fix: get_totp exact-name resolution + all-agent login validator

bw's name search is fuzzy: every agent email contains "coo" (tsgstaff-coo-*), so `bw get totp "coo Cloudron"` matched 10 items and errored. get_totp now resolves via get_item_id (exact-name filter) first, mirroring get_item_password. Added validate-all-logins.py: per-agent fresh-browser-context login (shared contexts carry session cookies and hide the login form), asserts password+TOTP round-trip, then verifies every stored API credential against its system. First full run: 9/10 PASS. Known failure: vp-compliance stored password does not match the account ("Incorrect username or password" pre-TOTP) -- enrollment typed a different value than stored. Needs Cloudron admin reset, then update_item and re-validate.
2026-08-14 11:48:06 -05:00
parent c461f85efa
commit 1b8bd843d9
5 changed files with 353 additions and 2 deletions
@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+"""
+validate-coo.py -- Targeted re-validation of the coo identity.
+
+Verifies the get_totp exact-name fix: fresh login with password + TOTP.
+
+Usage:
+    docker compose run --rm --entrypoint python3 provision validate-coo.py
+"""
+
+import os
+import sys
+
+from playwright.sync_api import sync_playwright
+
+sys.path.insert(0, os.path.dirname(__file__))
+from bw_helper import BitwardenHelper
+
+CLOUDRON_BASE = "https://my.knownelement.com"
+ITEM = "coo Cloudron"
+EMAIL = "tsgstaff-coo@turnsys.com"
+
+
+def main():
+    bw = BitwardenHelper(
+        client_id=os.environ["BW_CLIENTID"],
+        client_secret=os.environ["BW_CLIENTSECRET"],
+        password=os.environ["BW_PASSWORD"],
+        server_url=os.environ.get("BW_SERVER", ""),
+    )
+    bw.login()
+    password = bw.get_item_password(ITEM)
+
+    with sync_playwright() as p:
+        browser = p.chromium.launch(headless=True)
+        context = browser.new_context(viewport={"width": 1280, "height": 1024})
+        page = context.new_page()
+
+        page.goto(f"{CLOUDRON_BASE}/login.html", wait_until="domcontentloaded", timeout=30000)
+        page.wait_for_timeout(1500)
+        page.wait_for_selector("#inputPassword", timeout=15000)
+        page.click("#inputUsername")
+        page.keyboard.type(EMAIL)
+        page.click("#inputPassword")
+        page.keyboard.type(password)
+        page.locator('[role="button"]:has-text("Log in")').first.click()
+        page.wait_for_timeout(4000)
+
+        totp_el = page.query_selector("#inputTotpToken")
+        if totp_el and totp_el.is_visible():
+            print("2FA prompt: YES")
+            code = bw.get_totp(ITEM)
+            print(f"TOTP resolved by exact name: {code}")
+            totp_el.click()
+            page.keyboard.type(code)
+            page.locator("#totpTokenSubmitButton").click()
+            page.wait_for_timeout(5000)
+        else:
+            print("2FA prompt: NO (problem)")
+
+        authed = ("login" not in page.url.lower()
+                  and "openid" not in page.url.lower()
+                  and "setupaccount" not in page.url.lower())
+        print(f"coo login: {'PASS' if authed else 'FAIL'} ({page.url})")
+        sys.exit(0 if authed else 1)
+
+
+if __name__ == "__main__":
+    main()