a9f8ad56c1
API 核心: - constants.py: 系統常量定義 - unit_of_work.py: Unit of Work 模式 - incident_approval_service.py: Incident-Approval 同步服務 文檔更新: - LOGBOOK.md: 進度更新 - AWOOOI_AGENTIC_WORKSPACE_ROADMAP.md: 路線圖 - 2026-03-26_llm_testing_evaluation.md: LLM 測試評估 - phase5_telemetry_architecture.md: 遙測架構 - SECRETS_REFERENCE.md: 密鑰參考 配置/腳本: - Skill 02 v1.x: leWOOOgo 後端更新 - .dependency-cruiser.cjs: 依賴規則 - demo-multisig-flow.sh: 演示腳本 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
115 lines
3.7 KiB
Bash
Executable File
115 lines
3.7 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# HITL Multi-Sig Demo Flow
|
|
# ========================
|
|
# 展示完整的 CRITICAL 簽核流程
|
|
#
|
|
# 使用方式:
|
|
# 1. 確保 API 和 Web 都已啟動
|
|
# 2. 執行此腳本
|
|
#
|
|
|
|
set -e
|
|
|
|
API_URL="${API_URL:-http://localhost:8000}"
|
|
|
|
echo "=============================================="
|
|
echo " HITL Multi-Sig Demo Flow"
|
|
echo "=============================================="
|
|
echo ""
|
|
echo "API URL: $API_URL"
|
|
echo ""
|
|
|
|
# Step 1: Create a CRITICAL approval
|
|
echo "Step 1: Creating CRITICAL approval..."
|
|
echo ""
|
|
|
|
APPROVAL_RESPONSE=$(curl -s -X POST "$API_URL/api/v1/approvals" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{
|
|
"action": "DROP TABLE user_sessions",
|
|
"description": "清除所有用戶 session 以強制重新登入。此操作將影響所有線上用戶。",
|
|
"risk_level": "critical",
|
|
"blast_radius": {
|
|
"affected_pods": 0,
|
|
"estimated_downtime": "0",
|
|
"related_services": ["auth-service", "api-gateway", "user-service"],
|
|
"data_impact": "destructive"
|
|
},
|
|
"dry_run_checks": [
|
|
{"name": "RBAC Check", "passed": true, "message": "db-admin"},
|
|
{"name": "Syntax Check", "passed": true},
|
|
{"name": "Backup Available", "passed": false, "message": "No recent backup!"}
|
|
],
|
|
"requested_by": "OpenClaw"
|
|
}')
|
|
|
|
APPROVAL_ID=$(echo "$APPROVAL_RESPONSE" | jq -r '.id')
|
|
echo "Created approval: $APPROVAL_ID"
|
|
echo "Status: $(echo "$APPROVAL_RESPONSE" | jq -r '.status')"
|
|
echo "Required signatures: $(echo "$APPROVAL_RESPONSE" | jq -r '.required_signatures')"
|
|
echo "Current signatures: $(echo "$APPROVAL_RESPONSE" | jq -r '.current_signatures')"
|
|
echo ""
|
|
|
|
# Step 2: First signature
|
|
echo "Step 2: First signer (Alice CTO) signs..."
|
|
echo ""
|
|
|
|
SIGN1_RESPONSE=$(curl -s -X POST "$API_URL/api/v1/approvals/$APPROVAL_ID/sign" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{
|
|
"signer_id": "alice-001",
|
|
"signer_name": "Alice Chen (CTO)",
|
|
"comment": "已確認風險，建議在低流量時段執行"
|
|
}')
|
|
|
|
echo "Sign result: $(echo "$SIGN1_RESPONSE" | jq -r '.message')"
|
|
echo "Status: $(echo "$SIGN1_RESPONSE" | jq -r '.approval.status')"
|
|
echo "Signatures: $(echo "$SIGN1_RESPONSE" | jq -r '.approval.current_signatures')/$(echo "$SIGN1_RESPONSE" | jq -r '.approval.required_signatures')"
|
|
echo "Execution triggered: $(echo "$SIGN1_RESPONSE" | jq -r '.execution_triggered')"
|
|
echo ""
|
|
|
|
# Step 3: Check pending
|
|
echo "Step 3: Check pending approvals..."
|
|
echo ""
|
|
|
|
PENDING_RESPONSE=$(curl -s "$API_URL/api/v1/approvals/pending")
|
|
echo "Pending count: $(echo "$PENDING_RESPONSE" | jq -r '.count')"
|
|
echo ""
|
|
|
|
# Step 4: Second signature
|
|
echo "Step 4: Second signer (Bob CISO) signs..."
|
|
echo ""
|
|
|
|
SIGN2_RESPONSE=$(curl -s -X POST "$API_URL/api/v1/approvals/$APPROVAL_ID/sign" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{
|
|
"signer_id": "bob-002",
|
|
"signer_name": "Bob Wu (CISO)",
|
|
"comment": "CISO 核准。已通知 DBA 團隊待命。"
|
|
}')
|
|
|
|
echo "Sign result: $(echo "$SIGN2_RESPONSE" | jq -r '.message')"
|
|
echo "Status: $(echo "$SIGN2_RESPONSE" | jq -r '.approval.status')"
|
|
echo "Signatures: $(echo "$SIGN2_RESPONSE" | jq -r '.approval.current_signatures')/$(echo "$SIGN2_RESPONSE" | jq -r '.approval.required_signatures')"
|
|
echo "Execution triggered: $(echo "$SIGN2_RESPONSE" | jq -r '.execution_triggered')"
|
|
echo ""
|
|
|
|
# Step 5: Final check
|
|
echo "Step 5: Final check - pending approvals..."
|
|
echo ""
|
|
|
|
FINAL_PENDING=$(curl -s "$API_URL/api/v1/approvals/pending")
|
|
echo "Pending count: $(echo "$FINAL_PENDING" | jq -r '.count')"
|
|
echo ""
|
|
|
|
echo "=============================================="
|
|
echo " Multi-Sig Demo Complete!"
|
|
echo "=============================================="
|
|
echo ""
|
|
echo "✅ CRITICAL approval created"
|
|
echo "✅ First signature (1/2) - still PENDING"
|
|
echo "✅ Second signature (2/2) - APPROVED"
|
|
echo "✅ Execution triggered"
|
|
echo ""
|