adr-sml/scripts/deploy-local.sh

#!/usr/bin/env bash
#
# Local deploy — the fallback while Gitea Actions is unavailable.
#
# Gitea Actions needs `[actions] ENABLED = true` in app.ini and a registered
# act_runner. The instance is jointly administered, so both depend on a second
# administrator (AGENTS.md Q23). Until that lands, this script is how the site
# ships.
#
# It matches .gitea/workflows/deploy.yml on everything that determines what gets
# published: the same guard coverage, `npm run check` before the build,
# `npm run check:claims` after it, the same three sync passes in the same order
# with the same cache headers, and the same invalidation. Any change to one must
# be made to the other.
#
# Two deliberate differences: it does not run `npm ci` (your node_modules is
# already installed, and CI starts empty), and it refuses to run as user/pouya,
# which CI cannot do because CI has no such credential.
#
# Required environment (values are in AGENTS.md §7 — deliberately not restated
# here; §7 is the single source of truth for operational facts):
#
#   AWS_REGION  S3_BUCKET  CLOUDFRONT_DISTRIBUTION_ID
#
# ⚠️ INTAKE_ENDPOINT IS NO LONGER ONE OF THEM, AND THE GUARD THAT DEMANDED IT
# WAS BLOCKING A DEPLOY ON A VALUE NOTHING READ. Build step 8 moved the intake
# form to the same-origin path /api/intake (see src/data/intake.ts for the four
# reasons). After that, `git grep PUBLIC_INTAKE_ENDPOINT -- src/` returned
# nothing — the value exported into the build below was consumed by no page —
# and the guard's own message was false in both directions: the form posts to
# /api/intake whatever that variable holds, and the thing that actually decides
# whether it works, the CloudFront /api/* behaviour, was guarded nowhere.
#
# So the guard now checks the thing that matters, after the deploy, at the
# bottom of this script. Found by `adversarial-reviewer`, 2026-08-31.
# PUBLIC_BOOKING_URL went with it: `CONTACT.bookingUrl` is `null` in source while
# R6 keeps booking parked, and nothing read that variable either.
#
# Credentials: use the scoped deploy user, `adr-sml-deploy`. AGENTS.md §7 records
# it as PROVISIONED, with one inline policy verified by nine
# simulate-principal-policy checks; Q22 closed on execution 2026-08-28.
# (This comment said it "does NOT yet exist" for three days after it did —
# found by `adversarial-reviewer` round 2.)
# NEVER run this as user/pouya — see AGENTS.md §10.

set -euo pipefail

# Same five values the workflow guards. Emptiness only — no value is echoed.
missing=''
[ -n "${AWS_REGION:-}" ]                 || missing="$missing AWS_REGION"
[ -n "${S3_BUCKET:-}" ]                  || missing="$missing S3_BUCKET"
[ -n "${CLOUDFRONT_DISTRIBUTION_ID:-}" ] || missing="$missing CLOUDFRONT_DISTRIBUTION_ID"
[ -n "${AWS_ACCESS_KEY_ID:-}" ]          || missing="$missing AWS_ACCESS_KEY_ID"
[ -n "${AWS_SECRET_ACCESS_KEY:-}" ]      || missing="$missing AWS_SECRET_ACCESS_KEY"
if [ -n "$missing" ]; then
  echo "Not set:$missing" >&2
  echo >&2
  echo "Values are in AGENTS.md §7." >&2
  exit 1
fi

export AWS_DEFAULT_REGION="$AWS_REGION"

echo "==> Identity check"
caller=$(aws sts get-caller-identity --query Arn --output text)
echo "    $caller"
case "$caller" in
  *:user/pouya)
    echo >&2
    echo "REFUSING: that is the broadly-permissioned personal user." >&2
    echo "AGENTS.md §10 — never use user/pouya to deploy. Use the scoped" >&2
    echo "deploy user, adr-sml-deploy — PROVISIONED, AGENTS.md §7." >&2
    exit 1
    ;;
esac

echo "==> Type and template check"
npm run check

echo "==> Build"
# Only PUBLIC_SITE_URL, because it is the only one astro.config.mjs reads.
# PUBLIC_INTAKE_ENDPOINT and PUBLIC_BOOKING_URL were exported here and consumed
# by nothing — see the header.
PUBLIC_SITE_URL="https://adr.smlcompany.ca" \
  npm run build

# AFTER the build and BEFORE anything is uploaded. AGENTS.md §4 Forbidden,
# enforced mechanically on the output rather than by a reviewer reading it.
# Pouya's ruling 2026-08-29: "prose in a comment does not govern the writing
# that follows it." It also refuses to run against a stale or empty dist, so a
# pass here is a pass on the bytes about to be published.
echo "==> Claim check"
npm run check:claims

echo "==> Pass 1/3 — hashed assets and fonts (immutable)"
aws s3 sync ./dist "s3://${S3_BUCKET}" \
  --exclude "*" \
  --include "_astro/*" --include "fonts/*" \
  --cache-control "public, max-age=31536000, immutable" \
  --no-progress

echo "==> Pass 2/3 — images"
aws s3 sync ./dist "s3://${S3_BUCKET}" \
  --exclude "*" \
  --include "*.avif" --include "*.webp" --include "*.jpg" \
  --include "*.png" --include "*.svg" \
  --cache-control "public, max-age=604800" \
  --no-progress

echo "==> Pass 3/3 — HTML and the rest (must-revalidate, --delete)"
aws s3 sync ./dist "s3://${S3_BUCKET}" \
  --exclude "_astro/*" --exclude "fonts/*" \
  --cache-control "public, max-age=0, must-revalidate" \
  --delete --no-progress

echo "==> Invalidate CloudFront"
aws cloudfront create-invalidation \
  --distribution-id "${CLOUDFRONT_DISTRIBUTION_ID}" \
  --paths "/*" >/dev/null

# THE CHECK THAT REPLACES THE INTAKE_ENDPOINT GUARD, and it runs AFTER the
# deploy because it tests the deployed thing rather than a variable.
#
# The intake form posts to the same-origin path /api/intake, which only works if
# a CloudFront behaviour routes /api/* to the HTTP API origin AGENTS.md §7
# records. Nothing in the build can know whether that behaviour exists, and a
# deploy that succeeds while the form posts into a 404 is the failure the old
# guard was reaching for and could not see.
#
# ⚠️ IT ASSERTS A POSITIVE, AND THE FIRST VERSION ASSERTED THE ABSENCE OF ONE
# CODE. That version was `code=$(curl ... || echo 000)` and passed on anything
# that was not literally 404. Two defects, both measured by
# `adversarial-reviewer` round 2:
#
#   - `curl -w '%{http_code}'` ALREADY prints 000 on a failed transfer, so
#     `|| echo 000` double-appended and $code became `000000` — the 000 arm was
#     unreachable and a connection failure reported success.
#   - If the /api/* behaviour is MISSING, the POST falls through to the S3
#     default behaviour and CloudFront answers 403 for a disallowed method —
#     indistinguishable from the handler's Origin refusal, which is the one
#     distinction the check exists to draw. It also passed on a real 501.
#
# So it now sends the correct Origin and asserts the answer it should get:
# the handler validates, finds an empty submission, and redirects 303 to
# /contact/could-not-send/. That happens BEFORE any DynamoDB write and before
# any email, which is what makes the probe safe against production.
echo "==> Intake route check"
code=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
  --max-time 15 \
  -H "Origin: https://adr.smlcompany.ca" \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'deploy-route-probe=1' \
  "https://adr.smlcompany.ca/api/intake")
rc=$?
location=$(curl -sS -o /dev/null -w '%{redirect_url}' -X POST \
  --max-time 15 \
  -H "Origin: https://adr.smlcompany.ca" \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'deploy-route-probe=1' \
  "https://adr.smlcompany.ca/api/intake" || true)
if [ "$rc" -ne 0 ]; then
  echo >&2
  echo "WARNING: the POST to /api/intake did not complete (curl exit $rc)." >&2
  echo "The contact form posts there. The site is deployed and the form is" >&2
  echo "unverified — see docs/06-deployment.md's cutover checklist." >&2
elif [ "$code" = "303" ] && case "$location" in *"/contact/could-not-send/") true;; *) false;; esac; then
  echo "    POST /api/intake -> 303 -> $location (routed, validating, rejecting an empty probe)"
else
  echo >&2
  echo "WARNING: POST /api/intake returned $code (expected 303 to" >&2
  echo "/contact/could-not-send/); redirect was '${location:-none}'." >&2
  # 404 IS AMBIGUOUS BETWEEN THREE CAUSES and the distribution's custom error
  # response hides the one string that would separate them: API Gateway's
  # {"message":"Not Found"} is replaced by /404.html, because custom error
  # responses are distribution-wide. So name the causes and the one command that
  # tells them apart. Corrected 2026-09-01 by `adversarial-reviewer`; the earlier
  # text named only the CloudFront behaviour.
  echo "404 means one of three things, and \`aws apigatewayv2 get-routes" >&2
  echo "--api-id <id> --query 'Items[].RouteKey'\` separates them in one call:" >&2
  echo "  - the CloudFront /api/* behaviour is missing (docs/09 Part 3);" >&2
  echo "  - the POST /api/intake route is missing or misspelled (Part 6.2);" >&2
  echo "  - the route exists and the distribution's 404 mapping is showing you" >&2
  echo "    /404.html instead of the API's own body." >&2
  # THE ORIGIN REQUEST POLICY ON /api/* IS NO LONGER A CONSTANT. Since
  # 2026-09-04 the behaviour may carry the custom `adr-sml-api-viewer-address`
  # whitelist (docs/09 Part 3, change 8) instead of the managed policy, so this
  # text no longer names one and tells the operator to read it. Naming the old
  # one would send them to "restore" what was deliberately replaced.
  echo "403 means CloudFront rejected the method, or the handler refused the" >&2
  echo "Origin. Read which origin request policy /api/* carries — since" >&2
  echo "2026-09-04 it may be the custom whitelist adr-sml-api-viewer-address" >&2
  echo "rather than Managed-AllViewerExceptHostHeader — because a policy that" >&2
  echo "drops or fails to forward Origin turns every real submission into a" >&2
  echo "403. Rollback id: b689b0a8-53d0-40ab-baf2-68738e2966ac." >&2
  echo "500 means the Lambda invoke permission for this route is missing" >&2
  echo "(Part 6.1) — the function is never entered, so CloudWatch is silent." >&2
  echo "Either way the form is not verified working. See docs/09-cutover-" >&2
  echo "runbook.md Part 7.1 and docs/06's cutover checklist." >&2
fi

echo "==> Deployed to https://adr.smlcompany.ca ($(git rev-parse --short HEAD))"