feat: Phase 3 - AES encryption, SQL audit engine, audit logs (85 tests)

Phase 3.1: Instance password AES-256-GCM encryption
Phase 3.2: SQL audit rule engine (10 rules)
Phase 3.3: Auto-audit on ticket creation
Phase 3.4: Operation audit logs + GET /audit/logs
Tests: 44 -> 85 (41 new), Frontend: AuditLogsPage

backend/tests/test_audit_engine.py

@@ -0,0 +1,194 @@
+"""Tests for SQL Audit Engine (Phase 3.2)."""
+import pytest
+from app.services.audit_engine import SQLAuditEngine, Severity
+
+
+class TestSQLAuditEngine:
+    def setup_method(self):
+        self.engine = SQLAuditEngine(env="development")
+
+    # --- DDL Rules ---
+
+    def test_drop_table_without_if_exists(self):
+        report = self.engine.audit("DROP TABLE users;")
+        assert not report.passed or report.has_warnings
+        rules = [f.rule for f in report.findings]
+        assert "DDL_IF_EXISTS" in rules
+        assert "DROP_TABLE" in rules
+
+    def test_drop_table_production_blocked(self):
+        engine = SQLAuditEngine(env="production")
+        report = engine.audit("DROP TABLE users;")
+        assert not report.passed
+        errors = [f for f in report.findings if f.level == Severity.ERROR]
+        assert any(f.rule == "DROP_TABLE_PRODUCTION" for f in errors)
+
+    def test_truncate_warning(self):
+        report = self.engine.audit("TRUNCATE TABLE logs;")
+        rules = [f.rule for f in report.findings]
+        assert "TRUNCATE" in rules
+
+    def test_truncate_production_error(self):
+        engine = SQLAuditEngine(env="production")
+        report = engine.audit("TRUNCATE TABLE logs;")
+        errors = [f for f in report.findings if f.level == Severity.ERROR]
+        assert any(f.rule == "TRUNCATE" for f in errors)
+
+    # --- Missing WHERE ---
+
+    def test_update_no_where_error(self):
+        report = self.engine.audit("UPDATE users SET status = 1;")
+        assert not report.passed
+        errors = [f.rule for f in report.findings if f.level == Severity.ERROR]
+        assert "UPDATE_NO_WHERE" in errors
+
+    def test_delete_no_where_error(self):
+        report = self.engine.audit("DELETE FROM users;")
+        assert not report.passed
+        errors = [f.rule for f in report.findings if f.level == Severity.ERROR]
+        assert "DELETE_NO_WHERE" in errors
+
+    def test_update_with_where_passes(self):
+        report = self.engine.audit("UPDATE users SET name = 'test' WHERE id = 1;")
+        error_rules = [f.rule for f in report.findings if f.level == Severity.ERROR]
+        assert "UPDATE_NO_WHERE" not in error_rules
+
+    def test_delete_with_where_passes(self):
+        report = self.engine.audit("DELETE FROM users WHERE id = 1;")
+        error_rules = [f.rule for f in report.findings if f.level == Severity.ERROR]
+        assert "DELETE_NO_WHERE" not in error_rules
+
+    # --- SELECT * ---
+
+    def test_select_star_info(self):
+        report = self.engine.audit("SELECT * FROM users WHERE id = 1;")
+        rules = [f.rule for f in report.findings]
+        assert "SELECT_STAR" in rules
+        star_finding = next(f for f in report.findings if f.rule == "SELECT_STAR")
+        assert star_finding.level == Severity.INFO
+
+    def test_select_columns_clean(self):
+        report = self.engine.audit("SELECT id, name FROM users WHERE id = 1;")
+        rules = [f.rule for f in report.findings]
+        assert "SELECT_STAR" not in rules
+
+    # --- Multiple statements ---
+
+    def test_multi_statement_error(self):
+        report = self.engine.audit("UPDATE users SET name = 'a'; DELETE FROM logs;")
+        assert not report.passed
+        rules = [f.rule for f in report.findings if f.level == Severity.ERROR]
+        assert "MULTI_STATEMENT" in rules
+
+    def test_single_statement_ok(self):
+        report = self.engine.audit("SELECT id FROM users LIMIT 10;")
+        rules = [f.rule for f in report.findings]
+        assert "MULTI_STATEMENT" not in rules
+
+    # --- Large IN clause ---
+
+    def test_large_in_warning(self):
+        values = ", ".join([str(i) for i in range(150)])
+        sql = f"SELECT * FROM users WHERE id IN ({values});"
+        report = self.engine.audit(sql)
+        rules = [f.rule for f in report.findings]
+        assert "LARGE_IN" in rules
+
+    def test_small_in_ok(self):
+        report = self.engine.audit("SELECT * FROM users WHERE id IN (1, 2, 3);")
+        rules = [f.rule for f in report.findings]
+        assert "LARGE_IN" not in rules
+
+    # --- Production extra rules ---
+
+    def test_alter_table_production_error(self):
+        engine = SQLAuditEngine(env="production")
+        report = engine.audit("ALTER TABLE users ADD COLUMN age INT;")
+        assert not report.passed
+        errors = [f.rule for f in report.findings if f.level == Severity.ERROR]
+        assert "ALTER_TABLE_PRODUCTION" in errors
+
+    def test_alter_table_dev_ok(self):
+        report = self.engine.audit("ALTER TABLE users ADD COLUMN age INT;")
+        error_rules = [f.rule for f in report.findings if f.level == Severity.ERROR]
+        assert "ALTER_TABLE_PRODUCTION" not in error_rules
+
+    # --- JOIN without ON ---
+
+    def test_join_no_on_warning(self):
+        report = self.engine.audit("SELECT * FROM users JOIN orders;")
+        rules = [f.rule for f in report.findings]
+        assert "JOIN_NO_ON" in rules
+
+    def test_join_with_on_ok(self):
+        report = self.engine.audit("SELECT * FROM users JOIN orders ON users.id = orders.user_id;")
+        rules = [f.rule for f in report.findings]
+        assert "JOIN_NO_ON" not in rules
+
+    # --- Score ---
+
+    def test_clean_sql_score_100(self):
+        report = self.engine.audit("SELECT id, name FROM users WHERE id = 1 LIMIT 10;")
+        assert report.score == 100
+        assert report.passed
+
+    def test_error_reduces_score(self):
+        report = self.engine.audit("UPDATE users SET name = 'test';")
+        assert report.score < 100
+        assert not report.passed
+
+    def test_report_to_dict(self):
+        report = self.engine.audit("SELECT * FROM users;")
+        d = report.to_dict()
+        assert "passed" in d
+        assert "score" in d
+        assert "findings" in d
+        assert isinstance(d["findings"], list)
+
+
+class TestAuditEngineIntegration:
+    """Test audit engine integration with ticket creation via API."""
+
+    @pytest.mark.asyncio
+    async def test_ticket_creation_returns_audit_report(self, client, db, admin_token, test_instance):
+        from tests.conftest import auth_header
+        resp = await client.post(
+            "/api/v1/tickets",
+            json={
+                "title": "SQL审核测试工单",
+                "db_type": "mysql",
+                "instance_id": test_instance.id,
+                "target_database": "test_db",
+                "sql_content": "SELECT * FROM users WHERE id = 1;",
+                "reason": "测试审核引擎",
+                "priority": "medium",
+            },
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 201
+        data = resp.json()
+        assert "audit_report" in data
+        assert "score" in data["audit_report"]
+        assert "findings" in data["audit_report"]
+
+    @pytest.mark.asyncio
+    async def test_ticket_with_dangerous_sql_has_low_score(self, client, db, admin_token, test_instance):
+        from tests.conftest import auth_header
+        resp = await client.post(
+            "/api/v1/tickets",
+            json={
+                "title": "危险SQL工单",
+                "db_type": "mysql",
+                "instance_id": test_instance.id,
+                "target_database": "test_db",
+                "sql_content": "UPDATE users SET status = 1;",
+                "reason": "全表更新测试",
+                "priority": "high",
+            },
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 201
+        data = resp.json()
+        report = data["audit_report"]
+        assert report["passed"] is False
+        assert report["score"] < 100