This was generated by AI during triage.
Problem
scripts/smoke-test.sh uses one BASE_URL for both public application APIs and internal actuator checks. This produces a misleading failure when a deployment exposes /api/* through the public web ingress but keeps actuator endpoints on the backend service.
Observed in the test environment:
- Direct backend
http://127.0.0.1:8080/actuator/prometheus returns 401, matching RouteSecurityPolicyRegistry, PrometheusSecurityTest, and the smoke expectation.
- Public
https://skill.xf-yun.com.cn/actuator/prometheus returns 200 text/html, because web/nginx.conf.template does not proxy /actuator/* and the SPA fallback serves index.html.
- The same public fallback also returns HTML for
/actuator/health.
This is not evidence that Prometheus metrics are anonymously exposed, but the current smoke output makes it look like a security regression.
Expected behavior
Smoke testing should model the public application URL and the internal actuator URL separately, and must not treat an SPA fallback as an actuator response.
Suggested direction
- Add a separate actuator/backend base URL (or an explicit actuator-skip mode) while preserving the 401 assertion against the real backend endpoint.
- Validate response content type/body for health and Prometheus checks so
200 text/html cannot be accepted as actuator health.
- Document the intended command for Compose, staging, and ingress deployments.
- Keep
/actuator/prometheus protected for anonymous backend requests.
Acceptance criteria
- Public API smoke checks can run against a web ingress that does not expose actuator routes.
- Actuator checks can target the backend service independently.
- Anonymous access to the actual Prometheus endpoint is still asserted as
401.
- SPA fallback responses are reported as routing/target errors, not successful actuator responses.
- Script-level tests cover split public/backend URLs.
Problem
scripts/smoke-test.shuses oneBASE_URLfor both public application APIs and internal actuator checks. This produces a misleading failure when a deployment exposes/api/*through the public web ingress but keeps actuator endpoints on the backend service.Observed in the test environment:
http://127.0.0.1:8080/actuator/prometheusreturns401, matchingRouteSecurityPolicyRegistry,PrometheusSecurityTest, and the smoke expectation.https://skill.xf-yun.com.cn/actuator/prometheusreturns200 text/html, becauseweb/nginx.conf.templatedoes not proxy/actuator/*and the SPA fallback servesindex.html./actuator/health.This is not evidence that Prometheus metrics are anonymously exposed, but the current smoke output makes it look like a security regression.
Expected behavior
Smoke testing should model the public application URL and the internal actuator URL separately, and must not treat an SPA fallback as an actuator response.
Suggested direction
200 text/htmlcannot be accepted as actuator health./actuator/prometheusprotected for anonymous backend requests.Acceptance criteria
401.