initial

skeleton/scripts/demo_curl.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# End-to-end curl cookbook — SPEC appendix A.
+# Usage:
+#   export BASE=https://s.f0xx.org
+#   export BEARER=your-trusted-token
+#   export SIGNER=optional-for-ttl0
+#   ./scripts/demo_curl.sh
+set -euo pipefail
+
+BASE="${BASE:-https://s.f0xx.org}"
+BEARER="${BEARER:?set BEARER to a trusted API token}"
+SIGNER="${SIGNER:-}"
+TARGET="${TARGET:-https://defender.net/very/long/link?demo=1}"
+TTL="${TTL:-3600}"
+
+echo "==> 1) Health"
+curl -fsS "$BASE/api/v1/health" | head -c 200
+echo
+
+echo "==> 2) Shorten (POST preferred)"
+SHORT_JSON="$(curl -fsS -X POST "$BASE/api/v1/shorten" \
+  -H 'Content-Type: application/json' \
+  -d "$(jq -nc --arg url "$TARGET" --arg bearer "$BEARER" --argjson ttl "$TTL" \
+    '{url:$url,bearer:$bearer,ttl:$ttl}')")"
+echo "$SHORT_JSON" | jq .
+
+SHORT="$(echo "$SHORT_JSON" | jq -r '.u // empty')"
+if [[ -z "$SHORT" ]]; then
+  echo "shorten failed (no .u in response)" >&2
+  exit 1
+fi
+SLUG="${SHORT##*/}"
+
+echo "==> 3) Shorten cache hit (same bearer + url)"
+curl -fsS -X POST "$BASE/api/v1/shorten" \
+  -H 'Content-Type: application/json' \
+  -d "$(jq -nc --arg url "$TARGET" --arg bearer "$BEARER" --argjson ttl "$TTL" \
+    '{url:$url,bearer:$bearer,ttl:$ttl}')" | jq .
+
+echo "==> 4) Redirect (HEAD — no body)"
+curl -sSI "$SHORT" | grep -E '^(HTTP|Location:)'
+
+echo "==> 5) QR PNG"
+curl -fsS -o "/tmp/url-shortener-qr-${SLUG}.png" "$BASE/api/v1/qr/${SLUG}.png?size=256"
+file "/tmp/url-shortener-qr-${SLUG}.png"
+
+if [[ -n "$SIGNER" ]]; then
+  echo "==> 6) Permanent link (ttl=0, signer required)"
+  curl -fsS -X POST "$BASE/api/v1/shorten" \
+    -H 'Content-Type: application/json' \
+    -d "$(jq -nc --arg url "$TARGET&perm=1" --arg bearer "$BEARER" --arg signer "$SIGNER" \
+      '{url:$url,bearer:$bearer,signer:$signer,ttl:0}')" | jq .
+fi
+
+echo "==> Done"

skeleton/scripts/init-mariadb-grants.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+# Grant existing androidcast app user access to url_shortener (after schema import as root).
+# Password is NOT stored here — same as examples/crash_reporter/backend/config/config.php db.mysql.password
+#
+# Usage (on BE):
+#   mysql -u root -p < sql/schema.mariadb.sql
+#   ./scripts/init-mariadb-grants.sh
+set -eu
+
+DB_NAME="${URL_SHORTENER_DB_NAME:-url_shortener}"
+DB_USER="${URL_SHORTENER_DB_USER:-androidcast}"
+
+echo "Granting ${DB_USER}@localhost and @127.0.0.1 on ${DB_NAME}.* ..."
+mysql -u root -p <<EOF
+GRANT SELECT, INSERT, UPDATE, DELETE ON ${DB_NAME}.* TO '${DB_USER}'@'localhost';
+GRANT SELECT, INSERT, UPDATE, DELETE ON ${DB_NAME}.* TO '${DB_USER}'@'127.0.0.1';
+FLUSH PRIVILEGES;
+EOF
+
+echo "Smoke: mysql -u ${DB_USER} -p -h 127.0.0.1 ${DB_NAME} -e 'SHOW TABLES;'"

skeleton/scripts/purge_url_shortener.php

@@ -0,0 +1,15 @@
+#!/usr/bin/env php
+<?php
+declare(strict_types=1);
+
+require_once dirname(__DIR__) . '/src/bootstrap.php';
+
+$pdo = Database::pdo();
+$deletedLinks = $pdo->exec(
+    'DELETE FROM links WHERE expires_at IS NOT NULL AND expires_at < NOW()'
+);
+$deletedAudit = $pdo->exec(
+    'DELETE FROM audit_log WHERE created_at < (NOW() - INTERVAL 90 DAY)'
+);
+
+echo "purge: links=$deletedLinks audit=$deletedAudit\n";

skeleton/scripts/run-php-tests.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# PHP unit-style checks (no phpunit required).
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+php "$ROOT/tests/run_tests.php"

skeleton/scripts/seed_bearer.php

@@ -0,0 +1,26 @@
+#!/usr/bin/env php
+<?php
+declare(strict_types=1);
+
+require_once dirname(__DIR__) . '/src/bootstrap.php';
+
+$label = 'cli-seed';
+$canPermanent = false;
+foreach (array_slice($argv, 1) as $arg) {
+    if ($arg === '--permanent') {
+        $canPermanent = true;
+    } elseif (str_starts_with($arg, '--label=')) {
+        $label = substr($arg, 8);
+    }
+}
+
+$created = BearerRepository::createTrusted($label, true, $canPermanent);
+echo "Bearer token (store securely — shown once):\n";
+echo $created['token'] . "\n";
+echo "bearer_id=" . $created['id'] . " label=" . $label . "\n";
+
+if ($canPermanent) {
+    $signer = SignerRepository::create($label . '-signer');
+    echo "Signer key (for ttl=0):\n";
+    echo $signer['key'] . "\n";
+}

skeleton/scripts/smoke_shorten.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Minimal deploy smoke — exits non-zero on failure.
+set -euo pipefail
+
+BASE="${BASE:-https://s.f0xx.org}"
+BEARER="${BEARER:-}"
+
+echo "==> health $BASE/api/v1/health"
+body="$(curl -fsS "$BASE/api/v1/health")"
+echo "$body" | grep -q '"status":"ok"' || { echo "health not ok: $body"; exit 1; }
+
+if [[ -z "$BEARER" ]]; then
+  echo "SKIP shorten (set BEARER to run full smoke)"
+  exit 0
+fi
+
+echo "==> shorten POST"
+resp="$(curl -fsS -X POST "$BASE/api/v1/shorten" \
+  -H 'Content-Type: application/json' \
+  -d '{"url":"https://example.com/smoke-'"$(date +%s)"'","bearer":"'"$BEARER"'","ttl":300}')"
+echo "$resp"
+short="$(echo "$resp" | sed -n 's/.*"u":"\([^"]*\)".*/\1/p')"
+[[ -n "$short" ]] || { echo "no short url in response"; exit 1; }
+
+echo "==> redirect HEAD"
+curl -fsSI "$short" | grep -qi '^location:' || { echo "missing redirect"; exit 1; }
+
+echo "OK"