feat/Update_Controllers_to_Allow_for_Premium_Membership

deploy/deploy.sh

@@ -67,7 +67,7 @@ export APP_BUILD_STAMP="${APP_BUILD_STAMP:-unknown}"
 export DEPLOY_BUILD_AI_SERVICE="${DEPLOY_BUILD_AI_SERVICE:-false}"
 
 compose() {
-  docker compose "$@"
+  docker compose -f docker-compose.yml "$@"
 }
 
 # ---------------------------------------------------------------------------
@@ -92,7 +92,8 @@ require_var() {
 }
 
 validate_deploy_config() {
-  local failed=0
+  local failed=0 octet subnet_address microsoft_tenant
+  local -a subnet_octets=()
 
   # Deliberately no default. Guessing this wrong means backing up the wrong
   # database and reporting success — the exact failure this block exists to stop.
@@ -125,8 +126,42 @@ validate_deploy_config() {
   require_var AUTH_JWT_KEY \
     "JWT signing key. With Auth__Require=true the backend refuses to start without it." || failed=1
 
-  if [ -z "${APP_PUBLIC_BASE_URL:-}" ]; then
-    echo "Note: APP_PUBLIC_BASE_URL is not set — the post-deploy public smoke check will be skipped."
+  if [ -n "${AUTH_MICROSOFT_CLIENT_ID:-}" ]; then
+    require_var AUTH_MICROSOFT_TENANT \
+      "Microsoft sign-in tenant policy: tenant GUID, organizations, consumers, or common." || failed=1
+    microsoft_tenant="$(printf '%s' "${AUTH_MICROSOFT_TENANT:-}" | tr '[:upper:]' '[:lower:]')"
+    if [ -n "$microsoft_tenant" ] \
+      && [[ "$microsoft_tenant" != "common" ]] \
+      && [[ "$microsoft_tenant" != "organizations" ]] \
+      && [[ "$microsoft_tenant" != "consumers" ]] \
+      && [[ ! "$microsoft_tenant" =~ ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ ]]; then
+      echo "AUTH_MICROSOFT_TENANT is invalid."
+      failed=1
+    fi
+  fi
+
+  require_var APP_PUBLIC_BASE_URL \
+    "Canonical public HTTPS origin, for example https://jobs.example.com." || failed=1
+  if [ -n "${APP_PUBLIC_BASE_URL:-}" ] && [[ ! "$APP_PUBLIC_BASE_URL" =~ ^https://[A-Za-z0-9.-]+(:[0-9]+)?/?$ ]]; then
+    echo "APP_PUBLIC_BASE_URL must be one HTTPS origin without credentials, a path, query, or fragment."
+    failed=1
+  fi
+
+  require_var WEB_PROXY_SUBNET \
+    "Dedicated nginx-to-backend CIDR, for example 172.31.250.0/29; check it does not overlap another Docker network." || failed=1
+  if [ -n "${WEB_PROXY_SUBNET:-}" ] && [[ ! "$WEB_PROXY_SUBNET" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]|[12][0-9]|3[0-2])$ ]]; then
+    echo "WEB_PROXY_SUBNET must be an IPv4 CIDR."
+    failed=1
+  elif [ -n "${WEB_PROXY_SUBNET:-}" ]; then
+    subnet_address="${WEB_PROXY_SUBNET%/*}"
+    IFS='.' read -r -a subnet_octets <<< "$subnet_address"
+    for octet in "${subnet_octets[@]}"; do
+      if ((10#$octet > 255)); then
+        echo "WEB_PROXY_SUBNET contains an invalid IPv4 octet."
+        failed=1
+        break
+      fi
+    done
   fi
 
   if [ "$failed" -ne 0 ]; then
@@ -418,44 +453,42 @@ if [ "$ai_status" != "running" ]; then
   compose logs --tail=200 ai-service || true
 fi
 
-if [ -n "${APP_PUBLIC_BASE_URL:-}" ]; then
-  public_base="${APP_PUBLIC_BASE_URL%/}"
-  auth_config_body_file="$(mktemp)"
-  auth_config_headers_file="$(mktemp)"
-  cleanup_public_check() {
-    rm -f "$auth_config_body_file" "$auth_config_headers_file"
-  }
-  trap cleanup_public_check EXIT
+public_base="${APP_PUBLIC_BASE_URL%/}"
+auth_config_body_file="$(mktemp)"
+auth_config_headers_file="$(mktemp)"
+cleanup_public_check() {
+  rm -f "$auth_config_body_file" "$auth_config_headers_file"
+}
+trap cleanup_public_check EXIT
 
-  echo "Running public smoke check against ${public_base}"
-  if ! curl -fsS "${public_base}/" >/dev/null; then
-    echo "Public frontend check failed for ${public_base}/"
-    exit 1
-  fi
-
-  if ! curl -fsS -D "$auth_config_headers_file" -o "$auth_config_body_file" "${public_base}/api/auth/config"; then
-    echo "Public API smoke check failed for ${public_base}/api/auth/config"
-    exit 1
-  fi
-
-  content_type="$(awk 'BEGIN{IGNORECASE=1} /^content-type:/ {print $2}' "$auth_config_headers_file" | tr -d '\r' | tail -n 1)"
-  if [[ "$content_type" != application/json* ]]; then
-    echo "Public API smoke check returned unexpected content type: ${content_type:-missing}"
-    echo "First bytes of response:"
-    head -c 200 "$auth_config_body_file" || true
-    exit 1
-  fi
-
-  if ! grep -q 'requireAuth' "$auth_config_body_file"; then
-    echo "Public API smoke check returned JSON without requireAuth."
-    cat "$auth_config_body_file"
-    exit 1
-  fi
-
-  trap - EXIT
-  cleanup_public_check
+echo "Running public smoke check against ${public_base}"
+if ! curl -fsS "${public_base}/" >/dev/null; then
+  echo "Public frontend check failed for ${public_base}/"
+  exit 1
 fi
 
+if ! curl -fsS -D "$auth_config_headers_file" -o "$auth_config_body_file" "${public_base}/api/auth/config"; then
+  echo "Public API smoke check failed for ${public_base}/api/auth/config"
+  exit 1
+fi
+
+content_type="$(awk 'BEGIN{IGNORECASE=1} /^content-type:/ {print $2}' "$auth_config_headers_file" | tr -d '\r' | tail -n 1)"
+if [[ "$content_type" != application/json* ]]; then
+  echo "Public API smoke check returned unexpected content type: ${content_type:-missing}"
+  echo "First bytes of response:"
+  head -c 200 "$auth_config_body_file" || true
+  exit 1
+fi
+
+if ! grep -q 'requireAuth' "$auth_config_body_file"; then
+  echo "Public API smoke check returned JSON without requireAuth."
+  cat "$auth_config_body_file"
+  exit 1
+fi
+
+trap - EXIT
+cleanup_public_check
+
 # Clean up old legacy container name if it still exists from pre-rename deployments.
 docker rm -f app-summarizer-1 2>/dev/null || true