fix(auth): add host retry flow for discord scrape

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

scripts/setup-cron.sh

@@ -6,6 +6,7 @@ SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
 REPO_ROOT="${DCE_REPO_ROOT:-$(cd "$SCRIPT_DIR/.." && pwd -P)}"
 COMPOSE_FILE="${DCE_COMPOSE_FILE:-$REPO_ROOT/docker-compose.yml}"
 ENV_FILE="${DCE_ENV_FILE:-$REPO_ROOT/scrape.env}"
+HOST_RUNNER="${DCE_HOST_RUNNER:-$REPO_ROOT/scripts/run-discord-scrape-host.sh}"
 CONFIG_FILE="${DCE_CONFIG_FILE:-$REPO_ROOT/config/scrape-targets.json}"
 LOG_FILE="${DCE_LOG_FILE:-$REPO_ROOT/logs/discord-scrape.log}"
 JOB_NAME="discord-scrape"
@@ -96,46 +97,9 @@ strip_existing_job() {
   ' <<<"$existing_crontab"
 }
 
-build_compose_command() {
-  local subcommand=$1
+build_target_args() {
   local -a command_parts
 
-  if [[ -n "$COMPOSE_BIN" ]]; then
-    command_parts=(
-      "$COMPOSE_BIN"
-      --env-file "$ENV_FILE"
-      -f "$COMPOSE_FILE"
-      run
-      -T
-      --rm
-      discord-scraper
-      "$subcommand"
-    )
-  elif (( DOCKER_BIN_OVERRIDDEN == 0 )) && command -v docker-compose >/dev/null 2>&1; then
-    command_parts=(
-      docker-compose
-      --env-file "$ENV_FILE"
-      -f "$COMPOSE_FILE"
-      run
-      -T
-      --rm
-      discord-scraper
-      "$subcommand"
-    )
-  else
-    command_parts=(
-      "$DOCKER_BIN"
-      compose
-      --env-file "$ENV_FILE"
-      -f "$COMPOSE_FILE"
-      run
-      -T
-      --rm
-      discord-scraper
-      "$subcommand"
-    )
-  fi
-
   local target
   for target in "${TARGETS[@]}"; do
     command_parts+=(--target "$target")
@@ -198,10 +162,11 @@ validate_targets() {
 }
 
 run_preflight() {
-  local preflight_command
+  local preflight_command target_args
 
   [[ -f "$ENV_FILE" ]] || die "Missing env file: $ENV_FILE"
-  preflight_command=$(build_compose_command preflight)
+  target_args=$(build_target_args)
+  preflight_command="$(printf '%q ' "$HOST_RUNNER") --env-file $(printf '%q' "$ENV_FILE") --compose-file $(printf '%q' "$COMPOSE_FILE") preflight ${target_args}"
   eval "$preflight_command"
 }
 
@@ -286,6 +251,7 @@ main() {
   fi
 
   [[ -f "$COMPOSE_FILE" ]] || die "Missing compose file: $COMPOSE_FILE"
+  [[ -x "$HOST_RUNNER" ]] || die "Missing or non-executable host runner: $HOST_RUNNER"
   [[ -f "$CONFIG_FILE" ]] || die "Missing config file: $CONFIG_FILE"
   "$JQ_BIN" empty "$CONFIG_FILE" >/dev/null 2>&1 || die "Invalid JSON config: $CONFIG_FILE"
 
@@ -304,7 +270,7 @@ main() {
 
   local begin_marker="# BEGIN ${JOB_NAME}"
   local end_marker="# END ${JOB_NAME}"
-  local current_crontab cleaned_crontab compose_command job_line lock_prefix
+  local current_crontab cleaned_crontab scrape_command target_args job_line lock_prefix
   current_crontab=$("$CRONTAB_BIN" -l 2>/dev/null || true)
   cleaned_crontab=$(strip_existing_job "$current_crontab" "$begin_marker" "$end_marker")
 
@@ -325,14 +291,15 @@ main() {
     run_preflight
   fi
 
-  compose_command=$(build_compose_command scrape)
+  target_args=$(build_target_args)
+  scrape_command="$(printf '%q ' "$HOST_RUNNER") --env-file $(printf '%q' "$ENV_FILE") --compose-file $(printf '%q' "$COMPOSE_FILE") scrape ${target_args}"
   if command -v flock >/dev/null 2>&1; then
     lock_prefix=$(printf '%q ' "$(command -v flock)" "-n" "/tmp/${JOB_NAME}.lock")
   else
     lock_prefix=""
   fi
 
-  job_line="$cron_line cd $(printf '%q' "$REPO_ROOT") && ${lock_prefix}${compose_command}>> $(printf '%q' "$LOG_FILE") 2>&1"
+  job_line="$cron_line cd $(printf '%q' "$REPO_ROOT") && ${lock_prefix}${scrape_command}>> $(printf '%q' "$LOG_FILE") 2>&1"
 
   local cron_block
   cron_block=$(printf '%s\n%s\n%s\n' "$begin_marker" "$job_line" "$end_marker")

scripts/tests/run-discord-scrape-host-smoke.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)
+TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/dce-host-smoke.XXXXXX")
+ENV_FILE="$TMP_DIR/scrape.env"
+COMPOSE_FILE="$TMP_DIR/docker-compose.yml"
+FAKE_DOCKER="$TMP_DIR/docker"
+CALL_COUNT="$TMP_DIR/call-count"
+TOKEN_FILE="$TMP_DIR/token.txt"
+
+cleanup() {
+  rm -rf "$TMP_DIR"
+}
+trap cleanup EXIT
+
+cat >"$COMPOSE_FILE" <<'EOF'
+services:
+  discord-scraper:
+    image: fake
+EOF
+
+cat >"$FAKE_DOCKER" <<'EOF'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+count_file=${FAKE_DOCKER_CALL_COUNT:?}
+token_file=${FAKE_DOCKER_TOKEN_FILE:?}
+mode=${FAKE_DOCKER_MODE:?}
+count=0
+if [[ -f "$count_file" ]]; then
+  count=$(cat "$count_file")
+fi
+count=$((count + 1))
+printf '%s' "$count" >"$count_file"
+
+if [[ "$mode" == "auth-refresh" ]]; then
+  if [[ "${DISCORD_TOKEN:-}" == "stale-token" ]]; then
+    printf 'Authentication token is invalid.\n' >&2
+    printf 'fresh-token\n' >"$token_file"
+    exit 1
+  fi
+  printf 'run succeeded after refresh\n'
+  exit 0
+fi
+
+if [[ "$mode" == "auth-persistent-fail" ]]; then
+  printf "Request to 'channels/111' failed: forbidden.\n" >&2
+  exit 1
+fi
+
+printf 'run succeeded\n'
+EOF
+chmod +x "$FAKE_DOCKER"
+
+run_host() {
+  DCE_REPO_ROOT="$REPO_ROOT" \
+  DCE_DOCKER_BIN="$FAKE_DOCKER" \
+  DCE_ENV_FILE="$ENV_FILE" \
+  DCE_COMPOSE_FILE="$COMPOSE_FILE" \
+  FAKE_DOCKER_CALL_COUNT="$CALL_COUNT" \
+  FAKE_DOCKER_TOKEN_FILE="$TOKEN_FILE" \
+  FAKE_DOCKER_MODE="$1" \
+  "$REPO_ROOT/scripts/run-discord-scrape-host.sh" scrape --target demo
+}
+
+printf 'stale-token\n' >"$TOKEN_FILE"
+cat >"$ENV_FILE" <<EOF
+DISCORD_TOKEN_FILE=$TOKEN_FILE
+EOF
+
+run_host auth-refresh >/dev/null
+[[ "$(cat "$CALL_COUNT")" == "2" ]] || { echo "expected one retry after auth failure" >&2; exit 1; }
+
+printf 'stale-token\n' >"$TOKEN_FILE"
+printf '0' >"$CALL_COUNT"
+if run_host auth-persistent-fail >/dev/null; then
+  echo "expected persistent auth failure to exit non-zero" >&2
+  exit 1
+fi
+[[ "$(cat "$CALL_COUNT")" == "2" ]] || { echo "expected exactly one retry before final failure" >&2; exit 1; }
+
+echo "run-discord-scrape-host smoke test passed"

scripts/tests/setup-cron-smoke.sh

@@ -85,6 +85,7 @@ run_setup
 grep -q '^MAILTO=test@example.com$' "$CRONTAB_FILE" || { echo "expected unrelated crontab line to remain" >&2; exit 1; }
 [[ "$(grep -c '^# BEGIN discord-scrape$' "$CRONTAB_FILE")" == "1" ]] || { echo "expected exactly one managed cron block after install" >&2; exit 1; }
 grep -q 'compose --env-file' "$DOCKER_LOG" || { echo "expected docker preflight to run during install" >&2; exit 1; }
+grep -q 'scripts/run-discord-scrape-host.sh' "$CRONTAB_FILE" || { echo "expected cron job to run host wrapper" >&2; exit 1; }
 
 run_setup
 [[ "$(grep -c '^# BEGIN discord-scrape$' "$CRONTAB_FILE")" == "1" ]] || { echo "expected exactly one managed cron block after reinstall" >&2; exit 1; }