vptechops
1b8bd843d9
bw's name search is fuzzy: every agent email contains "coo"
(tsgstaff-coo-*), so `bw get totp "coo Cloudron"` matched 10 items and
errored. get_totp now resolves via get_item_id (exact-name filter)
first, mirroring get_item_password.
Added validate-all-logins.py: per-agent fresh-browser-context login
(shared contexts carry session cookies and hide the login form),
asserts password+TOTP round-trip, then verifies every stored API
credential against its system. First full run: 9/10 PASS.
Known failure: vp-compliance stored password does not match the
account ("Incorrect username or password" pre-TOTP) -- enrollment
typed a different value than stored. Needs Cloudron admin reset,
then update_item and re-validate.
70 lines
2.2 KiB
Python
70 lines
2.2 KiB
Python
#!/usr/bin/env python3
|
|
"""
|
|
validate-coo.py -- Targeted re-validation of the coo identity.
|
|
|
|
Verifies the get_totp exact-name fix: fresh login with password + TOTP.
|
|
|
|
Usage:
|
|
docker compose run --rm --entrypoint python3 provision validate-coo.py
|
|
"""
|
|
|
|
import os
|
|
import sys
|
|
|
|
from playwright.sync_api import sync_playwright
|
|
|
|
sys.path.insert(0, os.path.dirname(__file__))
|
|
from bw_helper import BitwardenHelper
|
|
|
|
CLOUDRON_BASE = "https://my.knownelement.com"
|
|
ITEM = "coo Cloudron"
|
|
EMAIL = "tsgstaff-coo@turnsys.com"
|
|
|
|
|
|
def main():
|
|
bw = BitwardenHelper(
|
|
client_id=os.environ["BW_CLIENTID"],
|
|
client_secret=os.environ["BW_CLIENTSECRET"],
|
|
password=os.environ["BW_PASSWORD"],
|
|
server_url=os.environ.get("BW_SERVER", ""),
|
|
)
|
|
bw.login()
|
|
password = bw.get_item_password(ITEM)
|
|
|
|
with sync_playwright() as p:
|
|
browser = p.chromium.launch(headless=True)
|
|
context = browser.new_context(viewport={"width": 1280, "height": 1024})
|
|
page = context.new_page()
|
|
|
|
page.goto(f"{CLOUDRON_BASE}/login.html", wait_until="domcontentloaded", timeout=30000)
|
|
page.wait_for_timeout(1500)
|
|
page.wait_for_selector("#inputPassword", timeout=15000)
|
|
page.click("#inputUsername")
|
|
page.keyboard.type(EMAIL)
|
|
page.click("#inputPassword")
|
|
page.keyboard.type(password)
|
|
page.locator('[role="button"]:has-text("Log in")').first.click()
|
|
page.wait_for_timeout(4000)
|
|
|
|
totp_el = page.query_selector("#inputTotpToken")
|
|
if totp_el and totp_el.is_visible():
|
|
print("2FA prompt: YES")
|
|
code = bw.get_totp(ITEM)
|
|
print(f"TOTP resolved by exact name: {code}")
|
|
totp_el.click()
|
|
page.keyboard.type(code)
|
|
page.locator("#totpTokenSubmitButton").click()
|
|
page.wait_for_timeout(5000)
|
|
else:
|
|
print("2FA prompt: NO (problem)")
|
|
|
|
authed = ("login" not in page.url.lower()
|
|
and "openid" not in page.url.lower()
|
|
and "setupaccount" not in page.url.lower())
|
|
print(f"coo login: {'PASS' if authed else 'FAIL'} ({page.url})")
|
|
sys.exit(0 if authed else 1)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|