From bb09b0d4f2ef8f93de6ccc178a144e4a3bd76039 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= <hernani+magikoopa@vecirex.net>
Date: Fri, 17 Jul 2026 23:22:18 +0200
Subject: [PATCH] monitoring: wire auth401 + full phases; CONTINUE_ON_ERROR
 export

---
 scripts/taler-monitoring/taler-monitoring.sh | 39 +++++++++++++++++++-
 1 file changed, 37 insertions(+), 2 deletions(-)

diff --git a/scripts/taler-monitoring/taler-monitoring.sh b/scripts/taler-monitoring/taler-monitoring.sh
index e63c922..8b20e72 100755
--- a/scripts/taler-monitoring/taler-monitoring.sh
+++ b/scripts/taler-monitoring/taler-monitoring.sh
@@ -21,13 +21,16 @@ Usage:
 
 Phases:
   urls     public HTTPS (no SSH)          ← default with --domain
+           (includes merchant /webui/ SPA fingerprints: version.txt, overlay, assets)
   inside   container status via SSH       (local stack only)
   versions taler packages vs deb.taler.net trixie + repo availability
   sanity   public + optional server
   server   server-side only (SSH)
   e2e      withdraw + pay (small amounts; remote aborts on login/KYC)
   ladder   withdraw/pay amount ladder (GOA ceiling or stage TESTPAYSAN max_wire)
+  auth401  merchant Basic-auth / case matrix (HTTP 401 paths; may create throwaway instance)
   all      urls + inside + versions + sanity + e2e  (SSH phases only on koopa)
+  full     all + server + ladder + auth401  (maximum; long-running, needs secrets)
 
 Options:
   -d, --domain DOMAIN   load profile from domains.conf (bank/exchange/merchant)
@@ -63,6 +66,23 @@ Env (same meaning):
   QR_ECC=M      qrencode ECC level (default M)
   KOOPA_SSH  KOOPA_SSH_FALLBACKS   (default koopa → koopa-external)
   METRICS_LOAD=0   skip host/container RAM/CPU probes (e2e/ladder/inside)
+  EXPECT_WEBUI_VERSION=1.6.11   pin merchant /webui/version.txt (urls)
+  EXPECT_WEBUI_OVERLAY=selfbuild  require substr in version-overlay.txt
+  WEBUI_OVERLAY_DENY='master-11340'  fail if overlay matches regex
+  CHECK_WEBUI_SPA=0             skip SPA fingerprint block in urls
+  AUTH401_*                     see check_auth401.sh / secrets.env.example
+  AUTH401_CONTINUE=1 / CONTINUE_ON_ERROR=1
+                        auth401: run all groups, collect every ERROR (no mid-run halt)
+
+Full load (GOA / hacktivism):
+  ./taler-monitoring.sh -d hacktivism.ch full
+  # or explicit:
+  ./taler-monitoring.sh -d hacktivism.ch urls inside versions sanity server e2e ladder auth401
+
+SPA pin after selfbuild:
+  EXPECT_WEBUI_VERSION=1.6.11 EXPECT_WEBUI_OVERLAY=selfbuild-v1.6.11 \\
+    WEBUI_OVERLAY_DENY='c778af04|master-11340' \\
+    ./taler-monitoring.sh -d hacktivism.ch urls
 EOF
 }
 
@@ -110,7 +130,7 @@ while [ $# -gt 0 ]; do
       CURRENCY_OVERRIDE="$2"; shift 2
       ;;
     --no-probe) NO_PROBE=1; shift ;;
-    urls|inside|versions|sanity|server|e2e|ladder|goa-ladder|all) PHASES+=("$1"); shift ;;
+    urls|inside|versions|sanity|server|e2e|ladder|goa-ladder|auth401|all|full) PHASES+=("$1"); shift ;;
     *)
       # bare domain shorthand: ./taler-monitoring.sh taler.net
       if [[ "$1" == *.* && "$1" != *://* && "$1" != -* ]]; then
@@ -183,6 +203,9 @@ export LADDER_MAX_AMOUNT LADDER_INCLUDE_ZERO LADDER_INCLUDE_MAX
 export LADDER_HIGH_FROM LADDER_HIGH_RUNGS LADDER_LOAD
 export LADDER_PAY LADDER_WITHDRAW_SCALE LADDER_PAY_SETTLE_ROUNDS
 export TALER_DOMAIN_APPLIED=1
+# Optional: auth401 and other phases may honor CONTINUE_ON_ERROR
+export CONTINUE_ON_ERROR="${CONTINUE_ON_ERROR:-}"
+export AUTH401_CONTINUE="${AUTH401_CONTINUE:-${CONTINUE_ON_ERROR:-}}"
 
 # Default phases
 # - local GOA (koopa): urls + inside + versions + e2e
@@ -212,6 +235,15 @@ for p in "${PHASES[@]}"; do
       # remote without inside SSH: public + optional e2e
       OUT_PHASES+=(urls versions e2e)
     fi
+  elif [ "$p" = "full" ]; then
+    # Maximum coverage. Long. Needs secrets for e2e/ladder/auth401.
+    if [ "${LOCAL_STACK}" = "1" ]; then
+      OUT_PHASES+=(urls inside versions sanity server e2e ladder auth401)
+    elif [ -n "${INSIDE_SSH:-}" ] || [ "${INSIDE_PROFILE:-}" = "stage-lfp" ]; then
+      OUT_PHASES+=(urls inside versions e2e ladder auth401)
+    else
+      OUT_PHASES+=(urls versions e2e auth401)
+    fi
   else
     OUT_PHASES+=("$p")
   fi
@@ -247,7 +279,7 @@ if [ "${PROGRESS_TOTAL:-0}" = "0" ] || [ -z "${PROGRESS_TOTAL:-}" ]; then
   _pt=0
   for p in "${PHASES[@]}"; do
     case "$p" in
-      urls)     _pt=$((_pt + 85)) ;;   # +qr group
+      urls)     _pt=$((_pt + 95)) ;;   # +qr + webui SPA fingerprints
       inside)   _pt=$((_pt + 30)) ;;
       versions) _pt=$((_pt + 25)) ;;
       sanity)   _pt=$((_pt + 35)) ;;
@@ -255,6 +287,7 @@ if [ "${PROGRESS_TOTAL:-0}" = "0" ] || [ -z "${PROGRESS_TOTAL:-}" ]; then
       # e2e: ATM ladder emits many INFO lines (coins before/after each note)
       e2e)      _pt=$((_pt + 240)) ;;
       ladder|goa-ladder) _pt=$((_pt + 120)) ;;
+      auth401)  _pt=$((_pt + 70)) ;;
     esac
   done
   set_progress_total "$_pt"
@@ -266,6 +299,7 @@ printf '  bank     %s\n' "$BANK_PUBLIC"
 printf '  exchange %s\n' "$EXCHANGE_PUBLIC"
 printf '  merchant %s\n' "$MERCHANT_PUBLIC"
 printf '  currency expect=%s  skip_ssh=%s\n' "${EXPECT_CURRENCY:-any}" "$SKIP_SSH"
+printf '  phases   %s\n' "${PHASES[*]}"
 printf '  progress total≈%s (set PROGRESS_TOTAL= to override; PROGRESS_OFF=1 to hide)\n' "${PROGRESS_TOTAL:-0}"
 
 chmod +x "$ROOT"/check_*.sh 2>/dev/null || true
@@ -280,6 +314,7 @@ for p in "${PHASES[@]}"; do
     server)   "$ROOT/check_server.sh"   || ec=1 ;;
     e2e)      "$ROOT/check_e2e.sh"      || ec=1 ;;
     ladder|goa-ladder) "$ROOT/check_goa_ladder.sh" || ec=1 ;;
+    auth401)  "$ROOT/check_auth401.sh"  || ec=1 ;;
   esac
 done
 exit "$ec"