mbs-panel/.github/workflows/ci.yml

name: CI

on:
  push:
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: pip install -r requirements.txt

      - name: Compile check all Python files
        run: python -m compileall -q .

      - name: Shell syntax check
        run: |
          bash -n install.sh
          bash -n mbs

      - name: Smoke test install-script rendering
        env:
          BOT_TOKEN: "x"
          BOT_USERNAME: "x"
          ADMIN_IDS: "1"
          ADMIN_PANEL_PASSWORD: "ci-test-password-not-real"
          PANEL_DOMAIN: "panel.test"
          SUB_DOMAIN: "sub.test"
          SITE_DOMAIN: "test"
          XRAY_PUBLIC_KEY: "x"
          XRAY_SHORT_ID_TCP: "x"
          XRAY_SHORT_ID_GRPC: "x"
          XRAY_SHORT_ID_XHTTP: "x"
        run: |
          python - << 'PYEOF'
          import json
          import nodeprov

          transports = nodeprov.build_transports("fi2.example.com", 443, "www.microsoft.com", "PUBKEY", include_ws=True)
          node = {
              "provision_token": "TESTTOKEN",
              "address": "fi2.example.com",
              "sni": "www.microsoft.com",
              "private_key": "PRIVKEY",
              "transports_json": json.dumps(transports),
              "hysteria_enabled": 1,
              "hysteria_port": 443,
              "hysteria_password": "hypass",
              "hysteria_obfs_password": "obfspass",
          }
          script = nodeprov.render_install_script(node)
          assert "PRIVKEY" in script
          assert len(script) > 500
          print("node install script rendered OK,", len(script), "bytes")
          PYEOF

      - name: Smoke test app wiring + payments + HWID logic
        env:
          BOT_TOKEN: "123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
          BOT_USERNAME: "x"
          ADMIN_IDS: "1"
          ADMIN_PANEL_PASSWORD: "ci-test-password-not-real"
          PANEL_DOMAIN: "panel.test"
          SUB_DOMAIN: "sub.test"
          SITE_DOMAIN: "test"
          XRAY_PUBLIC_KEY: "x"
          XRAY_SHORT_ID_TCP: "x"
          XRAY_SHORT_ID_GRPC: "x"
          XRAY_SHORT_ID_XHTTP: "x"
          PAYMENTS_ENABLED: "true"
          YOOKASSA_ENABLED: "true"
          YOOKASSA_SHOP_ID: "123"
          YOOKASSA_SECRET_KEY: "xxx"
          PLATEGA_ENABLED: "true"
          PLATEGA_MERCHANT_ID: "abc"
          PLATEGA_SECRET: "yyy"
          HWID_LIMIT_ENABLED: "true"
        run: |
          python - << 'PYEOF'
          import hashlib
          import hmac

          import api
          import bot
          import payments
          import db

          assert set(payments.available_providers()) == {"yookassa", "platega"}

          good_sig = hmac.new(b"yyy", b'{"a":1}', hashlib.sha256).hexdigest()
          assert payments.verify_platega_signature(b'{"a":1}', good_sig)
          assert not payments.verify_platega_signature(b'{"a":1}', "wrong")

          db.init_db()
          db.create_payment("pid1", 1, "de1", "1m", "yookassa", 399)
          assert db.mark_payment_paid("pid1")["status"] == "paid"
          assert db.mark_payment_paid("pid1") is None

          db.get_or_create_user(1, "tester")
          db.add_device(1, "hwid-aaaaaaaaaa", "android", "Pixel", "ua")
          assert db.count_devices(1) == 1
          assert db.get_device(1, "hwid-aaaaaaaaaa") is not None

          print("app wiring + payments + HWID logic OK")
          PYEOF

      - name: Smoke test TOTP, backup/restore, node reorder, multi-admin, rate-limit
        env:
          BOT_TOKEN: "123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
          BOT_USERNAME: "x"
          ADMIN_IDS: "1"
          ADMIN_PANEL_PASSWORD: "ci-test-password-not-real"
          PANEL_DOMAIN: "panel.test"
          SUB_DOMAIN: "sub.test"
          SITE_DOMAIN: "test"
          XRAY_PUBLIC_KEY: "x"
          XRAY_SHORT_ID_TCP: "x"
          XRAY_SHORT_ID_GRPC: "x"
          XRAY_SHORT_ID_XHTTP: "x"
        run: |
          python - << 'PYEOF'
          import base64
          import db
          import totp

          raw_key = b"12345678901234567890"
          secret = base64.b32encode(raw_key).decode("ascii").rstrip("=")
          expected = ["755224","287082","359152","969429","338314","254676","287922","162583","399871","520489"]
          for counter, exp in enumerate(expected):
              assert totp._hotp(secret, counter) == exp, f"RFC 4226 vector failed at counter={counter}"
          print("TOTP: all 10 RFC 4226 test vectors pass")

          db.init_db()

          db.create_node("n1", "Node One", "managed", "1.1.1.1", 443, "pub1", "sid1", "sni1", "xtls-rprx-vision")
          db.create_node("n2", "Node Two", "managed", "2.2.2.2", 443, "pub2", "sid2", "sni2", "xtls-rprx-vision")
          order = [n["code"] for n in db.list_nodes()]
          assert order == ["de1", "n1", "n2"], order
          db.reorder_nodes(["n2", "de1", "n1"])
          assert [n["code"] for n in db.list_nodes()] == ["n2", "de1", "n1"]
          try:
              db.reorder_nodes(["n2", "de1"])
              assert False, "should reject incomplete reorder list"
          except ValueError:
              pass
          print("node reorder OK")

          import backup
          data = backup.create_backup()
          db.create_node("n3", "Node Three", "managed", "3.3.3.3", 443, "pub3", "sid3", "sni3", "xtls-rprx-vision")
          assert len(db.list_nodes()) == 4
          backup.restore_backup(data)
          assert len(db.list_nodes()) == 3, "restore should have reverted the extra node"
          print("backup/restore round-trip OK")

          admin = db.verify_admin_login("admin", "ci-test-password-not-real")
          assert admin is not None
          second = db.create_admin("second", "another-strong-password")
          assert len(db.list_admins()) == 2
          try:
              db.delete_admin(admin["id"])
              db.delete_admin(second["id"])
              assert False, "should refuse deleting the last admin"
          except ValueError:
              pass
          print("multi-admin OK")

          ip = "203.0.113.9"
          for _ in range(10):
              db.record_login_attempt(ip, "password")
          assert db.count_recent_login_attempts(ip, "password", minutes=15) >= 10
          db.clear_login_attempts(ip, "password")
          assert db.count_recent_login_attempts(ip, "password", minutes=15) == 0
          print("rate-limit counters OK")

          print("all v1.1.0 feature smoke tests passed")
          PYEOF

      - name: Smoke test live settings (.env-backed plans/toggles/HWID/credentials, no restart)
        env:
          BOT_TOKEN: "123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
          BOT_USERNAME: "x"
          ADMIN_IDS: "1"
          ADMIN_PANEL_PASSWORD: "ci-test-password-not-real"
          PANEL_DOMAIN: "panel.test"
          SUB_DOMAIN: "sub.test"
          SITE_DOMAIN: "test"
          XRAY_PUBLIC_KEY: "x"
          XRAY_SHORT_ID_TCP: "x"
          XRAY_SHORT_ID_GRPC: "x"
          XRAY_SHORT_ID_XHTTP: "x"
        run: |
          python - << 'PYEOF'
          import hashlib
          import hmac

          with open(".env", "a", encoding="utf-8") as f:
              f.write("PLATEGA_SECRET=old_secret\n")
              f.write("PLATEGA_ENABLED=true\n")
              f.write("PLATEGA_MERCHANT_ID=m1\n")

          import legal
          import settings
          import payments

          plans = settings.get_plans_by_code()
          assert plans["1m"]["price"] > 0, "default price should come from config before any .env override"

          settings.set_plan_prices({"1m": 4242})
          assert settings.get_plans_by_code()["1m"]["price"] == 4242, "price edit should apply live, no reimport"
          assert settings.get_plans_by_code()["7d"]["price"] != 4242, "unrelated plan must stay untouched"

          assert settings.get_hwid_settings()["enabled"] is False
          legal.update_env_var("HWID_LIMIT_ENABLED", "true")
          legal.update_env_var("HWID_FALLBACK_LIMIT", "9")
          hwid = settings.get_hwid_settings()
          assert hwid["enabled"] is True and hwid["fallback_limit"] == 9, "HWID settings should apply live"

          body = b'{"transactionId":"t1","status":"CONFIRMED"}'
          sig_old = hmac.new(b"old_secret", body, hashlib.sha256).hexdigest()
          assert payments.verify_platega_signature(body, sig_old), "signature must verify against the current secret"

          legal.update_env_var("PLATEGA_SECRET", "rotated_secret")
          assert not payments.verify_platega_signature(body, sig_old), "OLD signature must be rejected right after rotation, same process, no restart"
          sig_new = hmac.new(b"rotated_secret", body, hashlib.sha256).hexdigest()
          assert payments.verify_platega_signature(body, sig_new), "NEW signature must verify immediately after rotation, same process, no restart"

          for _ in range(5):
              legal.update_env_var("HWID_FALLBACK_LIMIT", "9")
          with open(".env", encoding="utf-8") as f:
              lines = [l for l in f.readlines() if l.startswith("HWID_FALLBACK_LIMIT=")]
          assert len(lines) == 1, "repeated writes to the same key must not duplicate .env lines"

          print("live settings: prices/HWID/credential-rotation all apply with zero reimport OK")
          PYEOF