feat: Phase 3 - AES encryption, SQL audit engine, audit logs (85 tests)

Phase 3.1: Instance password AES-256-GCM encryption
Phase 3.2: SQL audit rule engine (10 rules)
Phase 3.3: Auto-audit on ticket creation
Phase 3.4: Operation audit logs + GET /audit/logs
Tests: 44 -> 85 (41 new), Frontend: AuditLogsPage

backend/tests/test_audit_engine.py

@@ -0,0 +1,194 @@
+"""Tests for SQL Audit Engine (Phase 3.2)."""
+import pytest
+from app.services.audit_engine import SQLAuditEngine, Severity
+
+
+class TestSQLAuditEngine:
+    def setup_method(self):
+        self.engine = SQLAuditEngine(env="development")
+
+    # --- DDL Rules ---
+
+    def test_drop_table_without_if_exists(self):
+        report = self.engine.audit("DROP TABLE users;")
+        assert not report.passed or report.has_warnings
+        rules = [f.rule for f in report.findings]
+        assert "DDL_IF_EXISTS" in rules
+        assert "DROP_TABLE" in rules
+
+    def test_drop_table_production_blocked(self):
+        engine = SQLAuditEngine(env="production")
+        report = engine.audit("DROP TABLE users;")
+        assert not report.passed
+        errors = [f for f in report.findings if f.level == Severity.ERROR]
+        assert any(f.rule == "DROP_TABLE_PRODUCTION" for f in errors)
+
+    def test_truncate_warning(self):
+        report = self.engine.audit("TRUNCATE TABLE logs;")
+        rules = [f.rule for f in report.findings]
+        assert "TRUNCATE" in rules
+
+    def test_truncate_production_error(self):
+        engine = SQLAuditEngine(env="production")
+        report = engine.audit("TRUNCATE TABLE logs;")
+        errors = [f for f in report.findings if f.level == Severity.ERROR]
+        assert any(f.rule == "TRUNCATE" for f in errors)
+
+    # --- Missing WHERE ---
+
+    def test_update_no_where_error(self):
+        report = self.engine.audit("UPDATE users SET status = 1;")
+        assert not report.passed
+        errors = [f.rule for f in report.findings if f.level == Severity.ERROR]
+        assert "UPDATE_NO_WHERE" in errors
+
+    def test_delete_no_where_error(self):
+        report = self.engine.audit("DELETE FROM users;")
+        assert not report.passed
+        errors = [f.rule for f in report.findings if f.level == Severity.ERROR]
+        assert "DELETE_NO_WHERE" in errors
+
+    def test_update_with_where_passes(self):
+        report = self.engine.audit("UPDATE users SET name = 'test' WHERE id = 1;")
+        error_rules = [f.rule for f in report.findings if f.level == Severity.ERROR]
+        assert "UPDATE_NO_WHERE" not in error_rules
+
+    def test_delete_with_where_passes(self):
+        report = self.engine.audit("DELETE FROM users WHERE id = 1;")
+        error_rules = [f.rule for f in report.findings if f.level == Severity.ERROR]
+        assert "DELETE_NO_WHERE" not in error_rules
+
+    # --- SELECT * ---
+
+    def test_select_star_info(self):
+        report = self.engine.audit("SELECT * FROM users WHERE id = 1;")
+        rules = [f.rule for f in report.findings]
+        assert "SELECT_STAR" in rules
+        star_finding = next(f for f in report.findings if f.rule == "SELECT_STAR")
+        assert star_finding.level == Severity.INFO
+
+    def test_select_columns_clean(self):
+        report = self.engine.audit("SELECT id, name FROM users WHERE id = 1;")
+        rules = [f.rule for f in report.findings]
+        assert "SELECT_STAR" not in rules
+
+    # --- Multiple statements ---
+
+    def test_multi_statement_error(self):
+        report = self.engine.audit("UPDATE users SET name = 'a'; DELETE FROM logs;")
+        assert not report.passed
+        rules = [f.rule for f in report.findings if f.level == Severity.ERROR]
+        assert "MULTI_STATEMENT" in rules
+
+    def test_single_statement_ok(self):
+        report = self.engine.audit("SELECT id FROM users LIMIT 10;")
+        rules = [f.rule for f in report.findings]
+        assert "MULTI_STATEMENT" not in rules
+
+    # --- Large IN clause ---
+
+    def test_large_in_warning(self):
+        values = ", ".join([str(i) for i in range(150)])
+        sql = f"SELECT * FROM users WHERE id IN ({values});"
+        report = self.engine.audit(sql)
+        rules = [f.rule for f in report.findings]
+        assert "LARGE_IN" in rules
+
+    def test_small_in_ok(self):
+        report = self.engine.audit("SELECT * FROM users WHERE id IN (1, 2, 3);")
+        rules = [f.rule for f in report.findings]
+        assert "LARGE_IN" not in rules
+
+    # --- Production extra rules ---
+
+    def test_alter_table_production_error(self):
+        engine = SQLAuditEngine(env="production")
+        report = engine.audit("ALTER TABLE users ADD COLUMN age INT;")
+        assert not report.passed
+        errors = [f.rule for f in report.findings if f.level == Severity.ERROR]
+        assert "ALTER_TABLE_PRODUCTION" in errors
+
+    def test_alter_table_dev_ok(self):
+        report = self.engine.audit("ALTER TABLE users ADD COLUMN age INT;")
+        error_rules = [f.rule for f in report.findings if f.level == Severity.ERROR]
+        assert "ALTER_TABLE_PRODUCTION" not in error_rules
+
+    # --- JOIN without ON ---
+
+    def test_join_no_on_warning(self):
+        report = self.engine.audit("SELECT * FROM users JOIN orders;")
+        rules = [f.rule for f in report.findings]
+        assert "JOIN_NO_ON" in rules
+
+    def test_join_with_on_ok(self):
+        report = self.engine.audit("SELECT * FROM users JOIN orders ON users.id = orders.user_id;")
+        rules = [f.rule for f in report.findings]
+        assert "JOIN_NO_ON" not in rules
+
+    # --- Score ---
+
+    def test_clean_sql_score_100(self):
+        report = self.engine.audit("SELECT id, name FROM users WHERE id = 1 LIMIT 10;")
+        assert report.score == 100
+        assert report.passed
+
+    def test_error_reduces_score(self):
+        report = self.engine.audit("UPDATE users SET name = 'test';")
+        assert report.score < 100
+        assert not report.passed
+
+    def test_report_to_dict(self):
+        report = self.engine.audit("SELECT * FROM users;")
+        d = report.to_dict()
+        assert "passed" in d
+        assert "score" in d
+        assert "findings" in d
+        assert isinstance(d["findings"], list)
+
+
+class TestAuditEngineIntegration:
+    """Test audit engine integration with ticket creation via API."""
+
+    @pytest.mark.asyncio
+    async def test_ticket_creation_returns_audit_report(self, client, db, admin_token, test_instance):
+        from tests.conftest import auth_header
+        resp = await client.post(
+            "/api/v1/tickets",
+            json={
+                "title": "SQL审核测试工单",
+                "db_type": "mysql",
+                "instance_id": test_instance.id,
+                "target_database": "test_db",
+                "sql_content": "SELECT * FROM users WHERE id = 1;",
+                "reason": "测试审核引擎",
+                "priority": "medium",
+            },
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 201
+        data = resp.json()
+        assert "audit_report" in data
+        assert "score" in data["audit_report"]
+        assert "findings" in data["audit_report"]
+
+    @pytest.mark.asyncio
+    async def test_ticket_with_dangerous_sql_has_low_score(self, client, db, admin_token, test_instance):
+        from tests.conftest import auth_header
+        resp = await client.post(
+            "/api/v1/tickets",
+            json={
+                "title": "危险SQL工单",
+                "db_type": "mysql",
+                "instance_id": test_instance.id,
+                "target_database": "test_db",
+                "sql_content": "UPDATE users SET status = 1;",
+                "reason": "全表更新测试",
+                "priority": "high",
+            },
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 201
+        data = resp.json()
+        report = data["audit_report"]
+        assert report["passed"] is False
+        assert report["score"] < 100

backend/tests/test_audit_logs.py

@@ -0,0 +1,190 @@
+"""Tests for Audit Log API (Phase 3.4)."""
+import pytest
+from tests.conftest import auth_header
+
+
+class TestAuditLogAPI:
+    @pytest.mark.asyncio
+    async def test_list_audit_logs_admin(self, client, admin_token):
+        """Admin can list audit logs."""
+        resp = await client.get(
+            "/api/v1/audit/logs",
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 200
+        data = resp.json()
+        assert "items" in data
+        assert "total" in data
+        assert "page" in data
+
+    @pytest.mark.asyncio
+    async def test_list_audit_logs_dba(self, client, dba_token):
+        """DBA can also list audit logs."""
+        resp = await client.get(
+            "/api/v1/audit/logs",
+            headers=auth_header(dba_token),
+        )
+        assert resp.status_code == 200
+
+    @pytest.mark.asyncio
+    async def test_list_audit_logs_developer_forbidden(self, client, developer_token):
+        """Developer cannot access audit logs."""
+        resp = await client.get(
+            "/api/v1/audit/logs",
+            headers=auth_header(developer_token),
+        )
+        assert resp.status_code == 403
+
+    @pytest.mark.asyncio
+    async def test_create_instance_logs_audit(self, client, db, admin_token):
+        """Creating an instance produces an audit log entry."""
+        from app.models.audit_log import AuditLog
+        from sqlalchemy import select
+
+        resp = await client.post(
+            "/api/v1/instances",
+            json={
+                "name": "审计测试实例",
+                "db_type": "mysql",
+                "host": "10.0.0.100",
+                "port": 3306,
+                "username": "root",
+                "password": "test123",
+                "database": "test",
+            },
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 201
+
+        # Check audit log was created
+        result = await db.execute(
+            select(AuditLog).where(AuditLog.action == "CREATE_INSTANCE")
+        )
+        log = result.scalar_one_or_none()
+        assert log is not None
+        assert "审计测试实例" in log.detail
+
+    @pytest.mark.asyncio
+    async def test_create_user_logs_audit(self, client, db, admin_token):
+        """Creating a user produces an audit log entry."""
+        from app.models.audit_log import AuditLog
+        from sqlalchemy import select
+
+        resp = await client.post(
+            "/api/v1/users",
+            json={
+                "username": "audit_test_user",
+                "display_name": "审计测试",
+                "password": "123456",
+                "role": "developer",
+            },
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 201
+
+        result = await db.execute(
+            select(AuditLog).where(AuditLog.action == "CREATE_USER")
+        )
+        log = result.scalar_one_or_none()
+        assert log is not None
+        assert "audit_test_user" in log.detail
+
+    @pytest.mark.asyncio
+    async def test_create_ticket_logs_audit(self, client, db, admin_token, test_instance):
+        """Creating a ticket produces an audit log entry with SQL score."""
+        from app.models.audit_log import AuditLog
+        from sqlalchemy import select
+
+        resp = await client.post(
+            "/api/v1/tickets",
+            json={
+                "title": "审计日志工单测试",
+                "db_type": "mysql",
+                "instance_id": test_instance.id,
+                "target_database": "test_db",
+                "sql_content": "SELECT id FROM users LIMIT 10;",
+                "reason": "测试审计日志",
+            },
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 201
+
+        result = await db.execute(
+            select(AuditLog).where(AuditLog.action == "CREATE_TICKET")
+        )
+        log = result.scalar_one_or_none()
+        assert log is not None
+        assert "SQL审核评分" in log.detail
+
+    @pytest.mark.asyncio
+    async def test_audit_log_pagination(self, client, admin_token):
+        """Audit log pagination works."""
+        resp = await client.get(
+            "/api/v1/audit/logs?page=1&page_size=5",
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["page_size"] == 5
+
+    @pytest.mark.asyncio
+    async def test_audit_log_filter_by_action(self, client, admin_token, db, test_instance):
+        """Can filter audit logs by action."""
+        # Create a ticket first
+        await client.post(
+            "/api/v1/tickets",
+            json={
+                "title": "过滤测试工单",
+                "db_type": "mysql",
+                "instance_id": test_instance.id,
+                "target_database": "test_db",
+                "sql_content": "SELECT 1;",
+                "reason": "过滤测试用",
+            },
+            headers=auth_header(admin_token),
+        )
+
+        resp = await client.get(
+            "/api/v1/audit/logs?action=CREATE_TICKET",
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 200
+        data = resp.json()
+        for item in data["items"]:
+            assert item["action"] == "CREATE_TICKET"
+
+    @pytest.mark.asyncio
+    async def test_review_ticket_logs_audit(self, client, db, admin_token, dba_token, test_instance):
+        """Reviewing a ticket creates an audit log."""
+        from app.models.audit_log import AuditLog
+        from sqlalchemy import select
+
+        # Create ticket as admin
+        resp = await client.post(
+            "/api/v1/tickets",
+            json={
+                "title": "审核日志测试",
+                "db_type": "mysql",
+                "instance_id": test_instance.id,
+                "target_database": "test_db",
+                "sql_content": "SELECT 1;",
+                "reason": "审核日志测试",
+            },
+            headers=auth_header(admin_token),
+        )
+        ticket_id = resp.json()["id"]
+
+        # Review as DBA
+        resp = await client.post(
+            f"/api/v1/tickets/{ticket_id}/review",
+            json={"action": "approve", "comment": "批准"},
+            headers=auth_header(dba_token),
+        )
+        assert resp.status_code == 200
+
+        result = await db.execute(
+            select(AuditLog).where(AuditLog.action == "REVIEW_TICKET")
+        )
+        log = result.scalar_one_or_none()
+        assert log is not None
+        assert "approve" in log.detail

backend/tests/test_crypto.py

@@ -0,0 +1,138 @@
+"""Tests for AES encryption (Phase 3.1)."""
+import pytest
+from app.core.crypto import encrypt_password, decrypt_password
+
+
+class TestEncryption:
+    def test_encrypt_decrypt_roundtrip(self):
+        """Encrypt then decrypt returns original."""
+        plain = "my_secret_password_123"
+        encrypted = encrypt_password(plain)
+        assert encrypted != plain
+        assert decrypt_password(encrypted) == plain
+
+    def test_encrypt_produces_different_ciphertext(self):
+        """Each encryption uses a random nonce, so ciphertext differs."""
+        plain = "same_password"
+        e1 = encrypt_password(plain)
+        e2 = encrypt_password(plain)
+        assert e1 != e2  # different nonces
+        assert decrypt_password(e1) == plain
+        assert decrypt_password(e2) == plain
+
+    def test_encrypt_empty_string(self):
+        """Can encrypt and decrypt empty string."""
+        encrypted = encrypt_password("")
+        assert decrypt_password(encrypted) == ""
+
+    def test_encrypt_special_characters(self):
+        """Handles special characters in passwords."""
+        plain = 'p@ssw0rd!#$%^&*()_+-=[]{}|;\':",./<>?'
+        encrypted = encrypt_password(plain)
+        assert decrypt_password(encrypted) == plain
+
+    def test_encrypt_unicode(self):
+        """Handles unicode characters."""
+        plain = "密码测试🔑"
+        encrypted = encrypt_password(plain)
+        assert decrypt_password(encrypted) == plain
+
+    def test_decrypt_invalid_data_returns_as_is(self):
+        """Invalid ciphertext returns original string (backward compat)."""
+        result = decrypt_password("not_valid_base64!!!")
+        assert result == "not_valid_base64!!!"
+
+
+class TestInstanceEncryption:
+    """Test that instance passwords are stored encrypted via API."""
+
+    @pytest.mark.asyncio
+    async def test_create_instance_encrypts_password(self, client, admin_token):
+        """POST /instances stores password as encrypted ciphertext."""
+        from tests.conftest import auth_header
+        resp = await client.post(
+            "/api/v1/instances",
+            json={
+                "name": "加密测试",
+                "db_type": "mysql",
+                "host": "10.0.0.1",
+                "port": 3306,
+                "username": "root",
+                "password": "plain_text_pw",
+                "database": "test",
+                "env": "development",
+            },
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 201
+        data = resp.json()
+        # Response should NOT contain password at all (InstanceResponse excludes it)
+        assert "password" not in data
+
+    @pytest.mark.asyncio
+    async def test_password_not_stored_as_plaintext(self, client, db, admin_token):
+        """Verify the database actually stores encrypted, not plain text."""
+        from tests.conftest import auth_header
+        from app.models.instance import Instance
+        from sqlalchemy import select
+
+        plain_pw = "super_secret_123"
+        resp = await client.post(
+            "/api/v1/instances",
+            json={
+                "name": "明文检查",
+                "db_type": "mysql",
+                "host": "10.0.0.2",
+                "port": 3306,
+                "username": "root",
+                "password": plain_pw,
+                "database": "test",
+                "env": "development",
+            },
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 201
+        instance_id = resp.json()["id"]
+
+        # Read raw from database
+        result = await db.execute(select(Instance).where(Instance.id == instance_id))
+        instance = result.scalar_one()
+        assert instance.password != plain_pw  # Not stored as plaintext
+        assert len(instance.password) > 20  # Encrypted is longer
+
+    @pytest.mark.asyncio
+    async def test_update_instance_re_encrypts_password(self, client, db, admin_token):
+        """PUT /instances/:id re-encrypts password when updated."""
+        from tests.conftest import auth_header
+        from app.models.instance import Instance
+        from sqlalchemy import select
+
+        # Create
+        resp = await client.post(
+            "/api/v1/instances",
+            json={
+                "name": "更新加密",
+                "db_type": "mysql",
+                "host": "10.0.0.3",
+                "port": 3306,
+                "username": "root",
+                "password": "old_password",
+                "database": "test",
+            },
+            headers=auth_header(admin_token),
+        )
+        iid = resp.json()["id"]
+
+        # Update password
+        resp = await client.put(
+            f"/api/v1/instances/{iid}",
+            json={"password": "new_password"},
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 200
+
+        # Verify encrypted
+        result = await db.execute(select(Instance).where(Instance.id == iid))
+        inst = result.scalar_one()
+        assert inst.password != "new_password"
+        assert inst.password != "old_password"