches a truncated copy.
|
|
while IFS= read -r -d '' f; do
|
|
php -l "$f" >/dev/null || { echo "ERROR: php -l failed: $f" >&2; exit 1; }
|
|
done < <(find "$STAGE" -name '*.php' -print0)
|
|
echo " -> every staged .php parses"
|
|
|
|
echo ">> [6/6] zipping"
|
|
rm -f "$ZIP"
|
|
if [ "${MAKE_ZIP:-0}" != "1" ]; then
|
|
# Default: leave the folder uncompressed. The operator uploads $STAGE/ over FTP as-is,
|
|
# which is also the only path that cannot mangle directory separators (see below).
|
|
echo " -> skipped (MAKE_ZIP=1 to also produce $ZIP)"
|
|
elif command -v zip >/dev/null 2>&1; then
|
|
( cd "$STAGE" && zip -rq "$ZIP" . )
|
|
elif command -v python3 >/dev/null 2>&1; then
|
|
# No `zip` (common on Windows/Git Bash). Use Python's zipfile with POSIX (forward-slash)
|
|
# arcnames. PowerShell's Compress-Archive writes BACKSLASH path separators, which Cafe24's
|
|
# extractor and some unzip tools do NOT normalise — the app tree then unpacks as flat files
|
|
# (move_detect_app\src\... as one filename) and the deploy silently breaks. Prefer python.
|
|
( cd "$STAGE" && python3 - "$ZIP" <<'PY'
|
|
import os, sys, zipfile
|
|
with zipfile.ZipFile(sys.argv[1], "w", zipfile.ZIP_DEFLATED) as z:
|
|
for root, _dirs, files in os.walk("."):
|
|
for name in files:
|
|
full = os.path.join(root, name)
|
|
arc = os.path.relpath(full, ".").replace(os.sep, "/") # force forward slashes
|
|
z.write(full, arc)
|
|
PY
|
|
)
|
|
elif command -v powershell >/dev/null 2>&1; then
|
|
# Last resort. Compress-Archive uses backslash separators (see above) — the .htaccess/README
|
|
# note the operator to extract with a slash-aware tool, or prefer the python path.
|
|
win_stage="$(cygpath -w "$STAGE" 2>/dev/null || echo "$STAGE")"
|
|
win_zip="$(cygpath -w "$ZIP" 2>/dev/null || echo "$ZIP")"
|
|
powershell -NoProfile -Command "Compress-Archive -Path '${win_stage}\\*' -DestinationPath '${win_zip}' -Force"
|
|
echo " WARN: archived via Compress-Archive (backslash paths). Verify the host unpacks the tree correctly."
|
|
else
|
|
echo " WARN: no zip/python3/powershell — skipping the archive; upload $STAGE/ directly."
|
|
fi
|
|
|
|
echo ""
|
|
echo "DONE."
|
|
echo " package : $STAGE"
|
|
[ -f "$ZIP" ] && echo " zip : $ZIP"
|
|
echo ""
|
|
echo "Upload: put the CONTENTS of $STAGE into the Cafe24 FTP root."
|
|
echo " www/* merges into the existing www/ (DocumentRoot)"
|
|
echo " src/ vendor/ storage/ config.php sit BESIDE www/, never inside it"
|
|
echo ""
|
|
echo "Then, on the host: edit config.php (DB name/user/password), import schema.sql via"
|
|
echo "phpMyAdmin and delete it, and open https://<domain>/_preflight.php to confirm the PHP"
|
|
echo "build is usable — then DELETE _preflight.php. See README-UPLOAD.md."
|