From 88e5f4e7ee314c14f3a09d3c27b89a6073ca7296 Mon Sep 17 00:00:00 2001 From: logan Date: Mon, 25 May 2026 23:32:15 +0800 Subject: [PATCH] =?UTF-8?q?feat:=20Go=E5=90=8E=E7=AB=AFLDAP=E7=9C=9F?= =?UTF-8?q?=E5=AE=9E=E5=AF=B9=E6=8E=A5=20=E2=80=94=20AES-256-GCM=E5=AF=86?= =?UTF-8?q?=E7=A0=81=E5=8A=A0=E8=A7=A3=E5=AF=86=20+=20=E7=99=BB=E5=BD=95LD?= =?UTF-8?q?AP=20fallback?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 新增 crypto.go: AES-256-GCM 加解密，与 Python backend 兼容 - auth.go: Login 添加 LDAP fallback（本地优先→LDAP绑定→自动创建本地用户） - ldap.go: 实现真实 LDAP 连接/用户搜索/密码验证/OU列表/用户列表 - 所有 LDAP 操作解密 admin_password 后使用 - 新增/更新密码存储时加密 - router.go: 补充 delete-user 路由 - 添加 go-ldap/v3 依赖 --- backend/go.mod | 12 +- backend/internal/handler/audit_log.go | 32 + backend/internal/handler/auth.go | 170 ++- backend/internal/handler/crypto.go | 83 ++ backend/internal/handler/ghost.go | 13 +- backend/internal/handler/instance_detail.go | 132 +++ backend/internal/handler/ldap.go | 360 ++++++- backend/internal/handler/notification.go | 197 ++++ backend/internal/handler/redis.go | 152 +++ backend/internal/handler/workflow.go | 208 ++++ backend/router/router.go | 48 +- .../src/components/EditInstanceDialog.tsx | 2 +- frontend/src/pages/WorkflowPage.tsx | 5 +- pytest.ini | 3 + run_tests.sh | 20 + tests/__init__.py | 0 tests/conftest.py | 182 ++++ tests/test_announcement.py | 318 ++++++ tests/test_approval_flow_comprehensive.py | 339 ++++++ tests/test_audit_engine.py | 193 ++++ tests/test_audit_engine_v2.py | 714 +++++++++++++ tests/test_audit_logs.py | 173 +++ tests/test_audit_rule.py | 759 +++++++++++++ tests/test_audit_rule_seeds.py | 240 +++++ tests/test_audit_rules.py | 165 +++ tests/test_auth.py | 77 ++ tests/test_backup.py | 395 +++++++ tests/test_crypto.py | 138 +++ tests/test_dashboard.py | 221 ++++ tests/test_db_types.py | 204 ++++ tests/test_dictionary.py | 227 ++++ tests/test_explain.py | 994 ++++++++++++++++++ tests/test_impact.py | 250 +++++ tests/test_instance_access_control.py | 476 +++++++++ tests/test_instance_detail.py | 343 ++++++ tests/test_instance_fields.py | 144 +++ tests/test_instance_group.py | 486 +++++++++ tests/test_instance_permission.py | 389 +++++++ tests/test_instances.py | 192 ++++ tests/test_integration_api_crud.py | 377 +++++++ tests/test_integration_audit_policy.py | 261 +++++ tests/test_integration_config_notify.py | 188 ++++ tests/test_integration_query.py | 251 +++++ tests/test_integration_ticket_flow.py | 444 ++++++++ tests/test_ldap_config.py | 363 +++++++ tests/test_masking_rule.py | 681 ++++++++++++ tests/test_mongo.py | 711 +++++++++++++ tests/test_notification.py | 463 ++++++++ tests/test_permission_workflow.py | 467 ++++++++ tests/test_phase1_features.py | 280 +++++ tests/test_phase2_features.py | 189 ++++ tests/test_pool.py | 329 ++++++ tests/test_pool_endpoint.py | 186 ++++ tests/test_query.py | 532 ++++++++++ tests/test_query_history_service.py | 768 ++++++++++++++ tests/test_query_service.py | 584 ++++++++++ tests/test_redis.py | 296 ++++++ tests/test_rollback.py | 182 ++++ tests/test_schema_drift.py | 413 ++++++++ tests/test_schema_drift_endpoint.py | 231 ++++ tests/test_schema_drift_pool.py | 241 +++++ tests/test_settings.py | 381 +++++++ tests/test_sql_analyzer.py | 157 +++ tests/test_sql_assistant.py | 326 ++++++ tests/test_system_settings.py | 228 ++++ tests/test_ticket_executor.py | 601 +++++++++++ tests/test_tickets.py | 176 ++++ tests/test_user.py | 458 ++++++++ tests/test_user_endpoint.py | 232 ++++ tests/test_users.py | 78 ++ tests/test_workflow.py | 324 ++++++ 71 files changed, 20390 insertions(+), 64 deletions(-) create mode 100644 backend/internal/handler/audit_log.go create mode 100644 backend/internal/handler/crypto.go create mode 100644 backend/internal/handler/instance_detail.go create mode 100644 backend/internal/handler/notification.go create mode 100644 backend/internal/handler/redis.go create mode 100644 backend/internal/handler/workflow.go create mode 100644 pytest.ini create mode 100755 run_tests.sh create mode 100644 tests/__init__.py create mode 100644 tests/conftest.py create mode 100644 tests/test_announcement.py create mode 100644 tests/test_approval_flow_comprehensive.py create mode 100644 tests/test_audit_engine.py create mode 100644 tests/test_audit_engine_v2.py create mode 100644 tests/test_audit_logs.py create mode 100644 tests/test_audit_rule.py create mode 100644 tests/test_audit_rule_seeds.py create mode 100644 tests/test_audit_rules.py create mode 100644 tests/test_auth.py create mode 100644 tests/test_backup.py create mode 100644 tests/test_crypto.py create mode 100644 tests/test_dashboard.py create mode 100644 tests/test_db_types.py create mode 100644 tests/test_dictionary.py create mode 100644 tests/test_explain.py create mode 100644 tests/test_impact.py create mode 100644 tests/test_instance_access_control.py create mode 100644 tests/test_instance_detail.py create mode 100644 tests/test_instance_fields.py create mode 100644 tests/test_instance_group.py create mode 100644 tests/test_instance_permission.py create mode 100644 tests/test_instances.py create mode 100644 tests/test_integration_api_crud.py create mode 100644 tests/test_integration_audit_policy.py create mode 100644 tests/test_integration_config_notify.py create mode 100644 tests/test_integration_query.py create mode 100644 tests/test_integration_ticket_flow.py create mode 100644 tests/test_ldap_config.py create mode 100644 tests/test_masking_rule.py create mode 100644 tests/test_mongo.py create mode 100644 tests/test_notification.py create mode 100644 tests/test_permission_workflow.py create mode 100644 tests/test_phase1_features.py create mode 100644 tests/test_phase2_features.py create mode 100644 tests/test_pool.py create mode 100644 tests/test_pool_endpoint.py create mode 100644 tests/test_query.py create mode 100644 tests/test_query_history_service.py create mode 100644 tests/test_query_service.py create mode 100644 tests/test_redis.py create mode 100644 tests/test_rollback.py create mode 100644 tests/test_schema_drift.py create mode 100644 tests/test_schema_drift_endpoint.py create mode 100644 tests/test_schema_drift_pool.py create mode 100644 tests/test_settings.py create mode 100644 tests/test_sql_analyzer.py create mode 100644 tests/test_sql_assistant.py create mode 100644 tests/test_system_settings.py create mode 100644 tests/test_ticket_executor.py create mode 100644 tests/test_tickets.py create mode 100644 tests/test_user.py create mode 100644 tests/test_user_endpoint.py create mode 100644 tests/test_users.py create mode 100644 tests/test_workflow.py diff --git a/backend/go.mod b/backend/go.mod index 7594ac3..5062546 100644 --- a/backend/go.mod +++ b/backend/go.mod @@ -7,21 +7,25 @@ require ( github.com/gin-gonic/gin v1.10.1 github.com/golang-jwt/jwt/v5 v5.2.2 github.com/joho/godotenv v1.5.1 - golang.org/x/crypto v0.38.0 + golang.org/x/crypto v0.48.0 gorm.io/driver/sqlite v1.5.7 gorm.io/gorm v1.26.0 ) require ( + github.com/Azure/go-ntlmssp v0.1.0 // indirect github.com/bytedance/sonic v1.13.2 // indirect github.com/bytedance/sonic/loader v0.2.4 // indirect github.com/cloudwego/base64x v0.1.5 // indirect github.com/gabriel-vasile/mimetype v1.4.8 // indirect github.com/gin-contrib/sse v1.0.0 // indirect + github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect + github.com/go-ldap/ldap/v3 v3.4.13 // indirect github.com/go-playground/locales v0.14.1 // indirect github.com/go-playground/universal-translator v0.18.1 // indirect github.com/go-playground/validator/v10 v10.26.0 // indirect github.com/goccy/go-json v0.10.5 // indirect + github.com/google/uuid v1.6.0 // indirect github.com/jinzhu/inflection v1.0.0 // indirect github.com/jinzhu/now v1.1.5 // indirect github.com/json-iterator/go v1.1.12 // indirect @@ -36,9 +40,9 @@ require ( github.com/twitchyliquid64/golang-asm v0.15.1 // indirect github.com/ugorji/go/codec v1.2.12 // indirect golang.org/x/arch v0.15.0 // indirect - golang.org/x/net v0.38.0 // indirect - golang.org/x/sys v0.33.0 // indirect - golang.org/x/text v0.25.0 // indirect + golang.org/x/net v0.50.0 // indirect + golang.org/x/sys v0.41.0 // indirect + golang.org/x/text v0.34.0 // indirect google.golang.org/protobuf v1.36.6 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/backend/internal/handler/audit_log.go b/backend/internal/handler/audit_log.go new file mode 100644 index 0000000..94396b3 --- /dev/null +++ b/backend/internal/handler/audit_log.go @@ -0,0 +1,32 @@ +package handler + +import ( + "net/http" + "strconv" + + "sql-platform/internal/model" + + "github.com/gin-gonic/gin" +) + +// GET /api/v1/audit-logs +func ListAuditLogs(c *gin.Context) { + page, _ := strconv.Atoi(c.DefaultQuery("page", "1")) + pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "20")) + if page < 1 { page = 1 } + if pageSize < 1 || pageSize > 100 { pageSize = 20 } + + var total int64 + model.DB.Model(&model.AuditLog{}).Count(&total) + + var logs []model.AuditLog + offset := (page - 1) * pageSize + model.DB.Order("id DESC").Offset(offset).Limit(pageSize).Find(&logs) + + c.JSON(http.StatusOK, gin.H{ + "items": logs, + "total": total, + "page": page, + "page_size": pageSize, + }) +} diff --git a/backend/internal/handler/auth.go b/backend/internal/handler/auth.go index 5860575..573400e 100644 --- a/backend/internal/handler/auth.go +++ b/backend/internal/handler/auth.go @@ -1,17 +1,23 @@ package handler import ( + "encoding/json" + "fmt" "net/http" + "strings" "time" "sql-platform/internal/middleware" "sql-platform/internal/model" "github.com/gin-gonic/gin" + "github.com/go-ldap/ldap/v3" "golang.org/x/crypto/bcrypt" + "gorm.io/gorm" ) // POST /api/v1/auth/login +// Strategy: local account first, then LDAP fallback func Login(c *gin.Context) { var req model.LoginRequest if err := c.ShouldBindJSON(&req); err != nil { @@ -20,21 +26,57 @@ func Login(c *gin.Context) { } var user model.User - if err := model.DB.Where("username = ?", req.Username).First(&user).Error; err != nil { - c.JSON(http.StatusUnauthorized, gin.H{"detail": "Invalid username or password"}) - return - } + err := model.DB.Where("username = ?", req.Username).First(&user).Error - if user.IsActive != nil && !*user.IsActive { - c.JSON(http.StatusForbidden, gin.H{"detail": "Account is disabled"}) - return - } - - if err := bcrypt.CompareHashAndPassword([]byte(user.HashedPassword), []byte(req.Password)); err != nil { - c.JSON(http.StatusUnauthorized, gin.H{"detail": "Invalid username or password"}) + if err == nil { + // ── 本地用户存在，用本地密码验证 ── + if user.IsActive != nil && !*user.IsActive { + c.JSON(http.StatusForbidden, gin.H{"detail": "Account is disabled"}) + return + } + if err := bcrypt.CompareHashAndPassword([]byte(user.HashedPassword), []byte(req.Password)); err != nil { + c.JSON(http.StatusUnauthorized, gin.H{"detail": "Invalid username or password"}) + return + } + } else if err == gorm.ErrRecordNotFound { + // ── 本地不存在该用户，尝试 LDAP 认证 ── + ldapUser, ldapInfo, ldapErr := tryLDAPAuth(req.Username, req.Password) + if ldapErr != nil || ldapUser == nil { + c.JSON(http.StatusUnauthorized, gin.H{"detail": "Invalid username or password"}) + return + } + // LDAP 认证成功，自动创建本地用户 + isActive := true + defaultRole := "developer" + newUser := model.User{ + Username: ldapInfo.Username, + DisplayName: ldapInfo.DisplayName, + Email: ldapInfo.Email, + HashedPassword: "-", // LDAP 用户不存本地密码 + Role: defaultRole, + IsActive: &isActive, + } + if newUser.DisplayName == "" { + newUser.DisplayName = newUser.Username + } + if createErr := model.DB.Create(&newUser).Error; createErr != nil { + // 可能并发创建冲突，再查一次 + model.DB.Where("username = ?", ldapInfo.Username).First(&user) + if user.ID == 0 { + c.JSON(http.StatusInternalServerError, gin.H{"detail": "Failed to create LDAP user"}) + return + } + } else { + user = newUser + } + // 记录 auth_source + _ = ldapUser // used above + } else { + c.JSON(http.StatusInternalServerError, gin.H{"detail": "Database error"}) return } + // ── 生成 Token ── token, err := middleware.GenerateToken(&user) if err != nil { c.JSON(http.StatusInternalServerError, gin.H{"detail": "Failed to generate token"}) @@ -52,6 +94,106 @@ func Login(c *gin.Context) { }) } +// LDAPAuthInfo holds extracted user info from LDAP +type LDAPAuthInfo struct { + Username string + DisplayName string + Email *string +} + +// tryLDAPAuth attempts LDAP bind for the given username/password. +// Returns (ldapConn, userInfo, error). Caller does NOT need to close conn. +func tryLDAPAuth(username, password string) (*ldap.Conn, *LDAPAuthInfo, error) { + // 1. Load LDAP config from DB + var cfg model.LDAPConfig + if err := model.DB.Order("id").First(&cfg).Error; err != nil { + return nil, nil, fmt.Errorf("no LDAP config") + } + if cfg.LDAPHost == "" { + return nil, nil, fmt.Errorf("LDAP not configured") + } + + // 2. Connect to LDAP server + protocol := "ldap" + if cfg.UseLDAPS != nil && *cfg.UseLDAPS { + protocol = "ldaps" + } + uri := fmt.Sprintf("%s://%s:%d", protocol, cfg.LDAPHost, 389) + if cfg.LDAPPort != nil && *cfg.LDAPPort > 0 { + uri = fmt.Sprintf("%s://%s:%d", protocol, cfg.LDAPHost, *cfg.LDAPPort) + } + + conn, err := ldap.DialURL(uri) + if err != nil { + return nil, nil, fmt.Errorf("LDAP connect failed: %w", err) + } + defer conn.Close() + + // 3. Admin bind to search user (decrypt password first) + adminPw, _ := decryptPassword(cfg.AdminPassword) + if err := conn.Bind(cfg.AdminDN, adminPw); err != nil { + return nil, nil, fmt.Errorf("LDAP admin bind failed: %w", err) + } + + // 4. Build search filter + baseFilter := "(objectClass=inetOrgPerson)" + if cfg.SearchFilter != nil && *cfg.SearchFilter != "" { + baseFilter = *cfg.SearchFilter + } + userFilter := fmt.Sprintf("(&%s(uid=%s))", baseFilter, ldap.EscapeFilter(username)) + + // 5. Search user + searchReq := ldap.NewSearchRequest( + cfg.BaseDN, + ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, + 1, 10, false, + userFilter, + []string{"uid", "cn", "mail", "telephoneNumber"}, + nil, + ) + sr, err := conn.Search(searchReq) + if err != nil || len(sr.Entries) == 0 { + return nil, nil, fmt.Errorf("user not found in LDAP") + } + entry := sr.Entries[0] + userDN := entry.DN + + // 6. Verify password by binding as user + if err := conn.Bind(userDN, password); err != nil { + return nil, nil, fmt.Errorf("LDAP user bind failed: %w", err) + } + + // 7. Extract user info using mapping + userMapping := map[string]string{ + "username": "uid", + "email": "mail", + "display_name": "cn", + } + if cfg.UserMapping != nil && *cfg.UserMapping != "" { + json.Unmarshal([]byte(*cfg.UserMapping), &userMapping) + } + + getAttr := func(key string) string { + if v := entry.GetAttributeValue(key); v != "" { + return v + } + return "" + } + + info := &LDAPAuthInfo{ + Username: getAttr(userMapping["username"]), + DisplayName: getAttr(userMapping["display_name"]), + } + if email := getAttr(userMapping["email"]); email != "" { + info.Email = &email + } + if info.Username == "" { + info.Username = username + } + + return nil, info, nil // conn already closed by defer +} + // GET /api/v1/auth/me func GetMe(c *gin.Context) { userID, _, _ := middleware.GetCurrentUser(c) @@ -103,7 +245,11 @@ func CreateUser(c *gin.Context) { } if err := model.DB.Create(&user).Error; err != nil { - c.JSON(http.StatusBadRequest, gin.H{"detail": "Username already exists"}) + if strings.Contains(err.Error(), "UNIQUE") || strings.Contains(err.Error(), "duplicate") { + c.JSON(http.StatusBadRequest, gin.H{"detail": "Username already exists"}) + } else { + c.JSON(http.StatusInternalServerError, gin.H{"detail": err.Error()}) + } return } diff --git a/backend/internal/handler/crypto.go b/backend/internal/handler/crypto.go new file mode 100644 index 0000000..b4e97a8 --- /dev/null +++ b/backend/internal/handler/crypto.go @@ -0,0 +1,83 @@ +package handler + +import ( + "crypto/aes" + "crypto/cipher" + "crypto/rand" + "encoding/base64" + "os" +) + +// getSecretKey returns the AES key derived from SECRET_KEY env var. +// Mirrors Python's crypto._get_key(): first 32 bytes of utf-8 encoded key, zero-padded. +func getSecretKey() []byte { + keyStr := os.Getenv("SECRET_KEY") + if keyStr == "" { + keyStr = "dev-secret-key-change-in-production" + } + raw := []byte(keyStr) + if len(raw) >= 32 { + return raw[:32] + } + padded := make([]byte, 32) + copy(padded, raw) + return padded +} + +// decryptPassword decrypts a base64-encoded AES-256-GCM ciphertext. +// Mirrors Python's crypto.decrypt_password(). +// If the value is not valid encrypted data (e.g., plaintext), returns it as-is. +func decryptPassword(encrypted string) (string, error) { + raw, err := base64.StdEncoding.DecodeString(encrypted) + if err != nil { + return encrypted, nil // not valid base64 — plaintext + } + + nonceSize := 12 + if len(raw) <= nonceSize { + return encrypted, nil + } + + nonce := raw[:nonceSize] + ct := raw[nonceSize:] + key := getSecretKey() + + block, err := aes.NewCipher(key) + if err != nil { + return "", err + } + + aesgcm, err := cipher.NewGCM(block) + if err != nil { + return "", err + } + + plaintext, err := aesgcm.Open(nil, nonce, ct, nil) + if err != nil { + return encrypted, nil // decryption failed — return as-is + } + + return string(plaintext), nil +} + +// encryptPassword encrypts a plaintext password using AES-256-GCM. +// Returns base64(nonce + ciphertext), same format as Python's encrypt_password. +func encryptPassword(plaintext string) (string, error) { + key := getSecretKey() + block, err := aes.NewCipher(key) + if err != nil { + return "", err + } + aesgcm, err := cipher.NewGCM(block) + if err != nil { + return "", err + } + + nonce := make([]byte, 12) + if _, err := rand.Read(nonce); err != nil { + return "", err + } + + ct := aesgcm.Seal(nil, nonce, []byte(plaintext), nil) + return base64.StdEncoding.EncodeToString(append(nonce, ct...)), nil +} diff --git a/backend/internal/handler/ghost.go b/backend/internal/handler/ghost.go index b86dd49..0bb10ff 100644 --- a/backend/internal/handler/ghost.go +++ b/backend/internal/handler/ghost.go @@ -147,7 +147,18 @@ func ListNotificationTemplates(c *gin.Context) { func ListWorkflows(c *gin.Context) { var workflows []model.WorkflowDefinition model.DB.Order("id").Find(&workflows) - c.JSON(http.StatusOK, workflows) + + type WorkflowWithSteps struct { + model.WorkflowDefinition + Steps []model.WorkflowStep `json:"steps"` + } + + result := make([]WorkflowWithSteps, len(workflows)) + for i, wf := range workflows { + result[i] = WorkflowWithSteps{WorkflowDefinition: wf, Steps: []model.WorkflowStep{}} + model.DB.Where("workflow_id = ?", wf.ID).Order("step_number").Find(&result[i].Steps) + } + c.JSON(http.StatusOK, result) } // GET /api/v1/instance-groups diff --git a/backend/internal/handler/instance_detail.go b/backend/internal/handler/instance_detail.go new file mode 100644 index 0000000..8b749f7 --- /dev/null +++ b/backend/internal/handler/instance_detail.go @@ -0,0 +1,132 @@ +package handler + +import ( + "net/http" + + "sql-platform/internal/model" + + "github.com/gin-gonic/gin" +) + +// GET /api/v1/instances/:id/detail/databases +func DetailListDatabases(c *gin.Context) { + id := c.Param("id") + var instance model.Instance + if err := model.DB.First(&instance, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Instance not found"}) + return + } + // TODO: actual SHOW DATABASES + c.JSON(http.StatusOK, []string{"information_schema"}) +} + +// GET /api/v1/instances/:id/detail/tables +func DetailListTables(c *gin.Context) { + id := c.Param("id") + dbName := c.Query("database") + var instance model.Instance + if err := model.DB.First(&instance, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Instance not found"}) + return + } + // TODO: actual SHOW TABLES from database + _ = dbName + c.JSON(http.StatusOK, []interface{}{}) +} + +// GET /api/v1/instances/:id/detail/db-schema +func DetailDbSchema(c *gin.Context) { + id := c.Param("id") + dbName := c.Query("database") + var instance model.Instance + if err := model.DB.First(&instance, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Instance not found"}) + return + } + // TODO: actual schema introspection + _ = dbName + c.JSON(http.StatusOK, map[string]interface{}{}) +} + +// GET /api/v1/instances/:id/detail/table-detail +func DetailTableDetail(c *gin.Context) { + id := c.Param("id") + dbName := c.Query("database") + tableName := c.Query("table") + var instance model.Instance + if err := model.DB.First(&instance, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Instance not found"}) + return + } + // TODO: actual SHOW CREATE TABLE + SHOW COLUMNS + SHOW INDEX + _, _ = dbName, tableName + c.JSON(http.StatusOK, gin.H{ + "ddl": "", + "columns": []interface{}{}, + "indexes": []interface{}{}, + }) +} + +// GET /api/v1/instances/:id/detail/processlist +func DetailProcesslist(c *gin.Context) { + id := c.Param("id") + var instance model.Instance + if err := model.DB.First(&instance, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Instance not found"}) + return + } + // TODO: actual SHOW PROCESSLIST + c.JSON(http.StatusOK, []interface{}{}) +} + +// GET /api/v1/instances/:id/detail/status +func DetailStatus(c *gin.Context) { + id := c.Param("id") + var instance model.Instance + if err := model.DB.First(&instance, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Instance not found"}) + return + } + // TODO: actual SHOW GLOBAL STATUS + c.JSON(http.StatusOK, gin.H{ + "key_metrics": map[string]string{}, + "all_status": []interface{}{}, + }) +} + +// POST /api/v1/instances/:id/detail/processlist/:pid/kill +func DetailKillProcess(c *gin.Context) { + c.JSON(http.StatusOK, gin.H{"message": "Process killed (placeholder)"}) +} + +// GET /api/v1/instances/:id/detail/users +func DetailListUsers(c *gin.Context) { + id := c.Param("id") + var instance model.Instance + if err := model.DB.First(&instance, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Instance not found"}) + return + } + // TODO: actual SELECT from mysql.user + c.JSON(http.StatusOK, []interface{}{}) +} + +// POST /api/v1/query/execute +func ExecuteQuery(c *gin.Context) { + var input struct { + InstanceID int `json:"instance_id"` + Database string `json:"database"` + SQL string `json:"sql"` + } + if err := c.ShouldBindJSON(&input); err != nil { + c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()}) + return + } + // TODO: actual SQL execution + c.JSON(http.StatusOK, gin.H{ + "columns": []interface{}{}, + "rows": []interface{}{}, + "total": 0, + "cost_ms": 0, + }) +} diff --git a/backend/internal/handler/ldap.go b/backend/internal/handler/ldap.go index 2b01b93..f27d57f 100644 --- a/backend/internal/handler/ldap.go +++ b/backend/internal/handler/ldap.go @@ -1,11 +1,14 @@ package handler import ( + "encoding/json" + "fmt" "net/http" "sql-platform/internal/model" "github.com/gin-gonic/gin" + "github.com/go-ldap/ldap/v3" ) // GET /api/v1/ldap-config @@ -16,9 +19,24 @@ func GetLDAPConfig(c *gin.Context) { c.JSON(http.StatusOK, nil) return } - // mask password - configs[0].AdminPassword = "******" - c.JSON(http.StatusOK, configs[0]) + cfg := configs[0] + // mask password in response + cfg.AdminPassword = "******" + + // Parse user_mapping from JSON string to object for frontend + type ldapResponse struct { + model.LDAPConfig + UserMapping interface{} `json:"user_mapping"` + } + resp := ldapResponse{LDAPConfig: cfg} + if cfg.UserMapping != nil && *cfg.UserMapping != "" { + var mapping map[string]string + json.Unmarshal([]byte(*cfg.UserMapping), &mapping) + resp.UserMapping = mapping + } else { + resp.UserMapping = map[string]string{"username": "uid", "email": "mail", "display_name": "cn"} + } + c.JSON(http.StatusOK, resp) } // PUT /api/v1/ldap-config @@ -32,67 +50,309 @@ func UpdateLDAPConfig(c *gin.Context) { var configs []model.LDAPConfig model.DB.Order("id").Find(&configs) + // Helper to get string from input + getStr := func(key string) string { + if v, ok := input[key].(string); ok { + return v + } + return "" + } + getInt := func(key string) int { + if v, ok := input[key].(float64); ok { + return int(v) + } + return 0 + } + getBool := func(key string) *bool { + if v, ok := input[key].(bool); ok { + return &v + } + return nil + } + + // Serialize user_mapping to JSON string + userMappingStr := "" + if um, ok := input["user_mapping"]; ok { + if bytes, err := json.Marshal(um); err == nil { + userMappingStr = string(bytes) + } + } + if len(configs) == 0 { - // create new - config := model.LDAPConfig{} - if v, ok := input["ldap_host"].(string); ok { - config.LDAPHost = v + // Create new config + cfg := model.LDAPConfig{ + LDAPHost: getStr("ldap_host"), + AdminDN: getStr("admin_dn"), + BaseDN: getStr("base_dn"), + SearchFilter: func() *string { s := getStr("search_filter"); if s != "" { return &s }; return nil }(), + UserMapping: func() *string { s := userMappingStr; if s != "" { return &s }; return nil }(), } - if v, ok := input["base_dn"].(string); ok { - config.BaseDN = v + if port := getInt("ldap_port"); port > 0 { + cfg.LDAPPort = &port } - if v, ok := input["admin_dn"].(string); ok { - config.AdminDN = v + if b := getBool("use_ldaps"); b != nil { + cfg.UseLDAPS = b } - if v, ok := input["admin_password"].(string); ok && v != "******" { - config.AdminPassword = v + if pw := getStr("admin_password"); pw != "" && pw != "******" { + encPw, _ := encryptPassword(pw) + cfg.AdminPassword = encPw } - if v, ok := input["search_filter"].(string); ok { - config.SearchFilter = &v - } - if v, ok := input["user_mapping"].(string); ok { - config.UserMapping = &v - } - if v, ok := input["ldap_port"].(float64); ok { - port := int(v) - config.LDAPPort = &port - } - if v, ok := input["use_ldaps"].(bool); ok { - config.UseLDAPS = &v - } - model.DB.Create(&config) - c.JSON(http.StatusOK, config) + model.DB.Create(&cfg) + cfg.AdminPassword = "******" + c.JSON(http.StatusOK, cfg) } else { - // update existing - if pw, ok := input["admin_password"].(string); ok && pw == "******" { - delete(input, "admin_password") + // Update existing + cfg := configs[0] + updates := map[string]interface{}{} + + if v := getStr("ldap_host"); v != "" { + updates["ldap_host"] = v } - model.DB.Model(&configs[0]).Updates(input) - model.DB.First(&configs[0], configs[0].ID) - configs[0].AdminPassword = "******" - c.JSON(http.StatusOK, configs[0]) + if v := getStr("base_dn"); v != "" { + updates["base_dn"] = v + } + if v := getStr("admin_dn"); v != "" { + updates["admin_dn"] = v + } + if v := getStr("search_filter"); v != "" { + updates["search_filter"] = v + } + if userMappingStr != "" { + updates["user_mapping"] = userMappingStr + } + if v := getStr("admin_password"); v != "" && v != "******" { + encPw, _ := encryptPassword(v) + updates["admin_password"] = encPw + } + if port := getInt("ldap_port"); port > 0 { + updates["ldap_port"] = port + } + if b := getBool("use_ldaps"); b != nil { + updates["use_ldaps"] = *b + } + if len(updates) > 0 { + model.DB.Model(&cfg).Updates(updates) + } + model.DB.First(&cfg, cfg.ID) + cfg.AdminPassword = "******" + c.JSON(http.StatusOK, cfg) } } // POST /api/v1/ldap-config/test func TestLDAPConnection(c *gin.Context) { - // TODO: actual LDAP connection test + var req struct { + TestUser string `json:"test_user"` + TestPassword string `json:"test_password"` + } + if err := c.ShouldBindJSON(&req); err != nil { + c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()}) + return + } + + var cfg model.LDAPConfig + if err := model.DB.Order("id").First(&cfg).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "LDAP 配置不存在，请先保存配置"}) + return + } + if cfg.LDAPHost == "" { + c.JSON(http.StatusBadRequest, gin.H{"success": false, "message": "LDAP 未配置"}) + return + } + + // Connect + protocol := "ldap" + if cfg.UseLDAPS != nil && *cfg.UseLDAPS { + protocol = "ldaps" + } + port := 389 + if cfg.LDAPPort != nil && *cfg.LDAPPort > 0 { + port = *cfg.LDAPPort + } + uri := fmt.Sprintf("%s://%s:%d", protocol, cfg.LDAPHost, port) + + conn, err := ldap.DialURL(uri) + if err != nil { + c.JSON(http.StatusOK, gin.H{"success": false, "message": fmt.Sprintf("连接失败: %s", err)}) + return + } + defer conn.Close() + + // Admin bind (decrypt password) + adminPw, _ := decryptPassword(cfg.AdminPassword) + if err := conn.Bind(cfg.AdminDN, adminPw); err != nil { + c.JSON(http.StatusOK, gin.H{"success": false, "message": fmt.Sprintf("管理员绑定失败: %s", err)}) + return + } + + // If test_user provided, search and verify + if req.TestUser != "" && req.TestPassword != "" && req.TestPassword != "__use_stored__" { + baseFilter := "(objectClass=inetOrgPerson)" + if cfg.SearchFilter != nil && *cfg.SearchFilter != "" { + baseFilter = *cfg.SearchFilter + } + userFilter := fmt.Sprintf("(&%s(uid=%s))", baseFilter, ldap.EscapeFilter(req.TestUser)) + + sr, err := conn.Search(ldap.NewSearchRequest( + cfg.BaseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, + 1, 10, false, userFilter, + []string{"uid", "cn", "mail", "telephoneNumber", "title", "department", "memberOf", "distinguishedName"}, + nil, + )) + if err != nil || len(sr.Entries) == 0 { + c.JSON(http.StatusOK, gin.H{"success": false, "message": fmt.Sprintf("未找到用户: %s", req.TestUser)}) + return + } + entry := sr.Entries[0] + userDN := entry.DN + + // Verify password + if err := conn.Bind(userDN, req.TestPassword); err != nil { + c.JSON(http.StatusOK, gin.H{"success": false, "message": "密码验证失败"}) + return + } + + // Extract user info + userMapping := map[string]string{"username": "uid", "email": "mail", "display_name": "cn"} + if cfg.UserMapping != nil && *cfg.UserMapping != "" { + json.Unmarshal([]byte(*cfg.UserMapping), &userMapping) + } + + userInfo := map[string]string{ + "User lookup": "successful", + "User ID": entry.GetAttributeValue(userMapping["username"]), + "User DN": userDN, + "Display Name": entry.GetAttributeValue(userMapping["display_name"]), + "Email": entry.GetAttributeValue(userMapping["email"]), + } + if userInfo["Display Name"] == "" { + userInfo["Display Name"] = req.TestUser + } + + c.JSON(http.StatusOK, gin.H{ + "success": true, + "message": fmt.Sprintf("用户 %s 验证通过", req.TestUser), + "user_info": userInfo, + }) + return + } + + // Just test server connection c.JSON(http.StatusOK, gin.H{ "success": true, - "message": "LDAP connection test (placeholder)", + "message": fmt.Sprintf("LDAP 服务器 %s 连接成功", cfg.LDAPHost), }) } // POST /api/v1/ldap-config/ou-list func ListLDAPOUs(c *gin.Context) { - // TODO: actual LDAP OU list - c.JSON(http.StatusOK, []interface{}{}) + var cfg model.LDAPConfig + if err := model.DB.Order("id").First(&cfg).Error; err != nil { + c.JSON(http.StatusOK, []interface{}{}) + return + } + + conn, err := dialLDAP(&cfg) + if err != nil { + c.JSON(http.StatusOK, []interface{}{}) + return + } + defer conn.Close() + + adminPw, _ := decryptPassword(cfg.AdminPassword) + if err := conn.Bind(cfg.AdminDN, adminPw); err != nil { + c.JSON(http.StatusOK, []interface{}{}) + return + } + + sr, err := conn.Search(ldap.NewSearchRequest( + cfg.BaseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, + 100, 0, false, "(objectClass=organizationalUnit)", + []string{"ou", "dn", "description"}, + nil, + )) + if err != nil { + c.JSON(http.StatusOK, []interface{}{}) + return + } + + type OuItem struct { + DN string `json:"dn"` + Name string `json:"name"` + } + var items []OuItem + for _, e := range sr.Entries { + items = append(items, OuItem{ + DN: e.DN, + Name: e.GetAttributeValue("ou"), + }) + } + c.JSON(http.StatusOK, items) } // POST /api/v1/ldap-config/user-list func ListLDAPUsers(c *gin.Context) { - // TODO: actual LDAP user list - c.JSON(http.StatusOK, []interface{}{}) + var req struct { + OuDn string `json:"ou_dn"` + } + c.ShouldBindJSON(&req) + + var cfg model.LDAPConfig + if err := model.DB.Order("id").First(&cfg).Error; err != nil { + c.JSON(http.StatusOK, []interface{}{}) + return + } + + conn, err := dialLDAP(&cfg) + if err != nil { + c.JSON(http.StatusOK, []interface{}{}) + return + } + defer conn.Close() + + adminPw2, _ := decryptPassword(cfg.AdminPassword) + if err := conn.Bind(cfg.AdminDN, adminPw2); err != nil { + c.JSON(http.StatusOK, []interface{}{}) + return + } + + searchBase := cfg.BaseDN + if req.OuDn != "" { + searchBase = req.OuDn + } + + baseFilter := "(objectClass=inetOrgPerson)" + if cfg.SearchFilter != nil && *cfg.SearchFilter != "" { + baseFilter = *cfg.SearchFilter + } + + sr, err := conn.Search(ldap.NewSearchRequest( + searchBase, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, + 200, 0, false, baseFilter, + []string{"uid", "cn", "mail", "dn"}, + nil, + )) + if err != nil { + c.JSON(http.StatusOK, []interface{}{}) + return + } + + type LdapUser struct { + DN string `json:"dn"` + UID string `json:"uid"` + CN string `json:"cn"` + Mail string `json:"mail"` + } + var users []LdapUser + for _, e := range sr.Entries { + users = append(users, LdapUser{ + DN: e.DN, + UID: e.GetAttributeValue("uid"), + CN: e.GetAttributeValue("cn"), + Mail: e.GetAttributeValue("mail"), + }) + } + c.JSON(http.StatusOK, users) } // POST /api/v1/ldap-config/create-ou @@ -109,3 +369,21 @@ func CreateLDAPUser(c *gin.Context) { func BatchImportLDAP(c *gin.Context) { c.JSON(http.StatusOK, gin.H{"message": "Batch import (placeholder)", "count": 0}) } + +// POST /api/v1/ldap-config/delete-user +func DeleteLDAPUser(c *gin.Context) { + c.JSON(http.StatusOK, gin.H{"message": "User deleted (placeholder)"}) +} + +// helper: dial LDAP with config +func dialLDAP(cfg *model.LDAPConfig) (*ldap.Conn, error) { + protocol := "ldap" + if cfg.UseLDAPS != nil && *cfg.UseLDAPS { + protocol = "ldaps" + } + port := 389 + if cfg.LDAPPort != nil && *cfg.LDAPPort > 0 { + port = *cfg.LDAPPort + } + return ldap.DialURL(fmt.Sprintf("%s://%s:%d", protocol, cfg.LDAPHost, port)) +} diff --git a/backend/internal/handler/notification.go b/backend/internal/handler/notification.go new file mode 100644 index 0000000..eb0b5e8 --- /dev/null +++ b/backend/internal/handler/notification.go @@ -0,0 +1,197 @@ +package handler + +import ( + "bytes" + "encoding/json" + "io" + "net/http" + "strconv" + + "sql-platform/internal/model" + + "github.com/gin-gonic/gin" +) + +// ChannelResponse — config as JSON object for frontend +type ChannelResponse struct { + ID int `json:"id"` + Name string `json:"name"` + ChannelType string `json:"channel_type"` + Config map[string]interface{} `json:"config"` + IsEnabled bool `json:"is_enabled"` + CreatedAt string `json:"created_at"` + UpdatedAt string `json:"updated_at"` +} + +func toChannelResponse(ch model.NotificationChannel) ChannelResponse { + var cfg map[string]interface{} + if ch.Config != "" { + _ = json.Unmarshal([]byte(ch.Config), &cfg) + } + if cfg == nil { + cfg = map[string]interface{}{} + } + enabled := ch.IsEnabled != nil && *ch.IsEnabled + return ChannelResponse{ + ID: ch.ID, + Name: ch.Name, + ChannelType: ch.ChannelType, + Config: cfg, + IsEnabled: enabled, + CreatedAt: ch.CreatedAt.Format("2006-01-02T15:04:05Z"), + UpdatedAt: ch.UpdatedAt.Format("2006-01-02T15:04:05Z"), + } +} + +// GET /api/v1/notifications +func ListNotifications(c *gin.Context) { + var channels []model.NotificationChannel + model.DB.Order("id").Find(&channels) + result := make([]ChannelResponse, 0, len(channels)) + for _, ch := range channels { + result = append(result, toChannelResponse(ch)) + } + c.JSON(http.StatusOK, result) +} + +// POST /api/v1/notifications +func CreateNotification(c *gin.Context) { + var input struct { + Name string `json:"name"` + ChannelType string `json:"channel_type"` + Config map[string]interface{} `json:"config"` + IsEnabled bool `json:"is_enabled"` + } + if err := c.ShouldBindJSON(&input); err != nil { + c.JSON(http.StatusBadRequest, gin.H{"detail": "参数错误"}) + return + } + if input.Name == "" { + c.JSON(http.StatusBadRequest, gin.H{"detail": "名称不能为空"}) + return + } + cfgBytes, _ := json.Marshal(input.Config) + enabled := input.IsEnabled + ch := model.NotificationChannel{ + Name: input.Name, + ChannelType: input.ChannelType, + Config: string(cfgBytes), + IsEnabled: &enabled, + } + if err := model.DB.Create(&ch).Error; err != nil { + c.JSON(http.StatusInternalServerError, gin.H{"detail": "创建失败"}) + return + } + c.JSON(http.StatusOK, toChannelResponse(ch)) +} + +// PUT /api/v1/notifications/:id +func UpdateNotification(c *gin.Context) { + id, _ := strconv.Atoi(c.Param("id")) + var ch model.NotificationChannel + if err := model.DB.First(&ch, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "通知渠道不存在"}) + return + } + var input map[string]interface{} + if err := c.ShouldBindJSON(&input); err != nil { + c.JSON(http.StatusBadRequest, gin.H{"detail": "参数错误"}) + return + } + if name, ok := input["name"].(string); ok { + ch.Name = name + } + if ct, ok := input["channel_type"].(string); ok { + ch.ChannelType = ct + } + if cfg, ok := input["config"].(map[string]interface{}); ok { + cfgBytes, _ := json.Marshal(cfg) + ch.Config = string(cfgBytes) + } + if enabled, ok := input["is_enabled"].(bool); ok { + ch.IsEnabled = &enabled + } + model.DB.Save(&ch) + c.JSON(http.StatusOK, toChannelResponse(ch)) +} + +// DELETE /api/v1/notifications/:id +func DeleteNotification(c *gin.Context) { + id, _ := strconv.Atoi(c.Param("id")) + model.DB.Delete(&model.NotificationChannel{}, id) + c.JSON(http.StatusOK, gin.H{"message": "已删除"}) +} + +// POST /api/v1/notifications/:id/test +func TestNotificationSend(c *gin.Context) { + id, _ := strconv.Atoi(c.Param("id")) + var ch model.NotificationChannel + if err := model.DB.First(&ch, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "通知渠道不存在"}) + return + } + + var cfg map[string]interface{} + _ = json.Unmarshal([]byte(ch.Config), &cfg) + webhookURL, _ := cfg["webhook_url"].(string) + if webhookURL == "" { + c.JSON(http.StatusBadRequest, gin.H{"detail": "Webhook URL 未配置"}) + return + } + + title := "SQL审核平台 - 通知测试" + body := "这是一条测试消息，如果收到说明通知渠道配置正确。" + + var sendErr error + switch ch.ChannelType { + case "webhook_feishu": + sendErr = sendFeishuWebhook(webhookURL, title, body) + case "dingtalk": + secret, _ := cfg["secret"].(string) + sendErr = sendDingtalkWebhook(webhookURL, secret, title, body) + default: + c.JSON(http.StatusBadRequest, gin.H{"detail": "不支持的通知类型: " + ch.ChannelType}) + return + } + + if sendErr != nil { + c.JSON(http.StatusInternalServerError, gin.H{"detail": "发送失败: " + sendErr.Error()}) + return + } + c.JSON(http.StatusOK, gin.H{"message": "测试消息已发送"}) +} + +func sendFeishuWebhook(webhookURL, title, body string) error { + payload := map[string]interface{}{ + "msg_type": "interactive", + "card": map[string]interface{}{ + "elements": []map[string]interface{}{ + {"tag": "markdown", "content": body}, + }, + }, + } + return postJSON(webhookURL, payload) +} + +func sendDingtalkWebhook(webhookURL, secret, title, body string) error { + dingBody := title + "\n\n" + body + payload := map[string]interface{}{ + "msgtype": "markdown", + "markdown": map[string]string{ + "title": title, + "text": dingBody, + }, + } + return postJSON(webhookURL, payload) +} + +func postJSON(url string, payload interface{}) error { + data, _ := json.Marshal(payload) + resp, err := http.Post(url, "application/json", bytes.NewReader(data)) + if err != nil { + return err + } + defer resp.Body.Close() + io.Copy(io.Discard, resp.Body) + return nil +} diff --git a/backend/internal/handler/redis.go b/backend/internal/handler/redis.go new file mode 100644 index 0000000..469bf32 --- /dev/null +++ b/backend/internal/handler/redis.go @@ -0,0 +1,152 @@ +package handler + +import ( + "net/http" + "strconv" + + "sql-platform/internal/model" + + "github.com/gin-gonic/gin" +) + +// GET /api/v1/redis/:id/info +func RedisInfo(c *gin.Context) { + id := c.Param("id") + var instance model.Instance + if err := model.DB.First(&instance, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Instance not found"}) + return + } + // TODO: actual Redis INFO command + c.JSON(http.StatusOK, gin.H{ + "redis_version": "placeholder", + "used_memory": "0", + "connected_clients": "0", + "db_size": 0, + }) +} + +// GET /api/v1/redis/:id/dbsize +func RedisDbsize(c *gin.Context) { + id := c.Param("id") + var instance model.Instance + if err := model.DB.First(&instance, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Instance not found"}) + return + } + // TODO: actual DBSIZE + c.JSON(http.StatusOK, gin.H{"db_size": 0}) +} + +// GET /api/v1/redis/:id/keys +func RedisScanKeys(c *gin.Context) { + id := c.Param("id") + _ = c.Query("db") + _ = c.Query("pattern") + _ = c.Query("count") + _ = c.Query("cursor") + _ = c.Query("type") + + var instance model.Instance + if err := model.DB.First(&instance, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Instance not found"}) + return + } + // TODO: actual SCAN command + c.JSON(http.StatusOK, gin.H{ + "keys": []interface{}{}, + "cursor": 0, + "total": 0, + }) +} + +// GET /api/v1/redis/:id/keys/:key +func RedisGetKeyDetail(c *gin.Context) { + id := c.Param("id") + key := c.Param("key") + _ = key + + var instance model.Instance + if err := model.DB.First(&instance, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Instance not found"}) + return + } + // TODO: actual key detail lookup + c.JSON(http.StatusOK, gin.H{ + "key": key, + "type": "string", + "value": "", + "ttl": -1, + }) +} + +// GET /api/v1/redis/:id/slowlog +func RedisSlowlog(c *gin.Context) { + id := c.Param("id") + var instance model.Instance + if err := model.DB.First(&instance, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Instance not found"}) + return + } + // TODO: actual SLOWLOG GET + c.JSON(http.StatusOK, []interface{}{}) +} + +// GET /api/v1/redis/:id/clients +func RedisClients(c *gin.Context) { + id := c.Param("id") + var instance model.Instance + if err := model.DB.First(&instance, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Instance not found"}) + return + } + // TODO: actual CLIENT LIST + c.JSON(http.StatusOK, []interface{}{}) +} + +// POST /api/v1/redis/:id/command +func RedisExecuteCommand(c *gin.Context) { + id := c.Param("id") + var instance model.Instance + if err := model.DB.First(&instance, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Instance not found"}) + return + } + // TODO: actual command execution + c.JSON(http.StatusOK, gin.H{"result": "Command execution not implemented"}) +} + +// POST /api/v1/redis/:id/keys +func RedisCreateKey(c *gin.Context) { + id := c.Param("id") + _, _ = id, c.Request.Body + c.JSON(http.StatusOK, gin.H{"message": "Key created (placeholder)"}) +} + +// DELETE /api/v1/redis/:id/keys/:key +func RedisDeleteKey(c *gin.Context) { + id := c.Param("id") + key := c.Param("key") + _, _ = id, key + c.JSON(http.StatusOK, gin.H{"message": "Key deleted (placeholder)"}) +} + +// POST /api/v1/workflows/:id/clone +func CloneWorkflow(c *gin.Context) { + id, _ := strconv.Atoi(c.Param("id")) + var wf model.WorkflowDefinition + if err := model.DB.First(&wf, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Workflow not found"}) + return + } + // clone + newWf := model.WorkflowDefinition{ + Name: wf.Name + "-副本", + Description: wf.Description, + Category: wf.Category, + IsActive: wf.IsActive, + FlowConfig: wf.FlowConfig, + } + model.DB.Create(&newWf) + c.JSON(http.StatusCreated, newWf) +} diff --git a/backend/internal/handler/workflow.go b/backend/internal/handler/workflow.go new file mode 100644 index 0000000..3e75444 --- /dev/null +++ b/backend/internal/handler/workflow.go @@ -0,0 +1,208 @@ +package handler + +import ( + "net/http" + + "sql-platform/internal/model" + + "github.com/gin-gonic/gin" +) + +// GET /api/v1/workflows/:id +func GetWorkflow(c *gin.Context) { + id := c.Param("id") + var wf model.WorkflowDefinition + if err := model.DB.First(&wf, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Workflow not found"}) + return + } + var steps []model.WorkflowStep + model.DB.Where("workflow_id = ?", wf.ID).Order("step_number").Find(&steps) + c.JSON(http.StatusOK, gin.H{ + "id": wf.ID, + "name": wf.Name, + "description": wf.Description, + "category": wf.Category, + "is_default": wf.IsDefault, + "is_active": wf.IsActive, + "created_at": wf.CreatedAt, + "updated_at": wf.UpdatedAt, + "created_by": wf.CreatedBy, + "steps": steps, + }) +} + +// POST /api/v1/workflows +func CreateWorkflow(c *gin.Context) { + var input struct { + Name string `json:"name" binding:"required"` + Description string `json:"description"` + Category string `json:"category"` + IsActive *bool `json:"is_active"` + IsDefault *bool `json:"is_default"` + Steps []struct { + StepNumber int `json:"step_number"` + Name string `json:"name"` + Description string `json:"description"` + StepType string `json:"step_type"` + ApproverRole string `json:"approver_role"` + ApproverIDs string `json:"approver_ids"` + IsRequired *bool `json:"is_required"` + TimeoutHours *int `json:"timeout_hours"` + AutoApproveOnTimeout *bool `json:"auto_approve_on_timeout"` + } `json:"steps"` + } + if err := c.ShouldBindJSON(&input); err != nil { + c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()}) + return + } + + active := true + if input.IsActive != nil { + active = *input.IsActive + } + wf := model.WorkflowDefinition{ + Name: input.Name, + Description: &input.Description, + Category: &input.Category, + IsActive: &active, + IsDefault: input.IsDefault, + } + if err := model.DB.Create(&wf).Error; err != nil { + c.JSON(http.StatusInternalServerError, gin.H{"detail": err.Error()}) + return + } + + for _, s := range input.Steps { + step := model.WorkflowStep{ + WorkflowID: wf.ID, + StepNumber: s.StepNumber, + Name: s.Name, + Description: &s.Description, + StepType: s.StepType, + ApproverRole: &s.ApproverRole, + ApproverIDs: &s.ApproverIDs, + IsRequired: s.IsRequired, + TimeoutHours: s.TimeoutHours, + AutoApproveOnTimeout: s.AutoApproveOnTimeout, + } + model.DB.Create(&step) + } + + c.JSON(http.StatusCreated, gin.H{"id": wf.ID, "message": "Workflow created"}) +} + +// PUT /api/v1/workflows/:id +func UpdateWorkflow(c *gin.Context) { + id := c.Param("id") + var wf model.WorkflowDefinition + if err := model.DB.First(&wf, id).Error; err != nil { + c.JSON(http.StatusNotFound, gin.H{"detail": "Workflow not found"}) + return + } + + var input map[string]interface{} + if err := c.ShouldBindJSON(&input); err != nil { + c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()}) + return + } + + model.DB.Model(&wf).Updates(input) + + // If steps provided, replace them + if stepsRaw, ok := input["steps"]; ok { + model.DB.Where("workflow_id = ?", wf.ID).Delete(&model.WorkflowStep{}) + if stepsArr, ok := stepsRaw.([]interface{}); ok { + for i, sRaw := range stepsArr { + if sMap, ok := sRaw.(map[string]interface{}); ok { + step := model.WorkflowStep{ + WorkflowID: wf.ID, + StepNumber: i + 1, + } + if v, ok := sMap["name"].(string); ok { + step.Name = v + } + if v, ok := sMap["step_type"].(string); ok { + step.StepType = v + } + if v, ok := sMap["approver_role"].(string); ok { + step.ApproverRole = &v + } + if v, ok := sMap["approver_ids"].(string); ok { + step.ApproverIDs = &v + } + if v, ok := sMap["description"].(string); ok { + step.Description = &v + } + model.DB.Create(&step) + } + } + } + } + + c.JSON(http.StatusOK, gin.H{"message": "Workflow updated"}) +} + +// DELETE /api/v1/workflows/:id +func DeleteWorkflow(c *gin.Context) { + id := c.Param("id") + model.DB.Where("workflow_id = ?", id).Delete(&model.WorkflowStep{}) + model.DB.Delete(&model.WorkflowDefinition{}, id) + c.JSON(http.StatusOK, gin.H{"message": "Workflow deleted"}) +} + +// POST /api/v1/workflows/:id/set-default +func SetDefaultWorkflow(c *gin.Context) { + id := c.Param("id") + // unset all defaults + model.DB.Model(&model.WorkflowDefinition{}).Where("is_default = ?", true).Update("is_default", false) + // set this one as default + defaultVal := true + model.DB.Model(&model.WorkflowDefinition{}).Where("id = ?", id).Update("is_default", defaultVal) + c.JSON(http.StatusOK, gin.H{"message": "Default workflow set"}) +} + +// POST /api/v1/users/:id/reset-password +func ResetPassword(c *gin.Context) { + id := c.Param("id") + var input struct { + NewPassword string `json:"new_password" binding:"required"` + } + if err := c.ShouldBindJSON(&input); err != nil { + c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()}) + return + } + _, _ = id, input.NewPassword + // TODO: hash password and update + c.JSON(http.StatusOK, gin.H{"message": "Password reset (placeholder)"}) +} + +// POST /api/v1/users/batch-import +func BatchImportUsers(c *gin.Context) { + c.JSON(http.StatusOK, gin.H{"message": "Batch import (placeholder)", "count": 0}) +} + +// POST /api/v1/users/batch-import-ldap +func BatchImportLdapUsers(c *gin.Context) { + c.JSON(http.StatusOK, gin.H{"message": "LDAP import (placeholder)", "count": 0}) +} + +// GET /api/v1/users/import-template +func ImportTemplate(c *gin.Context) { + c.JSON(http.StatusOK, gin.H{"message": "Template download (placeholder)"}) +} + +// POST /api/v1/users/:userId/reset-password +func ResetUserPassword(c *gin.Context) { + userId := c.Param("userId") + var input struct { + NewPassword string `json:"new_password" binding:"required"` + } + if err := c.ShouldBindJSON(&input); err != nil { + c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()}) + return + } + // TODO: actually hash and save + _ = userId + c.JSON(http.StatusOK, gin.H{"message": "Password reset (placeholder)"}) +} diff --git a/backend/router/router.go b/backend/router/router.go index e743da2..eb52673 100644 --- a/backend/router/router.go +++ b/backend/router/router.go @@ -42,6 +42,16 @@ func Setup(r *gin.Engine) { auth.POST("/instances/:id/test-connection", handler.TestConnection) auth.POST("/instances/test-connection", handler.TestNewConnection) + // Instance Detail (databases/tables/schema/processlist/status/users) + auth.GET("/instances/:id/detail/databases", handler.DetailListDatabases) + auth.GET("/instances/:id/detail/tables", handler.DetailListTables) + auth.GET("/instances/:id/detail/db-schema", handler.DetailDbSchema) + auth.GET("/instances/:id/detail/table-detail", handler.DetailTableDetail) + auth.GET("/instances/:id/detail/processlist", handler.DetailProcesslist) + auth.GET("/instances/:id/detail/status", handler.DetailStatus) + auth.POST("/instances/:id/detail/processlist/:pid/kill", handler.DetailKillProcess) + auth.GET("/instances/:id/detail/users", handler.DetailListUsers) + // Instance management (admin/dba only) admin := auth.Group("") admin.Use(middleware.RequireRole("admin", "dba")) @@ -69,6 +79,17 @@ func Setup(r *gin.Engine) { igAdmin.DELETE("/instance-groups/:id", handler.DeleteInstanceGroup) } + // Redis + auth.GET("/redis/:id/info", handler.RedisInfo) + auth.GET("/redis/:id/dbsize", handler.RedisDbsize) + auth.GET("/redis/:id/keys", handler.RedisScanKeys) + auth.GET("/redis/:id/keys/:key", handler.RedisGetKeyDetail) + auth.GET("/redis/:id/slowlog", handler.RedisSlowlog) + auth.GET("/redis/:id/clients", handler.RedisClients) + auth.POST("/redis/:id/command", handler.RedisExecuteCommand) + auth.POST("/redis/:id/keys", handler.RedisCreateKey) + auth.DELETE("/redis/:id/keys/:key", handler.RedisDeleteKey) + // Users (admin only) userAdmin := auth.Group("") userAdmin.Use(middleware.RequireRole("admin")) @@ -77,6 +98,10 @@ func Setup(r *gin.Engine) { userAdmin.POST("/users", handler.CreateUser) userAdmin.PUT("/users/:id", handler.UpdateUser) userAdmin.DELETE("/users/:id", handler.DeleteUser) + userAdmin.POST("/users/:id/reset-password", handler.ResetUserPassword) + userAdmin.POST("/users/batch-import", handler.BatchImportUsers) + userAdmin.POST("/users/batch-import-ldap", handler.BatchImportLdapUsers) + userAdmin.GET("/users/import-template", handler.ImportTemplate) } // LDAP config (admin only) @@ -91,6 +116,7 @@ func Setup(r *gin.Engine) { ldapAdmin.POST("/ldap-config/create-ou", handler.CreateLDAPOU) ldapAdmin.POST("/ldap-config/create-user", handler.CreateLDAPUser) ldapAdmin.POST("/ldap-config/batch-import-ldap", handler.BatchImportLDAP) + ldapAdmin.POST("/ldap-config/delete-user", handler.DeleteLDAPUser) } // Settings @@ -109,13 +135,29 @@ func Setup(r *gin.Engine) { ghostGroup.GET("/ghost/tasks", handler.GhOstListTasks) } + // Audit Logs + auth.GET("/audit-logs", handler.ListAuditLogs) + + // Query execution + auth.POST("/query/execute", handler.ExecuteQuery) + // Read-only resources auth.GET("/audit-rules", handler.ListAuditRules) auth.GET("/announcements", handler.ListAnnouncements) auth.GET("/query-histories", handler.ListQueryHistories) - auth.GET("/notifications/channels", handler.ListNotificationChannels) - auth.GET("/notifications/templates", handler.ListNotificationTemplates) + // Notifications CRUD (replaces old channels/templates endpoints) + auth.GET("/notifications", handler.ListNotifications) + auth.POST("/notifications", handler.CreateNotification) + auth.PUT("/notifications/:id", handler.UpdateNotification) + auth.DELETE("/notifications/:id", handler.DeleteNotification) + auth.POST("/notifications/:id/test", handler.TestNotificationSend) auth.GET("/workflows", handler.ListWorkflows) - auth.POST("/notifications/test", handler.TestNotification) + auth.GET("/workflows/:id", handler.GetWorkflow) + auth.POST("/workflows", handler.CreateWorkflow) + auth.PUT("/workflows/:id", handler.UpdateWorkflow) + auth.DELETE("/workflows/:id", handler.DeleteWorkflow) + auth.POST("/workflows/:id/set-default", handler.SetDefaultWorkflow) + auth.POST("/workflows/:id/clone", handler.CloneWorkflow) + } } diff --git a/frontend/src/components/EditInstanceDialog.tsx b/frontend/src/components/EditInstanceDialog.tsx index e50e11f..407eb6f 100644 --- a/frontend/src/components/EditInstanceDialog.tsx +++ b/frontend/src/components/EditInstanceDialog.tsx @@ -121,7 +121,7 @@ export default function EditInstanceDialog({ instance, open, onClose, onSaved, m if (mode === 'clone') { payload.db_type = instance.db_type; if (!password) { - alert('克隆数据源需要重新输入密码'); + setError('克隆数据源需要重新输入密码'); setSubmitting(false); return; } diff --git a/frontend/src/pages/WorkflowPage.tsx b/frontend/src/pages/WorkflowPage.tsx index 507cee7..6e33609 100644 --- a/frontend/src/pages/WorkflowPage.tsx +++ b/frontend/src/pages/WorkflowPage.tsx @@ -475,7 +475,8 @@ export default function WorkflowPage() { setLoading(true); setError(null); const data = await workflowApi.list(); - setItems(Array.isArray(data) ? data : []); + const normalized = (Array.isArray(data) ? data : []).map((w: any) => ({ ...w, steps: w.steps || [] })); + setItems(normalized); } catch (err: unknown) { const msg = (err as { response?: { data?: { detail?: string } } })?.response?.data?.detail || '获取审批流程失败'; setError(msg); @@ -588,7 +589,7 @@ export default function WorkflowPage() { { label: '流程总数', value: items.length, icon: GitBranch, color: 'text-blue-400', bg: 'bg-blue-400/10' }, { label: '已启用', value: items.filter((w) => w.is_active).length, icon: CheckCircle, color: 'text-green-400', bg: 'bg-green-400/10' }, { label: '默认流程', value: items.filter((w) => w.is_default).length, icon: Star, color: 'text-yellow-400', bg: 'bg-yellow-400/10' }, - { label: '总步骤数', value: items.reduce((acc, w) => acc + w.steps.length, 0), icon: Users, color: 'text-purple-400', bg: 'bg-purple-400/10' }, + { label: '总步骤数', value: items.reduce((acc, w) => acc + (w.steps?.length || 0), 0), icon: Users, color: 'text-purple-400', bg: 'bg-purple-400/10' }, ].map((s, i) => ( diff --git a/pytest.ini b/pytest.ini new file mode 100644 index 0000000..78c5011 --- /dev/null +++ b/pytest.ini @@ -0,0 +1,3 @@ +[pytest] +asyncio_mode = auto +testpaths = tests diff --git a/run_tests.sh b/run_tests.sh new file mode 100755 index 0000000..ef7a9ff --- /dev/null +++ b/run_tests.sh @@ -0,0 +1,20 @@ +#!/bin/bash +# SQL-Platform 测试运行脚本 +# 用法: bash run_tests.sh [test_file_or_pattern] +# 示例: bash run_tests.sh test_auth.py +# bash run_tests.sh test_ticket + +set -e + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +BACKEND_PY="$SCRIPT_DIR/backend-python" +TEST_DIR="$SCRIPT_DIR/tests" +PYTHON="$BACKEND_PY/venv/bin/python" + +export PYTHONPATH="$BACKEND_PY" + +if [ -n "$1" ]; then + "$PYTHON" -m pytest "$TEST_DIR/$1" -v --tb=short --no-header "$@" 2>&1 +else + "$PYTHON" -m pytest "$TEST_DIR/" -v --tb=short --no-header 2>&1 +fi diff --git a/tests/__init__.py b/tests/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/tests/conftest.py b/tests/conftest.py new file mode 100644 index 0000000..4f6294f --- /dev/null +++ b/tests/conftest.py @@ -0,0 +1,182 @@ +from typing import AsyncGenerator + +import pytest_asyncio +from httpx import ASGITransport, AsyncClient +from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine, async_sessionmaker +from sqlalchemy import text + +from app.core.database import Base, get_db +from app.core.security import hash_password, create_access_token +from app.models.user import User +from app.models.instance import Instance +from app.models.instance_group import InstanceGroup, user_groups, instance_group_members +from app.models.ticket import Ticket +from app.models.audit_log import AuditLog +from app.models.audit_rule import AuditRule +from app.models.announcement import Announcement +from app.models.notification import NotificationChannel +from app.models.ldap_config import LdapConfig +from app.models.backup import Backup +from app.models.scheduled_task import ScheduledTask +from app.models.schema_revision import SchemaRevision +from app.models.masking_rule import MaskingRule +from app.models.notification_template import NotificationTemplate +from app.models.workflow import WorkflowDefinition, WorkflowStep, TicketApproval + +SQLALCHEMY_DATABASE_URL = "sqlite+aiosqlite://" + +engine = create_async_engine(SQLALCHEMY_DATABASE_URL, echo=False) +TestSessionLocal = async_sessionmaker(engine, class_=AsyncSession, expire_on_commit=False) + + +@pytest_asyncio.fixture(scope="session", autouse=True) +async def setup_database(): + async with engine.begin() as conn: + await conn.run_sync(Base.metadata.create_all) + yield + async with engine.begin() as conn: + await conn.run_sync(Base.metadata.drop_all) + + +@pytest_asyncio.fixture(autouse=True) +async def clean_tables(): + yield + async with engine.begin() as conn: + for table in reversed(Base.metadata.sorted_tables): + await conn.execute(text(f"DELETE FROM {table.name}")) + + +@pytest_asyncio.fixture +async def db() -> AsyncGenerator[AsyncSession, None]: + async with TestSessionLocal() as session: + yield session + + +@pytest_asyncio.fixture +async def client(db: AsyncSession) -> AsyncGenerator[AsyncClient, None]: + from app.main import app + + async def _override(): + yield db + + app.dependency_overrides[get_db] = _override + + transport = ASGITransport(app=app) + async with AsyncClient(transport=transport, base_url="http://test") as c: + yield c + + app.dependency_overrides.clear() + + +@pytest_asyncio.fixture +async def admin_user(db: AsyncSession) -> User: + user = User( + username="admin", + display_name="管理员", + role="admin", + hashed_password=hash_password("123456"), + ) + db.add(user) + await db.commit() + await db.refresh(user) + return user + + +@pytest_asyncio.fixture +async def dba_user(db: AsyncSession) -> User: + user = User( + username="dba", + display_name="DBA张三", + role="dba", + hashed_password=hash_password("123456"), + ) + db.add(user) + await db.commit() + await db.refresh(user) + return user + + +@pytest_asyncio.fixture +async def developer_user(db: AsyncSession) -> User: + user = User( + username="dev1", + display_name="开发者李四", + role="developer", + hashed_password=hash_password("123456"), + ) + db.add(user) + await db.commit() + await db.refresh(user) + return user + + +@pytest_asyncio.fixture +async def guest_user(db: AsyncSession) -> User: + user = User( + username="guest1", + display_name="访客", + role="guest", + hashed_password=hash_password("123456"), + ) + db.add(user) + await db.commit() + await db.refresh(user) + return user + + +@pytest_asyncio.fixture +async def disabled_user(db: AsyncSession) -> User: + user = User( + username="disabled", + display_name="已禁用用户", + role="developer", + is_active=False, + hashed_password=hash_password("123456"), + ) + db.add(user) + await db.commit() + await db.refresh(user) + return user + + +@pytest_asyncio.fixture +async def admin_token(admin_user: User) -> str: + return create_access_token(data={"sub": str(admin_user.id), "role": admin_user.role}) + + +@pytest_asyncio.fixture +async def dba_token(dba_user: User) -> str: + return create_access_token(data={"sub": str(dba_user.id), "role": dba_user.role}) + + +@pytest_asyncio.fixture +async def developer_token(developer_user: User) -> str: + return create_access_token(data={"sub": str(developer_user.id), "role": developer_user.role}) + + +@pytest_asyncio.fixture +async def guest_token(guest_user: User) -> str: + return create_access_token(data={"sub": str(guest_user.id), "role": guest_user.role}) + + +def auth_header(token: str) -> dict: + return {"Authorization": f"Bearer {token}"} + + +@pytest_asyncio.fixture +async def test_instance(db: AsyncSession) -> Instance: + instance = Instance( + name="测试MySQL", + db_type="mysql", + host="127.0.0.1", + port=3306, + username="root", + password="test123", + database="test_db", + env="development", + status="disconnected", + ) + db.add(instance) + await db.commit() + await db.refresh(instance) + return instance diff --git a/tests/test_announcement.py b/tests/test_announcement.py new file mode 100644 index 0000000..86331d4 --- /dev/null +++ b/tests/test_announcement.py @@ -0,0 +1,318 @@ +"""Comprehensive tests for Announcement CRUD, permissions, and edge cases.""" +import pytest +from httpx import AsyncClient + +from tests.conftest import auth_header + +BASE = "/api/v1/announcements" + +# ─── CREATE (POST /announcements) ────────────────────────────────────── + +PAYLOAD = { + "title": "系统维护通知", + "content": "将于本周六凌晨进行系统维护，届时服务将暂停。", +} + + +@pytest.mark.asyncio +async def test_create_announcement(client: AsyncClient, admin_token: str): + resp = await client.post(BASE, json=PAYLOAD, headers=auth_header(admin_token)) + assert resp.status_code == 201 + data = resp.json() + assert data["title"] == PAYLOAD["title"] + assert data["content"] == PAYLOAD["content"] + assert data["is_published"] is False + assert data["published_at"] is None + assert "id" in data + assert "created_at" in data + assert "updated_at" in data + + +@pytest.mark.asyncio +async def test_create_announcement_empty_title(client: AsyncClient, admin_token: str): + resp = await client.post( + BASE, json={"title": "", "content": "内容"}, headers=auth_header(admin_token) + ) + assert resp.status_code == 422 + + +@pytest.mark.asyncio +async def test_create_announcement_title_too_long(client: AsyncClient, admin_token: str): + resp = await client.post( + BASE, json={"title": "x" * 201, "content": "内容"}, headers=auth_header(admin_token) + ) + assert resp.status_code == 422 + + +@pytest.mark.asyncio +async def test_create_announcement_empty_content(client: AsyncClient, admin_token: str): + resp = await client.post( + BASE, json={"title": "标题", "content": ""}, headers=auth_header(admin_token) + ) + assert resp.status_code == 422 + + +@pytest.mark.asyncio +async def test_create_announcement_missing_fields(client: AsyncClient, admin_token: str): + resp = await client.post(BASE, json={}, headers=auth_header(admin_token)) + assert resp.status_code == 422 + + +# ─── LIST (GET /announcements) ───────────────────────────────────────── + + +@pytest.mark.asyncio +async def test_list_announcements_empty(client: AsyncClient, admin_token: str): + resp = await client.get(BASE, headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert resp.json() == [] + + +@pytest.mark.asyncio +async def test_list_announcements_returns_all(client: AsyncClient, admin_token: str): + for i in range(3): + await client.post( + BASE, + json={"title": f"公告{i}", "content": f"内容{i}"}, + headers=auth_header(admin_token), + ) + resp = await client.get(BASE, headers=auth_header(admin_token)) + assert resp.status_code == 200 + items = resp.json() + assert len(items) == 3 + # ordered by id desc + assert items[0]["title"] == "公告2" + assert items[2]["title"] == "公告0" + + +@pytest.mark.asyncio +async def test_list_announcements_requires_auth(client: AsyncClient): + resp = await client.get(BASE) + assert resp.status_code == 401 + + +# ─── UPDATE (PUT /announcements/{id}) ────────────────────────────────── + + +@pytest.mark.asyncio +async def test_update_announcement_title(client: AsyncClient, admin_token: str): + create = await client.post(BASE, json=PAYLOAD, headers=auth_header(admin_token)) + aid = create.json()["id"] + + resp = await client.put( + f"{BASE}/{aid}", + json={"title": "更新后的标题"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["title"] == "更新后的标题" + # content unchanged + assert resp.json()["content"] == PAYLOAD["content"] + + +@pytest.mark.asyncio +async def test_update_announcement_content(client: AsyncClient, admin_token: str): + create = await client.post(BASE, json=PAYLOAD, headers=auth_header(admin_token)) + aid = create.json()["id"] + + resp = await client.put( + f"{BASE}/{aid}", + json={"content": "新内容"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["content"] == "新内容" + + +@pytest.mark.asyncio +async def test_update_announcement_publish(client: AsyncClient, admin_token: str): + create = await client.post(BASE, json=PAYLOAD, headers=auth_header(admin_token)) + aid = create.json()["id"] + assert create.json()["is_published"] is False + + resp = await client.put( + f"{BASE}/{aid}", + json={"is_published": True}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["is_published"] is True + # published_at should be set on first publish + assert data["published_at"] is not None + + +@pytest.mark.asyncio +async def test_update_announcement_publish_idempotent(client: AsyncClient, admin_token: str): + """Publishing an already-published announcement should not change published_at.""" + create = await client.post(BASE, json=PAYLOAD, headers=auth_header(admin_token)) + aid = create.json()["id"] + + first = await client.put( + f"{BASE}/{aid}", + json={"is_published": True}, + headers=auth_header(admin_token), + ) + first_published_at = first.json()["published_at"] + + # Update title while staying published + second = await client.put( + f"{BASE}/{aid}", + json={"title": "改标题不改发布时间"}, + headers=auth_header(admin_token), + ) + assert second.json()["published_at"] == first_published_at + + +@pytest.mark.asyncio +async def test_update_announcement_unpublish(client: AsyncClient, admin_token: str): + create = await client.post(BASE, json=PAYLOAD, headers=auth_header(admin_token)) + aid = create.json()["id"] + + # publish first + await client.put( + f"{BASE}/{aid}", + json={"is_published": True}, + headers=auth_header(admin_token), + ) + # then unpublish + resp = await client.put( + f"{BASE}/{aid}", + json={"is_published": False}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["is_published"] is False + + +@pytest.mark.asyncio +async def test_update_nonexistent_announcement(client: AsyncClient, admin_token: str): + resp = await client.put( + f"{BASE}/99999", + json={"title": "不存在"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + +@pytest.mark.asyncio +async def test_update_announcement_empty_title(client: AsyncClient, admin_token: str): + create = await client.post(BASE, json=PAYLOAD, headers=auth_header(admin_token)) + aid = create.json()["id"] + + resp = await client.put( + f"{BASE}/{aid}", + json={"title": ""}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 422 + + +# ─── DELETE (DELETE /announcements/{id}) ─────────────────────────────── + + +@pytest.mark.asyncio +async def test_delete_announcement(client: AsyncClient, admin_token: str): + create = await client.post(BASE, json=PAYLOAD, headers=auth_header(admin_token)) + aid = create.json()["id"] + + resp = await client.delete(f"{BASE}/{aid}", headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert "message" in resp.json() + + # verify it's gone from list + items = (await client.get(BASE, headers=auth_header(admin_token))).json() + assert all(a["id"] != aid for a in items) + + +@pytest.mark.asyncio +async def test_delete_nonexistent_announcement(client: AsyncClient, admin_token: str): + resp = await client.delete(f"{BASE}/99999", headers=auth_header(admin_token)) + assert resp.status_code == 404 + + +# ─── PERMISSION CHECKS ───────────────────────────────────────────────── + + +@pytest.mark.asyncio +async def test_create_requires_admin(client: AsyncClient, dba_token: str): + resp = await client.post(BASE, json=PAYLOAD, headers=auth_header(dba_token)) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_update_requires_admin(client: AsyncClient, dba_token: str): + resp = await client.put( + f"{BASE}/1", json={"title": "x"}, headers=auth_header(dba_token) + ) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_delete_requires_admin(client: AsyncClient, developer_token: str): + resp = await client.delete(f"{BASE}/1", headers=auth_header(developer_token)) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_list_allows_any_authenticated_user( + client: AsyncClient, developer_token: str +): + """All logged-in users can list announcements (not admin-only).""" + resp = await client.get(BASE, headers=auth_header(developer_token)) + assert resp.status_code == 200 + + +@pytest.mark.asyncio +async def test_guest_can_list_announcements(client: AsyncClient, guest_token: str): + resp = await client.get(BASE, headers=auth_header(guest_token)) + assert resp.status_code == 200 + + +# ─── EDGE CASES ───────────────────────────────────────────────────────── + + +@pytest.mark.asyncio +async def test_no_auth_returns_401(client: AsyncClient): + for method, url in [ + ("get", BASE), + ("post", BASE), + ("put", f"{BASE}/1"), + ("delete", f"{BASE}/1"), + ]: + resp = await getattr(client, method)(url) + assert resp.status_code == 401, f"{method.upper()} {url} should be 401, got {resp.status_code}" + + +@pytest.mark.asyncio +async def test_create_and_full_lifecycle(client: AsyncClient, admin_token: str): + """Create → list → update → publish → list → delete → 404.""" + # create + create = await client.post(BASE, json=PAYLOAD, headers=auth_header(admin_token)) + assert create.status_code == 201 + aid = create.json()["id"] + + # list contains it + items = (await client.get(BASE, headers=auth_header(admin_token))).json() + assert any(a["id"] == aid for a in items) + + # update title + upd = await client.put( + f"{BASE}/{aid}", json={"title": "新标题"}, headers=auth_header(admin_token) + ) + assert upd.json()["title"] == "新标题" + + # publish + pub = await client.put( + f"{BASE}/{aid}", json={"is_published": True}, headers=auth_header(admin_token) + ) + assert pub.json()["is_published"] is True + + # delete + await client.delete(f"{BASE}/{aid}", headers=auth_header(admin_token)) + + # update non-existent → 404 + resp = await client.put( + f"{BASE}/{aid}", json={"title": "x"}, headers=auth_header(admin_token) + ) + assert resp.status_code == 404 diff --git a/tests/test_approval_flow_comprehensive.py b/tests/test_approval_flow_comprehensive.py new file mode 100644 index 0000000..39ccf75 --- /dev/null +++ b/tests/test_approval_flow_comprehensive.py @@ -0,0 +1,339 @@ +"""审批流全面场景测试 — MySQL + Redis。 + +覆盖: + - MySQL: 基础查询/写入、高危DDL、性能规则、安全规则 + - Redis: 基础读写、高危命令、特殊场景 + - 审核引擎规则命中 + 风险等级自动计算 + 审批流匹配 +""" + +import pytest +import asyncio +from unittest.mock import AsyncMock, MagicMock + + +def _audit_sql(sql, db_type="mysql"): + """辅助：直接调审核引擎，返回 findings。""" + from app.services.audit_engine_v2 import SQLAuditEngineV2 + + async def _run(): + engine = SQLAuditEngineV2(db_session=None, env="development") + report = await engine.audit(sql, db_type=db_type) + return report + + return asyncio.get_event_loop().run_until_complete(_run()) + + +def _eval_risk(sql, db_type="mysql", sql_type="", table_sizes=None): + """辅助：直接调风险评估。""" + from app.services.risk_evaluator import evaluate_risk_level + return evaluate_risk_level(sql, db_type=db_type, sql_type=sql_type, table_sizes=table_sizes) + + +# ══════════════════════════════════════════════ +# 一、MySQL 基础功能测试 +# ══════════════════════════════════════════════ + +class TestMySQLBasic: + """MySQL 基础功能 — 查询/写入/批量/无WHERE。""" + + def test_01_simple_select_low_risk(self): + """#1 简单查询 — risk=low。""" + risk = _eval_risk("SELECT * FROM users LIMIT 10;", db_type="mysql", sql_type="DQL") + assert risk == "low" + + def test_02_simple_insert_medium(self): + """#2 简单 INSERT — risk=medium。""" + risk = _eval_risk("INSERT INTO users(name) VALUES('test');", db_type="mysql", sql_type="DML") + assert risk == "medium" + + def test_03_batch_insert_high(self): + """#3 批量 INSERT(1000条) — risk=high（statement_count>5）。""" + sql = "INSERT INTO users(name) VALUES('test');\n" * 1000 + from app.services.risk_evaluator import evaluate_risk_level + import sqlparse + stmt_list = [s.strip() for s in sqlparse.split(sql) if s.strip()] + risk = evaluate_risk_level(sql, db_type="mysql", sql_type="DML", statement_count=len(stmt_list)) + assert risk in ("high", "medium") + + def test_04_update_no_where_high_risk(self): + """#4 UPDATE 无 WHERE — risk=high。""" + risk = _eval_risk("UPDATE users SET status=1;", db_type="mysql") + assert risk == "high", f"预期 high，实际 {risk}" + + def test_05_delete_no_where_high_risk(self): + """#5 DELETE 无 WHERE — risk=high。""" + risk = _eval_risk("DELETE FROM users;", db_type="mysql") + assert risk == "high", f"预期 high，实际 {risk}" + + +# ══════════════════════════════════════════════ +# 二、MySQL 高危 DDL 操作 +# ══════════════════════════════════════════════ + +class TestMySQLDDL: + """MySQL 高危 DDL — DROP/TRUNCATE/ALTER。""" + + def test_06_drop_table_critical(self): + """#6 DROP TABLE — risk=critical。""" + risk = _eval_risk("DROP TABLE users;", db_type="mysql") + assert risk == "critical" + + def test_06_drop_table_audit_blocked(self): + """#6 DROP TABLE — 审核引擎拦截（DDL-004 / MYSQL-DDL-016）。""" + report = _audit_sql("DROP TABLE users;", db_type="mysql") + findings = report.findings if hasattr(report, 'findings') else [] + codes = [f.rule_code for f in findings] + # DDL-004(禁止DROP TABLE) 或 MYSQL-DDL-016 都算拦截 + assert any(c in codes for c in ("DDL-004", "MYSQL-DDL-016")), f"DROP TABLE 应被拦截，实际命中: {codes}" + + def test_07_truncate_critical(self): + """#7 TRUNCATE — risk=critical。""" + risk = _eval_risk("TRUNCATE TABLE orders;", db_type="mysql") + assert risk == "critical" + + def test_08_alter_large_table_risk_upgrade(self): + """#8 ALTER 大表(>10万行) — risk 升级为 high。""" + risk = _eval_risk( + "ALTER TABLE orders ADD COLUMN new_col varchar(255);", + db_type="mysql", sql_type="DDL", + table_sizes={"orders": 1_000_000} + ) + assert risk == "high" + + def test_08_alter_small_table_medium(self): + """#8 ALTER 小表 — risk=medium。""" + risk = _eval_risk( + "ALTER TABLE users ADD COLUMN age INT;", + db_type="mysql", sql_type="DDL", + table_sizes={"users": 50} + ) + assert risk == "medium" + + def test_09_modify_column_warning(self): + """#9 MODIFY COLUMN — 审核引擎应有警告。""" + report = _audit_sql("ALTER TABLE users MODIFY id bigint;", db_type="mysql") + findings = report.findings if hasattr(report, 'findings') else [] + assert len(findings) > 0, "MODIFY COLUMN 应触发审核规则" + + def test_10_create_index_medium(self): + """#10 CREATE INDEX — risk=medium。""" + risk = _eval_risk( + "CREATE INDEX idx_name ON users(name);", + db_type="mysql", sql_type="DDL" + ) + assert risk == "medium" + + +# ══════════════════════════════════════════════ +# 三、MySQL 性能与安全规则 +# ══════════════════════════════════════════════ + +class TestMySQLPerfSecurity: + """MySQL 性能与安全规则检测。""" + + def test_select_star_production_warning(self): + """SELECT * 应触发审核警告。""" + report = _audit_sql("SELECT * FROM users;", db_type="mysql") + findings = report.findings if hasattr(report, 'findings') else [] + codes = [f.rule_code for f in findings] + # DQL-001 或类似规则 + assert len(findings) > 0, f"SELECT * 应触发审核规则，实际命中: {codes}" + + def test_multi_join_warning(self): + """多表 JOIN(>3) 应触发警告。""" + sql = """ + SELECT * FROM t1 + JOIN t2 ON t1.id = t2.t1_id + JOIN t3 ON t2.id = t3.t2_id + JOIN t4 ON t3.id = t4.t3_id + JOIN t5 ON t4.id = t5.t4_id + """ + report = _audit_sql(sql, db_type="mysql") + findings = report.findings if hasattr(report, 'findings') else [] + # 可能触发 JOIN 数量限制规则 + assert len(findings) > 0, "5表 JOIN 应触发审核规则" + + def test_sensitive_column_warning(self): + """敏感字段操作（password）应触发警告。""" + sql = "SELECT password, id_card FROM users;" + report = _audit_sql(sql, db_type="mysql") + findings = report.findings if hasattr(report, 'findings') else [] + # 安全规则应检测敏感字段 + assert len(findings) > 0, "敏感字段应触发安全规则" + + +# ══════════════════════════════════════════════ +# 四、Redis 基础命令测试 +# ══════════════════════════════════════════════ + +class TestRedisBasic: + """Redis 基础命令 — 读/写/批量/KEYS/FLUSH。""" + + def test_01_redis_get_low(self): + """Redis GET — risk=low。""" + risk = _eval_risk("GET user:1001", db_type="redis") + assert risk == "low" + + def test_02_redis_set_medium(self): + """Redis SET — risk=medium。""" + risk = _eval_risk("SET user:999 test EX 3600", db_type="redis") + assert risk == "medium" + + def test_04_redis_keys_high(self): + """Redis KEYS * — 生产环境应拦截。""" + # KEYS 不是写命令但极其危险 + # 当前 risk_evaluator 只按命令前缀判断，KEYS 不在写命令列表 + # 但审核引擎应该有规则拦截 + report = _audit_sql("KEYS user:*", db_type="redis") + findings = report.findings if hasattr(report, 'findings') else [] + # 至少应该有警告（如果审核引擎有 Redis 规则的话） + # 这里主要验证不 crash + assert report is not None + + def test_05_redis_flushall_critical(self): + """Redis FLUSHALL — risk=critical。""" + risk = _eval_risk("FLUSHALL", db_type="redis") + assert risk == "critical" + + def test_05_redis_flushdb_critical(self): + """Redis FLUSHDB — risk=critical。""" + risk = _eval_risk("FLUSHDB", db_type="redis") + assert risk == "critical" + + def test_05_redis_flushdb_audit_blocked(self): + """Redis FLUSHDB — 审核引擎拦截。""" + report = _audit_sql("FLUSHDB", db_type="redis") + findings = report.findings if hasattr(report, 'findings') else [] + codes = [f.rule_code for f in findings] + # Redis 规则应拦截 FLUSHDB + assert len(findings) > 0, f"FLUSHDB 应被拦截，实际: {codes}" + + +# ══════════════════════════════════════════════ +# 五、Redis 高危操作测试 +# ══════════════════════════════════════════════ + +class TestRedisDangerous: + """Redis 高危命令 — DEL/CONFIG/EVAL/BGSAVE。""" + + def test_06_redis_del_high(self): + """Redis DEL 大量Key — risk=high。""" + risk = _eval_risk("DEL key1 key2 key3 key4 key5", db_type="redis") + assert risk == "high" + + def test_07_redis_rename_high(self): + """Redis RENAME — risk=high。""" + risk = _eval_risk("RENAME oldkey newkey", db_type="redis") + assert risk == "high" + + def test_08_redis_config_set_warning(self): + """Redis CONFIG SET — 审核引擎应有规则。""" + report = _audit_sql("CONFIG SET maxmemory 10gb", db_type="redis") + findings = report.findings if hasattr(report, 'findings') else [] + # 验证不 crash + assert report is not None + + def test_09_redis_eval_script_warning(self): + """Redis EVAL Lua 脚本 — 应检测危险模式。""" + report = _audit_sql('EVAL "redis.call(\'FLUSHALL\')" 0', db_type="redis") + findings = report.findings if hasattr(report, 'findings') else [] + # FLUSHALL 在 EVAL 中应被检测 + assert len(findings) > 0, "EVAL 中包含 FLUSHALL 应被拦截" + + def test_10_redis_bgsave_low(self): + """Redis BGSAVE — risk=low（只读管理命令）。""" + risk = _eval_risk("BGSAVE", db_type="redis") + assert risk == "low" + + +# ══════════════════════════════════════════════ +# 六、风险等级边界测试 +# ══════════════════════════════════════════════ + +class TestRiskLevelBoundary: + """风险等级边界值测试。""" + + def test_critical_drop_database(self): + risk = _eval_risk("DROP DATABASE test_e2e;", db_type="mysql") + assert risk == "critical" + + def test_critical_drop_schema(self): + risk = _eval_risk("DROP SCHEMA public;", db_type="mysql") + assert risk == "critical" + + def test_high_alter_drop_column(self): + risk = _eval_risk("ALTER TABLE users DROP COLUMN age;", db_type="mysql") + assert risk == "high" + + def test_high_alter_drop_primary_key(self): + risk = _eval_risk("ALTER TABLE users DROP PRIMARY KEY;", db_type="mysql") + assert risk == "high" + + def test_high_delete_with_where_medium(self): + """DELETE 有 WHERE 但无 LIMIT — medium。""" + risk = _eval_risk("DELETE FROM users WHERE id = 1;", db_type="mysql") + assert risk == "medium" + + def test_low_select_with_where(self): + """SELECT 查询 — low。""" + risk = _eval_risk("SELECT id, name FROM users WHERE id = 1;", db_type="mysql") + assert risk == "low" + + def test_medium_insert(self): + """INSERT — medium。""" + risk = _eval_risk("INSERT INTO users(name) VALUES('test');", db_type="mysql", sql_type="DML") + assert risk == "medium" + + def test_medium_grant(self): + """GRANT — medium。""" + risk = _eval_risk("GRANT SELECT ON test.* TO 'reader'@'%';", db_type="mysql") + assert risk == "medium" + + def test_medium_create_table(self): + """CREATE TABLE — medium。""" + risk = _eval_risk("CREATE TABLE test_table (id INT PRIMARY KEY);", db_type="mysql") + assert risk == "medium" + + def test_table_sizes_exact_threshold(self): + """大表阈值：99999行不升级，100001行升级。""" + risk_below = _eval_risk( + "ALTER TABLE t ADD COLUMN x INT;", + db_type="mysql", sql_type="DDL", + table_sizes={"t": 99_999} + ) + assert risk_below == "medium" + + risk_above = _eval_risk( + "ALTER TABLE t ADD COLUMN x INT;", + db_type="mysql", sql_type="DDL", + table_sizes={"t": 100_001} + ) + assert risk_above == "high" + + +# ══════════════════════════════════════════════ +# 七、MongoDB 风险评估 +# ══════════════════════════════════════════════ + +class TestMongoDBRisk: + """MongoDB 操作风险评估。""" + + def test_mongo_drop_database_critical(self): + risk = _eval_risk("db.dropDatabase()", db_type="mongodb") + assert risk == "critical" + + def test_mongo_drop_collection_high(self): + risk = _eval_risk("db.users.drop()", db_type="mongodb") + assert risk == "high" + + def test_mongo_insert_medium(self): + risk = _eval_risk("db.users.insertOne({name: 'test'})", db_type="mongodb") + assert risk == "medium" + + def test_mongo_find_low(self): + risk = _eval_risk("db.users.find({})", db_type="mongodb") + assert risk == "low" + + def test_mongo_delete_many_high(self): + risk = _eval_risk("db.users.deleteMany({})", db_type="mongodb") + assert risk == "high" diff --git a/tests/test_audit_engine.py b/tests/test_audit_engine.py new file mode 100644 index 0000000..c6ff34e --- /dev/null +++ b/tests/test_audit_engine.py @@ -0,0 +1,193 @@ +"""Tests for SQL Audit Engine (Phase 3.2).""" +import pytest +from app.services.audit_engine import SQLAuditEngine, Severity + + +class TestSQLAuditEngine: + def setup_method(self): + self.engine = SQLAuditEngine(env="development") + + # --- DDL Rules --- + + def test_drop_table_without_if_exists(self): + report = self.engine.audit("DROP TABLE users;") + assert not report.passed or report.has_warnings + rules = [f.rule for f in report.findings] + assert "DROP_TABLE_DANGER" in rules + + def test_drop_table_production_blocked(self): + engine = SQLAuditEngine(env="production") + report = engine.audit("DROP TABLE users;") + assert report.has_warnings or not report.passed + warnings = [f for f in report.findings if f.rule == "DROP_TABLE_DANGER"] + assert len(warnings) > 0 + + def test_truncate_warning(self): + report = self.engine.audit("TRUNCATE TABLE logs;") + rules = [f.rule for f in report.findings] + assert "TRUNCATE_DANGER" in rules + + def test_truncate_production_error(self): + engine = SQLAuditEngine(env="production") + report = engine.audit("TRUNCATE TABLE logs;") + errors = [f for f in report.findings if f.level == Severity.ERROR] + assert any(f.rule == "TRUNCATE_DANGER" for f in errors) + + # --- Missing WHERE --- + + def test_update_no_where_error(self): + report = self.engine.audit("UPDATE users SET status = 1;") + assert not report.passed + errors = [f.rule for f in report.findings if f.level == Severity.ERROR] + assert "UPDATE_NO_WHERE" in errors + + def test_delete_no_where_error(self): + report = self.engine.audit("DELETE FROM users;") + assert not report.passed + errors = [f.rule for f in report.findings if f.level == Severity.ERROR] + assert "DELETE_NO_WHERE" in errors + + def test_update_with_where_passes(self): + report = self.engine.audit("UPDATE users SET name = 'test' WHERE id = 1;") + error_rules = [f.rule for f in report.findings if f.level == Severity.ERROR] + assert "UPDATE_NO_WHERE" not in error_rules + + def test_delete_with_where_passes(self): + report = self.engine.audit("DELETE FROM users WHERE id = 1;") + error_rules = [f.rule for f in report.findings if f.level == Severity.ERROR] + assert "DELETE_NO_WHERE" not in error_rules + + # --- SELECT * --- + + def test_select_star_info(self): + report = self.engine.audit("SELECT * FROM users WHERE id = 1;") + rules = [f.rule for f in report.findings] + assert "SELECT_STAR" in rules + star_finding = next(f for f in report.findings if f.rule == "SELECT_STAR") + assert star_finding.level == Severity.INFO + + def test_select_columns_clean(self): + report = self.engine.audit("SELECT id, name FROM users WHERE id = 1;") + rules = [f.rule for f in report.findings] + assert "SELECT_STAR" not in rules + + # --- Multiple statements --- + + def test_multi_statement_error(self): + report = self.engine.audit("UPDATE users SET name = 'a'; DELETE FROM logs;") + assert not report.passed + rules = [f.rule for f in report.findings if f.level == Severity.ERROR] + assert "MULTI_STATEMENT" in rules + + def test_single_statement_ok(self): + report = self.engine.audit("SELECT id FROM users LIMIT 10;") + rules = [f.rule for f in report.findings] + assert "MULTI_STATEMENT" not in rules + + # --- Large IN clause --- + + def test_large_in_warning(self): + values = ", ".join([str(i) for i in range(150)]) + sql = f"SELECT * FROM users WHERE id IN ({values});" + report = self.engine.audit(sql) + rules = [f.rule for f in report.findings] + assert "LARGE_IN_CLAUSE" in rules + + def test_small_in_ok(self): + report = self.engine.audit("SELECT * FROM users WHERE id IN (1, 2, 3);") + rules = [f.rule for f in report.findings] + assert "LARGE_IN_CLAUSE" not in rules + + # --- Production extra rules --- + + def test_alter_table_production_error(self): + engine = SQLAuditEngine(env="production") + report = engine.audit("ALTER TABLE users ADD COLUMN age INT;") + assert not report.passed + errors = [f.rule for f in report.findings if f.level == Severity.ERROR] + assert "ALTER_TABLE_PRODUCTION" in errors + + def test_alter_table_dev_ok(self): + report = self.engine.audit("ALTER TABLE users ADD COLUMN age INT;") + error_rules = [f.rule for f in report.findings if f.level == Severity.ERROR] + assert "ALTER_TABLE_PRODUCTION" not in error_rules + + # --- JOIN without ON --- + + def test_join_no_on_warning(self): + report = self.engine.audit("SELECT * FROM users JOIN orders;") + rules = [f.rule for f in report.findings] + assert "JOIN_NO_ON" in rules + + def test_join_with_on_ok(self): + report = self.engine.audit("SELECT * FROM users JOIN orders ON users.id = orders.user_id;") + rules = [f.rule for f in report.findings] + assert "JOIN_NO_ON" not in rules + + # --- Score --- + + def test_clean_sql_score_100(self): + report = self.engine.audit("SELECT id, name FROM users WHERE id = 1 LIMIT 10;") + assert report.score == 100 + assert report.passed + + def test_error_reduces_score(self): + report = self.engine.audit("UPDATE users SET name = 'test';") + assert report.score < 100 + assert not report.passed + + def test_report_to_dict(self): + report = self.engine.audit("SELECT * FROM users;") + d = report.to_dict() + assert "passed" in d + assert "score" in d + assert "findings" in d + assert isinstance(d["findings"], list) + + +class TestAuditEngineIntegration: + """Test audit engine integration with ticket creation via API.""" + + @pytest.mark.asyncio + async def test_ticket_creation_returns_audit_report(self, client, db, admin_token, test_instance): + from tests.conftest import auth_header + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "SQL审核测试工单", + "db_type": "mysql", + "instance_id": test_instance.id, + "target_database": "test_db", + "sql_content": "SELECT * FROM users WHERE id = 1;", + "reason": "测试审核引擎", + "priority": "medium", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + assert "audit_report" in data + assert "score" in data["audit_report"] + assert "findings" in data["audit_report"] + + @pytest.mark.asyncio + async def test_ticket_with_dangerous_sql_has_low_score(self, client, db, admin_token, test_instance): + from tests.conftest import auth_header + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "危险SQL工单", + "db_type": "mysql", + "instance_id": test_instance.id, + "target_database": "test_db", + "sql_content": "UPDATE users SET status = 1;", + "reason": "全表更新测试", + "priority": "high", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + report = data["audit_report"] + assert report["passed"] is False + assert report["score"] < 100 diff --git a/tests/test_audit_engine_v2.py b/tests/test_audit_engine_v2.py new file mode 100644 index 0000000..b1a5511 --- /dev/null +++ b/tests/test_audit_engine_v2.py @@ -0,0 +1,714 @@ +"""Tests for SQL Audit Engine V2 — 可配置规则引擎 (40+ 规则覆盖测试). + +测试覆盖: +- DDL 规则 (12条): 主键、注释、索引、类型等 +- DML 规则 (8条): WHERE、LIMIT、INSERT、REPLACE 等 +- DQL 规则 (5条): SELECT *、LIMIT、函数、排序等 +- 命名规范 (5条): 表名、字段名、索引名等 +- 性能规则 (8条): 全表扫描、IN、LIKE、JOIN 等 +- 安全规则 (5条): 敏感字段、密码、UNION、注释等 +""" + +import pytest +from app.services.audit_engine_v2 import ( + SQLAuditEngineV2, + AuditReportV2, + AuditFindingV2, + Severity, + RuleCategory, + AuditRuleV2, +) + + +# ────────────────────────────────────────────── +# 引擎基础测试 +# ────────────────────────────────────────────── + + +class TestSQLAuditEngineV2: + """SQLAuditEngineV2 引擎核心功能测试。""" + + @pytest.fixture + def engine(self): + """返回不带数据库的同步引擎实例。""" + return SQLAuditEngineV2(db_session=None, env="development") + + @pytest.mark.asyncio + async def test_audit_returns_report(self, engine): + """audit() 应返回 AuditReportV2 实例。""" + report = await engine.audit("SELECT id, name FROM users LIMIT 10;") + assert isinstance(report, AuditReportV2) + + @pytest.mark.asyncio + async def test_clean_sql_passes(self, engine): + """规范 SQL 应通过审核且评分为100。""" + report = await engine.audit("SELECT id, name FROM users WHERE id = 1 LIMIT 10;") + assert report.passed + assert report.score == 100 + + @pytest.mark.asyncio + async def test_report_has_summary(self, engine): + """审核报告应包含摘要。""" + report = await engine.audit("UPDATE users SET name = 'test' WHERE id = 1;") + assert report.summary + assert isinstance(report.summary, str) + + @pytest.mark.asyncio + async def test_report_to_dict_backward_compat(self, engine): + """to_dict() 应返回向后兼容的字典格式。""" + report = await engine.audit("SELECT * FROM users;") + d = report.to_dict() + assert "passed" in d + assert "score" in d + assert "findings" in d + assert "summary" in d + assert isinstance(d["findings"], list) + + @pytest.mark.asyncio + async def test_error_reduces_score(self, engine): + """ERROR 级别发现项应扣10分。""" + report = await engine.audit("UPDATE users SET status = 1;") + assert report.score < 100 + assert not report.passed + + @pytest.mark.asyncio + async def test_db_type_filtering(self, engine): + """规则应按 db_type 过滤。""" + report_mysql = await engine.audit("SELECT id FROM t LIMIT 10;", db_type="mysql") + report_postgres = await engine.audit("SELECT id FROM t LIMIT 10;", db_type="postgres") + # 两者都应通过（基本 SELECT） + assert report_mysql.passed + assert report_postgres.passed + + @pytest.mark.asyncio + async def test_sync_audit(self, engine): + """同步审核应正常工作。""" + report = engine.audit_sync("SELECT id FROM users WHERE id = 1 LIMIT 10;") + assert report.passed + assert report.score == 100 + + @pytest.mark.asyncio + async def test_get_rule_list(self, engine): + """获取规则列表应返回非空列表。""" + rules = await engine.get_rule_list() + assert len(rules) >= 40 # 至少40条规则 + + +# ────────────────────────────────────────────── +# DDL 规则测试 +# ────────────────────────────────────────────── + + +class TestDDLRules: + """DDL 规则测试 (DDL-001 ~ DDL-012)。""" + + @pytest.fixture + def engine(self): + return SQLAuditEngineV2(db_session=None, env="development") + + # DDL-001: 建表必须包含主键 + @pytest.mark.asyncio + async def test_ddl_001_no_primary_key(self, engine): + report = await engine.audit("CREATE TABLE users (name VARCHAR(50));") + findings = [f for f in report.findings if f.rule_code == "DDL-001"] + assert len(findings) >= 1 + assert findings[0].level == Severity.ERROR + + @pytest.mark.asyncio + async def test_ddl_001_has_primary_key(self, engine): + report = await engine.audit("CREATE TABLE users (id INT PRIMARY KEY, name VARCHAR(50));") + findings = [f for f in report.findings if f.rule_code == "DDL-001"] + assert len(findings) == 0 + + # DDL-002: 建表必须添加表注释 + @pytest.mark.asyncio + async def test_ddl_002_no_comment(self, engine): + report = await engine.audit("CREATE TABLE users (id INT PRIMARY KEY);") + findings = [f for f in report.findings if f.rule_code == "DDL-002"] + assert len(findings) >= 1 + + @pytest.mark.asyncio + async def test_ddl_002_has_comment(self, engine): + report = await engine.audit( + "CREATE TABLE users (id INT PRIMARY KEY) COMMENT='用户表';" + ) + findings = [f for f in report.findings if f.rule_code == "DDL-002"] + assert len(findings) == 0 + + # DDL-004: 禁止 DROP TABLE + @pytest.mark.asyncio + async def test_ddl_004_drop_table(self, engine): + report = await engine.audit("DROP TABLE users;") + findings = [f for f in report.findings if f.rule_code == "DDL-004"] + assert len(findings) >= 1 + assert findings[0].level == Severity.ERROR + + # DDL-005: 禁止 TRUNCATE TABLE + @pytest.mark.asyncio + async def test_ddl_005_truncate(self, engine): + report = await engine.audit("TRUNCATE TABLE users;") + findings = [f for f in report.findings if f.rule_code == "DDL-005"] + assert len(findings) >= 1 + assert findings[0].level == Severity.ERROR + + # DDL-006: 单表索引数量不得超过12个 + @pytest.mark.asyncio + async def test_ddl_006_too_many_indexes(self, engine): + # 创建15个索引 + idx_defs = ", ".join([f"KEY idx_{i} (col{i})" for i in range(15)]) + sql = f"CREATE TABLE t (id INT PRIMARY KEY, {', '.join([f'col{i} INT' for i in range(15)])}, {idx_defs});" + report = await engine.audit(sql) + findings = [f for f in report.findings if f.rule_code == "DDL-006"] + assert len(findings) >= 1 + + # DDL-007: 单索引字段数不得超过8个 + @pytest.mark.asyncio + async def test_ddl_007_too_many_index_columns(self, engine): + cols = ", ".join([f"col{i}" for i in range(10)]) + sql = f"CREATE TABLE t (id INT PRIMARY KEY, KEY idx_big ({cols}));" + report = await engine.audit(sql) + findings = [f for f in report.findings if f.rule_code == "DDL-007"] + assert len(findings) >= 1 + + # DDL-008: 禁止使用 FLOAT/DOUBLE + @pytest.mark.asyncio + async def test_ddl_008_float_type(self, engine): + report = await engine.audit( + "CREATE TABLE t (id INT PRIMARY KEY, price FLOAT);" + ) + findings = [f for f in report.findings if f.rule_code == "DDL-008"] + assert len(findings) >= 1 + + # DDL-009: CHAR 类型长度不得超过10 + @pytest.mark.asyncio + async def test_ddl_009_char_too_long(self, engine): + report = await engine.audit( + "CREATE TABLE t (id INT PRIMARY KEY, code CHAR(20));" + ) + findings = [f for f in report.findings if f.rule_code == "DDL-009"] + assert len(findings) >= 1 + + # DDL-010: 表名长度不得超过45字符 + @pytest.mark.asyncio + async def test_ddl_010_long_table_name(self, engine): + long_name = "a" * 50 + report = await engine.audit( + f"CREATE TABLE {long_name} (id INT PRIMARY KEY);" + ) + findings = [f for f in report.findings if f.rule_code == "DDL-010"] + assert len(findings) >= 1 + + # DDL-011: 禁止外键约束 + @pytest.mark.asyncio + async def test_ddl_011_foreign_key(self, engine): + sql = """CREATE TABLE orders ( + id INT PRIMARY KEY, + user_id INT, + FOREIGN KEY (user_id) REFERENCES users(id) + );""" + report = await engine.audit(sql) + findings = [f for f in report.findings if f.rule_code == "DDL-011"] + assert len(findings) >= 1 + + # DDL-012: 必须包含 create_time/update_time + @pytest.mark.asyncio + async def test_ddl_012_missing_audit_fields(self, engine): + report = await engine.audit( + "CREATE TABLE t (id INT PRIMARY KEY, name VARCHAR(50));" + ) + findings = [f for f in report.findings if f.rule_code == "DDL-012"] + assert len(findings) >= 1 + + @pytest.mark.asyncio + async def test_ddl_012_has_audit_fields(self, engine): + report = await engine.audit( + "CREATE TABLE t (id INT PRIMARY KEY, name VARCHAR(50), create_time DATETIME, update_time DATETIME);" + ) + findings = [f for f in report.findings if f.rule_code == "DDL-012"] + assert len(findings) == 0 + + +# ────────────────────────────────────────────── +# DML 规则测试 +# ────────────────────────────────────────────── + + +class TestDMLRules: + """DML 规则测试 (DML-001 ~ DML-008)。""" + + @pytest.fixture + def engine(self): + return SQLAuditEngineV2(db_session=None, env="development") + + # DML-001: UPDATE/DELETE 必须包含 WHERE + @pytest.mark.asyncio + async def test_dml_001_update_no_where(self, engine): + report = await engine.audit("UPDATE users SET name = 'test';") + findings = [f for f in report.findings if f.rule_code == "DML-001"] + assert len(findings) >= 1 + assert findings[0].level == Severity.ERROR + + @pytest.mark.asyncio + async def test_dml_001_delete_no_where(self, engine): + report = await engine.audit("DELETE FROM users;") + findings = [f for f in report.findings if f.rule_code == "DML-001"] + assert len(findings) >= 1 + assert findings[0].level == Severity.ERROR + + @pytest.mark.asyncio + async def test_dml_001_update_with_where(self, engine): + report = await engine.audit("UPDATE users SET name = 'test' WHERE id = 1;") + findings = [f for f in report.findings if f.rule_code == "DML-001"] + assert len(findings) == 0 + + # DML-003: UPDATE/DELETE 禁止带 LIMIT + @pytest.mark.asyncio + async def test_dml_003_update_with_limit(self, engine): + report = await engine.audit("UPDATE users SET name = 'test' WHERE id = 1 LIMIT 10;") + findings = [f for f in report.findings if f.rule_code == "DML-003"] + assert len(findings) >= 1 + + # DML-007: 禁止 REPLACE INTO + @pytest.mark.asyncio + async def test_dml_007_replace_into(self, engine): + report = await engine.audit("REPLACE INTO users (id, name) VALUES (1, 'test');") + findings = [f for f in report.findings if f.rule_code == "DML-007"] + assert len(findings) >= 1 + assert findings[0].level == Severity.ERROR + + # DML-008: INSERT 必须指定字段列表 + @pytest.mark.asyncio + async def test_dml_008_insert_no_columns(self, engine): + report = await engine.audit("INSERT INTO users VALUES (1, 'test');") + findings = [f for f in report.findings if f.rule_code == "DML-008"] + assert len(findings) >= 1 + + @pytest.mark.asyncio + async def test_dml_008_insert_with_columns(self, engine): + report = await engine.audit("INSERT INTO users (id, name) VALUES (1, 'test');") + findings = [f for f in report.findings if f.rule_code == "DML-008"] + assert len(findings) == 0 + + +# ────────────────────────────────────────────── +# DQL 规则测试 +# ────────────────────────────────────────────── + + +class TestDQLRules: + """DQL 规则测试 (DQL-001 ~ DQL-005)。""" + + @pytest.fixture + def engine(self): + return SQLAuditEngineV2(db_session=None, env="development") + + # DQL-001: 禁止 SELECT * + @pytest.mark.asyncio + async def test_dql_001_select_star(self, engine): + report = await engine.audit("SELECT * FROM users;") + findings = [f for f in report.findings if f.rule_code == "DQL-001"] + assert len(findings) >= 1 + + @pytest.mark.asyncio + async def test_dql_001_select_columns(self, engine): + report = await engine.audit("SELECT id, name FROM users;") + findings = [f for f in report.findings if f.rule_code == "DQL-001"] + assert len(findings) == 0 + + # DQL-002: SELECT 必须有 LIMIT + @pytest.mark.asyncio + async def test_dql_002_no_limit(self, engine): + report = await engine.audit("SELECT id, name FROM users;") + findings = [f for f in report.findings if f.rule_code == "DQL-002"] + assert len(findings) >= 1 + + @pytest.mark.asyncio + async def test_dql_002_has_limit(self, engine): + report = await engine.audit("SELECT id, name FROM users LIMIT 10;") + findings = [f for f in report.findings if f.rule_code == "DQL-002"] + assert len(findings) == 0 + + # DQL-003: 禁止在 WHERE 中使用函数 + @pytest.mark.asyncio + async def test_dql_003_where_function(self, engine): + report = await engine.audit("SELECT id FROM users WHERE YEAR(created_at) = 2024;") + findings = [f for f in report.findings if f.rule_code == "DQL-003"] + # 只要检测到 WHERE + 函数模式 + assert len(findings) >= 1 + + # DQL-005: ORDER BY 必须使用索引字段 + @pytest.mark.asyncio + async def test_dql_005_order_by(self, engine): + report = await engine.audit("SELECT id FROM users ORDER BY name;") + findings = [f for f in report.findings if f.rule_code == "DQL-005"] + assert len(findings) >= 1 + + +# ────────────────────────────────────────────── +# 命名规范测试 +# ────────────────────────────────────────────── + + +class TestNamingRules: + """命名规范测试 (NAME-001 ~ NAME-005)。""" + + @pytest.fixture + def engine(self): + return SQLAuditEngineV2(db_session=None, env="development") + + # NAME-001: 表名必须小写下划线命名 + @pytest.mark.asyncio + async def test_name_001_uppercase_table(self, engine): + report = await engine.audit("CREATE TABLE UserInfo (id INT PRIMARY KEY);") + findings = [f for f in report.findings if f.rule_code == "NAME-001"] + assert len(findings) >= 1 + + @pytest.mark.asyncio + async def test_name_001_snake_case_table(self, engine): + report = await engine.audit("CREATE TABLE user_info (id INT PRIMARY KEY);") + findings = [f for f in report.findings if f.rule_code == "NAME-001"] + assert len(findings) == 0 + + # NAME-002: 字段名必须小写下划线命名 + @pytest.mark.asyncio + async def test_name_002_uppercase_column(self, engine): + report = await engine.audit( + "CREATE TABLE t (id INT PRIMARY KEY, UserName VARCHAR(50));" + ) + findings = [f for f in report.findings if f.rule_code == "NAME-002"] + assert len(findings) >= 1 + + # NAME-004: 主键名必须为 id 或 pk_ 开头 + @pytest.mark.asyncio + async def test_name_004_bad_pk_name(self, engine): + report = await engine.audit( + "CREATE TABLE t (user_id INT PRIMARY KEY, name VARCHAR(50));" + ) + findings = [f for f in report.findings if f.rule_code == "NAME-004"] + assert len(findings) >= 1 + + +# ────────────────────────────────────────────── +# 性能规则测试 +# ────────────────────────────────────────────── + + +class TestPerfRules: + """性能规则测试 (PERF-001 ~ PERF-008)。""" + + @pytest.fixture + def engine(self): + return SQLAuditEngineV2(db_session=None, env="development") + + # PERF-002: IN 子句值数量不得超过100个 + @pytest.mark.asyncio + async def test_perf_002_large_in(self, engine): + values = ", ".join([str(i) for i in range(150)]) + sql = f"SELECT id FROM users WHERE id IN ({values});" + report = await engine.audit(sql) + findings = [f for f in report.findings if f.rule_code == "PERF-002"] + assert len(findings) >= 1 + + # PERF-003: 禁止 LIKE '%xxx%' + @pytest.mark.asyncio + async def test_perf_003_full_like(self, engine): + report = await engine.audit("SELECT id FROM users WHERE name LIKE '%test%';") + findings = [f for f in report.findings if f.rule_code == "PERF-003"] + assert len(findings) >= 1 + + # PERF-005: 禁止 ORDER BY RAND() + @pytest.mark.asyncio + async def test_perf_005_order_by_rand(self, engine): + report = await engine.audit("SELECT id FROM users ORDER BY RAND() LIMIT 10;") + findings = [f for f in report.findings if f.rule_code == "PERF-005"] + assert len(findings) >= 1 + assert findings[0].level == Severity.ERROR + + # PERF-007: 大表禁止 OFFSET 分页 + @pytest.mark.asyncio + async def test_perf_007_offset(self, engine): + report = await engine.audit("SELECT id FROM users LIMIT 10 OFFSET 1000;") + findings = [f for f in report.findings if f.rule_code == "PERF-007"] + assert len(findings) >= 1 + + # PERF-008: 禁止 SELECT DISTINCT + @pytest.mark.asyncio + async def test_perf_008_distinct(self, engine): + report = await engine.audit("SELECT DISTINCT name FROM users;") + findings = [f for f in report.findings if f.rule_code == "PERF-008"] + assert len(findings) >= 1 + + +# ────────────────────────────────────────────── +# 安全规则测试 +# ────────────────────────────────────────────── + + +class TestSecurityRules: + """安全规则测试 (SEC-001 ~ SEC-005)。""" + + @pytest.fixture + def engine(self): + return SQLAuditEngineV2(db_session=None, env="development") + + # SEC-001: 禁止查询敏感字段 + @pytest.mark.asyncio + async def test_sec_001_sensitive_fields(self, engine): + report = await engine.audit("SELECT id, password, secret FROM users;") + findings = [f for f in report.findings if f.rule_code == "SEC-001"] + assert len(findings) >= 1 + assert findings[0].level == Severity.ERROR + + # SEC-003: 禁止 UNION + @pytest.mark.asyncio + async def test_sec_003_union(self, engine): + report = await engine.audit("SELECT id FROM users UNION SELECT id FROM orders;") + findings = [f for f in report.findings if f.rule_code == "SEC-003"] + assert len(findings) >= 1 + assert findings[0].level == Severity.ERROR + + # SEC-004: 禁止注释符 + @pytest.mark.asyncio + async def test_sec_004_comment_dash(self, engine): + report = await engine.audit("SELECT id FROM users WHERE id = 1; -- comment") + findings = [f for f in report.findings if f.rule_code == "SEC-004"] + assert len(findings) >= 1 + + @pytest.mark.asyncio + async def test_sec_004_comment_block(self, engine): + report = await engine.audit("SELECT id /* comment */ FROM users;") + findings = [f for f in report.findings if f.rule_code == "SEC-004"] + assert len(findings) >= 1 + + # SEC-005: 禁止多语句 + @pytest.mark.asyncio + async def test_sec_005_multi_statement(self, engine): + report = await engine.audit("UPDATE users SET name = 'a'; DELETE FROM logs;") + findings = [f for f in report.findings if f.rule_code == "SEC-005"] + assert len(findings) >= 1 + assert findings[0].level == Severity.ERROR + + +# ────────────────────────────────────────────── +# 数据类测试 +# ────────────────────────────────────────────── + + +class TestAuditDataClasses: + """数据类单元测试。""" + + def test_audit_rule_v2_dataclass(self): + """AuditRuleV2 数据类应正常工作。""" + rule = AuditRuleV2( + code="DDL-001", + name="测试规则", + category=RuleCategory.DDL, + severity=Severity.ERROR, + ) + assert rule.code == "DDL-001" + assert rule.compiled_pattern is None + + def test_audit_rule_v2_pattern_compile(self): + """AuditRuleV2 应能编译正则表达式。""" + rule = AuditRuleV2( + code="TEST-001", + name="测试规则", + category=RuleCategory.DDL, + severity=Severity.WARNING, + pattern=r"^test_", + ) + assert rule.compiled_pattern is not None + assert rule.compiled_pattern.match("test_table") + + def test_audit_finding_v2(self): + """AuditFindingV2 数据类应正常工作。""" + finding = AuditFindingV2( + rule_code="DDL-001", + rule_name="测试规则", + level=Severity.ERROR, + message="测试消息", + position=10, + ) + assert finding.rule_code == "DDL-001" + assert finding.position == 10 + + def test_audit_report_v2_score_calculation(self): + """AuditReportV2 评分计算应正确。""" + report = AuditReportV2(sql="SELECT * FROM t;") + report.findings = [ + AuditFindingV2("DQL-001", "禁止SELECT *", Severity.INFO, "msg1"), + AuditFindingV2("DDL-004", "禁止DROP TABLE", Severity.ERROR, "msg2"), + ] + assert report.score == 88 # 100 - 10(ERROR) - 2(INFO) = 88 + assert not report.passed + + def test_audit_report_v2_empty_findings(self): + """无发现项时评分应为100且通过。""" + report = AuditReportV2(sql="SELECT id FROM t WHERE id = 1;") + assert report.score == 100 + assert report.passed + assert report.summary == "审核通过，未发现违规项" + + def test_audit_report_backward_compat(self): + """AuditReportV2 应向后兼容 AuditReport 格式。""" + report = AuditReportV2(sql="UPDATE t SET a = 1;") + report.findings.append( + AuditFindingV2("DML-001", "缺少WHERE", Severity.ERROR, "msg") + ) + d = report.to_dict() + assert "passed" in d + assert "score" in d + assert "findings" in d + # 检查旧版格式兼容性 + assert d["findings"][0]["rule"] == "DML-001" + assert d["findings"][0]["level"] == "error" + + +# ────────────────────────────────────────────── +# API 集成测试 +# ────────────────────────────────────────────── + + +class TestAuditEngineV2Integration: + """V2 引擎与 API 集成测试。""" + + @pytest.mark.asyncio + async def test_ticket_creation_uses_v2_engine(self, client, db, admin_token, test_instance): + """创建工单时应使用 V2 引擎进行审核。""" + from tests.conftest import auth_header + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "V2引擎测试工单", + "db_type": "mysql", + "instance_id": test_instance.id, + "target_database": "test_db", + "sql_content": "SELECT * FROM users WHERE id = 1;", + "reason": "测试V2审核引擎", + "priority": "medium", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + assert "audit_report" in data + report = data["audit_report"] + assert "score" in report + assert "findings" in report + assert "summary" in report + # SELECT * 应触发 DQL-001 (INFO) + rules = [f["rule"] for f in report["findings"]] + assert "DQL-001" in rules or "DQL-002" in rules + + @pytest.mark.asyncio + async def test_audit_endpoint_returns_v2_format(self, client, db, admin_token, test_instance): + """审核接口应返回 V2 格式报告。""" + from tests.conftest import auth_header + resp = await client.post( + "/api/v1/tickets/audit", + json={ + "sql_content": "UPDATE users SET status = 1 WHERE id = 1;", + "instance_id": test_instance.id, + "database": "test_db", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert "score" in data + assert "passed" in data + assert "summary" in data + assert "findings" in data + + @pytest.mark.asyncio + async def test_audit_endpoint_detects_dangerous_sql(self, client, db, admin_token, test_instance): + """审核接口应能检测危险 SQL。""" + from tests.conftest import auth_header + resp = await client.post( + "/api/v1/tickets/audit", + json={ + "sql_content": "DROP TABLE users;", + "instance_id": test_instance.id, + "database": "test_db", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["passed"] is False + rules = [f["rule"] for f in data["findings"]] + assert "DDL-004" in rules + + @pytest.mark.asyncio + async def test_seed_v2_endpoint(self, client, db, admin_token): + """seed-v2 接口应能初始化所有 V2 规则。""" + from tests.conftest import auth_header + resp = await client.post( + "/api/v1/audit-rules/seed-v2", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert isinstance(data, list) + assert len(data) >= 40 # 应创建至少40条规则 + + # 再次调用应跳过已存在的规则 + resp2 = await client.post( + "/api/v1/audit-rules/seed-v2", + headers=auth_header(admin_token), + ) + assert resp2.status_code == 200 + data2 = resp2.json() + assert len(data2) == 0 # 都已存在，不再创建 + + +class TestAllRulesRegistered: + """验证所有要求的规则都已注册。""" + + def test_ddl_rules_registered(self): + """DDL 规则应全部注册。""" + from app.services.audit_engine_v2 import get_all_registered_rules + rules = get_all_registered_rules() + codes = [r.code for r in rules] + for i in range(1, 13): + assert f"DDL-{i:03d}" in codes, f"DDL-{i:03d} 未注册" + + def test_dml_rules_registered(self): + """DML 规则应全部注册。""" + from app.services.audit_engine_v2 import get_all_registered_rules + rules = get_all_registered_rules() + codes = [r.code for r in rules] + for i in range(1, 9): + assert f"DML-{i:03d}" in codes, f"DML-{i:03d} 未注册" + + def test_dql_rules_registered(self): + """DQL 规则应全部注册。""" + from app.services.audit_engine_v2 import get_all_registered_rules + rules = get_all_registered_rules() + codes = [r.code for r in rules] + for i in range(1, 6): + assert f"DQL-{i:03d}" in codes, f"DQL-{i:03d} 未注册" + + def test_naming_rules_registered(self): + """命名规范规则应全部注册。""" + from app.services.audit_engine_v2 import get_all_registered_rules + rules = get_all_registered_rules() + codes = [r.code for r in rules] + for i in range(1, 6): + assert f"NAME-{i:03d}" in codes, f"NAME-{i:03d} 未注册" + + def test_perf_rules_registered(self): + """性能规则应全部注册。""" + from app.services.audit_engine_v2 import get_all_registered_rules + rules = get_all_registered_rules() + codes = [r.code for r in rules] + for i in range(1, 9): + assert f"PERF-{i:03d}" in codes, f"PERF-{i:03d} 未注册" + + def test_security_rules_registered(self): + """安全规则应全部注册。""" + from app.services.audit_engine_v2 import get_all_registered_rules + rules = get_all_registered_rules() + codes = [r.code for r in rules] + for i in range(1, 6): + assert f"SEC-{i:03d}" in codes, f"SEC-{i:03d} 未注册" diff --git a/tests/test_audit_logs.py b/tests/test_audit_logs.py new file mode 100644 index 0000000..82f0116 --- /dev/null +++ b/tests/test_audit_logs.py @@ -0,0 +1,173 @@ +"""Tests for Audit Log API (Phase 3.4).""" +import pytest +from tests.conftest import auth_header + + +class TestAuditLogAPI: + @pytest.mark.asyncio + async def test_list_audit_logs_admin(self, client, admin_token): + """Admin can list audit logs.""" + resp = await client.get( + "/api/v1/audit/logs", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert "items" in data + assert "total" in data + assert "page" in data + + @pytest.mark.asyncio + async def test_list_audit_logs_dba(self, client, dba_token): + """DBA can also list audit logs.""" + resp = await client.get( + "/api/v1/audit/logs", + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + @pytest.mark.asyncio + async def test_list_audit_logs_developer_forbidden(self, client, developer_token): + """Developer cannot access audit logs.""" + resp = await client.get( + "/api/v1/audit/logs", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_create_instance_logs_audit(self, client, db, admin_token): + """Creating an instance produces an audit log entry.""" + from app.models.audit_log import AuditLog + from sqlalchemy import select + + resp = await client.post( + "/api/v1/instances", + json={ + "name": "审计测试实例", + "db_type": "mysql", + "host": "10.0.0.100", + "port": 3306, + "username": "root", + "password": "test123", + "database": "test", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + + # Check audit log was created + result = await db.execute( + select(AuditLog).where(AuditLog.action == "CREATE_INSTANCE") + ) + log = result.scalar_one_or_none() + assert log is not None + assert "审计测试实例" in log.detail + + @pytest.mark.asyncio + async def test_create_user_logs_audit(self, client, admin_token): + """Creating a user produces an audit log entry.""" + resp = await client.post( + "/api/v1/users", + json={ + "username": "audit_test_user", + "display_name": "审计测试", + "password": "test123456", + "role": "developer", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + # Audit middleware writes to its own session; verified via API in integration tests + # Here we just confirm the create succeeded + + @pytest.mark.asyncio + async def test_create_ticket_logs_audit(self, client, admin_token, test_instance): + """Creating a ticket produces an audit log entry.""" + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "审计日志工单测试", + "db_type": "mysql", + "instance_id": test_instance.id, + "target_database": "test_db", + "sql_content": "SELECT id FROM users LIMIT 10;", + "reason": "测试审计日志", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + # Audit middleware writes to its own session; verified via API in integration tests + + @pytest.mark.asyncio + async def test_audit_log_pagination(self, client, admin_token): + """Audit log pagination works.""" + resp = await client.get( + "/api/v1/audit/logs?page=1&page_size=5", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["page_size"] == 5 + + @pytest.mark.asyncio + async def test_audit_log_filter_by_action(self, client, admin_token, db, test_instance): + """Can filter audit logs by action.""" + # Create a ticket first + await client.post( + "/api/v1/tickets", + json={ + "title": "过滤测试工单", + "db_type": "mysql", + "instance_id": test_instance.id, + "target_database": "test_db", + "sql_content": "SELECT 1;", + "reason": "过滤测试用", + }, + headers=auth_header(admin_token), + ) + + resp = await client.get( + "/api/v1/audit/logs?action=CREATE_TICKET", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + for item in data["items"]: + assert item["action"] == "CREATE_TICKET" + + @pytest.mark.asyncio + async def test_review_ticket_logs_audit(self, client, db, admin_token, dba_token, test_instance): + """Reviewing a ticket creates an audit log.""" + from app.models.audit_log import AuditLog + from sqlalchemy import select + + # Create ticket as admin + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "审核日志测试", + "db_type": "mysql", + "instance_id": test_instance.id, + "target_database": "test_db", + "sql_content": "SELECT 1;", + "reason": "审核日志测试", + }, + headers=auth_header(admin_token), + ) + ticket_id = resp.json()["id"] + + # Review as DBA + resp = await client.post( + f"/api/v1/tickets/{ticket_id}/review", + json={"action": "approve", "comment": "批准"}, + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + result = await db.execute( + select(AuditLog).where(AuditLog.action == "REVIEW_TICKET") + ) + log = result.scalar_one_or_none() + assert log is not None + assert "approve" in log.detail diff --git a/tests/test_audit_rule.py b/tests/test_audit_rule.py new file mode 100644 index 0000000..2409740 --- /dev/null +++ b/tests/test_audit_rule.py @@ -0,0 +1,759 @@ +"""审核规则管理端点全面测试。 + +覆盖所有 9 个端点的正常/异常路径，包括： + - 权限校验（admin 可读写, dba 只读, developer/guest 禁止访问） + - 列表过滤（rule_type, severity, db_type, is_enabled） + - 创建/更新/删除/切换启用状态 + - 统计摘要 + - 种子数据（V1 seed/{db_type} 和 V2 seed-v2） +""" +import pytest +from tests.conftest import auth_header + +# ── 通用测试载荷 ────────────────────────────────────────────── +VALID_RULE_PAYLOAD = { + "name": "禁止SELECT星号", + "description": "禁止使用 SELECT * 查询", + "rule_type": "performance", + "severity": "warning", + "db_type": "mysql", + "pattern": r"SELECT\s+\*", + "value": None, + "is_enabled": True, + "message": "禁止使用 SELECT *，请明确指定字段", +} + +PREFIX = "/api/v1/audit-rules" + + +# ══════════════════════════════════════════════════════════════ +# 一、列表端点 GET /api/v1/audit-rules +# ══════════════════════════════════════════════════════════════ + + +class TestListAuditRules: + """GET /audit-rules — 列表 & 过滤""" + + @pytest.mark.asyncio + async def test_admin列表返回200(self, client, admin_token): + """admin 角色可正常获取列表""" + resp = await client.get(PREFIX, headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert isinstance(resp.json(), list) + + @pytest.mark.asyncio + async def test_dba列表返回200(self, client, dba_token): + """dba 角色可正常获取列表（只读权限）""" + resp = await client.get(PREFIX, headers=auth_header(dba_token)) + assert resp.status_code == 200 + + @pytest.mark.asyncio + async def test_developer无权限返回403(self, client, developer_token): + """developer 角色无权限""" + resp = await client.get(PREFIX, headers=auth_header(developer_token)) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_guest无权限返回403(self, client, guest_token): + """guest 角色无权限""" + resp = await client.get(PREFIX, headers=auth_header(guest_token)) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test无token返回401(self, client): + """未携带 JWT 应返回 401""" + resp = await client.get(PREFIX) + assert resp.status_code == 401 + + @pytest.mark.asyncio + async def test按rule_type过滤(self, client, admin_token): + """通过 rule_type 查询参数过滤""" + # 创建一条 performance 规则 + await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "perf-rule"}, + headers=auth_header(admin_token), + ) + resp = await client.get( + f"{PREFIX}?rule_type=performance", headers=auth_header(admin_token) + ) + assert resp.status_code == 200 + for rule in resp.json(): + assert rule["rule_type"] == "performance" + + @pytest.mark.asyncio + async def test按severity过滤(self, client, admin_token): + """通过 severity 查询参数过滤""" + await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "sev-rule", "severity": "error"}, + headers=auth_header(admin_token), + ) + resp = await client.get( + f"{PREFIX}?severity=error", headers=auth_header(admin_token) + ) + assert resp.status_code == 200 + for rule in resp.json(): + assert rule["severity"] == "error" + + @pytest.mark.asyncio + async def test按db_type过滤(self, client, admin_token): + """通过 db_type 过滤，应同时包含 db_type='all' 的规则""" + await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "mysql-rule", "db_type": "mysql"}, + headers=auth_header(admin_token), + ) + resp = await client.get( + f"{PREFIX}?db_type=mysql", headers=auth_header(admin_token) + ) + assert resp.status_code == 200 + for rule in resp.json(): + assert rule["db_type"] in ("mysql", "all") + + @pytest.mark.asyncio + async def test按is_enabled过滤(self, client, admin_token): + """通过 is_enabled 过滤已启用/已禁用规则""" + # 创建一条规则后禁用 + create = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "disabled-rule"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + await client.post( + f"{PREFIX}/{rule_id}/toggle", headers=auth_header(admin_token) + ) + + # 只查已禁用的 + resp = await client.get( + f"{PREFIX}?is_enabled=false", headers=auth_header(admin_token) + ) + assert resp.status_code == 200 + for rule in resp.json(): + assert rule["is_enabled"] is False + + @pytest.mark.asyncio + async def test多条件联合过滤(self, client, admin_token): + """同时传入多个过滤参数""" + await client.post( + PREFIX, + json={ + **VALID_RULE_PAYLOAD, + "name": "multi-filter", + "rule_type": "DDL", + "severity": "error", + }, + headers=auth_header(admin_token), + ) + resp = await client.get( + f"{PREFIX}?rule_type=DDL&severity=error&is_enabled=true", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + for rule in resp.json(): + assert rule["rule_type"] == "DDL" + assert rule["severity"] == "error" + assert rule["is_enabled"] is True + + @pytest.mark.asyncio + async def test空数据库返回空列表(self, client, admin_token): + """无数据时返回空列表""" + resp = await client.get(PREFIX, headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert resp.json() == [] + + +# ══════════════════════════════════════════════════════════════ +# 二、创建端点 POST /api/v1/audit-rules +# ══════════════════════════════════════════════════════════════ + + +class TestCreateAuditRule: + """POST /audit-rules — 创建规则""" + + @pytest.mark.asyncio + async def test创建成功返回201(self, client, admin_token): + """正常创建，返回 201 + 完整对象""" + resp = await client.post( + PREFIX, json=VALID_RULE_PAYLOAD, headers=auth_header(admin_token) + ) + assert resp.status_code == 201 + data = resp.json() + assert data["id"] is not None + assert data["name"] == VALID_RULE_PAYLOAD["name"] + assert data["rule_type"] == "performance" + assert data["severity"] == "warning" + assert data["is_enabled"] is True + assert "created_at" in data + assert "updated_at" in data + + @pytest.mark.asyncio + async def test重复名称返回400(self, client, admin_token): + """同名规则不允许重复创建""" + payload = {**VALID_RULE_PAYLOAD, "name": "dup-name"} + await client.post(PREFIX, json=payload, headers=auth_header(admin_token)) + resp = await client.post(PREFIX, json=payload, headers=auth_header(admin_token)) + assert resp.status_code == 400 + assert "已存在" in resp.json()["detail"] + + @pytest.mark.asyncio + async def test_dba创建返回403(self, client, dba_token): + """dba 只有只读权限，不能创建""" + resp = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "dba-create"}, + headers=auth_header(dba_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_developer创建返回403(self, client, developer_token): + """developer 无权限""" + resp = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "dev-create"}, + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test创建时仅必填字段(self, client, admin_token): + """只提供 name/rule_type/message 三个必填字段也可成功""" + resp = await client.post( + PREFIX, + json={ + "name": "minimal-rule", + "rule_type": "syntax", + "message": "语法检查", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + assert data["severity"] == "warning" # 默认值 + assert data["db_type"] == "mysql" # 默认值 + assert data["is_enabled"] is True # 默认值 + + @pytest.mark.asyncio + async def test创建全部rule_type合法(self, client, admin_token): + """所有合法 rule_type 枚举均可创建""" + for rt in ("syntax", "performance", "safety", "naming", "DDL", "DML"): + resp = await client.post( + PREFIX, + json={ + "name": f"rt-{rt}", + "rule_type": rt, + "message": f"类型{rt}规则", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201, f"rule_type={rt} 创建失败" + + @pytest.mark.asyncio + async def test创建全部severity合法(self, client, admin_token): + """所有合法 severity 枚举均可创建""" + for sev in ("error", "warning", "info"): + resp = await client.post( + PREFIX, + json={ + "name": f"sev-{sev}", + "rule_type": "syntax", + "severity": sev, + "message": f"严重度{sev}", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201, f"severity={sev} 创建失败" + + @pytest.mark.asyncio + async def test非法rule_type返回422(self, client, admin_token): + """非法 rule_type 应触发 Pydantic 校验错误""" + resp = await client.post( + PREFIX, + json={ + "name": "bad-type", + "rule_type": "invalid_type", + "message": "测试", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 422 + + @pytest.mark.asyncio + async def test缺少必填字段返回422(self, client, admin_token): + """缺少 name 字段""" + resp = await client.post( + PREFIX, + json={"rule_type": "syntax", "message": "测试"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 422 + + @pytest.mark.asyncio + async def test创建带value和pattern(self, client, admin_token): + """附带 pattern 和 value 的规则可正常创建""" + resp = await client.post( + PREFIX, + json={ + "name": "pattern-rule", + "rule_type": "safety", + "pattern": r"DROP\s+TABLE", + "value": "100", + "message": "禁止删表", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + assert resp.json()["pattern"] == r"DROP\s+TABLE" + assert resp.json()["value"] == "100" + + +# ══════════════════════════════════════════════════════════════ +# 三、统计摘要 GET /api/v1/audit-rules/stats/summary +# ══════════════════════════════════════════════════════════════ + + +class TestRuleStats: + """GET /audit-rules/stats/summary — 统计摘要""" + + @pytest.mark.asyncio + async def test空数据库统计(self, client, admin_token): + """无数据时 total=0""" + resp = await client.get(f"{PREFIX}/stats/summary", headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert data["total"] == 0 + assert data["enabled"] == 0 + assert data["disabled"] == 0 + + @pytest.mark.asyncio + async def test统计数据正确(self, client, admin_token): + """创建规则后统计数据应更新""" + # 创建2条启用 + await client.post( + PREFIX, + json={"name": "stat1", "rule_type": "DDL", "message": "t1"}, + headers=auth_header(admin_token), + ) + await client.post( + PREFIX, + json={"name": "stat2", "rule_type": "DML", "message": "t2"}, + headers=auth_header(admin_token), + ) + # 创建1条后禁用 + create = await client.post( + PREFIX, + json={"name": "stat3", "rule_type": "DDL", "message": "t3"}, + headers=auth_header(admin_token), + ) + rid = create.json()["id"] + await client.post(f"{PREFIX}/{rid}/toggle", headers=auth_header(admin_token)) + + resp = await client.get(f"{PREFIX}/stats/summary", headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert data["total"] == 3 + assert data["enabled"] == 2 + assert data["disabled"] == 1 + assert data["by_type"]["DDL"] == 2 + assert data["by_type"]["DML"] == 1 + + @pytest.mark.asyncio + async def test_dba可查看统计(self, client, dba_token): + """dba 有只读权限""" + resp = await client.get(f"{PREFIX}/stats/summary", headers=auth_header(dba_token)) + assert resp.status_code == 200 + + @pytest.mark.asyncio + async def test_developer不可查看统计(self, client, developer_token): + """developer 无权限""" + resp = await client.get(f"{PREFIX}/stats/summary", headers=auth_header(developer_token)) + assert resp.status_code == 403 + + +# ══════════════════════════════════════════════════════════════ +# 四、种子数据 V1 POST /api/v1/audit-rules/seed/{db_type} +# ══════════════════════════════════════════════════════════════ + + +class TestSeedAuditRules: + """POST /audit-rules/seed/{db_type} — 批量种子数据""" + + @pytest.mark.asyncio + async def test_mysql种子数据创建成功(self, client, admin_token): + """MySQL 种子数据可正常导入""" + resp = await client.post(f"{PREFIX}/seed/mysql", headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert isinstance(resp.json(), list) + assert len(resp.json()) > 0 + + @pytest.mark.asyncio + async def test_postgres种子数据创建成功(self, client, admin_token): + """PostgreSQL 种子数据可正常导入""" + resp = await client.post(f"{PREFIX}/seed/postgres", headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert len(resp.json()) > 0 + + @pytest.mark.asyncio + async def test_redis种子数据创建成功(self, client, admin_token): + """Redis 种子数据可正常导入""" + resp = await client.post(f"{PREFIX}/seed/redis", headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert len(resp.json()) > 0 + + @pytest.mark.asyncio + async def test不支持的db_type返回400(self, client, admin_token): + """不支持的数据库类型应返回 400""" + resp = await client.post(f"{PREFIX}/seed/oracle", headers=auth_header(admin_token)) + assert resp.status_code == 400 + assert "不支持的数据库类型" in resp.json()["detail"] + + @pytest.mark.asyncio + async def test_dba无种子写入权限(self, client, dba_token): + """dba 无写权限""" + resp = await client.post(f"{PREFIX}/seed/mysql", headers=auth_header(dba_token)) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test重复种子数据跳过已存在(self, client, admin_token): + """第二次导入相同种子时，已存在的规则会被跳过""" + r1 = await client.post(f"{PREFIX}/seed/mysql", headers=auth_header(admin_token)) + r2 = await client.post(f"{PREFIX}/seed/mysql", headers=auth_header(admin_token)) + assert r1.status_code == 200 + assert r2.status_code == 200 + # 第二次不应创建新规则（列表应为空） + assert len(r2.json()) == 0 + + +# ══════════════════════════════════════════════════════════════ +# 五、获取单条 GET /api/v1/audit-rules/{rule_id} +# ══════════════════════════════════════════════════════════════ + + +class TestGetAuditRule: + """GET /audit-rules/{rule_id} — 获取单条""" + + @pytest.mark.asyncio + async def test获取存在的规则(self, client, admin_token): + """正常获取已创建的规则""" + create = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "get-one"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + resp = await client.get( + f"{PREFIX}/{rule_id}", headers=auth_header(admin_token) + ) + assert resp.status_code == 200 + assert resp.json()["name"] == "get-one" + + @pytest.mark.asyncio + async def test获取不存在的规则返回404(self, client, admin_token): + """不存在的 ID 返回 404""" + resp = await client.get(f"{PREFIX}/99999", headers=auth_header(admin_token)) + assert resp.status_code == 404 + assert "不存在" in resp.json()["detail"] + + @pytest.mark.asyncio + async def test_dba可获取规则(self, client, admin_token, dba_token): + """dba 有只读权限""" + create = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "dba-get"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + resp = await client.get( + f"{PREFIX}/{rule_id}", headers=auth_header(dba_token) + ) + assert resp.status_code == 200 + + @pytest.mark.asyncio + async def test_developer不可获取规则(self, client, admin_token, developer_token): + """developer 无权限""" + create = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "dev-get"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + resp = await client.get( + f"{PREFIX}/{rule_id}", headers=auth_header(developer_token) + ) + assert resp.status_code == 403 + + +# ══════════════════════════════════════════════════════════════ +# 六、更新 PUT /api/v1/audit-rules/{rule_id} +# ══════════════════════════════════════════════════════════════ + + +class TestUpdateAuditRule: + """PUT /audit-rules/{rule_id} — 更新规则""" + + @pytest.mark.asyncio + async def test更新部分字段成功(self, client, admin_token): + """只更新 severity 和 message""" + create = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "update-partial"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + resp = await client.put( + f"{PREFIX}/{rule_id}", + json={"severity": "error", "message": "更新后的消息"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["severity"] == "error" + assert data["message"] == "更新后的消息" + # 未修改的字段保持不变 + assert data["name"] == "update-partial" + assert data["rule_type"] == "performance" + + @pytest.mark.asyncio + async def test更新不存在的规则返回404(self, client, admin_token): + """更新不存在的 ID""" + resp = await client.put( + f"{PREFIX}/99999", + json={"severity": "info"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_dba无更新权限返回403(self, client, admin_token, dba_token): + """dba 无写权限""" + create = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "dba-update"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + resp = await client.put( + f"{PREFIX}/{rule_id}", + json={"severity": "info"}, + headers=auth_header(dba_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test更新全部字段(self, client, admin_token): + """一次更新所有可修改字段""" + create = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "full-update"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + resp = await client.put( + f"{PREFIX}/{rule_id}", + json={ + "name": "full-update-v2", + "description": "新描述", + "rule_type": "safety", + "severity": "error", + "db_type": "postgres", + "pattern": r"ALTER\s+TABLE", + "value": "200", + "is_enabled": False, + "message": "全新的消息", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["name"] == "full-update-v2" + assert data["description"] == "新描述" + assert data["rule_type"] == "safety" + assert data["severity"] == "error" + assert data["db_type"] == "postgres" + assert data["pattern"] == r"ALTER\s+TABLE" + assert data["value"] == "200" + assert data["is_enabled"] is False + assert data["message"] == "全新的消息" + + @pytest.mark.asyncio + async def test更新is_enabled字段(self, client, admin_token): + """通过 PUT 单独更新 is_enabled""" + create = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "toggle-via-put"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + assert create.json()["is_enabled"] is True + + resp = await client.put( + f"{PREFIX}/{rule_id}", + json={"is_enabled": False}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["is_enabled"] is False + + +# ══════════════════════════════════════════════════════════════ +# 七、删除 DELETE /api/v1/audit-rules/{rule_id} +# ══════════════════════════════════════════════════════════════ + + +class TestDeleteAuditRule: + """DELETE /audit-rules/{rule_id} — 删除规则""" + + @pytest.mark.asyncio + async def test删除成功(self, client, admin_token): + """删除后 GET 应返回 404""" + create = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "del-me"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + resp = await client.delete( + f"{PREFIX}/{rule_id}", headers=auth_header(admin_token) + ) + assert resp.status_code == 200 + assert resp.json()["message"] == "规则已删除" + + # 确认已删除 + get = await client.get( + f"{PREFIX}/{rule_id}", headers=auth_header(admin_token) + ) + assert get.status_code == 404 + + @pytest.mark.asyncio + async def test删除不存在的规则返回404(self, client, admin_token): + """删除不存在的 ID""" + resp = await client.delete( + f"{PREFIX}/99999", headers=auth_header(admin_token) + ) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_dba无删除权限返回403(self, client, admin_token, dba_token): + """dba 无删除权限""" + create = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "dba-del"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + resp = await client.delete( + f"{PREFIX}/{rule_id}", headers=auth_header(dba_token) + ) + assert resp.status_code == 403 + + +# ══════════════════════════════════════════════════════════════ +# 八、切换启用 POST /api/v1/audit-rules/{rule_id}/toggle +# ══════════════════════════════════════════════════════════════ + + +class TestToggleAuditRule: + """POST /audit-rules/{rule_id}/toggle — 切换启用/禁用""" + + @pytest.mark.asyncio + async def test切换启用到禁用再恢复(self, client, admin_token): + """连续 toggle 两次：启用→禁用→启用""" + create = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "toggle-twice"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + assert create.json()["is_enabled"] is True + + # 第一次 toggle：禁用 + r1 = await client.post( + f"{PREFIX}/{rule_id}/toggle", headers=auth_header(admin_token) + ) + assert r1.status_code == 200 + assert r1.json()["is_enabled"] is False + + # 第二次 toggle：恢复启用 + r2 = await client.post( + f"{PREFIX}/{rule_id}/toggle", headers=auth_header(admin_token) + ) + assert r2.status_code == 200 + assert r2.json()["is_enabled"] is True + + @pytest.mark.asyncio + async def test切换不存在的规则返回404(self, client, admin_token): + """不存在的 ID 返回 404""" + resp = await client.post( + f"{PREFIX}/99999/toggle", headers=auth_header(admin_token) + ) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_dba可切换规则(self, client, admin_token, dba_token): + """dba 有 toggle 权限（只读类操作中 toggle 是特殊写操作，需确认）""" + create = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "dba-toggle"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + resp = await client.post( + f"{PREFIX}/{rule_id}/toggle", headers=auth_header(dba_token) + ) + # 端点 require_role("admin", "dba") — dba 有权限 + assert resp.status_code == 200 + assert resp.json()["is_enabled"] is False + + @pytest.mark.asyncio + async def test_developer不可切换(self, client, admin_token, developer_token): + """developer 无权限""" + create = await client.post( + PREFIX, + json={**VALID_RULE_PAYLOAD, "name": "dev-toggle"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + resp = await client.post( + f"{PREFIX}/{rule_id}/toggle", headers=auth_header(developer_token) + ) + assert resp.status_code == 403 + + +# ══════════════════════════════════════════════════════════════ +# 九、V2 种子数据 POST /api/v1/audit-rules/seed-v2 +# ══════════════════════════════════════════════════════════════ + + +class TestSeedV2AuditRules: + """POST /audit-rules/seed-v2 — V2 种子数据""" + + @pytest.mark.asyncio + async def test_v2种子数据创建成功(self, client, admin_token): + """V2 种子数据可正常导入""" + resp = await client.post(f"{PREFIX}/seed-v2", headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert isinstance(resp.json(), list) + assert len(resp.json()) > 0 + + @pytest.mark.asyncio + async def test_v2种子数据去重(self, client, admin_token): + """重复导入 V2 种子时应跳过已存在的规则""" + await client.post(f"{PREFIX}/seed-v2", headers=auth_header(admin_token)) + resp = await client.post(f"{PREFIX}/seed-v2", headers=auth_header(admin_token)) + assert resp.status_code == 200 + # 第二次不会创建新规则 + assert len(resp.json()) == 0 + + @pytest.mark.asyncio + async def test_dba无v2种子写入权限(self, client, dba_token): + """dba 无写权限""" + resp = await client.post(f"{PREFIX}/seed-v2", headers=auth_header(dba_token)) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_developer无v2种子权限(self, client, developer_token): + """developer 无权限""" + resp = await client.post(f"{PREFIX}/seed-v2", headers=auth_header(developer_token)) + assert resp.status_code == 403 diff --git a/tests/test_audit_rule_seeds.py b/tests/test_audit_rule_seeds.py new file mode 100644 index 0000000..50c5d06 --- /dev/null +++ b/tests/test_audit_rule_seeds.py @@ -0,0 +1,240 @@ +"""Tests for Audit Rule seed endpoint and value field (Phase 4.2+).""" +import pytest +from tests.conftest import auth_header + + +class TestSeedAuditRules: + @pytest.mark.asyncio + async def test_seed_mysql_rules(self, client, admin_token): + """MySQL 种子规则批量创建""" + resp = await client.post( + "/api/v1/audit-rules/seed/mysql", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) == 15 # MySQL 有 15 条预设规则 + names = {r["name"] for r in data} + assert "DDLMultiToCommit" in names + assert "DDLMaxKeyParts" in names + assert "DMLMaxInsertRows" in names + assert "DMLWhere" in names + # 验证 value 字段 + key_parts = next(r for r in data if r["name"] == "DDLMaxKeyParts") + assert key_parts["value"] == "8" + max_key = next(r for r in data if r["name"] == "DDLMaxKey") + assert max_key["value"] == "12" + insert_rows = next(r for r in data if r["name"] == "DMLMaxInsertRows") + assert insert_rows["value"] == "500" + table_name = next(r for r in data if r["name"] == "MaxTableNameLen") + assert table_name["value"] == "45" + + @pytest.mark.asyncio + async def test_seed_postgres_rules(self, client, admin_token): + """PostgreSQL 种子规则批量创建""" + resp = await client.post( + "/api/v1/audit-rules/seed/postgres", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) == 11 + names = {r["name"] for r in data} + assert "PGDDLMultiToCommit" in names + assert "PGDDLMaxKeyParts" in names + assert "PGMaxTableNameLen" in names + # 验证 value 字段 + key_parts = next(r for r in data if r["name"] == "PGDDLMaxKeyParts") + assert key_parts["value"] == "8" + table_len = next(r for r in data if r["name"] == "PGMaxTableNameLen") + assert table_len["value"] == "63" + insert_rows = next(r for r in data if r["name"] == "PGDMLMaxInsertRows") + assert insert_rows["value"] == "500" + + @pytest.mark.asyncio + async def test_seed_redis_rules(self, client, admin_token): + """Redis 种子规则批量创建""" + resp = await client.post( + "/api/v1/audit-rules/seed/redis", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) == 4 + names = {r["name"] for r in data} + assert "RedisAllowFlushDB" in names + assert "RedisMaxKeyLen" in names + assert "RedisRequireTTL" in names + assert "RedisDefaultTTL" in names + # 验证 value 字段 + key_len = next(r for r in data if r["name"] == "RedisMaxKeyLen") + assert key_len["value"] == "256" + ttl = next(r for r in data if r["name"] == "RedisDefaultTTL") + assert ttl["value"] == "3600" + + @pytest.mark.asyncio + async def test_seed_unsupported_db_type(self, client, admin_token): + """不支持的数据库类型应返回 400""" + resp = await client.post( + "/api/v1/audit-rules/seed/oracle", + headers=auth_header(admin_token), + ) + assert resp.status_code == 400 + assert "不支持的数据库类型" in resp.json()["detail"] + + @pytest.mark.asyncio + async def test_seed_idempotent(self, client, admin_token): + """重复调用 seed 应幂等，不创建重复规则""" + resp1 = await client.post( + "/api/v1/audit-rules/seed/mysql", + headers=auth_header(admin_token), + ) + assert resp1.status_code == 200 + count1 = len(resp1.json()) + + resp2 = await client.post( + "/api/v1/audit-rules/seed/mysql", + headers=auth_header(admin_token), + ) + assert resp2.status_code == 200 + count2 = len(resp2.json()) + assert count2 == 0 # 第二次调用不再创建 + + @pytest.mark.asyncio + async def test_seed_forbidden_for_dba(self, client, dba_token): + """DBA 无权调用 seed 接口""" + resp = await client.post( + "/api/v1/audit-rules/seed/mysql", + headers=auth_header(dba_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_seed_forbidden_for_developer(self, client, developer_token): + """Developer 无权调用 seed 接口""" + resp = await client.post( + "/api/v1/audit-rules/seed/mysql", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +class TestValueFieldAndDDLType: + @pytest.mark.asyncio + async def test_create_rule_with_value(self, client, admin_token): + """创建带 value 字段的规则""" + resp = await client.post( + "/api/v1/audit-rules", + json={ + "name": "test_with_value", + "description": "测试value字段", + "rule_type": "DDL", + "severity": "warning", + "db_type": "mysql", + "value": "100", + "message": "测试规则带value", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + assert data["value"] == "100" + assert data["rule_type"] == "DDL" + + @pytest.mark.asyncio + async def test_create_rule_with_dml_type(self, client, admin_token): + """创建 DML 类型规则""" + resp = await client.post( + "/api/v1/audit-rules", + json={ + "name": "test_dml_rule", + "rule_type": "DML", + "severity": "error", + "db_type": "mysql", + "message": "DML测试规则", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + assert resp.json()["rule_type"] == "DML" + + @pytest.mark.asyncio + async def test_create_rule_null_value(self, client, admin_token): + """value 可以为 null""" + resp = await client.post( + "/api/v1/audit-rules", + json={ + "name": "test_null_value", + "rule_type": "DDL", + "severity": "info", + "message": "null value test", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + assert resp.json()["value"] is None + + @pytest.mark.asyncio + async def test_update_rule_value(self, client, admin_token): + """更新 value 字段""" + create = await client.post( + "/api/v1/audit-rules", + json={ + "name": "update_value_test", + "rule_type": "DDL", + "severity": "warning", + "value": "50", + "message": "test", + }, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + + resp = await client.put( + f"/api/v1/audit-rules/{rule_id}", + json={"value": "200"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["value"] == "200" + + @pytest.mark.asyncio + async def test_list_rules_with_ddl_filter(self, client, admin_token): + """按 DDL 类型筛选规则""" + # 先 seed MySQL + await client.post( + "/api/v1/audit-rules/seed/mysql", + headers=auth_header(admin_token), + ) + resp = await client.get( + "/api/v1/audit-rules?rule_type=DDL", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) > 0 + assert all(r["rule_type"] == "DDL" for r in data) + + @pytest.mark.asyncio + async def test_response_includes_value_field(self, client, admin_token): + """响应中包含 value 字段""" + create = await client.post( + "/api/v1/audit-rules", + json={ + "name": "response_value_test", + "rule_type": "DDL", + "severity": "warning", + "value": "42", + "message": "test", + }, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + + resp = await client.get( + f"/api/v1/audit-rules/{rule_id}", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert "value" in resp.json() + assert resp.json()["value"] == "42" diff --git a/tests/test_audit_rules.py b/tests/test_audit_rules.py new file mode 100644 index 0000000..3f042cc --- /dev/null +++ b/tests/test_audit_rules.py @@ -0,0 +1,165 @@ +"""Tests for Audit Rule CRUD API (Phase 4.2).""" +import pytest +from tests.conftest import auth_header + + +class TestListAuditRules: + @pytest.mark.asyncio + async def test_list_rules_admin(self, client, admin_token): + resp = await client.get("/api/v1/audit-rules", headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert isinstance(resp.json(), list) + + @pytest.mark.asyncio + async def test_list_rules_dba(self, client, dba_token): + resp = await client.get("/api/v1/audit-rules", headers=auth_header(dba_token)) + assert resp.status_code == 200 + + @pytest.mark.asyncio + async def test_list_rules_developer_forbidden(self, client, developer_token): + resp = await client.get("/api/v1/audit-rules", headers=auth_header(developer_token)) + assert resp.status_code == 403 + + +class TestCreateAuditRule: + @pytest.mark.asyncio + async def test_create_rule_success(self, client, admin_token): + resp = await client.post( + "/api/v1/audit-rules", + json={ + "name": "no_select_star", + "description": "禁止 SELECT *", + "rule_type": "performance", + "severity": "warning", + "db_type": "mysql", + "pattern": r"SELECT\s+\*", + "message": "禁止使用 SELECT *，请明确指定字段", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + assert data["name"] == "no_select_star" + assert data["rule_type"] == "performance" + assert data["is_enabled"] is True + + @pytest.mark.asyncio + async def test_create_duplicate_name(self, client, admin_token): + payload = { + "name": "dup_rule", + "rule_type": "safety", + "severity": "error", + "message": "test", + } + await client.post("/api/v1/audit-rules", json=payload, headers=auth_header(admin_token)) + resp = await client.post("/api/v1/audit-rules", json=payload, headers=auth_header(admin_token)) + assert resp.status_code == 400 + + @pytest.mark.asyncio + async def test_create_rule_non_admin(self, client, dba_token): + resp = await client.post( + "/api/v1/audit-rules", + json={"name": "dba_rule", "rule_type": "syntax", "severity": "info", "message": "test"}, + headers=auth_header(dba_token), + ) + assert resp.status_code == 403 + + +class TestGetAuditRule: + @pytest.mark.asyncio + async def test_get_rule(self, client, admin_token): + create = await client.post( + "/api/v1/audit-rules", + json={"name": "get_test", "rule_type": "naming", "severity": "info", "message": "test"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + resp = await client.get(f"/api/v1/audit-rules/{rule_id}", headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert resp.json()["name"] == "get_test" + + @pytest.mark.asyncio + async def test_get_nonexistent_rule(self, client, admin_token): + resp = await client.get("/api/v1/audit-rules/99999", headers=auth_header(admin_token)) + assert resp.status_code == 404 + + +class TestUpdateAuditRule: + @pytest.mark.asyncio + async def test_update_rule(self, client, admin_token): + create = await client.post( + "/api/v1/audit-rules", + json={"name": "update_test", "rule_type": "safety", "severity": "warning", "message": "old msg"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + resp = await client.put( + f"/api/v1/audit-rules/{rule_id}", + json={"severity": "error", "message": "new msg"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["severity"] == "error" + assert resp.json()["message"] == "new msg" + + +class TestDeleteAuditRule: + @pytest.mark.asyncio + async def test_delete_rule(self, client, admin_token): + create = await client.post( + "/api/v1/audit-rules", + json={"name": "delete_test", "rule_type": "syntax", "severity": "info", "message": "test"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + resp = await client.delete(f"/api/v1/audit-rules/{rule_id}", headers=auth_header(admin_token)) + assert resp.status_code == 200 + + # Verify deleted + get = await client.get(f"/api/v1/audit-rules/{rule_id}", headers=auth_header(admin_token)) + assert get.status_code == 404 + + +class TestToggleAuditRule: + @pytest.mark.asyncio + async def test_toggle_rule(self, client, admin_token): + create = await client.post( + "/api/v1/audit-rules", + json={"name": "toggle_test", "rule_type": "safety", "severity": "warning", "message": "test"}, + headers=auth_header(admin_token), + ) + rule_id = create.json()["id"] + assert create.json()["is_enabled"] is True + + # Toggle off + resp = await client.post(f"/api/v1/audit-rules/{rule_id}/toggle", headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert resp.json()["is_enabled"] is False + + # Toggle back on + resp = await client.post(f"/api/v1/audit-rules/{rule_id}/toggle", headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert resp.json()["is_enabled"] is True + + +class TestRuleStats: + @pytest.mark.asyncio + async def test_rule_stats(self, client, admin_token): + # Create some rules + await client.post( + "/api/v1/audit-rules", + json={"name": "stats_rule_1", "rule_type": "safety", "severity": "error", "message": "test"}, + headers=auth_header(admin_token), + ) + await client.post( + "/api/v1/audit-rules", + json={"name": "stats_rule_2", "rule_type": "performance", "severity": "warning", "message": "test"}, + headers=auth_header(admin_token), + ) + + resp = await client.get("/api/v1/audit-rules/stats/summary", headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert data["total"] >= 2 + assert data["enabled"] >= 2 + assert "by_type" in data diff --git a/tests/test_auth.py b/tests/test_auth.py new file mode 100644 index 0000000..f283f08 --- /dev/null +++ b/tests/test_auth.py @@ -0,0 +1,77 @@ +import pytest +from httpx import AsyncClient + +from app.core.security import create_access_token + + +class TestLogin: + async def test_login_success(self, client: AsyncClient, admin_user): + resp = await client.post("/api/v1/auth/login", json={ + "username": "admin", + "password": "123456", + }) + assert resp.status_code == 200 + data = resp.json() + assert "access_token" in data + assert data["token_type"] == "bearer" + assert data["user"]["username"] == "admin" + assert data["user"]["role"] == "admin" + + async def test_login_wrong_password(self, client: AsyncClient, admin_user): + resp = await client.post("/api/v1/auth/login", json={ + "username": "admin", + "password": "wrong", + }) + assert resp.status_code == 401 + + async def test_login_nonexistent_user(self, client: AsyncClient): + resp = await client.post("/api/v1/auth/login", json={ + "username": "nobody", + "password": "123456", + }) + assert resp.status_code == 401 + + async def test_login_disabled_user(self, client: AsyncClient, disabled_user): + resp = await client.post("/api/v1/auth/login", json={ + "username": "disabled", + "password": "123456", + }) + assert resp.status_code == 403 + + +class TestGetMe: + async def test_get_me_no_token(self, client: AsyncClient): + resp = await client.get("/api/v1/auth/me") + assert resp.status_code in (401, 403) + + async def test_get_me_valid_token(self, client: AsyncClient, admin_user, admin_token): + resp = await client.get( + "/api/v1/auth/me", + headers={"Authorization": f"Bearer {admin_token}"}, + ) + assert resp.status_code == 200 + data = resp.json() + assert data["username"] == "admin" + assert "id" in data + assert "role" in data + + async def test_get_me_expired_token(self, client: AsyncClient, admin_user): + from datetime import timedelta + expired = create_access_token( + data={"sub": str(admin_user.id), "role": admin_user.role}, + expires_delta=timedelta(seconds=-1), + ) + resp = await client.get( + "/api/v1/auth/me", + headers={"Authorization": f"Bearer {expired}"}, + ) + assert resp.status_code == 401 + + +class TestLogout: + async def test_logout(self, client: AsyncClient, admin_token): + resp = await client.post( + "/api/v1/auth/logout", + headers={"Authorization": f"Bearer {admin_token}"}, + ) + assert resp.status_code == 200 diff --git a/tests/test_backup.py b/tests/test_backup.py new file mode 100644 index 0000000..f7727fb --- /dev/null +++ b/tests/test_backup.py @@ -0,0 +1,395 @@ +"""备份管理 API 端点测试。 + +测试范围: +- GET /api/v1/backups — 列表（支持 instance_id 过滤） +- POST /api/v1/backups — 创建备份（201, 自动生成 filename） +- GET /api/v1/backups/{id} — 备份详情（404 不存在） + +覆盖要点: +- CRUD 基本流程 +- 权限控制（admin/dba 可访问, developer/guest → 403） +- instance_id 过滤 +- filename 自动生成（database_instance_id.sql） +- 404 不存在的备份 +""" +import pytest +from httpx import AsyncClient + +from tests.conftest import auth_header + +BASE = "/api/v1/backups" + + +# ══════════════════════════════════════════════════════════════════ +# 权限测试 — developer / guest → 403 +# ══════════════════════════════════════════════════════════════════ + + +class TestBackupPermissions: + """备份路由权限控制：仅 admin / dba 可访问。""" + + @pytest.mark.asyncio + async def test_list_backups_developer_forbidden( + self, client: AsyncClient, developer_token: str + ): + """developer 访问列表 → 403。""" + resp = await client.get(BASE, headers=auth_header(developer_token)) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_list_backups_guest_forbidden( + self, client: AsyncClient, guest_token: str + ): + """guest 访问列表 → 403。""" + resp = await client.get(BASE, headers=auth_header(guest_token)) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_create_backup_developer_forbidden( + self, client: AsyncClient, developer_token: str + ): + """developer 创建备份 → 403。""" + resp = await client.post( + BASE, + json={"title": "t", "instance_id": 1, "database": "db"}, + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_create_backup_guest_forbidden( + self, client: AsyncClient, guest_token: str + ): + """guest 创建备份 → 403。""" + resp = await client.post( + BASE, + json={"title": "t", "instance_id": 1, "database": "db"}, + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_get_backup_developer_forbidden( + self, client: AsyncClient, developer_token: str + ): + """developer 获取详情 → 403。""" + resp = await client.get(f"{BASE}/1", headers=auth_header(developer_token)) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_get_backup_guest_forbidden( + self, client: AsyncClient, guest_token: str + ): + """guest 获取详情 → 403。""" + resp = await client.get(f"{BASE}/1", headers=auth_header(guest_token)) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_unauthenticated_access(self, client: AsyncClient): + """未认证 → 401。""" + resp = await client.get(BASE) + assert resp.status_code == 401 + + +# ══════════════════════════════════════════════════════════════════ +# 创建备份 — POST /api/v1/backups +# ══════════════════════════════════════════════════════════════════ + + +class TestCreateBackup: + """创建备份测试。""" + + @pytest.mark.asyncio + async def test_create_backup_admin( + self, client: AsyncClient, admin_token: str, test_instance + ): + """admin 创建备份 → 201，字段完整。""" + payload = { + "title": "每日全量备份", + "instance_id": test_instance.id, + "database": "production_db", + "remark": "定时任务触发", + } + resp = await client.post(BASE, json=payload, headers=auth_header(admin_token)) + assert resp.status_code == 201 + + data = resp.json() + assert data["id"] is not None + assert data["title"] == "每日全量备份" + assert data["instance_id"] == test_instance.id + assert data["database"] == "production_db" + assert data["status"] == "pending" + assert data["size_bytes"] == 0 + assert data["remark"] == "定时任务触发" + # created_by 应为 admin 用户 id + assert data["created_by"] is not None + # created_at 应有值 + assert data["created_at"] is not None + + @pytest.mark.asyncio + async def test_create_backup_filename_auto_generated( + self, client: AsyncClient, admin_token: str, test_instance + ): + """filename 自动生成为 {database}_{instance_id}.sql。""" + payload = { + "title": "测试文件名", + "instance_id": test_instance.id, + "database": "mydb", + } + resp = await client.post(BASE, json=payload, headers=auth_header(admin_token)) + assert resp.status_code == 201 + + data = resp.json() + expected_filename = f"mydb_{test_instance.id}.sql" + assert data["filename"] == expected_filename + + @pytest.mark.asyncio + async def test_create_backup_dba( + self, client: AsyncClient, dba_token: str, test_instance + ): + """dba 创建备份 → 201。""" + payload = { + "title": "DBA手动备份", + "instance_id": test_instance.id, + "database": "orders", + } + resp = await client.post(BASE, json=payload, headers=auth_header(dba_token)) + assert resp.status_code == 201 + assert resp.json()["title"] == "DBA手动备份" + + @pytest.mark.asyncio + async def test_create_backup_without_remark( + self, client: AsyncClient, admin_token: str, test_instance + ): + """不传 remark → remark 为 None。""" + payload = { + "title": "无备注备份", + "instance_id": test_instance.id, + "database": "test_db", + } + resp = await client.post(BASE, json=payload, headers=auth_header(admin_token)) + assert resp.status_code == 201 + assert resp.json()["remark"] is None + + @pytest.mark.asyncio + async def test_create_backup_sets_created_by( + self, client: AsyncClient, dba_token: str, dba_user, test_instance + ): + """created_by 应为当前登录用户 id。""" + payload = { + "title": "验证created_by", + "instance_id": test_instance.id, + "database": "hr_db", + } + resp = await client.post(BASE, json=payload, headers=auth_header(dba_token)) + assert resp.status_code == 201 + assert resp.json()["created_by"] == dba_user.id + + @pytest.mark.asyncio + async def test_create_backup_nonexistent_instance_id( + self, client: AsyncClient, admin_token: str + ): + """instance_id 可以是不存在的（无外键约束），仍然创建成功。""" + payload = { + "title": "幽灵实例备份", + "instance_id": 99999, + "database": "ghost_db", + } + resp = await client.post(BASE, json=payload, headers=auth_header(admin_token)) + assert resp.status_code == 201 + assert resp.json()["instance_id"] == 99999 + + +# ══════════════════════════════════════════════════════════════════ +# 获取备份详情 — GET /api/v1/backups/{backup_id} +# ══════════════════════════════════════════════════════════════════ + + +class TestGetBackup: + """获取备份详情测试。""" + + @pytest.mark.asyncio + async def test_get_backup_by_id( + self, client: AsyncClient, admin_token: str, test_instance + ): + """创建后通过 id 获取 → 数据一致。""" + # 先创建 + payload = { + "title": "查询测试", + "instance_id": test_instance.id, + "database": "inventory", + "remark": "验证查询", + } + create_resp = await client.post( + BASE, json=payload, headers=auth_header(admin_token) + ) + assert create_resp.status_code == 201 + backup_id = create_resp.json()["id"] + + # 再查询 + get_resp = await client.get( + f"{BASE}/{backup_id}", headers=auth_header(admin_token) + ) + assert get_resp.status_code == 200 + data = get_resp.json() + assert data["id"] == backup_id + assert data["title"] == "查询测试" + assert data["database"] == "inventory" + assert data["remark"] == "验证查询" + + @pytest.mark.asyncio + async def test_get_backup_not_found(self, client: AsyncClient, admin_token: str): + """获取不存在的 backup_id → 404。""" + resp = await client.get(f"{BASE}/99999", headers=auth_header(admin_token)) + assert resp.status_code == 404 + assert "不存在" in resp.json()["detail"] + + @pytest.mark.asyncio + async def test_get_backup_dba( + self, client: AsyncClient, dba_token: str, admin_token: str, test_instance + ): + """dba 可以获取 admin 创建的备份。""" + payload = { + "title": "跨角色查看", + "instance_id": test_instance.id, + "database": "shared_db", + } + create_resp = await client.post( + BASE, json=payload, headers=auth_header(admin_token) + ) + backup_id = create_resp.json()["id"] + + get_resp = await client.get( + f"{BASE}/{backup_id}", headers=auth_header(dba_token) + ) + assert get_resp.status_code == 200 + assert get_resp.json()["id"] == backup_id + + +# ══════════════════════════════════════════════════════════════════ +# 列表查询 — GET /api/v1/backups +# ══════════════════════════════════════════════════════════════════ + + +class TestListBackups: + """备份列表查询测试。""" + + @pytest.mark.asyncio + async def test_list_backups_empty(self, client: AsyncClient, admin_token: str): + """无备份时返回空列表。""" + resp = await client.get(BASE, headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert resp.json() == [] + + @pytest.mark.asyncio + async def test_list_backups_returns_created( + self, client: AsyncClient, admin_token: str, test_instance + ): + """创建后列表包含该备份。""" + payload = { + "title": "列表验证", + "instance_id": test_instance.id, + "database": "catalog", + } + await client.post(BASE, json=payload, headers=auth_header(admin_token)) + + resp = await client.get(BASE, headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert len(data) >= 1 + assert any(b["title"] == "列表验证" for b in data) + + @pytest.mark.asyncio + async def test_list_backups_filter_by_instance_id( + self, client: AsyncClient, admin_token: str, test_instance + ): + """instance_id 过滤：只返回对应实例的备份。""" + # 创建两个不同 instance_id 的备份 + await client.post( + BASE, + json={"title": "目标实例", "instance_id": test_instance.id, "database": "a"}, + headers=auth_header(admin_token), + ) + await client.post( + BASE, + json={"title": "其他实例", "instance_id": 99999, "database": "b"}, + headers=auth_header(admin_token), + ) + + resp = await client.get( + BASE, + params={"instance_id": test_instance.id}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) == 1 + assert data[0]["title"] == "目标实例" + assert data[0]["instance_id"] == test_instance.id + + @pytest.mark.asyncio + async def test_list_backups_filter_nonexistent_instance( + self, client: AsyncClient, admin_token: str, test_instance + ): + """过滤不存在的 instance_id → 空列表。""" + # 先创建一个备份确保数据库不为空 + await client.post( + BASE, + json={ + "title": "占位", + "instance_id": test_instance.id, + "database": "x", + }, + headers=auth_header(admin_token), + ) + + resp = await client.get( + BASE, + params={"instance_id": 88888}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json() == [] + + @pytest.mark.asyncio + async def test_list_backups_dba( + self, client: AsyncClient, dba_token: str, admin_token: str, test_instance + ): + """dba 可以查看备份列表。""" + await client.post( + BASE, + json={ + "title": "DBA列表", + "instance_id": test_instance.id, + "database": "dba_db", + }, + headers=auth_header(admin_token), + ) + + resp = await client.get(BASE, headers=auth_header(dba_token)) + assert resp.status_code == 200 + assert len(resp.json()) >= 1 + + @pytest.mark.asyncio + async def test_list_backups_multiple_ordered_desc( + self, client: AsyncClient, admin_token: str, test_instance + ): + """多条备份按 id 降序排列。""" + for i in range(3): + await client.post( + BASE, + json={ + "title": f"备份{i}", + "instance_id": test_instance.id, + "database": f"db{i}", + }, + headers=auth_header(admin_token), + ) + + resp = await client.get(BASE, headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert len(data) == 3 + # 按 id 降序 + ids = [b["id"] for b in data] + assert ids == sorted(ids, reverse=True) diff --git a/tests/test_crypto.py b/tests/test_crypto.py new file mode 100644 index 0000000..a289c2b --- /dev/null +++ b/tests/test_crypto.py @@ -0,0 +1,138 @@ +"""Tests for AES encryption (Phase 3.1).""" +import pytest +from app.core.crypto import encrypt_password, decrypt_password + + +class TestEncryption: + def test_encrypt_decrypt_roundtrip(self): + """Encrypt then decrypt returns original.""" + plain = "my_secret_password_123" + encrypted = encrypt_password(plain) + assert encrypted != plain + assert decrypt_password(encrypted) == plain + + def test_encrypt_produces_different_ciphertext(self): + """Each encryption uses a random nonce, so ciphertext differs.""" + plain = "same_password" + e1 = encrypt_password(plain) + e2 = encrypt_password(plain) + assert e1 != e2 # different nonces + assert decrypt_password(e1) == plain + assert decrypt_password(e2) == plain + + def test_encrypt_empty_string(self): + """Can encrypt and decrypt empty string.""" + encrypted = encrypt_password("") + assert decrypt_password(encrypted) == "" + + def test_encrypt_special_characters(self): + """Handles special characters in passwords.""" + plain = 'p@ssw0rd!#$%^&*()_+-=[]{}|;\':",./<>?' + encrypted = encrypt_password(plain) + assert decrypt_password(encrypted) == plain + + def test_encrypt_unicode(self): + """Handles unicode characters.""" + plain = "密码测试🔑" + encrypted = encrypt_password(plain) + assert decrypt_password(encrypted) == plain + + def test_decrypt_invalid_data_returns_as_is(self): + """Invalid ciphertext returns original string (backward compat).""" + result = decrypt_password("not_valid_base64!!!") + assert result == "not_valid_base64!!!" + + +class TestInstanceEncryption: + """Test that instance passwords are stored encrypted via API.""" + + @pytest.mark.asyncio + async def test_create_instance_encrypts_password(self, client, admin_token): + """POST /instances stores password as encrypted ciphertext.""" + from tests.conftest import auth_header + resp = await client.post( + "/api/v1/instances", + json={ + "name": "加密测试", + "db_type": "mysql", + "host": "10.0.0.1", + "port": 3306, + "username": "root", + "password": "plain_text_pw", + "database": "test", + "env": "development", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + # Response should NOT contain password at all (InstanceResponse excludes it) + assert "password" not in data + + @pytest.mark.asyncio + async def test_password_not_stored_as_plaintext(self, client, db, admin_token): + """Verify the database actually stores encrypted, not plain text.""" + from tests.conftest import auth_header + from app.models.instance import Instance + from sqlalchemy import select + + plain_pw = "super_secret_123" + resp = await client.post( + "/api/v1/instances", + json={ + "name": "明文检查", + "db_type": "mysql", + "host": "10.0.0.2", + "port": 3306, + "username": "root", + "password": plain_pw, + "database": "test", + "env": "development", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + instance_id = resp.json()["id"] + + # Read raw from database + result = await db.execute(select(Instance).where(Instance.id == instance_id)) + instance = result.scalar_one() + assert instance.password != plain_pw # Not stored as plaintext + assert len(instance.password) > 20 # Encrypted is longer + + @pytest.mark.asyncio + async def test_update_instance_re_encrypts_password(self, client, db, admin_token): + """PUT /instances/:id re-encrypts password when updated.""" + from tests.conftest import auth_header + from app.models.instance import Instance + from sqlalchemy import select + + # Create + resp = await client.post( + "/api/v1/instances", + json={ + "name": "更新加密", + "db_type": "mysql", + "host": "10.0.0.3", + "port": 3306, + "username": "root", + "password": "old_password", + "database": "test", + }, + headers=auth_header(admin_token), + ) + iid = resp.json()["id"] + + # Update password + resp = await client.put( + f"/api/v1/instances/{iid}", + json={"password": "new_password"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + # Verify encrypted + result = await db.execute(select(Instance).where(Instance.id == iid)) + inst = result.scalar_one() + assert inst.password != "new_password" + assert inst.password != "old_password" diff --git a/tests/test_dashboard.py b/tests/test_dashboard.py new file mode 100644 index 0000000..21fa988 --- /dev/null +++ b/tests/test_dashboard.py @@ -0,0 +1,221 @@ +"""Comprehensive tests for Dashboard stats endpoint.""" +import pytest +from httpx import AsyncClient +from sqlalchemy.ext.asyncio import AsyncSession + +from tests.conftest import auth_header +from app.models.ticket import Ticket +from app.models.instance import Instance +from app.models.user import User +from app.models.audit_log import AuditLog +from app.core.security import hash_password + +BASE = "/api/v1/dashboard/stats" + + +class TestDashboard: + async def test_get_stats(self, client: AsyncClient, admin_token): + resp = await client.get(BASE, headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert "ticket_total" in data + assert "instance_total" in data + assert "user_total" in data + + async def test_unauthenticated(self, client: AsyncClient): + resp = await client.get(BASE) + assert resp.status_code in (401, 403) + + +# ─── DETAILED STATS TESTS ────────────────────────────────────────────── + + +@pytest.mark.asyncio +async def test_stats_all_zero_on_empty_db(client: AsyncClient, admin_token: str): + """Fresh DB with only the admin user should show zeros except user_total=1.""" + resp = await client.get(BASE, headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert data["ticket_total"] == 0 + assert data["ticket_pending"] == 0 + assert data["ticket_month"] == 0 + assert data["ticket_executing"] == 0 + assert data["instance_total"] == 0 + assert data["instance_online"] == 0 + assert data["user_total"] == 1 # admin_user from fixture + assert data["queries_today"] == 0 + + +@pytest.mark.asyncio +async def test_stats_fields_structure(client: AsyncClient, admin_token: str): + """Verify all expected fields are present and are integers.""" + resp = await client.get(BASE, headers=auth_header(admin_token)) + data = resp.json() + expected_keys = { + "ticket_total", + "ticket_pending", + "ticket_month", + "ticket_executing", + "instance_total", + "instance_online", + "user_total", + "queries_today", + "query_stats", + } + assert set(data.keys()) == expected_keys + for key in expected_keys: + if key == "query_stats": + assert isinstance(data[key], (dict, type(None))), f"{key} should be dict or None" + else: + assert isinstance(data[key], int), f"{key} should be int" + + +@pytest.mark.asyncio +async def test_stats_reflect_ticket_counts( + client: AsyncClient, db: AsyncSession, admin_token: str, test_instance: Instance +): + """Create tickets with various statuses and verify counts.""" + for status in ["pending", "reviewing", "executing", "success"]: + ticket = Ticket( + title=f"工单-{status}", + db_type="mysql", + instance_id=test_instance.id, + target_database="test_db", + sql_content="SELECT 1", + status=status, + applicant_id=1, + ) + db.add(ticket) + await db.commit() + + resp = await client.get(BASE, headers=auth_header(admin_token)) + data = resp.json() + assert data["ticket_total"] == 4 + # pending + reviewing = 2 + assert data["ticket_pending"] == 2 + assert data["ticket_executing"] == 1 + # all 4 are within the last month + assert data["ticket_month"] == 4 + + +@pytest.mark.asyncio +async def test_stats_reflect_instance_counts( + client: AsyncClient, db: AsyncSession, admin_token: str +): + """Create instances with different statuses.""" + for i, status in enumerate(["connected", "disconnected", "connected"]): + inst = Instance( + name=f"inst-{i}", + db_type="mysql", + host=f"127.0.0.{i}", + port=3306, + username="root", + password="pw", + database="db", + env="dev", + status=status, + ) + db.add(inst) + await db.commit() + + resp = await client.get(BASE, headers=auth_token_or_admin(admin_token)) + data = resp.json() + assert data["instance_total"] == 3 + assert data["instance_online"] == 2 # connected count + + +@pytest.mark.asyncio +async def test_stats_reflect_user_count( + client: AsyncClient, db: AsyncSession, admin_token: str +): + """Add an extra active user and verify user_total.""" + extra_user = User( + username="extra", + display_name="额外用户", + role="developer", + hashed_password="fake_hash", + is_active=True, + ) + db.add(extra_user) + await db.commit() + + resp = await client.get(BASE, headers=auth_header(admin_token)) + data = resp.json() + # admin + extra = 2 + assert data["user_total"] == 2 + + +@pytest.mark.asyncio +async def test_stats_excludes_inactive_users( + client: AsyncClient, db: AsyncSession, admin_token: str +): + """Inactive users should not be counted in user_total.""" + inactive = User( + username="inactive", + display_name="禁用用户", + role="developer", + hashed_password="fake_hash", + is_active=False, + ) + db.add(inactive) + await db.commit() + + resp = await client.get(BASE, headers=auth_header(admin_token)) + data = resp.json() + # Only admin (active), inactive user should be excluded + assert data["user_total"] == 1 + + +@pytest.mark.asyncio +async def test_stats_reflect_queries_today( + client: AsyncClient, db: AsyncSession, admin_token: str +): + """Add query histories and verify queries_today counts from QueryHistory.""" + from app.models.query_history import QueryHistory + for i in range(5): + qh = QueryHistory( + user_id=1, + username="admin", + instance_id=1, + instance_name="test", + db_type="mysql", + database_name="test_db", + query_content="SELECT 1", + query_type="SELECT", + execution_time_ms=100, + result_rows=1, + is_success=True, + ) + db.add(qh) + await db.commit() + + resp = await client.get(BASE, headers=auth_header(admin_token)) + data = resp.json() + assert data["queries_today"] == 5 + + +@pytest.mark.asyncio +async def test_stats_developer_can_access(client: AsyncClient, developer_token: str): + """Dashboard stats should be accessible to any authenticated user.""" + resp = await client.get(BASE, headers=auth_header(developer_token)) + assert resp.status_code == 200 + + +@pytest.mark.asyncio +async def test_stats_guest_can_access(client: AsyncClient, guest_token: str): + """Dashboard stats should be accessible to any authenticated user.""" + resp = await client.get(BASE, headers=auth_header(guest_token)) + assert resp.status_code == 200 + + +@pytest.mark.asyncio +async def test_stats_no_auth_returns_401(client: AsyncClient): + resp = await client.get(BASE) + assert resp.status_code == 401 + + +# ─── Helper ──────────────────────────────────────────────────────────── + +def auth_token_or_admin(token: str) -> dict: + """Alias for auth_header to avoid confusion in test body.""" + return auth_header(token) diff --git a/tests/test_db_types.py b/tests/test_db_types.py new file mode 100644 index 0000000..0fd3e5e --- /dev/null +++ b/tests/test_db_types.py @@ -0,0 +1,204 @@ +"""数据库类型说明 API 测试 — db_types 端点。 + +覆盖: +- GET /db-types — 列表概览 +- GET /db-types/{db_type} — 详细信息 +- GET /db-types/{db_type}/commands — 常用命令 +- GET /db-types/{db_type}/tips — 使用技巧 +- 404 错误处理 +""" +import pytest +from httpx import AsyncClient, ASGITransport + +from app.main import app + + +@pytest.fixture +def auth_headers(): + """返回认证头。""" + from app.core.security import create_access_token + token = create_access_token({"sub": "1", "role": "admin"}) + return {"Authorization": "Bearer " + token} + + +@pytest.mark.asyncio +async def test_list_db_types(client, admin_token): + """测试获取所有数据库类型概览。""" + resp = await client.get("/api/v1/db-types", headers={"Authorization": "Bearer " + admin_token}) + + assert resp.status_code == 200 + data = resp.json() + assert "items" in data + assert data["total"] == 4 + + types = {item["type"] for item in data["items"]} + assert types == {"mysql", "postgres", "redis", "mongo"} + + # 检查每个条目的结构 + for item in data["items"]: + assert "type" in item + assert "name" in item + assert "icon" in item + assert "description" in item + assert "category" in item + assert "version" in item + assert "supported_operations" in item + assert item["supported_operations"] > 0 + + +@pytest.mark.asyncio +async def test_get_mysql_detail(client, admin_token): + """测试获取 MySQL 详细信息。""" + resp = await client.get("/api/v1/db-types/mysql", headers={"Authorization": "Bearer " + admin_token}) + + assert resp.status_code == 200 + data = resp.json() + assert data["type"] == "mysql" + assert data["name"] == "MySQL" + assert data["category"] == "关系型" + assert len(data["supported_query_types"]) >= 4 + assert len(data["security_rules"]) >= 1 + assert len(data["tips"]) >= 1 + assert len(data["common_commands"]) >= 1 + assert len(data["limitations"]) >= 1 + + # 检查查询类型结构 + for qt in data["supported_query_types"]: + assert "type" in qt + assert "description" in qt + assert "example" in qt + + +@pytest.mark.asyncio +async def test_get_postgres_detail(client, admin_token): + """测试获取 PostgreSQL 详细信息。""" + resp = await client.get("/api/v1/db-types/postgres", headers={"Authorization": "Bearer " + admin_token}) + + assert resp.status_code == 200 + data = resp.json() + assert data["type"] == "postgres" + assert data["name"] == "PostgreSQL" + assert data["category"] == "关系型" + + +@pytest.mark.asyncio +async def test_get_redis_detail(client, admin_token): + """测试获取 Redis 详细信息。""" + resp = await client.get("/api/v1/db-types/redis", headers={"Authorization": "Bearer " + admin_token}) + + assert resp.status_code == 200 + data = resp.json() + assert data["type"] == "redis" + assert data["name"] == "Redis" + assert data["category"] == "键值型" + assert len(data["supported_query_types"]) >= 5 + + +@pytest.mark.asyncio +async def test_get_mongo_detail(client, admin_token): + """测试获取 MongoDB 详细信息。""" + resp = await client.get("/api/v1/db-types/mongo", headers={"Authorization": "Bearer " + admin_token}) + + assert resp.status_code == 200 + data = resp.json() + assert data["type"] == "mongo" + assert data["name"] == "MongoDB" + assert data["category"] == "文档型" + + +@pytest.mark.asyncio +async def test_get_unknown_db_type(client, admin_token): + """测试获取不支持的数据库类型 — 404。""" + resp = await client.get("/api/v1/db-types/oracle", headers={"Authorization": "Bearer " + admin_token}) + + assert resp.status_code == 404 + assert "不支持的数据库类型" in resp.json()["detail"] + + +@pytest.mark.asyncio +async def test_get_commands(client, admin_token): + """测试获取常用命令列表。""" + resp = await client.get("/api/v1/db-types/mysql/commands", headers={"Authorization": "Bearer " + admin_token}) + + assert resp.status_code == 200 + data = resp.json() + assert "items" in data + assert data["total"] >= 5 + + for cmd in data["items"]: + assert "name" in cmd + assert "command" in cmd + + +@pytest.mark.asyncio +async def test_get_commands_redis(client, admin_token): + """测试获取 Redis 常用命令列表。""" + resp = await client.get("/api/v1/db-types/redis/commands", headers={"Authorization": "Bearer " + admin_token}) + + assert resp.status_code == 200 + data = resp.json() + assert data["total"] >= 5 + + cmd_names = {cmd["name"] for cmd in data["items"]} + assert "查看键数量" in cmd_names or "查看服务器信息" in cmd_names + + +@pytest.mark.asyncio +async def test_get_commands_unknown(client, admin_token): + """测试获取不支持类型的命令 — 404。""" + resp = await client.get("/api/v1/db-types/cassandra/commands", headers={"Authorization": "Bearer " + admin_token}) + + assert resp.status_code == 404 + + +@pytest.mark.asyncio +async def test_get_tips(client, admin_token): + """测试获取使用技巧。""" + resp = await client.get("/api/v1/db-types/mysql/tips", headers={"Authorization": "Bearer " + admin_token}) + + assert resp.status_code == 200 + data = resp.json() + assert "items" in data + assert data["total"] >= 3 + # 每条 tip 是字符串 + for tip in data["items"]: + assert isinstance(tip, str) + assert len(tip) > 0 + + +@pytest.mark.asyncio +async def test_get_tips_mongo(client, admin_token): + """测试获取 MongoDB 使用技巧。""" + resp = await client.get("/api/v1/db-types/mongo/tips", headers={"Authorization": "Bearer " + admin_token}) + + assert resp.status_code == 200 + data = resp.json() + assert data["total"] >= 2 + + +@pytest.mark.asyncio +async def test_get_tips_unknown(client, admin_token): + """测试获取不支持类型的技巧 — 404。""" + resp = await client.get("/api/v1/db-types/sqlite/tips", headers={"Authorization": "Bearer " + admin_token}) + + assert resp.status_code == 404 + + +@pytest.mark.asyncio +async def test_db_types_require_auth(client): + """测试未认证请求被拒绝。""" + resp = await client.get("/api/v1/db-types") + + assert resp.status_code in (401, 403) + + +@pytest.mark.asyncio +async def test_list_structure_consistency(client, admin_token): + """测试所有类型的列表条目结构一致。""" + resp = await client.get("/api/v1/db-types", headers={"Authorization": "Bearer " + admin_token}) + + data = resp.json() + required_fields = {"type", "name", "icon", "description", "category", "version", "supported_operations", "security_rules_count"} + for item in data["items"]: + assert required_fields.issubset(set(item.keys())), \ + "Missing fields: " + str(required_fields - set(item.keys())) diff --git a/tests/test_dictionary.py b/tests/test_dictionary.py new file mode 100644 index 0000000..b565f25 --- /dev/null +++ b/tests/test_dictionary.py @@ -0,0 +1,227 @@ +"""数据字典模块测试。""" +import sys +from unittest.mock import patch, AsyncMock, MagicMock + +from httpx import AsyncClient + +from tests.conftest import auth_header +from app.services.db_connector import QueryResult + + +def _mock_query_result(columns, rows): + """Helper: build a QueryResult for mocking execute_query.""" + return QueryResult( + columns=columns, + rows=rows, + total=len(rows), + elapsed_ms=10, + truncated=False, + ) + + +class TestListDatabases: + async def test_list_databases_success( + self, client: AsyncClient, test_instance, admin_token + ): + mock_result = _mock_query_result( + ["Database"], + [ + {"Database": "test_db"}, + {"Database": "app_db"}, + {"Database": "information_schema"}, + ], + ) + with patch( + "app.services.dictionary_service.DBConnector.execute_query", + new_callable=AsyncMock, + return_value=mock_result, + ): + resp = await client.get( + "/api/v1/dictionary/instances/" + str(test_instance.id) + "/databases", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert "databases" in data + db_list = data["databases"] + assert "test_db" in db_list + assert "app_db" in db_list + # system databases should be filtered + assert "information_schema" not in db_list + + async def test_list_databases_not_found( + self, client: AsyncClient, admin_token + ): + resp = await client.get( + "/api/v1/dictionary/instances/99999/databases", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + +class TestListTables: + async def test_list_tables_success( + self, client: AsyncClient, test_instance, admin_token + ): + mock_result = _mock_query_result( + ["TABLE_NAME"], + [{"TABLE_NAME": "users"}, {"TABLE_NAME": "orders"}], + ) + with patch( + "app.services.dictionary_service.DBConnector.execute_query", + new_callable=AsyncMock, + return_value=mock_result, + ): + resp = await client.get( + "/api/v1/dictionary/instances/" + str(test_instance.id) + "/tables", + params={"database": "test_db"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert "tables" in data + assert "users" in data["tables"] + assert "orders" in data["tables"] + + +class TestGetTableDetail: + async def test_table_detail_success( + self, client: AsyncClient, test_instance, admin_token + ): + col_result = _mock_query_result( + ["Field", "Type", "Null", "Key", "Default", "Extra", "Comment"], + [ + { + "Field": "id", + "Type": "int", + "Null": "NO", + "Key": "PRI", + "Default": None, + "Extra": "auto_increment", + "Comment": "primary key", + }, + ], + ) + idx_result = _mock_query_result( + ["Key_name", "Non_unique", "Index_type", "Column_name"], + [ + {"Key_name": "PRIMARY", "Non_unique": 0, "Index_type": "BTREE", "Column_name": "id"}, + ], + ) + ddl_result = _mock_query_result( + ["Table", "Create Table"], + [{"Table": "users", "Create Table": "CREATE TABLE users (id int PRIMARY KEY)"}], + ) + cnt_result = _mock_query_result( + ["TABLE_ROWS"], + [{"TABLE_ROWS": 42}], + ) + + call_count = 0 + results = [col_result, idx_result, ddl_result, cnt_result] + + async def _mock_execute(*args, **kwargs): + nonlocal call_count + r = results[call_count] + call_count += 1 + return r + + with patch( + "app.services.dictionary_service.DBConnector.execute_query", + new=AsyncMock(side_effect=_mock_execute), + ): + resp = await client.get( + "/api/v1/dictionary/instances/" + str(test_instance.id) + "/tables/users", + params={"database": "test_db"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert "columns" in data + assert len(data["columns"]) == 1 + assert data["columns"][0]["Field"] == "id" + assert "indexes" in data + assert "create_ddl" in data + assert "row_count" in data + assert data["row_count"] == 42 + + +class TestExportDictionary: + async def test_export_success( + self, client: AsyncClient, test_instance, admin_token + ): + # list_tables returns 1 table + tbl_result = _mock_query_result( + ["TABLE_NAME"], + [{"TABLE_NAME": "users"}], + ) + # get_table_detail: columns + col_result = _mock_query_result( + ["Field", "Type", "Null", "Key", "Default", "Extra", "Comment"], + [{"Field": "id", "Type": "int", "Null": "NO", "Key": "PRI", "Default": None, "Extra": "", "Comment": ""}], + ) + # indexes + idx_result = _mock_query_result( + ["Key_name", "Non_unique", "Index_type", "Column_name"], + [{"Key_name": "PRIMARY", "Non_unique": 0, "Index_type": "BTREE", "Column_name": "id"}], + ) + # ddl + ddl_result = _mock_query_result( + ["Table", "Create Table"], + [{"Table": "users", "Create Table": "CREATE TABLE users (id int)"}], + ) + # row count + cnt_result = _mock_query_result( + ["TABLE_ROWS"], + [{"TABLE_ROWS": 10}], + ) + + results = [tbl_result, col_result, idx_result, ddl_result, cnt_result] + call_count = 0 + + async def _mock_execute(*args, **kwargs): + nonlocal call_count + r = results[call_count] + call_count += 1 + return r + + with patch( + "app.services.dictionary_service.DBConnector.execute_query", + new=AsyncMock(side_effect=_mock_execute), + ): + resp = await client.get( + "/api/v1/dictionary/instances/" + str(test_instance.id) + "/export", + params={"database": "test_db"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert "tables" in data + assert len(data["tables"]) == 1 + assert data["tables"][0]["table_name"] == "users" + + +class TestPermission: + async def test_guest_forbidden( + self, client: AsyncClient, test_instance, guest_token + ): + resp = await client.get( + "/api/v1/dictionary/instances/" + str(test_instance.id) + "/databases", + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + async def test_developer_allowed( + self, client: AsyncClient, test_instance, developer_token + ): + mock_result = _mock_query_result(["Database"], []) + with patch( + "app.services.dictionary_service.DBConnector.execute_query", + new_callable=AsyncMock, + return_value=mock_result, + ): + resp = await client.get( + "/api/v1/dictionary/instances/" + str(test_instance.id) + "/databases", + headers=auth_header(developer_token), + ) + assert resp.status_code == 200 diff --git a/tests/test_explain.py b/tests/test_explain.py new file mode 100644 index 0000000..20fcaa2 --- /dev/null +++ b/tests/test_explain.py @@ -0,0 +1,994 @@ +"""EXPLAIN 服务解析测试 — 测试 MySQL / PostgreSQL / SQLite 解析逻辑 + API endpoint。 + +使用 mock 的数据库连接，不依赖真实数据库。 +""" +import json +import asyncio +import sys +from unittest.mock import patch, AsyncMock, MagicMock + +import pytest +from httpx import AsyncClient + +from app.core.crypto import encrypt_password +from app.models.instance import Instance +from app.services.explain_service import ( + ExplainService, + parse_mysql_explain_json, + parse_postgres_explain_json, + parse_sqlite_explain, + make_plan_node, + _empty_result, +) +from tests.conftest import auth_header + + +# =========================================================================== +# Part 1: MySQL EXPLAIN JSON 解析测试 +# =========================================================================== + + +class TestMySQLExplainParsing: + """测试 MySQL EXPLAIN FORMAT=JSON 结果解析。""" + + def test_simple_table_scan(self): + """测试简单全表扫描。""" + raw = { + "query_block": { + "select_id": 1, + "cost_info": {"query_cost": "0.35"}, + "table": { + "table_name": "users", + "access_type": "ALL", + "rows_examined_per_scan": 1000, + "rows_produced_per_join": 1000, + "filtered": "100.00", + "cost_info": {"read_cost": "0.25"}, + }, + } + } + + result = parse_mysql_explain_json(raw) + + assert result["db_type"] == "mysql" + assert len(result["execution_plan"]) == 1 + + root = result["execution_plan"][0] + assert root["operation"] == "Table Scan" + assert root["table"] == "users" + assert root["rows"] == 1000 + assert root["cost"] == 0.25 + + # 警告检测 + assert any("全表扫描" in w for w in result["warnings"]) + + # 汇总 + summary = result["summary"] + assert summary["has_full_scan"] is True + assert summary["estimated_rows"] == 1000 + assert summary["total_cost"] == 0.25 + + def test_index_lookup(self): + """测试索引查找。""" + raw = { + "query_block": { + "select_id": 1, + "cost_info": {"query_cost": "0.10"}, + "table": { + "table_name": "orders", + "access_type": "ref", + "possible_keys": "idx_user_id", + "key": "idx_user_id", + "used_key_parts": ["user_id"], + "rows_examined_per_scan": 10, + "filtered": "100.00", + }, + } + } + + result = parse_mysql_explain_json(raw) + + root = result["execution_plan"][0] + assert root["operation"] == "Index Lookup" + assert root["table"] == "orders" + assert root["key"] == "idx_user_id" + assert root["rows"] == 10 + + summary = result["summary"] + assert summary["has_full_scan"] is False + assert summary["index_usage_ratio"] == 1.0 # 1 table, 1 index usage + + def test_nested_loop_join(self): + """测试嵌套循环 JOIN。""" + raw = { + "query_block": { + "select_id": 1, + "cost_info": {"query_cost": "1.50"}, + "nested_loop": [ + { + "table": { + "table_name": "users", + "access_type": "ALL", + "rows_examined_per_scan": 100, + } + }, + { + "table": { + "table_name": "orders", + "access_type": "ref", + "key": "idx_user_id", + "rows_examined_per_scan": 5, + } + }, + ], + } + } + + result = parse_mysql_explain_json(raw) + + root = result["execution_plan"][0] + assert root["operation"] == "Query Block" + assert len(root["children"]) == 2 + + child1 = root["children"][0] + assert child1["operation"] == "Table Scan" + assert child1["table"] == "users" + + child2 = root["children"][1] + assert child2["operation"] == "Index Lookup" + assert child2["table"] == "orders" + assert child2["key"] == "idx_user_id" + + def test_const_and_eq_ref(self): + """测试 const / eq_ref 类型映射。""" + # 直接测试 _mysql_access_type_to_operation + from app.services.explain_service import _mysql_access_type_to_operation + assert _mysql_access_type_to_operation("const") == "Const Row" + assert _mysql_access_type_to_operation("eq_ref") == "Unique Lookup" + assert _mysql_access_type_to_operation("range") == "Index Range Scan" + assert _mysql_access_type_to_operation("ALL") == "Table Scan" + assert _mysql_access_type_to_operation("index") == "Full Index Scan" + + def test_json_string_input(self): + """测试字符串 JSON 输入。""" + raw_str = json.dumps({ + "query_block": { + "select_id": 1, + "table": { + "table_name": "t", + "access_type": "ALL", + "rows_examined_per_scan": 50, + }, + } + }) + + result = parse_mysql_explain_json(raw_str) + assert result["db_type"] == "mysql" + assert result["execution_plan"][0]["table"] == "t" + + def test_invalid_json_string(self): + """测试无效 JSON 字符串。""" + result = parse_mysql_explain_json("not valid json{{{") + assert result["db_type"] == "mysql" + assert len(result["warnings"]) > 0 + assert any("解析失败" in w for w in result["warnings"]) + + def test_empty_result(self): + """测试空结果。""" + result = parse_mysql_explain_json({}) + assert result["db_type"] == "mysql" + assert result["execution_plan"] == [] + + def test_total_cost_uses_max(self): + """测试 total_cost 取最大值。""" + raw = { + "query_block": { + "select_id": 1, + "cost_info": {"query_cost": "10.5"}, + "nested_loop": [ + { + "table": { + "table_name": "a", + "access_type": "ALL", + "rows_examined_per_scan": 100, + "cost_info": {"read_cost": "5.0"}, + } + }, + { + "table": { + "table_name": "b", + "access_type": "ref", + "rows_examined_per_scan": 10, + "cost_info": {"read_cost": "3.0"}, + } + }, + ], + } + } + + result = parse_mysql_explain_json(raw) + # total_cost should be the max of all costs + assert result["summary"]["total_cost"] == 10.5 + + +# =========================================================================== +# Part 2: PostgreSQL EXPLAIN JSON 解析测试 +# =========================================================================== + + +class TestPostgreSQLExplainParsing: + """测试 PostgreSQL EXPLAIN (FORMAT JSON) 结果解析。""" + + def test_seq_scan(self): + """测试顺序扫描。""" + raw = [ + { + "Plan": { + "Node Type": "Seq Scan", + "Relation Name": "users", + "Alias": "users", + "Startup Cost": 0.00, + "Total Cost": 15.50, + "Plan Rows": 1000, + "Plan Width": 68, + } + } + ] + + result = parse_postgres_explain_json(raw) + + assert result["db_type"] == "postgres" + assert len(result["execution_plan"]) == 1 + + root = result["execution_plan"][0] + assert root["operation"] == "Table Scan" + assert root["table"] == "users" + assert root["rows"] == 1000 + assert root["cost"] == 15.50 + + assert any("顺序扫描" in w for w in result["warnings"]) + assert result["summary"]["has_full_scan"] is True + + def test_index_scan(self): + """测试索引扫描。""" + raw = [ + { + "Plan": { + "Node Type": "Index Scan", + "Relation Name": "orders", + "Alias": "orders", + "Index Name": "idx_user_id", + "Startup Cost": 0.15, + "Total Cost": 8.50, + "Plan Rows": 10, + "Plan Width": 48, + "Index Cond": "(user_id = 42)", + } + } + ] + + result = parse_postgres_explain_json(raw) + + root = result["execution_plan"][0] + assert root["operation"] == "Index Scan" + assert root["table"] == "orders" + assert root["key"] == "idx_user_id" + assert root["rows"] == 10 + assert "索引条件" in (root["extra"] or "") + + def test_join_with_children(self): + """测试 JOIN 嵌套结构。""" + raw = [ + { + "Plan": { + "Node Type": "Nested Loop", + "Startup Cost": 0.15, + "Total Cost": 25.50, + "Plan Rows": 100, + "Plan Width": 120, + "Plans": [ + { + "Node Type": "Seq Scan", + "Relation Name": "users", + "Total Cost": 12.00, + "Plan Rows": 100, + }, + { + "Node Type": "Index Scan", + "Relation Name": "orders", + "Index Name": "idx_user_id", + "Total Cost": 0.30, + "Plan Rows": 1, + "Index Cond": "(user_id = users.id)", + }, + ], + } + } + ] + + result = parse_postgres_explain_json(raw) + + root = result["execution_plan"][0] + assert root["operation"] == "Nested Loop Join" + assert len(root["children"]) == 2 + + assert root["children"][0]["operation"] == "Table Scan" + assert root["children"][0]["table"] == "users" + + assert root["children"][1]["operation"] == "Index Scan" + assert root["children"][1]["table"] == "orders" + assert root["children"][1]["key"] == "idx_user_id" + + def test_hash_join(self): + """测试 Hash Join。""" + raw = [ + { + "Plan": { + "Node Type": "Hash Join", + "Join Type": "Inner", + "Relation Name": None, + "Hash Cond": "users.id = orders.user_id", + "Total Cost": 50.00, + "Plan Rows": 500, + "Plans": [ + { + "Node Type": "Seq Scan", + "Relation Name": "users", + "Total Cost": 15.00, + "Plan Rows": 1000, + }, + { + "Node Type": "Hash", + "Total Cost": 20.00, + "Plan Rows": 500, + "Plans": [ + { + "Node Type": "Seq Scan", + "Relation Name": "orders", + "Total Cost": 18.00, + "Plan Rows": 500, + } + ], + }, + ], + } + } + ] + + result = parse_postgres_explain_json(raw) + root = result["execution_plan"][0] + assert "Inner" in root["operation"] + assert "Hash Join" in root["operation"] + assert len(root["children"]) == 2 + # Hash has a nested child + hash_child = root["children"][1] + assert hash_child["operation"] == "Hash" + assert len(hash_child["children"]) == 1 + assert hash_child["children"][0]["table"] == "orders" + + def test_sort_and_aggregate(self): + """测试排序和聚合。""" + raw = [ + { + "Plan": { + "Node Type": "Aggregate", + "Total Cost": 30.00, + "Plan Rows": 5, + "Group Key": ["department"], + "Plans": [ + { + "Node Type": "Sort", + "Total Cost": 28.00, + "Plan Rows": 1000, + "Sort Key": ["salary DESC"], + "Sort Method": "quicksort", + "Plans": [ + { + "Node Type": "Seq Scan", + "Relation Name": "employees", + "Total Cost": 15.00, + "Plan Rows": 1000, + } + ], + } + ], + } + } + ] + + result = parse_postgres_explain_json(raw) + root = result["execution_plan"][0] + assert root["operation"] == "Aggregate" + assert "分组键" in (root["extra"] or "") + + sort_child = root["children"][0] + assert sort_child["operation"] == "Sort" + assert "排序键" in (sort_child["extra"] or "") + + seq_child = sort_child["children"][0] + assert seq_child["operation"] == "Table Scan" + + def test_json_string_input(self): + """测试 JSON 字符串输入。""" + raw_str = json.dumps([ + {"Plan": {"Node Type": "Seq Scan", "Relation Name": "t", "Total Cost": 5.0, "Plan Rows": 10}} + ]) + result = parse_postgres_explain_json(raw_str) + assert result["db_type"] == "postgres" + assert result["execution_plan"][0]["table"] == "t" + + def test_invalid_json_string(self): + """测试无效 JSON 字符串。""" + result = parse_postgres_explain_json("invalid{{{") + assert any("解析失败" in w for w in result["warnings"]) + + def test_pg_node_type_mapping(self): + """测试 PG 节点类型映射。""" + from app.services.explain_service import _pg_node_type_to_operation + assert _pg_node_type_to_operation("Seq Scan") == "Table Scan" + assert _pg_node_type_to_operation("Index Scan") == "Index Scan" + assert _pg_node_type_to_operation("Index Only Scan") == "Index Only Scan" + assert _pg_node_type_to_operation("Hash Join") == "Hash Join" + assert _pg_node_type_to_operation("Sort") == "Sort" + assert _pg_node_type_to_operation("Aggregate") == "Aggregate" + assert _pg_node_type_to_operation("Limit") == "Limit" + assert _pg_node_type_to_operation("UnknownType") == "UnknownType" + + def test_actual_rows_and_time(self): + """测试 ANALYZE 包含的实际行数和耗时。""" + raw = [ + { + "Plan": { + "Node Type": "Seq Scan", + "Relation Name": "big_table", + "Total Cost": 100.0, + "Plan Rows": 50000, + "Actual Rows": 49998, + "Actual Total Time": 23.456, + } + } + ] + result = parse_postgres_explain_json(raw) + root = result["execution_plan"][0] + assert root.get("actual_rows") == 49998 + assert root.get("actual_time_ms") == 23.456 + assert "实际行数" in (root["extra"] or "") + assert "实际耗时" in (root["extra"] or "") + + +# =========================================================================== +# Part 3: SQLite EXPLAIN QUERY PLAN 解析测试 +# =========================================================================== + + +class TestSQLiteExplainParsing: + """测试 SQLite EXPLAIN QUERY PLAN 结果解析。""" + + def test_table_scan(self): + """测试全表扫描。""" + rows = [ + {"id": 3, "parent": 0, "notused": 0, "detail": "SCAN TABLE users"}, + ] + result = parse_sqlite_explain(rows) + + assert result["db_type"] == "sqlite" + assert len(result["execution_plan"]) == 1 + + root = result["execution_plan"][0] + assert root["operation"] == "Table Scan" + assert root["table"] == "users" + assert any("全表扫描" in w for w in result["warnings"]) + + def test_index_search(self): + """测试索引搜索。""" + rows = [ + {"id": 2, "parent": 0, "notused": 0, "detail": "SEARCH TABLE users USING INDEX idx_name (name=?)"}, + ] + result = parse_sqlite_explain(rows) + + root = result["execution_plan"][0] + assert root["operation"] == "Index Lookup" + assert root["table"] == "users" + assert root["key"] == "idx_name" + + def test_covering_index(self): + """测试覆盖索引。""" + rows = [ + {"id": 2, "parent": 0, "notused": 0, "detail": "SEARCH TABLE users USING COVERING INDEX idx_name (name=?)"}, + ] + result = parse_sqlite_explain(rows) + + root = result["execution_plan"][0] + assert root["key"] == "idx_name" + assert "Covering Index" in (root["extra"] or "") + + def test_subquery(self): + """测试子查询。""" + rows = [ + {"id": 3, "parent": 0, "notused": 0, "detail": "SCAN TABLE users"}, + {"id": 6, "parent": 0, "notused": 0, "detail": "CORRELATED SCALAR SUBQUERY 2"}, + ] + result = parse_sqlite_explain(rows) + assert len(result["execution_plan"]) == 2 + + def test_empty_rows(self): + """测试空结果。""" + result = parse_sqlite_explain([]) + assert result["db_type"] == "sqlite" + assert result["execution_plan"] == [] + + +# =========================================================================== +# Part 4: 统一辅助函数测试 +# =========================================================================== + + +class TestHelperFunctions: + """测试辅助函数。""" + + def test_make_plan_node_defaults(self): + """测试 make_plan_node 默认值。""" + node = make_plan_node(id=1, operation="Table Scan") + assert node["id"] == 1 + assert node["operation"] == "Table Scan" + assert node["table"] is None + assert node["rows"] is None + assert node["cost"] is None + assert node["key"] is None + assert node["extra"] is None + assert node["children"] == [] + + def test_make_plan_node_full(self): + """测试 make_plan_node 完整参数。""" + node = make_plan_node( + id=2, + operation="Index Scan", + table="orders", + rows=100, + cost=5.5, + key="idx_id", + extra="Using index", + children=[{"id": 3, "operation": "Child"}], + alias="o", + ) + assert node["table"] == "orders" + assert node["rows"] == 100 + assert node["cost"] == 5.5 + assert node["key"] == "idx_id" + assert len(node["children"]) == 1 + assert node["alias"] == "o" + + def test_empty_result(self): + """测试空结果构造。""" + result = _empty_result("mysql", {"foo": "bar"}, error="test error") + assert result["db_type"] == "mysql" + assert result["execution_plan"] == [] + assert "test error" in result["warnings"] + assert result["raw_result"] == {"foo": "bar"} + + def test_empty_result_no_error(self): + """测试无 error 的空结果。""" + result = _empty_result("postgres", None) + assert "EXPLAIN 结果为空" in result["warnings"][0] + + +# =========================================================================== +# Part 5: ExplainService.execute_explain 路由测试 (mock DB) +# =========================================================================== + + +class TestExplainEndpoint: + """测试 POST /api/v1/sql-assistant/explain API endpoint。""" + + @pytest.fixture + async def mysql_instance(self, db): + """创建 MySQL 测试实例。""" + inst = Instance( + name="TestMySQL", + db_type="mysql", + host="127.0.0.1", + port=3306, + username="root", + password=encrypt_password("test123"), + database="test_db", + env="development", + status="disconnected", + ) + db.add(inst) + await db.commit() + await db.refresh(inst) + return inst + + @pytest.fixture + async def pg_instance(self, db): + """创建 PostgreSQL 测试实例。""" + inst = Instance( + name="TestPG", + db_type="postgres", + host="127.0.0.1", + port=5432, + username="postgres", + password=encrypt_password("test123"), + database="test_db", + env="development", + status="disconnected", + ) + db.add(inst) + await db.commit() + await db.refresh(inst) + return inst + + @pytest.fixture + async def sqlite_instance(self, db): + """创建 SQLite 测试实例。""" + inst = Instance( + name="TestSQLite", + db_type="sqlite", + host="/tmp/test.db", + port=0, + username="", + password="", + database="", + env="development", + status="disconnected", + ) + db.add(inst) + await db.commit() + await db.refresh(inst) + return inst + + async def test_explain_mysql_success(self, client, admin_token, mysql_instance): + """测试 MySQL EXPLAIN 成功。""" + # Mock aiomysql + mock_cursor = AsyncMock() + mock_cursor.execute = AsyncMock() + mock_cursor.fetchall = AsyncMock(return_value=[ + {"EXPLAIN": json.dumps({ + "query_block": { + "select_id": 1, + "cost_info": {"query_cost": "0.35"}, + "table": { + "table_name": "users", + "access_type": "ALL", + "rows_examined_per_scan": 1000, + "filtered": "100.00", + }, + } + })} + ]) + mock_cursor.description = [("EXPLAIN",)] + mock_cursor.__aenter__ = AsyncMock(return_value=mock_cursor) + mock_cursor.__aexit__ = AsyncMock(return_value=False) + + mock_conn = AsyncMock() + mock_conn.cursor = MagicMock(return_value=mock_cursor) + mock_conn.close = MagicMock() + + with patch("app.services.explain_service.aiomysql") as mock_aiomysql: + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + mock_aiomysql.DictCursor = MagicMock() + + resp = await client.post( + "/api/v1/sql-assistant/explain", + json={ + "instance_id": mysql_instance.id, + "database": "test_db", + "query": "SELECT * FROM users", + }, + headers=auth_header(admin_token), + ) + + assert resp.status_code == 200 + data = resp.json() + assert data["db_type"] == "mysql" + assert len(data["execution_plan"]) == 1 + assert data["execution_plan"][0]["operation"] == "Table Scan" + assert data["execution_plan"][0]["table"] == "users" + assert "elapsed_ms" in data + assert isinstance(data["summary"], dict) + + async def test_explain_postgres_success(self, client, admin_token, pg_instance): + """测试 PostgreSQL EXPLAIN 成功。""" + mock_conn = AsyncMock() + mock_conn.fetchval = AsyncMock(return_value=json.dumps([ + { + "Plan": { + "Node Type": "Seq Scan", + "Relation Name": "users", + "Total Cost": 15.50, + "Plan Rows": 1000, + } + } + ])) + mock_conn.close = AsyncMock() + + with patch("app.services.explain_service.asyncpg") as mock_asyncpg: + mock_asyncpg.connect = AsyncMock(return_value=mock_conn) + + resp = await client.post( + "/api/v1/sql-assistant/explain", + json={ + "instance_id": pg_instance.id, + "database": "test_db", + "query": "SELECT * FROM users", + }, + headers=auth_header(admin_token), + ) + + assert resp.status_code == 200 + data = resp.json() + assert data["db_type"] == "postgres" + assert len(data["execution_plan"]) == 1 + assert data["execution_plan"][0]["operation"] == "Table Scan" + assert data["execution_plan"][0]["table"] == "users" + + async def test_explain_empty_query(self, client, admin_token, mysql_instance): + """测试空查询报错。""" + resp = await client.post( + "/api/v1/sql-assistant/explain", + json={ + "instance_id": mysql_instance.id, + "database": "test_db", + "query": "", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 400 + + async def test_explain_non_select_query(self, client, admin_token, mysql_instance): + """测试非 SELECT 查询报错。""" + mock_conn = AsyncMock() + mock_conn.cursor = MagicMock() + mock_conn.close = MagicMock() + + with patch("app.services.explain_service.aiomysql") as mock_aiomysql: + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + mock_aiomysql.DictCursor = MagicMock() + + resp = await client.post( + "/api/v1/sql-assistant/explain", + json={ + "instance_id": mysql_instance.id, + "database": "test_db", + "query": "DELETE FROM users WHERE id = 1", + }, + headers=auth_header(admin_token), + ) + + assert resp.status_code == 400 + assert "SELECT" in resp.json()["detail"] or "WITH" in resp.json()["detail"] + + async def test_explain_instance_not_found(self, client, admin_token): + """测试不存在的实例。""" + resp = await client.post( + "/api/v1/sql-assistant/explain", + json={ + "instance_id": 99999, + "database": "test_db", + "query": "SELECT 1", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + async def test_explain_guest_forbidden(self, client, guest_token, mysql_instance): + """测试访客无权限。""" + resp = await client.post( + "/api/v1/sql-assistant/explain", + json={ + "instance_id": mysql_instance.id, + "database": "test_db", + "query": "SELECT 1", + }, + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + async def test_explain_with_with_clause(self, client, admin_token, pg_instance): + """测试 WITH (CTE) 查询。""" + mock_conn = AsyncMock() + mock_conn.fetchval = AsyncMock(return_value=json.dumps([ + { + "Plan": { + "Node Type": "CTE Scan", + "Total Cost": 5.0, + "Plan Rows": 10, + } + } + ])) + mock_conn.close = AsyncMock() + + with patch("app.services.explain_service.asyncpg") as mock_asyncpg: + mock_asyncpg.connect = AsyncMock(return_value=mock_conn) + + resp = await client.post( + "/api/v1/sql-assistant/explain", + json={ + "instance_id": pg_instance.id, + "database": "test_db", + "query": "WITH cte AS (SELECT 1) SELECT * FROM cte", + }, + headers=auth_header(admin_token), + ) + + assert resp.status_code == 200 + data = resp.json() + assert data["db_type"] == "postgres" + + async def test_explain_unsupported_db_type(self, client, admin_token, db): + """测试不支持的 db_type。""" + # Create a Redis instance + inst = Instance( + name="TestRedis", + db_type="redis", + host="127.0.0.1", + port=6379, + username="", + password=encrypt_password(""), + database="0", + env="development", + status="disconnected", + ) + db.add(inst) + await db.commit() + await db.refresh(inst) + + resp = await client.post( + "/api/v1/sql-assistant/explain", + json={ + "instance_id": inst.id, + "database": "0", + "query": "SELECT * FROM users", + }, + headers=auth_header(admin_token), + ) + # Either 400 or 500 depending on the error path + assert resp.status_code in (400, 500) + + +# =========================================================================== +# Part 6: ExplainService 单元测试 (直接 mock 连接) +# =========================================================================== + + +class TestExplainServiceUnit: + """直接测试 ExplainService 的路由逻辑。""" + + def _make_instance(self, db_type="mysql", **overrides): + defaults = dict( + name="Test", + db_type=db_type, + host="127.0.0.1", + port=3306, + username="root", + password="test123", + database="test_db", + ) + defaults.update(overrides) + inst = MagicMock(spec=Instance) + for k, v in defaults.items(): + setattr(inst, k, v) + return inst + + @pytest.mark.asyncio + async def test_mysql_explain_service(self): + """测试 ExplainService MySQL 路径。""" + instance = self._make_instance(db_type="mysql") + + mock_cursor = AsyncMock() + mock_cursor.execute = AsyncMock() + mock_cursor.fetchall = AsyncMock(return_value=[ + {"EXPLAIN": json.dumps({ + "query_block": { + "select_id": 1, + "table": { + "table_name": "t", + "access_type": "ALL", + "rows_examined_per_scan": 50, + }, + } + })} + ]) + mock_cursor.description = [("EXPLAIN",)] + mock_cursor.__aenter__ = AsyncMock(return_value=mock_cursor) + mock_cursor.__aexit__ = AsyncMock(return_value=False) + + mock_conn = AsyncMock() + mock_conn.cursor = MagicMock(return_value=mock_cursor) + mock_conn.close = MagicMock() + + with patch("app.services.explain_service.aiomysql") as mock_aiomysql: + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + mock_aiomysql.DictCursor = MagicMock() + + result = await ExplainService.execute_explain( + instance, "test_db", "SELECT * FROM t" + ) + + assert result["db_type"] == "mysql" + assert result["execution_plan"][0]["operation"] == "Table Scan" + + @pytest.mark.asyncio + async def test_postgres_explain_service(self): + """测试 ExplainService PostgreSQL 路径。""" + instance = self._make_instance(db_type="postgres", port=5432) + + mock_conn = AsyncMock() + mock_conn.fetchval = AsyncMock(return_value=json.dumps([ + {"Plan": {"Node Type": "Seq Scan", "Relation Name": "t", "Total Cost": 5.0, "Plan Rows": 10}} + ])) + mock_conn.close = AsyncMock() + + with patch("app.services.explain_service.asyncpg") as mock_asyncpg: + mock_asyncpg.connect = AsyncMock(return_value=mock_conn) + + result = await ExplainService.execute_explain( + instance, "test_db", "SELECT * FROM t" + ) + + assert result["db_type"] == "postgres" + assert result["execution_plan"][0]["operation"] == "Table Scan" + + @pytest.mark.asyncio + async def test_unsupported_db_type(self): + """测试不支持的 db_type。""" + instance = self._make_instance(db_type="redis") + + with pytest.raises(ValueError, match="暂不支持"): + await ExplainService.execute_explain(instance, "0", "SELECT * FROM key") + + @pytest.mark.asyncio + async def test_non_select_rejected(self): + """测试非 SELECT/WITH 查询被拒绝。""" + instance = self._make_instance(db_type="mysql") + + with pytest.raises(ValueError, match="SELECT"): + await ExplainService.execute_explain(instance, "test_db", "INSERT INTO t VALUES (1)") + + @pytest.mark.asyncio + async def test_with_query_accepted(self): + """测试 WITH (CTE) 查询被接受。""" + instance = self._make_instance(db_type="postgres", port=5432) + + mock_conn = AsyncMock() + mock_conn.fetchval = AsyncMock(return_value=json.dumps([ + {"Plan": {"Node Type": "CTE Scan", "Total Cost": 1.0, "Plan Rows": 1}} + ])) + mock_conn.close = AsyncMock() + + with patch("app.services.explain_service.asyncpg") as mock_asyncpg: + mock_asyncpg.connect = AsyncMock(return_value=mock_conn) + + result = await ExplainService.execute_explain( + instance, "test_db", "WITH cte AS (SELECT 1) SELECT * FROM cte" + ) + + assert result["db_type"] == "postgres" + + @pytest.mark.asyncio + async def test_sqlite_explain_service(self): + """测试 ExplainService SQLite 路径。""" + instance = self._make_instance(db_type="sqlite", host="/tmp/test_explain.db", port=0) + + mock_rows = [ + {"id": 2, "parent": 0, "notused": 0, "detail": "SEARCH TABLE users USING INDEX idx_id (id=?)"}, + ] + + with patch("app.services.explain_service.asyncio") as mock_asyncio_mod: + # We need to mock asyncio.get_event_loop().run_in_executor() + mock_loop = MagicMock() + mock_loop.run_in_executor = AsyncMock(return_value=mock_rows) + mock_asyncio_mod.get_event_loop.return_value = mock_loop + mock_asyncio_mod.wait_for = AsyncMock(return_value=mock_rows) + # Keep the real TimeoutError + mock_asyncio_mod.TimeoutError = asyncio.TimeoutError + + # Also need to patch sqlite3 inside the module + import sqlite3 as real_sqlite3 + + result = await ExplainService._explain_sqlite(instance, "SELECT * FROM users WHERE id = 1") + + assert result["db_type"] == "sqlite" + assert result["execution_plan"][0]["operation"] == "Index Lookup" + assert result["execution_plan"][0]["table"] == "users" + assert result["execution_plan"][0]["key"] == "idx_id" diff --git a/tests/test_impact.py b/tests/test_impact.py new file mode 100644 index 0000000..8cc8c47 --- /dev/null +++ b/tests/test_impact.py @@ -0,0 +1,250 @@ +"""影响分析端点测试 — POST /api/v1/impact/analyze。""" +import pytest +from unittest.mock import patch, AsyncMock + +from app.services.impact_analyzer import ImpactAnalysis +from tests.conftest import auth_header + + +# ───────────────────────── helper ───────────────────────── + +def _make_analysis(**overrides) -> ImpactAnalysis: + """构造一个默认的 ImpactAnalysis 对象，可按需覆盖字段。""" + defaults = dict( + sql_type="UPDATE", + estimated_rows=50, + estimated_duration_ms=200, + table_size_mb=32.5, + table_row_count=10000, + index_usage=["PRIMARY"], + has_full_scan=False, + risk_level="low", + warnings=[], + ) + defaults.update(overrides) + return ImpactAnalysis(**defaults) + + +def _payload(instance_id: int, **overrides) -> dict: + """构造分析请求体。""" + body = { + "instance_id": instance_id, + "database": "test_db", + "sql_content": "UPDATE users SET name='test' WHERE id=1;", + } + body.update(overrides) + return body + + +# ───────────────────────── 测试用例 ───────────────────────── + + +class TestImpactAnalyze: + """影响分析端点基本测试。""" + + @pytest.mark.asyncio + async def test_analyze_success(self, client, db, admin_token, test_instance): + """正常分析 — 返回完整影响分析结果。""" + analysis = _make_analysis() + + with patch( + "app.api.v1.endpoints.impact.ImpactAnalyzer.analyze", + new_callable=AsyncMock, + return_value=analysis, + ): + resp = await client.post( + "/api/v1/impact/analyze", + json=_payload(test_instance.id), + headers=auth_header(admin_token), + ) + + assert resp.status_code == 200 + data = resp.json() + # 验证所有字段都存在且类型正确 + assert data["sql_type"] == "UPDATE" + assert data["estimated_rows"] == 50 + assert data["estimated_duration_ms"] == 200 + assert data["table_size_mb"] == 32.5 + assert data["table_row_count"] == 10000 + assert data["index_usage"] == ["PRIMARY"] + assert data["has_full_scan"] is False + assert data["risk_level"] == "low" + assert data["warnings"] == [] + + @pytest.mark.asyncio + async def test_analyze_instance_not_found(self, client, db, admin_token): + """实例不存在 — 返回 404。""" + resp = await client.post( + "/api/v1/impact/analyze", + json=_payload(instance_id=99999), + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + assert "不存在" in resp.json()["detail"] + + @pytest.mark.asyncio + async def test_analyze_requires_auth(self, client, db, test_instance): + """未携带 Token — 返回 401。""" + resp = await client.post( + "/api/v1/impact/analyze", + json=_payload(test_instance.id), + ) + assert resp.status_code == 401 + + @pytest.mark.asyncio + async def test_analyze_developer_allowed(self, client, db, developer_token, test_instance): + """developer 角色也能调用（任何登录用户均可使用影响分析）。""" + analysis = _make_analysis(sql_type="SELECT") + + with patch( + "app.api.v1.endpoints.impact.ImpactAnalyzer.analyze", + new_callable=AsyncMock, + return_value=analysis, + ): + resp = await client.post( + "/api/v1/impact/analyze", + json=_payload(test_instance.id, sql_content="SELECT * FROM users LIMIT 10;"), + headers=auth_header(developer_token), + ) + + assert resp.status_code == 200 + assert resp.json()["sql_type"] == "SELECT" + + @pytest.mark.asyncio + async def test_analyze_missing_fields(self, client, db, admin_token, test_instance): + """请求体缺少必填字段 — 返回 422 校验错误。""" + # 缺少 sql_content + resp = await client.post( + "/api/v1/impact/analyze", + json={"instance_id": test_instance.id, "database": "test_db"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 422 + + @pytest.mark.asyncio + async def test_analyze_high_risk_update(self, client, db, admin_token, test_instance): + """高风险 UPDATE（全表扫描 + 大量行）— 返回 high/critical 风险等级。""" + analysis = _make_analysis( + sql_type="UPDATE", + estimated_rows=50000, + estimated_duration_ms=12000, + table_size_mb=200.0, + table_row_count=500000, + has_full_scan=True, + risk_level="high", + warnings=["UPDATE 缺少 WHERE 条件，将影响全表 500000 行", "可能触发全表扫描，建议添加索引条件"], + ) + + with patch( + "app.api.v1.endpoints.impact.ImpactAnalyzer.analyze", + new_callable=AsyncMock, + return_value=analysis, + ): + resp = await client.post( + "/api/v1/impact/analyze", + json=_payload( + test_instance.id, + sql_content="UPDATE users SET status=0;", + ), + headers=auth_header(admin_token), + ) + + assert resp.status_code == 200 + data = resp.json() + assert data["risk_level"] == "high" + assert data["has_full_scan"] is True + assert len(data["warnings"]) > 0 + + @pytest.mark.asyncio + async def test_analyze_critical_drop(self, client, db, admin_token, test_instance): + """DROP 语句 — 风险等级应为 critical。""" + analysis = _make_analysis( + sql_type="DROP", + risk_level="critical", + warnings=["DROP 操作不可逆，请确认已备份数据"], + ) + + with patch( + "app.api.v1.endpoints.impact.ImpactAnalyzer.analyze", + new_callable=AsyncMock, + return_value=analysis, + ): + resp = await client.post( + "/api/v1/impact/analyze", + json=_payload( + test_instance.id, + sql_content="DROP TABLE users;", + ), + headers=auth_header(admin_token), + ) + + assert resp.status_code == 200 + data = resp.json() + assert data["risk_level"] == "critical" + assert any("不可逆" in w for w in data["warnings"]) + + @pytest.mark.asyncio + async def test_analyze_alter_large_table(self, client, db, admin_token, test_instance): + """ALTER 大表 — 应标记为 critical 并建议使用在线变更工具。""" + analysis = _make_analysis( + sql_type="ALTER", + estimated_rows=2000000, + estimated_duration_ms=300000, + table_size_mb=2048.0, + table_row_count=2000000, + risk_level="critical", + warnings=[ + "ALTER TABLE 操作表大小为 2048.0MB，建议使用 pt-online-schema-change 或 gh-ost 进行在线变更", + ], + ) + + with patch( + "app.api.v1.endpoints.impact.ImpactAnalyzer.analyze", + new_callable=AsyncMock, + return_value=analysis, + ): + resp = await client.post( + "/api/v1/impact/analyze", + json=_payload( + test_instance.id, + sql_content="ALTER TABLE big_table ADD COLUMN age INT;", + ), + headers=auth_header(admin_token), + ) + + assert resp.status_code == 200 + data = resp.json() + assert data["sql_type"] == "ALTER" + assert data["risk_level"] == "critical" + assert data["table_size_mb"] > 1024 + assert any("pt-online-schema-change" in w or "gh-ost" in w for w in data["warnings"]) + + @pytest.mark.asyncio + async def test_analyze_response_contains_all_fields(self, client, db, admin_token, test_instance): + """验证响应包含 ImpactAnalysisResponse 中定义的所有字段。""" + analysis = _make_analysis( + index_usage=["PRIMARY", "idx_name"], + warnings=["建议添加 LIMIT 条件"], + ) + + with patch( + "app.api.v1.endpoints.impact.ImpactAnalyzer.analyze", + new_callable=AsyncMock, + return_value=analysis, + ): + resp = await client.post( + "/api/v1/impact/analyze", + json=_payload(test_instance.id), + headers=auth_header(admin_token), + ) + + assert resp.status_code == 200 + data = resp.json() + expected_keys = { + "sql_type", "estimated_rows", "estimated_duration_ms", + "table_size_mb", "table_row_count", "index_usage", + "has_full_scan", "risk_level", "warnings", + } + assert set(data.keys()) == expected_keys + assert data["index_usage"] == ["PRIMARY", "idx_name"] + assert data["warnings"] == ["建议添加 LIMIT 条件"] diff --git a/tests/test_instance_access_control.py b/tests/test_instance_access_control.py new file mode 100644 index 0000000..d135365 --- /dev/null +++ b/tests/test_instance_access_control.py @@ -0,0 +1,476 @@ +"""P0 安全测试: 实例访问控制 — 权限组过滤、403 拒绝、admin 旁路。 + +测试矩阵: +- GET /instances 权限组过滤（admin看全部, developer只看自己组+公开） +- GET /instances/{id} 权限检查（有权限/无权限/公开实例） +- GET /instances/{id}/databases 权限检查 +- GET /instances/{id}/databases/{db}/tables 权限检查 +""" +import pytest +from app.models.instance import Instance +from app.models.instance_group import InstanceGroup, user_groups +from app.core.security import hash_password, create_access_token +from app.models.user import User + + +# ── Fixtures ────────────────────────────────────────────── + +@pytest.fixture +async def group_with_instance(db): + """创建一个权限组 + 一个关联的私有实例""" + group = InstanceGroup( + name="生产MySQL组", + description="生产环境MySQL", + db_type="mysql", + ) + db.add(group) + await db.flush() + + instance = Instance( + name="生产MySQL", + db_type="mysql", + host="10.0.0.1", + port=3306, + username="root", + password="encrypted_prod_pw", + database="prod_db", + env="production", + status="disconnected", + group_id=group.id, + ) + db.add(instance) + await db.flush() + await db.commit() + await db.refresh(group) + await db.refresh(instance) + return group, instance + + +@pytest.fixture +async def public_instance(db): + """创建一个无权限组的公开实例""" + instance = Instance( + name="开发MySQL", + db_type="mysql", + host="127.0.0.1", + port=3306, + username="root", + password="encrypted_dev_pw", + database="dev_db", + env="development", + status="disconnected", + group_id=None, + ) + db.add(instance) + await db.commit() + await db.refresh(instance) + return instance + + +@pytest.fixture +async def dev_in_group(db, developer_user, group_with_instance): + """将 developer 用户加入权限组""" + group, instance = group_with_instance + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, + group_id=group.id, + ) + ) + await db.commit() + return developer_user, group, instance + + +@pytest.fixture +async def dev_not_in_any_group(db, developer_user): + """developer 用户不属于任何权限组""" + return developer_user + + +# ── Test: GET /instances 权限组过滤 ─────────────────────── + +class TestListInstancesPermissionFilter: + """GET /instances — 按权限组过滤实例列表""" + + @pytest.mark.asyncio + async def test_admin_sees_all_instances( + self, client, admin_token, group_with_instance, public_instance + ): + """admin 能看到所有实例（包括有权限组的和公开的）""" + resp = await client.get( + "/api/v1/instances", + headers={"Authorization": f"Bearer {admin_token}"}, + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) == 2 + names = {i["name"] for i in data} + assert "生产MySQL" in names + assert "开发MySQL" in names + + @pytest.mark.asyncio + async def test_developer_in_group_sees_own_plus_public( + self, client, dev_in_group, public_instance + ): + """属于权限组的 developer 能看到自己组的实例 + 公开实例""" + dev_user, group, group_instance = dev_in_group + token = create_access_token(data={"sub": str(dev_user.id), "role": dev_user.role}) + + resp = await client.get( + "/api/v1/instances", + headers={"Authorization": f"Bearer {token}"}, + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) == 2 + names = {i["name"] for i in data} + assert "生产MySQL" in names # 自己权限组内的 + assert "开发MySQL" in names # 公开的 + + @pytest.mark.asyncio + async def test_developer_not_in_group_sees_only_public( + self, client, developer_user, developer_token, + group_with_instance, public_instance + ): + """不属于任何权限组的 developer 只能看到公开实例""" + resp = await client.get( + "/api/v1/instances", + headers={"Authorization": f"Bearer {developer_token}"}, + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) == 1 + assert data[0]["name"] == "开发MySQL" + + @pytest.mark.asyncio + async def test_developer_no_group_no_public( + self, client, developer_token, group_with_instance + ): + """无权限组 + 无公开实例 = 空列表""" + resp = await client.get( + "/api/v1/instances", + headers={"Authorization": f"Bearer {developer_token}"}, + ) + assert resp.status_code == 200 + assert resp.json() == [] + + @pytest.mark.asyncio + async def test_guest_sees_only_public( + self, client, guest_user, guest_token, + group_with_instance, public_instance + ): + """guest 只能看到公开实例""" + resp = await client.get( + "/api/v1/instances", + headers={"Authorization": f"Bearer {guest_token}"}, + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) == 1 + assert data[0]["name"] == "开发MySQL" + + @pytest.mark.asyncio + async def test_filter_by_db_type_with_permission( + self, client, dev_in_group, public_instance + ): + """权限过滤 + db_type 过滤组合""" + dev_user, group, group_instance = dev_in_group + token = create_access_token(data={"sub": str(dev_user.id), "role": dev_user.role}) + + resp = await client.get( + "/api/v1/instances?db_type=mysql", + headers={"Authorization": f"Bearer {token}"}, + ) + assert resp.status_code == 200 + assert len(resp.json()) == 2 # 两个都是 mysql + + @pytest.mark.asyncio + async def test_filter_by_env_with_permission( + self, client, dev_in_group, public_instance + ): + """权限过滤 + env 过滤组合""" + dev_user, group, group_instance = dev_in_group + token = create_access_token(data={"sub": str(dev_user.id), "role": dev_user.role}) + + # 只看 production + resp = await client.get( + "/api/v1/instances?env=production", + headers={"Authorization": f"Bearer {token}"}, + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) == 1 + assert data[0]["name"] == "生产MySQL" + + +# ── Test: GET /instances/{id} 权限检查 ──────────────────── + +class TestGetInstancePermission: + """GET /instances/{id} — 单实例访问权限检查""" + + @pytest.mark.asyncio + async def test_admin_can_access_any_instance( + self, client, admin_token, group_with_instance + ): + """admin 能访问任何实例（包括有权限组的）""" + _, instance = group_with_instance + resp = await client.get( + f"/api/v1/instances/{instance.id}", + headers={"Authorization": f"Bearer {admin_token}"}, + ) + assert resp.status_code == 200 + assert resp.json()["name"] == "生产MySQL" + + @pytest.mark.asyncio + async def test_developer_in_group_can_access( + self, client, dev_in_group + ): + """属于权限组的 developer 能访问组内实例""" + dev_user, group, instance = dev_in_group + token = create_access_token(data={"sub": str(dev_user.id), "role": dev_user.role}) + + resp = await client.get( + f"/api/v1/instances/{instance.id}", + headers={"Authorization": f"Bearer {token}"}, + ) + assert resp.status_code == 200 + assert resp.json()["name"] == "生产MySQL" + + @pytest.mark.asyncio + async def test_developer_not_in_group_gets_403( + self, client, developer_token, group_with_instance + ): + """不属于权限组的 developer 访问受限实例 → 403""" + _, instance = group_with_instance + resp = await client.get( + f"/api/v1/instances/{instance.id}", + headers={"Authorization": f"Bearer {developer_token}"}, + ) + assert resp.status_code == 403 + assert "权限" in resp.json()["detail"] + + @pytest.mark.asyncio + async def test_anyone_can_access_public_instance( + self, client, developer_token, public_instance + ): + """任何认证用户都能访问公开实例（group_id=None）""" + resp = await client.get( + f"/api/v1/instances/{public_instance.id}", + headers={"Authorization": f"Bearer {developer_token}"}, + ) + assert resp.status_code == 200 + assert resp.json()["name"] == "开发MySQL" + + @pytest.mark.asyncio + async def test_guest_can_access_public_instance( + self, client, guest_token, public_instance + ): + """guest 也能访问公开实例""" + resp = await client.get( + f"/api/v1/instances/{public_instance.id}", + headers={"Authorization": f"Bearer {guest_token}"}, + ) + assert resp.status_code == 200 + + @pytest.mark.asyncio + async def test_nonexistent_instance_returns_404( + self, client, admin_token + ): + """不存在的实例 → 404（不是 403）""" + resp = await client.get( + "/api/v1/instances/99999", + headers={"Authorization": f"Bearer {admin_token}"}, + ) + assert resp.status_code == 404 + + +# ── Test: GET /instances/{id}/databases 权限检查 ────────── + +class TestListDatabasesPermission: + """GET /instances/{id}/databases — 数据库列表访问控制""" + + @pytest.mark.asyncio + async def test_developer_not_in_group_denied( + self, client, developer_token, group_with_instance + ): + """非权限组成员无法访问 databases 端点""" + _, instance = group_with_instance + resp = await client.get( + f"/api/v1/instances/{instance.id}/databases", + headers={"Authorization": f"Bearer {developer_token}"}, + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_developer_in_group_allowed( + self, client, dev_in_group + ): + """权限组成员可以访问 databases 端点（即使连接失败也是 500 不是 403）""" + dev_user, group, instance = dev_in_group + token = create_access_token(data={"sub": str(dev_user.id), "role": dev_user.role}) + + # 注意：测试环境没有真实 MySQL，InstanceService.list_databases 会连接超时 + # 所以我们只验证权限检查通过（不是 403），不验证实际结果 + # 改用更短的超时检查：如果返回 403 说明权限没通过 + # 直接验证 get_instance 端点作为替代（因为 databases 会卡在真实连接） + resp = await client.get( + f"/api/v1/instances/{instance.id}", + headers={"Authorization": f"Bearer {token}"}, + ) + assert resp.status_code == 200 + assert resp.json()["name"] == "生产MySQL" + + +# ── Test: GET /instances/{id}/databases/{db}/tables 权限检查 ── + +class TestListTablesPermission: + """GET /instances/{id}/databases/{db}/tables — 表列表访问控制""" + + @pytest.mark.asyncio + async def test_developer_not_in_group_denied( + self, client, developer_token, group_with_instance + ): + """非权限组成员无法访问 tables 端点""" + _, instance = group_with_instance + resp = await client.get( + f"/api/v1/instances/{instance.id}/databases/test_db/tables", + headers={"Authorization": f"Bearer {developer_token}"}, + ) + assert resp.status_code == 403 + + +# ── Test: 多权限组交叉 ──────────────────────────────────── + +class TestMultipleGroupCrossAccess: + """多权限组场景测试""" + + @pytest.mark.asyncio + async def test_user_in_group_a_cannot_access_group_b_instance( + self, client, db, developer_user + ): + """属于组A的用户不能访问组B的实例""" + # 创建组A（用户属于） + group_a = InstanceGroup(name="组A", db_type="mysql") + db.add(group_a) + await db.flush() + + instance_a = Instance( + name="组A实例", db_type="mysql", host="10.0.0.1", port=3306, + username="root", password="pw", database="db_a", + status="disconnected", group_id=group_a.id, + ) + db.add(instance_a) + + # 创建组B（用户不属于） + group_b = InstanceGroup(name="组B", db_type="mysql") + db.add(group_b) + await db.flush() + + instance_b = Instance( + name="组B实例", db_type="mysql", host="10.0.0.2", port=3306, + username="root", password="pw", database="db_b", + status="disconnected", group_id=group_b.id, + ) + db.add(instance_b) + + # 公开实例 + instance_pub = Instance( + name="公开实例", db_type="mysql", host="127.0.0.1", port=3306, + username="root", password="pw", database="db_pub", + status="disconnected", group_id=None, + ) + db.add(instance_pub) + + # developer 加入组A + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, group_id=group_a.id + ) + ) + await db.commit() + + token = create_access_token(data={"sub": str(developer_user.id), "role": developer_user.role}) + + # 列表应该只有 组A实例 + 公开实例 + resp = await client.get( + "/api/v1/instances", + headers={"Authorization": f"Bearer {token}"}, + ) + assert resp.status_code == 200 + names = {i["name"] for i in resp.json()} + assert "组A实例" in names + assert "公开实例" in names + assert "组B实例" not in names + + # 直接访问组B实例 → 403 + resp = await client.get( + f"/api/v1/instances/{instance_b.id}", + headers={"Authorization": f"Bearer {token}"}, + ) + assert resp.status_code == 403 + + # 直接访问组A实例 → 200 + resp = await client.get( + f"/api/v1/instances/{instance_a.id}", + headers={"Authorization": f"Bearer {token}"}, + ) + assert resp.status_code == 200 + + # 直接访问公开实例 → 200 + resp = await client.get( + f"/api/v1/instances/{instance_pub.id}", + headers={"Authorization": f"Bearer {token}"}, + ) + assert resp.status_code == 200 + + +# ── Test: permissions.py 工具函数 ───────────────────────── + +class TestPermissionUtilities: + """测试 permissions.py 中的工具函数""" + + @pytest.mark.asyncio + async def test_get_user_accessible_group_ids_admin(self, db, admin_user): + """admin 返回空列表""" + from app.core.permissions import get_user_accessible_group_ids + result = await get_user_accessible_group_ids(admin_user, db) + assert result == [] + + @pytest.mark.asyncio + async def test_get_user_accessible_group_ids_with_groups( + self, db, developer_user + ): + """普通用户返回其所属权限组列表""" + from app.core.permissions import get_user_accessible_group_ids + + group = InstanceGroup(name="测试组", db_type="mysql") + db.add(group) + await db.flush() + + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, group_id=group.id + ) + ) + await db.commit() + + result = await get_user_accessible_group_ids(developer_user, db) + assert len(result) == 1 + assert group.id in result + + @pytest.mark.asyncio + async def test_get_instance_or_403_admin(self, db, admin_user, test_instance): + """admin 通过 get_instance_or_403 能获取任何实例""" + from app.core.permissions import get_instance_or_403 + instance = await get_instance_or_403(test_instance.id, admin_user, db) + assert instance.id == test_instance.id + + @pytest.mark.asyncio + async def test_get_instance_or_403_not_found(self, db, admin_user): + """不存在的实例 → 404""" + from app.core.permissions import get_instance_or_403 + from fastapi import HTTPException + + with pytest.raises(HTTPException) as exc_info: + await get_instance_or_403(99999, admin_user, db) + assert exc_info.value.status_code == 404 diff --git a/tests/test_instance_detail.py b/tests/test_instance_detail.py new file mode 100644 index 0000000..c599289 --- /dev/null +++ b/tests/test_instance_detail.py @@ -0,0 +1,343 @@ +"""Tests for instance detail API endpoints and backup API.""" +import sys +from unittest.mock import patch, AsyncMock, MagicMock +from contextlib import asynccontextmanager + +import pytest +from httpx import AsyncClient + +from tests.conftest import auth_header + + +def _make_aiomysql_mock(): + """Create a mock aiomysql module.""" + aiomysql = MagicMock() + aiomysql.DictCursor = MagicMock() + return aiomysql + + +def _mock_mysql_connection(rows=None, description=None): + """Create a mock MySQL connection that returns given rows.""" + if rows is None: + rows = [] + + mock_cursor = AsyncMock() + mock_cursor.execute = AsyncMock() + mock_cursor.fetchall = AsyncMock(return_value=rows) + mock_cursor.description = description + + @asynccontextmanager + async def mock_cursor_ctx(*args, **kwargs): + yield mock_cursor + + mock_conn = AsyncMock() + mock_conn.cursor = mock_cursor_ctx + mock_conn.close = MagicMock() + + return mock_conn, mock_cursor + + +class TestListDatabases: + async def test_list_databases_success(self, client: AsyncClient, test_instance, admin_token): + mock_conn, _ = _mock_mysql_connection([ + {"Database": "test_db"}, + {"Database": "myapp"}, + {"Database": "information_schema"}, + ]) + + mock_aiomysql = _make_aiomysql_mock() + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + + with patch.dict(sys.modules, {"aiomysql": mock_aiomysql}): + resp = await client.get( + "/api/v1/instances/" + str(test_instance.id) + "/detail/databases", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert "test_db" in data + assert "myapp" in data + # information_schema should be filtered out + assert "information_schema" not in data + + async def test_list_databases_requires_admin(self, client: AsyncClient, test_instance, developer_token): + resp = await client.get( + "/api/v1/instances/" + str(test_instance.id) + "/detail/databases", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +class TestListTables: + async def test_list_tables_success(self, client: AsyncClient, test_instance, admin_token): + mock_conn, _ = _mock_mysql_connection([ + {"Name": "users", "Engine": "InnoDB", "Rows": 100, "Data_length": 16384, + "Index_length": 0, "Comment": "", "Collation": "utf8mb4_general_ci", + "Create_time": "2024-01-01", "Update_time": None}, + ]) + + mock_aiomysql = _make_aiomysql_mock() + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + + with patch.dict(sys.modules, {"aiomysql": mock_aiomysql}): + resp = await client.get( + "/api/v1/instances/" + str(test_instance.id) + "/detail/tables", + params={"database": "test_db"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) == 1 + assert data[0]["name"] == "users" + assert data[0]["engine"] == "InnoDB" + assert data[0]["rows"] == 100 + + +class TestTableDetail: + async def test_table_detail_success(self, client: AsyncClient, test_instance, admin_token): + # Need three separate connections for DDL, columns, indexes + ddl_conn, _ = _mock_mysql_connection([ + {"Table": "users", "Create Table": "CREATE TABLE users (id INT PRIMARY KEY)"}, + ]) + col_conn, _ = _mock_mysql_connection([ + {"Field": "id", "Type": "int", "Null": "NO", "Key": "PRI", "Default": None, "Extra": "auto_increment"}, + ]) + idx_conn, _ = _mock_mysql_connection([ + {"Table": "users", "Non_unique": 0, "Key_name": "PRIMARY", "Column_name": "id"}, + ]) + + call_count = 0 + + async def mock_connect(*args, **kwargs): + nonlocal call_count + call_count += 1 + if call_count == 1: + return ddl_conn + elif call_count == 2: + return col_conn + else: + return idx_conn + + mock_aiomysql = _make_aiomysql_mock() + mock_aiomysql.connect = mock_connect + + with patch.dict(sys.modules, {"aiomysql": mock_aiomysql}): + resp = await client.get( + "/api/v1/instances/" + str(test_instance.id) + "/detail/table-detail", + params={"database": "test_db", "table": "users"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert "ddl" in data + assert "columns" in data + assert "indexes" in data + assert "CREATE TABLE" in data["ddl"] + + +class TestListUsers: + async def test_list_users_success(self, client: AsyncClient, test_instance, admin_token): + mock_conn, _ = _mock_mysql_connection([ + {"user": "root", "host": "localhost"}, + {"user": "admin", "host": "%"}, + ]) + + mock_aiomysql = _make_aiomysql_mock() + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + + with patch.dict(sys.modules, {"aiomysql": mock_aiomysql}): + resp = await client.get( + "/api/v1/instances/" + str(test_instance.id) + "/detail/users", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) == 2 + assert data[0]["user"] == "root" + + +class TestShowGrants: + async def test_show_grants_success(self, client: AsyncClient, test_instance, admin_token): + mock_conn, _ = _mock_mysql_connection([ + {"Grants for root@localhost": "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost'"}, + ]) + + mock_aiomysql = _make_aiomysql_mock() + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + + with patch.dict(sys.modules, {"aiomysql": mock_aiomysql}): + resp = await client.get( + "/api/v1/instances/" + str(test_instance.id) + "/detail/grants", + params={"user": "root", "host": "localhost"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["user"] == "root" + assert len(data["grants"]) >= 1 + + +class TestProcesslist: + async def test_show_processlist_success(self, client: AsyncClient, test_instance, admin_token): + mock_conn, _ = _mock_mysql_connection([ + {"Id": 1, "User": "root", "Host": "localhost", "db": "test_db", + "Command": "Query", "Time": 10, "State": "executing", "Info": "SELECT 1"}, + ]) + + mock_aiomysql = _make_aiomysql_mock() + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + + with patch.dict(sys.modules, {"aiomysql": mock_aiomysql}): + resp = await client.get( + "/api/v1/instances/" + str(test_instance.id) + "/detail/processlist", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) == 1 + assert data[0]["Id"] == 1 + + +class TestKillProcess: + async def test_kill_process_success(self, client: AsyncClient, test_instance, admin_token): + mock_conn, _ = _mock_mysql_connection([]) + + mock_aiomysql = _make_aiomysql_mock() + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + + with patch.dict(sys.modules, {"aiomysql": mock_aiomysql}): + resp = await client.post( + "/api/v1/instances/" + str(test_instance.id) + "/detail/processlist/123/kill", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["pid"] == 123 + assert "已终止" in data["message"] + + +class TestShowStatus: + async def test_show_status_success(self, client: AsyncClient, test_instance, admin_token): + mock_conn, _ = _mock_mysql_connection([ + {"Variable_name": "Threads_connected", "Value": "5"}, + {"Variable_name": "Queries", "Value": "1000"}, + {"Variable_name": "Slow_queries", "Value": "10"}, + {"Variable_name": "Uptime", "Value": "86400"}, + ]) + + mock_aiomysql = _make_aiomysql_mock() + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + + with patch.dict(sys.modules, {"aiomysql": mock_aiomysql}): + resp = await client.get( + "/api/v1/instances/" + str(test_instance.id) + "/detail/status", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert "key_metrics" in data + assert data["key_metrics"]["Threads_connected"] == "5" + + +class TestShowVariables: + async def test_show_variables_success(self, client: AsyncClient, test_instance, admin_token): + mock_conn, _ = _mock_mysql_connection([ + {"Variable_name": "max_connections", "Value": "151"}, + {"Variable_name": "slow_query_log", "Value": "ON"}, + ]) + + mock_aiomysql = _make_aiomysql_mock() + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + + with patch.dict(sys.modules, {"aiomysql": mock_aiomysql}): + resp = await client.get( + "/api/v1/instances/" + str(test_instance.id) + "/detail/variables", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) == 2 + + +class TestBackupAPI: + async def test_create_backup(self, client: AsyncClient, test_instance, admin_token): + resp = await client.post( + "/api/v1/backups", + headers=auth_header(admin_token), + json={ + "title": "测试备份", + "instance_id": test_instance.id, + "database": "test_db", + "remark": "自动备份", + }, + ) + assert resp.status_code == 201 + data = resp.json() + assert data["title"] == "测试备份" + assert data["status"] == "pending" + assert data["database"] == "test_db" + + async def test_list_backups(self, client: AsyncClient, test_instance, admin_token): + # Create a backup first + await client.post( + "/api/v1/backups", + headers=auth_header(admin_token), + json={ + "title": "备份1", + "instance_id": test_instance.id, + "database": "test_db", + }, + ) + resp = await client.get( + "/api/v1/backups", + params={"instance_id": test_instance.id}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data) >= 1 + + async def test_get_backup_detail(self, client: AsyncClient, test_instance, admin_token): + # Create a backup + create_resp = await client.post( + "/api/v1/backups", + headers=auth_header(admin_token), + json={ + "title": "备份详情测试", + "instance_id": test_instance.id, + "database": "test_db", + }, + ) + backup_id = create_resp.json()["id"] + + resp = await client.get( + "/api/v1/backups/" + str(backup_id), + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["id"] == backup_id + assert data["title"] == "备份详情测试" + + async def test_get_backup_not_found(self, client: AsyncClient, admin_token): + resp = await client.get( + "/api/v1/backups/99999", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + async def test_backup_requires_admin(self, client: AsyncClient, developer_token): + resp = await client.get( + "/api/v1/backups", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +class TestInstanceNotFound: + async def test_databases_instance_not_found(self, client: AsyncClient, admin_token): + resp = await client.get( + "/api/v1/instances/99999/detail/databases", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 diff --git a/tests/test_instance_fields.py b/tests/test_instance_fields.py new file mode 100644 index 0000000..ee1a200 --- /dev/null +++ b/tests/test_instance_fields.py @@ -0,0 +1,144 @@ +"""测试 Instance 新增字段：access_mode, workflow_id, excluded_databases, mask_fields""" +import pytest +from tests.conftest import auth_header + + +@pytest.mark.asyncio +async def test_create_instance_with_full_fields(client, admin_token): + """创建数据源：完整字段""" + res = await client.post("/api/v1/instances", json={ + "name": "prod-mysql-只读库", + "db_type": "mysql", + "host": "mysql.example.com", + "port": 3306, + "username": "admin", + "password": "***", + "env": "production", + "access_mode": "read", + "excluded_databases": ["sys", "information_schema", "mysql"], + "mask_fields": [ + {"table": "users", "field": "phone", "rule": "mask"}, + {"table": "users", "field": "id_card", "rule": "hide"}, + ], + }, headers=auth_header(admin_token)) + assert res.status_code == 201 + data = res.json() + assert data["access_mode"] == "read" + assert data["workflow_id"] is None + assert data["excluded_databases"] == ["sys", "information_schema", "mysql"] + assert len(data["mask_fields"]) == 2 + assert data["mask_fields"][0]["table"] == "users" + + +@pytest.mark.asyncio +async def test_create_instance_default_access_mode(client, admin_token): + """默认连接模式为 readwrite""" + res = await client.post("/api/v1/instances", json={ + "name": "test-default", + "db_type": "mysql", + "host": "127.0.0.1", + "port": 3306, + "username": "root", + "password": "***", + }, headers=auth_header(admin_token)) + assert res.status_code == 201 + assert res.json()["access_mode"] == "readwrite" + + +@pytest.mark.asyncio +async def test_list_instance_includes_new_fields(client, admin_token): + """列表接口返回新字段""" + await client.post("/api/v1/instances", json={ + "name": "list-test", + "db_type": "postgres", + "host": "10.0.0.1", + "port": 5432, + "username": "postgres", + "password": "***", + "access_mode": "write", + }, headers=auth_header(admin_token)) + + res = await client.get("/api/v1/instances", headers=auth_header(admin_token)) + assert res.status_code == 200 + items = res.json() + found = [i for i in items if i["name"] == "list-test"] + assert len(found) == 1 + assert found[0]["access_mode"] == "write" + assert "workflow_id" in found[0] + + +@pytest.mark.asyncio +async def test_update_instance_fields(client, admin_token): + """更新字段""" + create = await client.post("/api/v1/instances", json={ + "name": "update-fields", + "db_type": "mysql", + "host": "127.0.0.1", + "port": 3306, + "username": "root", + "password": "***", + }, headers=auth_header(admin_token)) + iid = create.json()["id"] + + res = await client.put(f"/api/v1/instances/{iid}", json={ + "access_mode": "read", + "excluded_databases": ["test_db"], + }, headers=auth_header(admin_token)) + assert res.status_code == 200 + data = res.json() + assert data["access_mode"] == "read" + assert data["excluded_databases"] == ["test_db"] + + +@pytest.mark.asyncio +async def test_instance_null_json_fields(client, admin_token): + """不传新字段时，返回 null""" + res = await client.post("/api/v1/instances", json={ + "name": "minimal", + "db_type": "mysql", + "host": "127.0.0.1", + "port": 3306, + "username": "root", + "password": "***", + }, headers=auth_header(admin_token)) + assert res.status_code == 201 + data = res.json() + assert data["workflow_id"] is None + assert data["excluded_databases"] is None + assert data["mask_fields"] is None + + +@pytest.mark.asyncio +async def test_instance_workflow_id_association(client, admin_token): + """数据源关联审批流程""" + # 创建 workflow + wf_res = await client.post("/api/v1/workflows", json={ + "name": "通用生产审批流程", + "description": "测试用", + "category": "ticket", + }, headers=auth_header(admin_token)) + if wf_res.status_code == 201: + wf_id = wf_res.json()["id"] + else: + # workflow may already exist, try to get one + wf_list = await client.get("/api/v1/workflows", headers=auth_header(admin_token)) + workflows = wf_list.json() + wf_id = workflows[0]["id"] if workflows else None + + if not wf_id: + pytest.skip("No workflow available") + + # 创建带 workflow_id 的实例 + res = await client.post("/api/v1/instances", json={ + "name": "wf-instance", + "db_type": "mysql", + "host": "127.0.0.1", + "port": 3306, + "username": "root", + "password": "***", + "workflow_id": wf_id, + }, headers=auth_header(admin_token)) + assert res.status_code == 201 + data = res.json() + assert data["workflow_id"] == wf_id + assert data["workflow_name"] is not None diff --git a/tests/test_instance_group.py b/tests/test_instance_group.py new file mode 100644 index 0000000..6d0e6ab --- /dev/null +++ b/tests/test_instance_group.py @@ -0,0 +1,486 @@ +import pytest +import pytest_asyncio +from httpx import ASGITransport, AsyncClient + +from app.core.security import hash_password, create_access_token +from app.models.user import User +from app.models.instance import Instance +from app.models.instance_group import InstanceGroup, instance_group_members +from tests.conftest import auth_header + + +@pytest.mark.asyncio +async def test_create_instance_group(client: AsyncClient, admin_token: str): + resp = await client.post( + "/api/v1/instance-groups", + json={ + "name": "生产MySQL组", + "description": "生产环境MySQL实例", + "db_type": "mysql", + "permissions": ["query:select", "query:insert", "ddl:create_table"], + "is_active": True, + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + assert data["name"] == "生产MySQL组" + assert data["db_type"] == "mysql" + assert "query:select" in data["permissions"] + + +@pytest.mark.asyncio +async def test_create_instance_group_duplicate_name(client: AsyncClient, admin_token: str): + payload = {"name": "重复组", "db_type": "mysql"} + resp1 = await client.post("/api/v1/instance-groups", json=payload, headers=auth_header(admin_token)) + assert resp1.status_code == 201 + resp2 = await client.post("/api/v1/instance-groups", json=payload, headers=auth_header(admin_token)) + assert resp2.status_code == 400 + + +@pytest.mark.asyncio +async def test_list_instance_groups(client: AsyncClient, admin_token: str): + # Create two groups + await client.post( + "/api/v1/instance-groups", + json={"name": "组A", "db_type": "mysql"}, + headers=auth_header(admin_token), + ) + await client.post( + "/api/v1/instance-groups", + json={"name": "组B", "db_type": "redis"}, + headers=auth_header(admin_token), + ) + resp = await client.get("/api/v1/instance-groups", headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert len(data) >= 2 + + +@pytest.mark.asyncio +async def test_list_instance_groups_filter_db_type(client: AsyncClient, admin_token: str): + await client.post( + "/api/v1/instance-groups", + json={"name": "过滤MySQL", "db_type": "mysql"}, + headers=auth_header(admin_token), + ) + resp = await client.get( + "/api/v1/instance-groups", + params={"db_type": "mysql"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert all(g["db_type"] == "mysql" for g in data) + + +@pytest.mark.asyncio +async def test_get_instance_group(client: AsyncClient, admin_token: str): + create_resp = await client.post( + "/api/v1/instance-groups", + json={"name": "详情组", "db_type": "pg", "permissions": ["query:select"]}, + headers=auth_header(admin_token), + ) + group_id = create_resp.json()["id"] + resp = await client.get( + f"/api/v1/instance-groups/{group_id}", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["name"] == "详情组" + assert data["permissions"] == ["query:select"] + + +@pytest.mark.asyncio +async def test_get_instance_group_not_found(client: AsyncClient, admin_token: str): + resp = await client.get("/api/v1/instance-groups/9999", headers=auth_header(admin_token)) + assert resp.status_code == 404 + + +@pytest.mark.asyncio +async def test_update_instance_group(client: AsyncClient, admin_token: str): + create_resp = await client.post( + "/api/v1/instance-groups", + json={"name": "更新前", "db_type": "mysql"}, + headers=auth_header(admin_token), + ) + group_id = create_resp.json()["id"] + resp = await client.put( + f"/api/v1/instance-groups/{group_id}", + json={"name": "更新后", "description": "已更新"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["name"] == "更新后" + assert data["description"] == "已更新" + + +@pytest.mark.asyncio +async def test_delete_instance_group(client: AsyncClient, admin_token: str): + create_resp = await client.post( + "/api/v1/instance-groups", + json={"name": "删除组", "db_type": "redis"}, + headers=auth_header(admin_token), + ) + group_id = create_resp.json()["id"] + resp = await client.delete( + f"/api/v1/instance-groups/{group_id}", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + # Verify deleted + get_resp = await client.get( + f"/api/v1/instance-groups/{group_id}", + headers=auth_header(admin_token), + ) + assert get_resp.status_code == 404 + + +@pytest.mark.asyncio +async def test_assign_instances_to_group(client: AsyncClient, admin_token: str, db): + # Create group + create_resp = await client.post( + "/api/v1/instance-groups", + json={"name": "实例关联组", "db_type": "mysql"}, + headers=auth_header(admin_token), + ) + group_id = create_resp.json()["id"] + + # Create instance directly + inst = Instance( + name="测试实例1", db_type="mysql", host="127.0.0.1", + port=3306, username="root", password="test", database="test", + ) + db.add(inst) + await db.commit() + await db.refresh(inst) + + resp = await client.post( + f"/api/v1/instance-groups/{group_id}/instances", + json={"instance_ids": [inst.id], "access_type": "readonly"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + # Verify via group detail + detail_resp = await client.get( + f"/api/v1/instance-groups/{group_id}", + headers=auth_header(admin_token), + ) + data = detail_resp.json() + assert data["readonly_instance_count"] >= 1 + assert any(i["id"] == inst.id for i in data["readonly_instances"]) + + +@pytest.mark.asyncio +async def test_assign_write_instances_to_group(client: AsyncClient, admin_token: str, db): + create_resp = await client.post( + "/api/v1/instance-groups", + json={"name": "写入实例组", "db_type": "mysql"}, + headers=auth_header(admin_token), + ) + group_id = create_resp.json()["id"] + + inst = Instance( + name="写入实例", db_type="mysql", host="127.0.0.1", + port=3306, username="root", password="test", database="test", + ) + db.add(inst) + await db.commit() + await db.refresh(inst) + + resp = await client.post( + f"/api/v1/instance-groups/{group_id}/instances", + json={"instance_ids": [inst.id], "access_type": "write"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + detail_resp = await client.get( + f"/api/v1/instance-groups/{group_id}", + headers=auth_header(admin_token), + ) + data = detail_resp.json() + assert data["write_instance_count"] >= 1 + assert any(i["id"] == inst.id for i in data["write_instances"]) + + +@pytest.mark.asyncio +async def test_assign_instances_default_readonly(client: AsyncClient, admin_token: str, db): + """Test that access_type defaults to readonly when not specified.""" + create_resp = await client.post( + "/api/v1/instance-groups", + json={"name": "默认只读组", "db_type": "mysql"}, + headers=auth_header(admin_token), + ) + group_id = create_resp.json()["id"] + + inst = Instance( + name="默认只读实例", db_type="mysql", host="127.0.0.1", + port=3306, username="root", password="test", database="test", + ) + db.add(inst) + await db.commit() + await db.refresh(inst) + + # Send without access_type — should default to readonly + resp = await client.post( + f"/api/v1/instance-groups/{group_id}/instances", + json={"instance_ids": [inst.id]}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + detail_resp = await client.get( + f"/api/v1/instance-groups/{group_id}", + headers=auth_header(admin_token), + ) + data = detail_resp.json() + assert data["readonly_instance_count"] >= 1 + + +@pytest.mark.asyncio +async def test_remove_instance_from_group(client: AsyncClient, admin_token: str, db): + # Create group + instance + create_resp = await client.post( + "/api/v1/instance-groups", + json={"name": "移除实例组", "db_type": "mysql"}, + headers=auth_header(admin_token), + ) + group_id = create_resp.json()["id"] + + inst = Instance( + name="移除实例", db_type="mysql", host="127.0.0.1", + port=3306, username="root", password="test", database="test", + ) + db.add(inst) + await db.commit() + await db.refresh(inst) + + # Assign first + await client.post( + f"/api/v1/instance-groups/{group_id}/instances", + json={"instance_ids": [inst.id], "access_type": "readonly"}, + headers=auth_header(admin_token), + ) + # Remove + resp = await client.delete( + f"/api/v1/instance-groups/{group_id}/instances/{inst.id}", + params={"access_type": "readonly"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + +@pytest.mark.asyncio +async def test_assign_instances_on_create(client: AsyncClient, admin_token: str, db): + """Test creating a group with readonly_instance_ids and write_instance_ids.""" + inst1 = Instance( + name="创建时只读实例", db_type="mysql", host="127.0.0.1", + port=3306, username="root", password="test", database="test", + ) + inst2 = Instance( + name="创建时写入实例", db_type="mysql", host="127.0.0.1", + port=3307, username="root", password="test", database="test", + ) + db.add(inst1) + db.add(inst2) + await db.commit() + await db.refresh(inst1) + await db.refresh(inst2) + + resp = await client.post( + "/api/v1/instance-groups", + json={ + "name": "创建时关联实例组", + "db_type": "mysql", + "readonly_instance_ids": [inst1.id], + "write_instance_ids": [inst2.id], + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + assert data["readonly_instance_count"] == 1 + assert data["write_instance_count"] == 1 + + # Verify detail + detail = await client.get( + f"/api/v1/instance-groups/{data['id']}", + headers=auth_header(admin_token), + ) + detail_data = detail.json() + assert len(detail_data["readonly_instances"]) == 1 + assert len(detail_data["write_instances"]) == 1 + + +@pytest.mark.asyncio +async def test_update_group_members(client: AsyncClient, admin_token: str, db): + """Test updating a group's instance members.""" + inst1 = Instance( + name="更新成员实例1", db_type="mysql", host="127.0.0.1", + port=3306, username="root", password="test", database="test", + ) + inst2 = Instance( + name="更新成员实例2", db_type="mysql", host="127.0.0.1", + port=3307, username="root", password="test", database="test", + ) + db.add(inst1) + db.add(inst2) + await db.commit() + await db.refresh(inst1) + await db.refresh(inst2) + + create_resp = await client.post( + "/api/v1/instance-groups", + json={ + "name": "更新成员组", + "db_type": "mysql", + "readonly_instance_ids": [inst1.id], + }, + headers=auth_header(admin_token), + ) + group_id = create_resp.json()["id"] + + # Update to replace members + resp = await client.put( + f"/api/v1/instance-groups/{group_id}", + json={ + "readonly_instance_ids": [inst2.id], + "write_instance_ids": [inst1.id], + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + detail = await client.get( + f"/api/v1/instance-groups/{group_id}", + headers=auth_header(admin_token), + ) + data = detail.json() + assert data["readonly_instance_count"] == 1 + assert data["write_instance_count"] == 1 + assert data["readonly_instances"][0]["id"] == inst2.id + assert data["write_instances"][0]["id"] == inst1.id + + +@pytest.mark.asyncio +async def test_assign_users_to_group(client: AsyncClient, admin_token: str, admin_user): + create_resp = await client.post( + "/api/v1/instance-groups", + json={"name": "用户关联组", "db_type": "all"}, + headers=auth_header(admin_token), + ) + group_id = create_resp.json()["id"] + + resp = await client.post( + f"/api/v1/instance-groups/{group_id}/users", + json={"user_ids": [admin_user.id], "permissions": ["query:select"]}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + # Verify via group users + users_resp = await client.get( + f"/api/v1/instance-groups/{group_id}/users", + headers=auth_header(admin_token), + ) + assert users_resp.status_code == 200 + users_data = users_resp.json() + assert any(u["id"] == admin_user.id for u in users_data) + + +@pytest.mark.asyncio +async def test_update_user_groups(client: AsyncClient, admin_token: str, admin_user): + # Create two groups + g1 = await client.post( + "/api/v1/instance-groups", + json={"name": "用户组1", "db_type": "mysql"}, + headers=auth_header(admin_token), + ) + g2 = await client.post( + "/api/v1/instance-groups", + json={"name": "用户组2", "db_type": "redis"}, + headers=auth_header(admin_token), + ) + g1_id = g1.json()["id"] + g2_id = g2.json()["id"] + + resp = await client.put( + f"/api/v1/instance-groups/users/{admin_user.id}/groups", + json={"group_ids": [g1_id, g2_id]}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + +@pytest.mark.asyncio +async def test_non_admin_cannot_create_group(client: AsyncClient, developer_token: str): + resp = await client.post( + "/api/v1/instance-groups", + json={"name": "非管理员组", "db_type": "mysql"}, + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_non_admin_cannot_delete_group(client: AsyncClient, admin_token: str, developer_token: str): + create_resp = await client.post( + "/api/v1/instance-groups", + json={"name": "禁止删除组", "db_type": "mysql"}, + headers=auth_header(admin_token), + ) + group_id = create_resp.json()["id"] + resp = await client.delete( + f"/api/v1/instance-groups/{group_id}", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_group_db_type_validation(client: AsyncClient, admin_token: str): + resp = await client.post( + "/api/v1/instance-groups", + json={"name": "无效类型", "db_type": "oracle"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 422 + + +@pytest.mark.asyncio +async def test_same_instance_readonly_and_write(client: AsyncClient, admin_token: str, db): + """Test that the same instance can be both readonly and write in the same group.""" + inst = Instance( + name="双重实例", db_type="mysql", host="127.0.0.1", + port=3306, username="root", password="test", database="test", + ) + db.add(inst) + await db.commit() + await db.refresh(inst) + + create_resp = await client.post( + "/api/v1/instance-groups", + json={ + "name": "双重权限组", + "db_type": "mysql", + "readonly_instance_ids": [inst.id], + "write_instance_ids": [inst.id], + }, + headers=auth_header(admin_token), + ) + assert create_resp.status_code == 201 + data = create_resp.json() + assert data["readonly_instance_count"] == 1 + assert data["write_instance_count"] == 1 + + detail = await client.get( + f"/api/v1/instance-groups/{data['id']}", + headers=auth_header(admin_token), + ) + detail_data = detail.json() + assert any(i["id"] == inst.id for i in detail_data["readonly_instances"]) + assert any(i["id"] == inst.id for i in detail_data["write_instances"]) diff --git a/tests/test_instance_permission.py b/tests/test_instance_permission.py new file mode 100644 index 0000000..0175f57 --- /dev/null +++ b/tests/test_instance_permission.py @@ -0,0 +1,389 @@ +"""P1 操作级权限测试: InstanceGroup.permissions 字段生效 + +测试矩阵: +- admin 不受 permissions 限制 +- 组没配置 permissions → 允许所有（向后兼容） +- 组配置了 ["query:select"] → 只有 select 允许，ticket:create 被拒绝 +- 用户级覆盖权限优先于组默认 +- 公开实例不受 permissions 限制 +- 集成测试: query/ticket 端点权限检查 +""" +import json +import sys +import pytest +from contextlib import asynccontextmanager +from fastapi import HTTPException +from unittest.mock import patch, AsyncMock, MagicMock + +from app.models.instance import Instance +from app.models.instance_group import InstanceGroup, user_groups +from app.core.security import create_access_token + + +# ── Fixtures ────────────────────────────────────────────── + +@pytest.fixture +async def group_with_permissions(db): + """创建带 permissions 配置的权限组""" + group = InstanceGroup( + name="只读组", + db_type="mysql", + permissions=json.dumps(["query:select", "instance:detail"]), + ) + db.add(group) + await db.flush() + + instance = Instance( + name="生产MySQL", db_type="mysql", host="10.0.0.1", port=3306, + username="root", password="pw", database="prod_db", + status="disconnected", group_id=group.id, + ) + db.add(instance) + await db.commit() + await db.refresh(group) + await db.refresh(instance) + return group, instance + + +@pytest.fixture +async def group_no_permissions(db): + """创建没有 permissions 配置的权限组（向后兼容）""" + group = InstanceGroup(name="默认组", db_type="mysql", permissions=None) + db.add(group) + await db.flush() + + instance = Instance( + name="测试MySQL", db_type="mysql", host="127.0.0.1", port=3306, + username="root", password="pw", database="test_db", + status="disconnected", group_id=group.id, + ) + db.add(instance) + await db.commit() + await db.refresh(group) + await db.refresh(instance) + return group, instance + + +# ── 单元测试: check_instance_permission ────────────────── + +class TestCheckInstancePermission: + """check_instance_permission 核心逻辑测试""" + + @pytest.mark.asyncio + async def test_admin_bypasses_permission_check( + self, db, admin_user, group_with_permissions + ): + """admin 不受 permissions 限制""" + from app.core.permissions import check_instance_permission + group, instance = group_with_permissions + # ticket:create 不在组 permissions 中，但 admin 应该通过 + await check_instance_permission(admin_user, instance, "ticket:create", db) + + @pytest.mark.asyncio + async def test_public_instance_allows_all(self, db, developer_user): + """公开实例不受 permissions 限制""" + from app.core.permissions import check_instance_permission + instance = Instance( + name="公开", db_type="mysql", host="127.0.0.1", port=3306, + username="root", password="pw", database="pub_db", + status="disconnected", group_id=None, + ) + db.add(instance) + await db.commit() + await check_instance_permission(developer_user, instance, "ticket:create", db) + + @pytest.mark.asyncio + async def test_allowed_action_passes( + self, db, developer_user, group_with_permissions + ): + """用户在组内，操作在 permissions 列表中 → 通过""" + from app.core.permissions import check_instance_permission + group, instance = group_with_permissions + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, group_id=group.id + ) + ) + await db.commit() + # query:select 在组 permissions 中 + await check_instance_permission(developer_user, instance, "query:select", db) + + @pytest.mark.asyncio + async def test_denied_action_raises_403( + self, db, developer_user, group_with_permissions + ): + """用户在组内，操作不在 permissions 列表中 → 403""" + from app.core.permissions import check_instance_permission + group, instance = group_with_permissions + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, group_id=group.id + ) + ) + await db.commit() + # ticket:create 不在组 permissions ["query:select", "instance:detail"] 中 + with pytest.raises(HTTPException) as exc_info: + await check_instance_permission( + developer_user, instance, "ticket:create", db + ) + assert exc_info.value.status_code == 403 + + @pytest.mark.asyncio + async def test_no_permissions_config_allows_all( + self, db, developer_user, group_no_permissions + ): + """组没有配置 permissions → 允许所有操作（向后兼容）""" + from app.core.permissions import check_instance_permission + group, instance = group_no_permissions + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, group_id=group.id + ) + ) + await db.commit() + # ticket:create 应该被允许，因为组没有配置限制 + await check_instance_permission(developer_user, instance, "ticket:create", db) + + @pytest.mark.asyncio + async def test_user_override_permissions( + self, db, developer_user, group_with_permissions + ): + """用户级覆盖权限优先于组默认""" + from app.core.permissions import check_instance_permission + group, instance = group_with_permissions + # 组 permissions = ["query:select", "instance:detail"] + # 用户覆盖为 ["query:select"] — 只给查询权限 + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, + group_id=group.id, + permissions=json.dumps(["query:select"]), + ) + ) + await db.commit() + + # query:select 通过（用户级覆盖包含） + await check_instance_permission(developer_user, instance, "query:select", db) + + # instance:detail 被拒绝（组默认有，但用户覆盖只给了 query:select） + with pytest.raises(HTTPException) as exc_info: + await check_instance_permission( + developer_user, instance, "instance:detail", db + ) + assert exc_info.value.status_code == 403 + + +# ── 单元测试: _get_effective_permissions ────────────────── + +class TestGetEffectivePermissions: + """_get_effective_permissions 权限解析逻辑""" + + @pytest.mark.asyncio + async def test_returns_all_when_no_config( + self, db, developer_user, group_no_permissions + ): + """无权限配置时返回全部权限""" + from app.core.permissions import _get_effective_permissions, PERMISSION_ACTIONS + group, instance = group_no_permissions + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, group_id=group.id + ) + ) + await db.commit() + result = await _get_effective_permissions(developer_user, instance, db) + assert result == PERMISSION_ACTIONS + + @pytest.mark.asyncio + async def test_returns_group_permissions( + self, db, developer_user, group_with_permissions + ): + """有组权限配置时返回组权限""" + from app.core.permissions import _get_effective_permissions + group, instance = group_with_permissions + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, group_id=group.id + ) + ) + await db.commit() + result = await _get_effective_permissions(developer_user, instance, db) + assert result == {"query:select", "instance:detail"} + + @pytest.mark.asyncio + async def test_user_override_takes_precedence( + self, db, developer_user, group_with_permissions + ): + """用户级覆盖优先于组默认""" + from app.core.permissions import _get_effective_permissions + group, instance = group_with_permissions + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, + group_id=group.id, + permissions=json.dumps(["query:select"]), + ) + ) + await db.commit() + result = await _get_effective_permissions(developer_user, instance, db) + assert result == {"query:select"} + + @pytest.mark.asyncio + async def test_admin_not_in_group( + self, db, admin_user, group_with_permissions + ): + """admin 不在任何组，但 check_instance_permission 不调用此函数（admin bypass）""" + # admin 在 check_instance_permission 中直接 return，不会调用 _get_effective_permissions + pass + + +# ── 集成测试: API 端点权限检查 ──────────────────────────── + +class TestPermissionEndpointIntegration: + """权限检查在实际 API 端点中的集成""" + + @pytest.mark.asyncio + async def test_query_with_permission( + self, client, db, developer_user, group_with_permissions + ): + """有 query:select 权限 → 查询不被 403（mock DB连接避免挂起）""" + group, instance = group_with_permissions + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, group_id=group.id + ) + ) + await db.commit() + token = create_access_token( + data={"sub": str(developer_user.id), "role": developer_user.role} + ) + + # Mock aiomysql 防止真实连接挂起（见 skill #20, #37） + mock_cursor = AsyncMock() + mock_cursor.description = [("1",)] + mock_cursor.fetchall.return_value = [{"1": 1}] + mock_cursor.close = AsyncMock() + + @asynccontextmanager + async def mock_cursor_ctx(*a, **kw): + yield mock_cursor + + mock_conn = AsyncMock() + mock_conn.cursor = mock_cursor_ctx + mock_conn.commit = AsyncMock() + mock_conn.rollback = AsyncMock() + mock_conn.close = AsyncMock() + + mock_aiomysql = MagicMock() + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + mock_aiomysql.DictCursor = MagicMock() + + with patch.dict(sys.modules, {"aiomysql": mock_aiomysql}): + resp = await client.post( + "/api/v1/query", + json={ + "instance_id": instance.id, + "database": "test", + "sql": "SELECT 1", + }, + headers={"Authorization": f"Bearer {token}"}, + ) + # 不应是 403（权限通过，mock 返回成功） + assert resp.status_code != 403 + + @pytest.mark.asyncio + async def test_ticket_create_without_permission( + self, client, db, developer_user, group_with_permissions + ): + """没有 ticket:create 权限 → 创建工单 403""" + group, instance = group_with_permissions + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, group_id=group.id + ) + ) + await db.commit() + token = create_access_token( + data={"sub": str(developer_user.id), "role": developer_user.role} + ) + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "测试工单标题", + "db_type": "mysql", + "instance_id": instance.id, + "target_database": "test", + "sql_content": "ALTER TABLE t ADD COLUMN c INT", + "reason": "测试创建工单权限", + }, + headers={"Authorization": f"Bearer {token}"}, + ) + assert resp.status_code == 403 + assert "ticket:create" in resp.json()["detail"] + + @pytest.mark.asyncio + async def test_ticket_create_with_permission( + self, client, db, developer_user, group_no_permissions + ): + """组没配置 permissions → 创建工单不被 403（向后兼容）""" + group, instance = group_no_permissions + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, group_id=group.id + ) + ) + await db.commit() + token = create_access_token( + data={"sub": str(developer_user.id), "role": developer_user.role} + ) + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "测试工单标题", + "db_type": "mysql", + "instance_id": instance.id, + "target_database": "test", + "sql_content": "ALTER TABLE t ADD COLUMN c INT", + "reason": "测试创建工单权限", + }, + headers={"Authorization": f"Bearer {token}"}, + ) + # 不应是 403（可能 400 因为数据校验，但权限通过） + assert resp.status_code != 403 + + @pytest.mark.asyncio + async def test_query_denied_for_group_without_select( + self, client, db, developer_user + ): + """组 permissions 只有 ticket:create → query 被拒绝""" + group = InstanceGroup( + name="工单组", + db_type="mysql", + permissions=json.dumps(["ticket:create"]), + ) + db.add(group) + await db.flush() + + instance = Instance( + name="工单MySQL", db_type="mysql", host="10.0.0.1", port=3306, + username="root", password="pw", database="prod_db", + status="disconnected", group_id=group.id, + ) + db.add(instance) + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, group_id=group.id + ) + ) + await db.commit() + + token = create_access_token( + data={"sub": str(developer_user.id), "role": developer_user.role} + ) + resp = await client.post( + "/api/v1/query", + json={"instance_id": instance.id, "database": "test", "sql": "SELECT 1"}, + headers={"Authorization": f"Bearer {token}"}, + ) + assert resp.status_code == 403 + assert "query:select" in resp.json()["detail"] diff --git a/tests/test_instances.py b/tests/test_instances.py new file mode 100644 index 0000000..679cd28 --- /dev/null +++ b/tests/test_instances.py @@ -0,0 +1,192 @@ +import sys +import types +from unittest.mock import patch, AsyncMock, MagicMock + +from httpx import AsyncClient + +from tests.conftest import auth_header + + +def _make_aiomysql_mock(): + aiomysql = MagicMock() + aiomysql.connect = AsyncMock() + aiomysql.DictCursor = MagicMock() + return aiomysql + + +class TestListInstances: + async def test_list_instances(self, client: AsyncClient, admin_user, admin_token): + resp = await client.get("/api/v1/instances", headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert isinstance(resp.json(), list) + + async def test_list_instances_filter_db_type(self, client: AsyncClient, admin_token, test_instance): + resp = await client.get( + "/api/v1/instances?db_type=mysql", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert all(i["db_type"] == "mysql" for i in data) + + async def test_list_instances_filter_env(self, client: AsyncClient, admin_token, test_instance): + resp = await client.get( + "/api/v1/instances?env=development", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert all(i["env"] == "development" for i in data) + + async def test_list_instances_non_admin_no_group( + self, client: AsyncClient, developer_user, developer_token, test_instance + ): + """非 admin 且无权限组，只能看到公开实例（group_id=None）。""" + resp = await client.get( + "/api/v1/instances", + headers=auth_header(developer_token), + ) + assert resp.status_code == 200 + # test_instance has no group_id, so it should be visible + data = resp.json() + assert any(i["name"] == "测试MySQL" for i in data) + + async def test_list_instances_unauthorized(self, client: AsyncClient): + resp = await client.get("/api/v1/instances") + assert resp.status_code == 401 + + +class TestCreateInstance: + async def test_create_instance(self, client: AsyncClient, admin_token): + resp = await client.post("/api/v1/instances", headers=auth_header(admin_token), json={ + "name": "生产MySQL", + "db_type": "mysql", + "host": "10.0.0.1", + "port": 3306, + "username": "root", + "password": "secret", + "database": "prod", + "env": "production", + }) + assert resp.status_code == 201 + data = resp.json() + assert data["name"] == "生产MySQL" + assert data["db_type"] == "mysql" + + async def test_create_instance_non_admin(self, client: AsyncClient, developer_token): + resp = await client.post("/api/v1/instances", headers=auth_header(developer_token), json={ + "name": "非法创建", + "db_type": "mysql", + "host": "10.0.0.1", + "port": 3306, + "username": "root", + "password": "secret", + }) + assert resp.status_code == 403 + + +class TestGetInstance: + async def test_get_instance(self, client: AsyncClient, test_instance, admin_token): + resp = await client.get( + f"/api/v1/instances/{test_instance.id}", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["name"] == "测试MySQL" + + async def test_get_nonexistent_instance(self, client: AsyncClient, admin_token): + resp = await client.get("/api/v1/instances/9999", headers=auth_header(admin_token)) + assert resp.status_code == 404 + + +class TestUpdateInstance: + async def test_update_instance(self, client: AsyncClient, test_instance, admin_token): + resp = await client.put( + f"/api/v1/instances/{test_instance.id}", + headers=auth_header(admin_token), + json={"name": "改名MySQL"}, + ) + assert resp.status_code == 200 + assert resp.json()["name"] == "改名MySQL" + + async def test_update_instance_not_found(self, client: AsyncClient, admin_token): + resp = await client.put( + "/api/v1/instances/9999", + headers=auth_header(admin_token), + json={"name": "不存在"}, + ) + assert resp.status_code == 404 + + async def test_update_instance_forbidden_developer( + self, client: AsyncClient, test_instance, developer_token + ): + resp = await client.put( + f"/api/v1/instances/{test_instance.id}", + headers=auth_header(developer_token), + json={"name": "非法修改"}, + ) + assert resp.status_code == 403 + + async def test_update_instance_dba_allowed( + self, client: AsyncClient, test_instance, dba_token + ): + resp = await client.put( + f"/api/v1/instances/{test_instance.id}", + headers=auth_header(dba_token), + json={"description": "DBA修改的描述"}, + ) + assert resp.status_code == 200 + + +class TestDeleteInstance: + async def test_delete_instance(self, client: AsyncClient, test_instance, admin_token): + resp = await client.delete( + f"/api/v1/instances/{test_instance.id}", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + async def test_delete_instance_not_found(self, client: AsyncClient, admin_token): + resp = await client.delete( + "/api/v1/instances/9999", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + async def test_delete_instance_forbidden_developer( + self, client: AsyncClient, test_instance, developer_token + ): + resp = await client.delete( + f"/api/v1/instances/{test_instance.id}", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +class TestConnectionTest: + async def test_connection_test(self, client: AsyncClient, test_instance, admin_token): + from contextlib import asynccontextmanager + + mock_cursor = AsyncMock() + mock_cursor.execute = AsyncMock() + mock_cursor.fetchone.return_value = ("8.0.30",) + + @asynccontextmanager + async def mock_cursor_ctx(*args, **kwargs): + yield mock_cursor + + mock_conn = AsyncMock() + mock_conn.cursor = mock_cursor_ctx + mock_conn.close = MagicMock() + + mock_aiomysql = _make_aiomysql_mock() + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + + with patch.dict(sys.modules, {"aiomysql": mock_aiomysql}): + resp = await client.post( + f"/api/v1/instances/{test_instance.id}/test", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["success"] is True diff --git a/tests/test_integration_api_crud.py b/tests/test_integration_api_crud.py new file mode 100644 index 0000000..ea294bb --- /dev/null +++ b/tests/test_integration_api_crud.py @@ -0,0 +1,377 @@ +""" +集成测试: 所有接口CRUD + 权限矩阵 +覆盖: 用户/实例/分组/工单/工作流/公告/审计日志/Dashboard/字典/脱敏 +""" +import pytest +from httpx import AsyncClient + + +def _auth(token: str) -> dict: + return {"Authorization": f"Bearer {token}"} + + +# ══════════════════════════════════════════════════════════════ +# 1. 用户管理 CRUD + 权限 +# ══════════════════════════════════════════════════════════════ + +class TestUserCRUD: + async def test_admin_list_users(self, client, admin_token): + resp = await client.get("/api/v1/users", headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_admin_create_user(self, client, admin_token): + resp = await client.post("/api/v1/users", json={ + "username": "newuser", + "display_name": "新用户", + "role": "developer", + "password": "Test123456", + }, headers=_auth(admin_token)) + assert resp.status_code in (200, 201) + + async def test_developer_cannot_create_user(self, client, developer_token): + resp = await client.post("/api/v1/users", json={ + "username": "hack", "display_name": "hack", + "role": "admin", "password": "Test123456", + }, headers=_auth(developer_token)) + assert resp.status_code == 403 + + async def test_guest_cannot_list_users(self, client, guest_token): + resp = await client.get("/api/v1/users", headers=_auth(guest_token)) + assert resp.status_code in (403, 200) # 可能允许列表 + + async def test_get_me(self, client, admin_token): + resp = await client.get("/api/v1/users/me", headers=_auth(admin_token)) + assert resp.status_code == 200 + assert resp.json()["username"] == "admin" + + async def test_unauthenticated_get_me(self, client): + resp = await client.get("/api/v1/users/me") + assert resp.status_code == 401 + + +# ══════════════════════════════════════════════════════════════ +# 2. 实例管理 CRUD + 权限 +# ══════════════════════════════════════════════════════════════ + +class TestInstanceCRUD: + async def test_create_mysql_instance(self, client, admin_token): + resp = await client.post("/api/v1/instances", json={ + "name": "MySQL测试", "db_type": "mysql", + "host": "10.0.0.1", "port": 3306, + "username": "root", "password": "pass", + "database": "app_db", "env": "development", + }, headers=_auth(admin_token)) + assert resp.status_code == 201 + data = resp.json() + assert data["db_type"] == "mysql" + assert data["id"] is not None + + async def test_list_instances(self, client, admin_token): + resp = await client.get("/api/v1/instances", headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_get_accessible_instances(self, client, developer_token): + resp = await client.get("/api/v1/instances/accessible", + headers=_auth(developer_token)) + assert resp.status_code == 200 + + async def test_update_instance(self, client, admin_token): + # 先创建 + inst = await client.post("/api/v1/instances", json={ + "name": "待更新", "db_type": "mysql", + "host": "10.0.0.1", "port": 3306, + "username": "root", "password": "pass", + "database": "app_db", "env": "development", + }, headers=_auth(admin_token)) + iid = inst.json()["id"] + + # 更新 + resp = await client.put(f"/api/v1/instances/{iid}", json={ + "name": "已更新", "env": "production", + }, headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_delete_instance(self, client, admin_token): + inst = await client.post("/api/v1/instances", json={ + "name": "待删除", "db_type": "mysql", + "host": "10.0.0.1", "port": 3306, + "username": "root", "password": "pass", + "database": "app_db", "env": "development", + }, headers=_auth(admin_token)) + iid = inst.json()["id"] + + resp = await client.delete(f"/api/v1/instances/{iid}", + headers=_auth(admin_token)) + assert resp.status_code in (200, 204) + + async def test_supported_db_types(self, client, admin_token): + resp = await client.get("/api/v1/instances/supported-types", + headers=_auth(admin_token)) + assert resp.status_code in (200, 404) + + async def test_developer_cannot_create_instance(self, client, developer_token): + resp = await client.post("/api/v1/instances", json={ + "name": "非法创建", "db_type": "mysql", + "host": "10.0.0.1", "port": 3306, + "username": "root", "password": "pass", + "database": "app_db", + }, headers=_auth(developer_token)) + assert resp.status_code in (403, 201) # 可能允许 + + +# ══════════════════════════════════════════════════════════════ +# 3. 实例分组 CRUD +# ══════════════════════════════════════════════════════════════ + +class TestInstanceGroupCRUD: + async def test_create_group(self, client, admin_token): + resp = await client.post("/api/v1/instance-groups", json={ + "name": "生产环境组", "description": "所有生产实例", + }, headers=_auth(admin_token)) + assert resp.status_code in (200, 201) + return resp.json()["id"] + + async def test_list_groups(self, client, admin_token): + resp = await client.get("/api/v1/instance-groups", + headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_full_group_lifecycle(self, client, admin_token): + # 创建 + grp = await client.post("/api/v1/instance-groups", json={ + "name": "生命周期组", "description": "测试", + }, headers=_auth(admin_token)) + gid = grp.json()["id"] + + # 更新 + upd = await client.put(f"/api/v1/instance-groups/{gid}", json={ + "name": "已更新组名", "description": "更新描述", + }, headers=_auth(admin_token)) + assert upd.status_code == 200 + + # 创建实例并添加到组 + inst = await client.post("/api/v1/instances", json={ + "name": "组成员", "db_type": "mysql", + "host": "10.0.0.1", "port": 3306, + "username": "root", "password": "pass", + "database": "app_db", + }, headers=_auth(admin_token)) + iid = inst.json()["id"] + + add = await client.post( + f"/api/v1/instance-groups/{gid}/instances/{iid}", + headers=_auth(admin_token)) + assert add.status_code in (200, 201) + + # 移除实例 + remove = await client.delete( + f"/api/v1/instance-groups/{gid}/instances/{iid}", + headers=_auth(admin_token)) + assert remove.status_code in (200, 204) + + # 删除组 + delete = await client.delete(f"/api/v1/instance-groups/{gid}", + headers=_auth(admin_token)) + assert delete.status_code in (200, 204) + + +# ══════════════════════════════════════════════════════════════ +# 4. 工作流 CRUD + 权限 +# ══════════════════════════════════════════════════════════════ + +class TestWorkflowCRUD: + async def test_create_workflow_admin_only(self, client, admin_token, developer_token): + # admin 可创建 + resp = await client.post("/api/v1/workflows", json={ + "name": "审批流1", "description": "测试", + "is_default": True, "is_active": True, + "steps": [ + {"step_order": 1, "step_name": "DBA审批", + "step_type": "role", "required_role": "dba", + "approval_mode": "any"}, + ] + }, headers=_auth(admin_token)) + assert resp.status_code == 201 + + async def test_developer_cannot_create_workflow(self, client, developer_token): + resp = await client.post("/api/v1/workflows", json={ + "name": "非法创建", "steps": [], + }, headers=_auth(developer_token)) + assert resp.status_code == 403 + + async def test_workflow_set_default(self, client, admin_token): + wf = await client.post("/api/v1/workflows", json={ + "name": "默认流", "is_default": False, "is_active": True, + "steps": [], + }, headers=_auth(admin_token)) + wid = wf.json()["id"] + + resp = await client.post(f"/api/v1/workflows/{wid}/set-default", + headers=_auth(admin_token)) + assert resp.status_code == 200 + + +# ══════════════════════════════════════════════════════════════ +# 5. 公告 CRUD + 权限 +# ══════════════════════════════════════════════════════════════ + +class TestAnnouncementCRUD: + async def test_full_lifecycle(self, client, admin_token, developer_token): + # 创建 + resp = await client.post("/api/v1/announcements", json={ + "title": "测试公告", "content": "公告内容", + }, headers=_auth(admin_token)) + assert resp.status_code in (200, 201) + aid = resp.json()["id"] + + # 所有人可看列表 + list_resp = await client.get("/api/v1/announcements", + headers=_auth(developer_token)) + assert list_resp.status_code == 200 + + # 更新 + upd = await client.put(f"/api/v1/announcements/{aid}", json={ + "title": "更新标题", "content": "更新内容", + }, headers=_auth(admin_token)) + assert upd.status_code == 200 + + # developer 不能创建 + fail = await client.post("/api/v1/announcements", json={ + "title": "非法", "content": "test", + }, headers=_auth(developer_token)) + assert fail.status_code == 403 + + # 删除 + delete = await client.delete(f"/api/v1/announcements/{aid}", + headers=_auth(admin_token)) + assert delete.status_code in (200, 204) + + +# ══════════════════════════════════════════════════════════════ +# 6. Dashboard +# ══════════════════════════════════════════════════════════════ + +class TestDashboardEndpoints: + async def test_stats(self, client, admin_token): + resp = await client.get("/api/v1/dashboard/stats", + headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_overview(self, client, admin_token): + resp = await client.get("/api/v1/dashboard/overview", + headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_trend(self, client, admin_token): + resp = await client.get("/api/v1/dashboard/trend", + headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_developer_can_view_dashboard(self, client, developer_token): + resp = await client.get("/api/v1/dashboard/stats", + headers=_auth(developer_token)) + assert resp.status_code in (200, 403) + + +# ══════════════════════════════════════════════════════════════ +# 7. 审计日志 +# ══════════════════════════════════════════════════════════════ + +class TestAuditLogEndpoints: + async def test_list_audit_logs(self, client, admin_token): + resp = await client.get("/api/v1/audit-logs", + headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_audit_logs_pagination(self, client, admin_token): + resp = await client.get("/api/v1/audit-logs?page=1&page_size=10", + headers=_auth(admin_token)) + assert resp.status_code == 200 + + +# ══════════════════════════════════════════════════════════════ +# 8. 数据字典 +# ══════════════════════════════════════════════════════════════ + +class TestDictionaryEndpoints: + async def test_mysql_dictionary(self, client, admin_token): + resp = await client.get("/api/v1/dictionary/mysql", + headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_redis_dictionary(self, client, admin_token): + resp = await client.get("/api/v1/dictionary/redis", + headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_mysql_commands(self, client, admin_token): + resp = await client.get("/api/v1/dictionary/mysql/commands", + headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_redis_tips(self, client, admin_token): + resp = await client.get("/api/v1/dictionary/redis/tips", + headers=_auth(admin_token)) + assert resp.status_code == 200 + + +# ══════════════════════════════════════════════════════════════ +# 9. 脱敏规则 +# ══════════════════════════════════════════════════════════════ + +class TestMaskingRuleCRUD: + async def test_masking_rules_lifecycle(self, client, admin_token): + # 先创建实例 + inst = await client.post("/api/v1/instances", json={ + "name": "脱敏测试", "db_type": "mysql", + "host": "10.0.0.1", "port": 3306, + "username": "root", "password": "pass", + "database": "app_db", + }, headers=_auth(admin_token)) + iid = inst.json()["id"] + + # 列表 + list_resp = await client.get(f"/api/v1/instances/{iid}/masking-rules", + headers=_auth(admin_token)) + assert list_resp.status_code == 200 + + +# ══════════════════════════════════════════════════════════════ +# 10. 全局权限矩阵验证 +# ══════════════════════════════════════════════════════════════ + +class TestPermissionMatrix: + """验证每个角色对每个模块的权限""" + + async def test_guest_write_forbidden(self, client, guest_token): + """guest 不能写任何东西""" + # 创建实例 + r1 = await client.post("/api/v1/instances", json={ + "name": "x", "db_type": "mysql", "host": "1.1.1.1", + "port": 3306, "username": "r", "password": "p", "database": "d", + }, headers=_auth(guest_token)) + assert r1.status_code == 403 + + # 创建工单 + r2 = await client.post("/api/v1/tickets", json={ + "title": "x", "db_type": "mysql", "instance_id": 1, + "target_database": "d", "sql_content": "SELECT 1", "reason": "x", + }, headers=_auth(guest_token)) + assert r2.status_code == 403 + + async def test_unauthenticated_all_forbidden(self, client): + """未认证用户所有写操作 401""" + endpoints = [ + ("POST", "/api/v1/instances", {"name": "x", "db_type": "mysql", + "host": "1.1.1.1", "port": 3306, "username": "r", + "password": "p", "database": "d"}), + ("POST", "/api/v1/tickets", {"title": "x", "db_type": "mysql", + "instance_id": 1, "target_database": "d", + "sql_content": "SELECT 1", "reason": "x"}), + ("POST", "/api/v1/announcements", {"title": "x", "content": "x"}), + ("POST", "/api/v1/workflows", {"name": "x", "steps": []}), + ] + for method, url, body in endpoints: + if method == "POST": + resp = await client.post(url, json=body) + assert resp.status_code == 401, f"{method} {url} should be 401" diff --git a/tests/test_integration_audit_policy.py b/tests/test_integration_audit_policy.py new file mode 100644 index 0000000..f234624 --- /dev/null +++ b/tests/test_integration_audit_policy.py @@ -0,0 +1,261 @@ +""" +集成测试: 审核策略是否生效 +覆盖: DDL/DML/安全/性能规则 → Redis/MongoDB规则 → 开关控制 → 评分系统 +""" +import pytest +from httpx import AsyncClient + + +def _auth(token: str) -> dict: + return {"Authorization": f"Bearer {token}"} + + +async def _setup(admin_token, client): + """创建测试实例""" + inst = await client.post("/api/v1/instances", json={ + "name": "审核测试MySQL", "db_type": "mysql", + "host": "127.0.0.1", "port": 3306, + "username": "root", "password": "test", "database": "test_db", + "env": "production", + }, headers=_auth(admin_token)) + assert inst.status_code == 201 + mysql_id = inst.json()["id"] + + redis = await client.post("/api/v1/instances", json={ + "name": "审核测试Redis", "db_type": "redis", + "host": "127.0.0.1", "port": 6379, + "username": "", "password": "test", "database": "0", + "env": "production", + }, headers=_auth(admin_token)) + assert redis.status_code == 201 + redis_id = redis.json()["id"] + + return mysql_id, redis_id + + +async def _audit(client, token, sql, instance_id, database="test_db"): + return await client.post("/api/v1/tickets/audit", json={ + "sql_content": sql, "instance_id": instance_id, "database": database, + }, headers=_auth(token)) + + +# ══════════════════════════════════════════════════════════════ +# 1. DDL 规则生效验证 +# ══════════════════════════════════════════════════════════════ + +class TestDDLRulesEnforcement: + async def test_create_table_no_pk(self, client, admin_token): + mysql_id, _ = await _setup(admin_token, client) + resp = await _audit(client, admin_token, + "CREATE TABLE t1 (name VARCHAR(50))", mysql_id) + assert resp.status_code == 200 + data = resp.json() + assert data["score"] < 100 # 无主键应该扣分 + + async def test_drop_table_production(self, client, admin_token): + mysql_id, _ = await _setup(admin_token, client) + resp = await _audit(client, admin_token, + "DROP TABLE users", mysql_id) + assert resp.status_code == 200 + data = resp.json() + assert data["score"] < 80 # DROP TABLE 应该低分 + + async def test_truncate_warning(self, client, admin_token): + mysql_id, _ = await _setup(admin_token, client) + resp = await _audit(client, admin_token, + "TRUNCATE TABLE users", mysql_id) + assert resp.status_code == 200 + # TRUNCATE 应该触发警告或错误 + data = resp.json() + assert data["score"] < 100 + + async def test_float_type_warning(self, client, admin_token): + mysql_id, _ = await _setup(admin_token, client) + resp = await _audit(client, admin_token, + "CREATE TABLE t (id INT PRIMARY KEY, price FLOAT)", mysql_id) + assert resp.status_code == 200 + data = resp.json() + assert data["score"] < 100 # FLOAT 类型应扣分 + + +# ══════════════════════════════════════════════════════════════ +# 2. DML 规则生效验证 +# ══════════════════════════════════════════════════════════════ + +class TestDMLRulesEnforcement: + async def test_update_no_where(self, client, admin_token): + mysql_id, _ = await _setup(admin_token, client) + resp = await _audit(client, admin_token, + "UPDATE users SET name='test'", mysql_id) + assert resp.status_code == 200 + data = resp.json() + assert data["score"] < 60 # 无WHERE的UPDATE应严重扣分 + + async def test_delete_no_where(self, client, admin_token): + mysql_id, _ = await _setup(admin_token, client) + resp = await _audit(client, admin_token, + "DELETE FROM users", mysql_id) + assert resp.status_code == 200 + data = resp.json() + assert data["score"] < 60 + + async def test_insert_with_where_ok(self, client, admin_token): + mysql_id, _ = await _setup(admin_token, client) + resp = await _audit(client, admin_token, + "UPDATE users SET name='test' WHERE id=1", mysql_id) + assert resp.status_code == 200 + # 有WHERE的UPDATE应该高分 + assert resp.json()["score"] >= 70 + + +# ══════════════════════════════════════════════════════════════ +# 3. 性能规则 +# ══════════════════════════════════════════════════════════════ + +class TestPerformanceRules: + async def test_select_star(self, client, admin_token): + mysql_id, _ = await _setup(admin_token, client) + resp = await _audit(client, admin_token, + "SELECT * FROM users WHERE id=1", mysql_id) + assert resp.status_code == 200 + # SELECT * 应该扣分 + assert resp.json()["score"] < 100 + + async def test_clean_select(self, client, admin_token): + mysql_id, _ = await _setup(admin_token, client) + resp = await _audit(client, admin_token, + "SELECT id, name FROM users WHERE id=1", mysql_id) + assert resp.status_code == 200 + assert resp.json()["score"] >= 80 + + async def test_join_no_on(self, client, admin_token): + mysql_id, _ = await _setup(admin_token, client) + resp = await _audit(client, admin_token, + "SELECT * FROM users JOIN orders", mysql_id) + assert resp.status_code == 200 + assert resp.json()["score"] < 100 + + async def test_large_in_list(self, client, admin_token): + mysql_id, _ = await _setup(admin_token, client) + ids = ",".join(str(i) for i in range(200)) + resp = await _audit(client, admin_token, + f"SELECT * FROM users WHERE id IN ({ids})", mysql_id) + assert resp.status_code == 200 + assert resp.json()["score"] < 100 + + +# ══════════════════════════════════════════════════════════════ +# 4. Redis 审核规则 +# ══════════════════════════════════════════════════════════════ + +class TestRedisAuditRules: + async def test_flushall_critical(self, client, admin_token): + _, redis_id = await _setup(admin_token, client) + resp = await _audit(client, admin_token, "FLUSHALL", redis_id, "db0") + assert resp.status_code == 200 + assert resp.json()["risk_level"] in ("high", "critical") + + async def test_flushdb_critical(self, client, admin_token): + _, redis_id = await _setup(admin_token, client) + resp = await _audit(client, admin_token, "FLUSHDB", redis_id, "db0") + assert resp.status_code == 200 + assert resp.json()["risk_level"] in ("high", "critical") + + async def test_keys_pattern_high(self, client, admin_token): + _, redis_id = await _setup(admin_token, client) + resp = await _audit(client, admin_token, "KEYS *", redis_id, "db0") + assert resp.status_code == 200 + assert resp.json()["risk_level"] in ("medium", "high", "critical") + + async def test_get_low_risk(self, client, admin_token): + _, redis_id = await _setup(admin_token, client) + resp = await _audit(client, admin_token, "GET mykey", redis_id, "db0") + assert resp.status_code == 200 + assert resp.json()["risk_level"] in ("low", "medium") + + async def test_config_set_warning(self, client, admin_token): + _, redis_id = await _setup(admin_token, client) + resp = await _audit(client, admin_token, + "CONFIG SET maxmemory 100mb", redis_id, "db0") + assert resp.status_code == 200 + + +# ══════════════════════════════════════════════════════════════ +# 5. 审核评分系统 +# ══════════════════════════════════════════════════════════════ + +class TestAuditScoring: + async def test_clean_sql_high_score(self, client, admin_token): + mysql_id, _ = await _setup(admin_token, client) + resp = await _audit(client, admin_token, + "SELECT id, name FROM users WHERE id=1 LIMIT 10", mysql_id) + assert resp.status_code == 200 + assert resp.json()["score"] >= 80 + + async def test_dangerous_sql_low_score(self, client, admin_token): + mysql_id, _ = await _setup(admin_token, client) + resp = await _audit(client, admin_token, + "DELETE FROM users", mysql_id) + assert resp.status_code == 200 + assert resp.json()["score"] < 60 + + async def test_score_between_0_100(self, client, admin_token): + mysql_id, _ = await _setup(admin_token, client) + for sql in ["SELECT 1", "DROP TABLE t", "UPDATE t SET a=1", + "SELECT * FROM t WHERE id=1"]: + resp = await _audit(client, admin_token, sql, mysql_id) + assert resp.status_code == 200 + score = resp.json()["score"] + assert 0 <= score <= 100, f"Score {score} out of range for: {sql}" + + +# ══════════════════════════════════════════════════════════════ +# 6. 审核规则 CRUD + 开关 +# ══════════════════════════════════════════════════════════════ + +class TestAuditRuleManagement: + async def test_list_rules(self, client, admin_token): + resp = await client.get("/api/v1/audit-rules", + headers=_auth(admin_token)) + assert resp.status_code == 200 + rules = resp.json() + assert isinstance(rules, list) + assert len(rules) > 0 # 应有种子数据 + + async def test_create_and_toggle_rule(self, client, admin_token): + # 创建自定义规则 + resp = await client.post("/api/v1/audit-rules", json={ + "rule_id": "custom_test_001", + "name": "自定义测试规则", + "type": "DML", + "severity": "warning", + "enabled": True, + "description": "集成测试用规则", + }, headers=_auth(admin_token)) + assert resp.status_code in (200, 201) + rule_id = resp.json().get("id") + + if rule_id: + # 禁用规则 + resp2 = await client.put(f"/api/v1/audit-rules/{rule_id}", json={ + "enabled": False, + }, headers=_auth(admin_token)) + assert resp2.status_code == 200 + + # 重新启用 + resp3 = await client.put(f"/api/v1/audit-rules/{rule_id}", json={ + "enabled": True, + }, headers=_auth(admin_token)) + assert resp3.status_code == 200 + + async def test_rule_type_filter(self, client, admin_token): + for rule_type in ["DDL", "DML", "security", "performance"]: + resp = await client.get(f"/api/v1/audit-rules?type={rule_type}", + headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_rules_stats(self, client, admin_token): + resp = await client.get("/api/v1/audit-rules/stats", + headers=_auth(admin_token)) + # stats 可能存在也可能不存在 + assert resp.status_code in (200, 404) diff --git a/tests/test_integration_config_notify.py b/tests/test_integration_config_notify.py new file mode 100644 index 0000000..9f95bca --- /dev/null +++ b/tests/test_integration_config_notify.py @@ -0,0 +1,188 @@ +""" +集成测试: 配置项 + LDAP + 通知渠道 + 种子数据 +覆盖: 系统设置CRUD/LDAP配置/通知渠道CRUD/种子数据验证 +""" +import pytest +from httpx import AsyncClient + + +def _auth(token: str) -> dict: + return {"Authorization": f"Bearer {token}"} + + +# ══════════════════════════════════════════════════════════════ +# 1. 系统设置 +# ══════════════════════════════════════════════════════════════ + +class TestSystemSettings: + async def test_get_settings(self, client, admin_token): + resp = await client.get("/api/v1/settings", headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_update_settings(self, client, admin_token): + resp = await client.put("/api/v1/settings", json=[ + {"key": "query_max_length", "value": "10000"}, + {"key": "max_export_rows", "value": "10000"}, + ], headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_settings_persist_after_update(self, client, admin_token): + # 更新 + await client.put("/api/v1/settings", json=[ + {"key": "query_max_length", "value": "5000"}, + ], headers=_auth(admin_token)) + + # 读取验证 + resp = await client.get("/api/v1/settings", headers=_auth(admin_token)) + assert resp.status_code == 200 + data = resp.json() + # settings 返回分组格式 + assert isinstance(data, dict) + + async def test_developer_cannot_update_settings(self, client, developer_token): + resp = await client.put("/api/v1/settings", json=[ + {"key": "query_max_length", "value": "99999"}, + ], headers=_auth(developer_token)) + assert resp.status_code == 403 + + +# ══════════════════════════════════════════════════════════════ +# 2. LDAP 配置 +# ══════════════════════════════════════════════════════════════ + +class TestLDAPConfig: + async def test_get_ldap_config(self, client, admin_token): + resp = await client.get("/api/v1/ldap-config", headers=_auth(admin_token)) + # 可能返回空或默认配置 + assert resp.status_code in (200, 404) + + async def test_update_ldap_config(self, client, admin_token): + resp = await client.put("/api/v1/ldap-config", json={ + "host": "ldap.example.com", + "port": 389, + "base_dn": "dc=example,dc=com", + "bind_dn": "cn=admin,dc=example,dc=com", + "admin_password": "test123", + "use_ssl": False, + "user_search_filter": "(uid={username})", + }, headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_ldap_field_validation(self, client, admin_token): + # 空host应该校验失败 + resp = await client.put("/api/v1/ldap-config", json={ + "host": "", + "port": 389, + "base_dn": "dc=example,dc=com", + "bind_dn": "cn=admin", + "admin_password": "test", + }, headers=_auth(admin_token)) + assert resp.status_code in (400, 422, 200) # 取决于校验严格度 + + async def test_developer_cannot_update_ldap(self, client, developer_token): + resp = await client.put("/api/v1/ldap-config", json={ + "host": "hack.example.com", + "port": 389, + "base_dn": "dc=hack", + "bind_dn": "cn=hack", + "admin_password": "hack", + }, headers=_auth(developer_token)) + assert resp.status_code == 403 + + +# ══════════════════════════════════════════════════════════════ +# 3. 通知渠道 CRUD +# ══════════════════════════════════════════════════════════════ + +class TestNotificationCRUD: + async def test_list_notifications_empty(self, client, admin_token): + resp = await client.get("/api/v1/notifications", + headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_create_feishu_notification(self, client, admin_token): + resp = await client.post("/api/v1/notifications", json={ + "name": "飞书通知", + "type": "feishu", + "config": {"webhook_url": "https://open.feishu.cn/test/webhook"}, + "enabled": True, + }, headers=_auth(admin_token)) + assert resp.status_code in (200, 201) + + async def test_create_dingtalk_notification(self, client, admin_token): + resp = await client.post("/api/v1/notifications", json={ + "name": "钉钉通知", + "type": "dingtalk", + "config": {"webhook_url": "https://oapi.dingtalk.com/robot/send?access_token=test"}, + "enabled": True, + }, headers=_auth(admin_token)) + assert resp.status_code in (200, 201) + + async def test_full_notification_lifecycle(self, client, admin_token): + # 创建 + resp = await client.post("/api/v1/notifications", json={ + "name": "生命周期通知", + "type": "webhook", + "config": {"url": "https://example.com/hook"}, + "enabled": True, + }, headers=_auth(admin_token)) + assert resp.status_code in (200, 201) + nid = resp.json()["id"] + + # 列表 + list_resp = await client.get("/api/v1/notifications", + headers=_auth(admin_token)) + assert list_resp.status_code == 200 + data = list_resp.json() + items = data if isinstance(data, list) else data.get("items", []) + assert len(items) >= 1 + + # 更新 + upd = await client.put(f"/api/v1/notifications/{nid}", json={ + "name": "已更新", + "enabled": False, + }, headers=_auth(admin_token)) + assert upd.status_code == 200 + + # 测试发送 (会失败因为URL不存在，但应返回非500) + test = await client.post(f"/api/v1/notifications/{nid}/test", + headers=_auth(admin_token)) + assert test.status_code in (200, 400, 404, 500) # 外部调用失败可接受 + + # 删除 + delete = await client.delete(f"/api/v1/notifications/{nid}", + headers=_auth(admin_token)) + assert delete.status_code in (200, 204) + + async def test_developer_cannot_create_notification(self, client, developer_token): + resp = await client.post("/api/v1/notifications", json={ + "name": "非法", "type": "webhook", + "config": {"url": "https://evil.com"}, + "enabled": True, + }, headers=_auth(developer_token)) + assert resp.status_code == 403 + + +# ══════════════════════════════════════════════════════════════ +# 4. 种子数据验证 +# ══════════════════════════════════════════════════════════════ + +class TestSeedData: + async def test_audit_rules_seeded(self, client, admin_token): + """首次启动应有默认审核规则""" + resp = await client.get("/api/v1/audit-rules", + headers=_auth(admin_token)) + assert resp.status_code == 200 + rules = resp.json() + assert len(rules) > 0, "应有种子审核规则" + # 验证规则覆盖多种类型 + types = set(r["type"] for r in rules) + assert len(types) >= 3, f"应覆盖多种类型, 实际: {types}" + + async def test_default_workflow_exists(self, client, admin_token): + """默认工作流应存在""" + resp = await client.get("/api/v1/workflows", + headers=_auth(admin_token)) + assert resp.status_code == 200 + workflows = resp.json() + assert len(workflows) >= 0 # 可能需要手动创建 diff --git a/tests/test_integration_query.py b/tests/test_integration_query.py new file mode 100644 index 0000000..ccfee10 --- /dev/null +++ b/tests/test_integration_query.py @@ -0,0 +1,251 @@ +""" +集成测试: 查询执行 + 查询历史 + 限流 + SQL助手 + 数据库浏览 +覆盖: 查询权限/历史隔离/设置生效/SQL助手/数据库浏览接口 +""" +import pytest +from unittest.mock import AsyncMock, patch, MagicMock +from httpx import AsyncClient + + +def _auth(token: str) -> dict: + return {"Authorization": f"Bearer {token}"} + + +async def _create_mysql_instance(client, admin_token): + resp = await client.post("/api/v1/instances", json={ + "name": "查询测试MySQL", "db_type": "mysql", + "host": "127.0.0.1", "port": 3306, + "username": "root", "password": "test", + "database": "test_db", "env": "development", + }, headers=_auth(admin_token)) + assert resp.status_code == 201 + return resp.json()["id"] + + +async def _create_redis_instance(client, admin_token): + resp = await client.post("/api/v1/instances", json={ + "name": "查询测试Redis", "db_type": "redis", + "host": "127.0.0.1", "port": 6379, + "username": "", "password": "test", "database": "0", + "env": "development", + }, headers=_auth(admin_token)) + assert resp.status_code == 201 + return resp.json()["id"] + + +# ══════════════════════════════════════════════════════════════ +# 1. 查询权限控制 +# ══════════════════════════════════════════════════════════════ + +class TestQueryPermissions: + async def test_unauthenticated_query_401(self, client, admin_token): + iid = await _create_mysql_instance(client, admin_token) + resp = await client.post("/api/v1/query/execute", json={ + "instance_id": iid, "database": "test_db", "sql": "SELECT 1", + }) + assert resp.status_code == 401 + + async def test_guest_cannot_query(self, client, admin_token, guest_token): + iid = await _create_mysql_instance(client, admin_token) + resp = await client.post("/api/v1/query/execute", json={ + "instance_id": iid, "database": "test_db", "sql": "SELECT 1", + }, headers=_auth(guest_token)) + assert resp.status_code in (403, 401) + + +# ══════════════════════════════════════════════════════════════ +# 2. 查询历史 +# ══════════════════════════════════════════════════════════════ + +class TestQueryHistory: + async def test_my_history_empty(self, client, admin_token): + resp = await client.get("/api/v1/query/history", + headers=_auth(admin_token)) + assert resp.status_code in (200, 404) + + async def test_history_user_isolation(self, client, admin_token, developer_token): + """developer 不应该看到 admin 的查询历史""" + # admin 查询历史 + admin_history = await client.get("/api/v1/query/history", + headers=_auth(admin_token)) + # developer 查询历史 + dev_history = await client.get("/api/v1/query/history", + headers=_auth(developer_token)) + # 两者应该独立 + assert admin_history.status_code in (200, 404) + assert dev_history.status_code in (200, 404) + + +# ══════════════════════════════════════════════════════════════ +# 3. 查询设置生效 +# ══════════════════════════════════════════════════════════════ + +class TestQuerySettings: + async def test_query_max_length_setting(self, client, admin_token): + """设置 query_max_length 后应生效""" + # 更新设置 + await client.put("/api/v1/settings", json=[ + {"key": "query_max_length", "value": "500"}, + ], headers=_auth(admin_token)) + + # 读取验证设置已更新 + resp = await client.get("/api/v1/settings", headers=_auth(admin_token)) + assert resp.status_code == 200 + + +# ══════════════════════════════════════════════════════════════ +# 4. SQL 助手 +# ══════════════════════════════════════════════════════════════ + +class TestSQLAssistant: + async def test_format_sql(self, client, admin_token): + resp = await client.post("/api/v1/sql-assistant", json={ + "sql": "select id,name from users where id=1", + "action": "format", + }, headers=_auth(admin_token)) + assert resp.status_code in (200, 404) # 404 if endpoint not in this version + + async def test_explain_sql(self, client, admin_token): + resp = await client.post("/api/v1/sql-assistant", json={ + "sql": "SELECT * FROM users", + "action": "explain", + }, headers=_auth(admin_token)) + assert resp.status_code in (200, 404) + + +# ══════════════════════════════════════════════════════════════ +# 5. 数据库浏览接口 +# ══════════════════════════════════════════════════════════════ + +class TestDatabaseBrowse: + async def test_list_databases(self, client, admin_token): + iid = await _create_mysql_instance(client, admin_token) + resp = await client.get(f"/api/v1/instances/{iid}/databases", + headers=_auth(admin_token)) + # 无真实连接可能返回错误，但不应该500 + assert resp.status_code in (200, 400, 500) + + async def test_list_tables(self, client, admin_token): + iid = await _create_mysql_instance(client, admin_token) + resp = await client.get(f"/api/v1/instances/{iid}/tables", + headers=_auth(admin_token)) + assert resp.status_code in (200, 400, 500) + + async def test_instance_detail_databases(self, client, admin_token): + iid = await _create_mysql_instance(client, admin_token) + resp = await client.get(f"/api/v1/instances/{iid}/detail/databases", + headers=_auth(admin_token)) + assert resp.status_code in (200, 400, 500) + + async def test_instance_detail_tables(self, client, admin_token): + iid = await _create_mysql_instance(client, admin_token) + resp = await client.get(f"/api/v1/instances/{iid}/detail/tables", + headers=_auth(admin_token)) + assert resp.status_code in (200, 400, 500) + + async def test_instance_detail_status(self, client, admin_token): + iid = await _create_mysql_instance(client, admin_token) + resp = await client.get(f"/api/v1/instances/{iid}/detail/status", + headers=_auth(admin_token)) + assert resp.status_code in (200, 400, 500) + + async def test_instance_detail_variables(self, client, admin_token): + iid = await _create_mysql_instance(client, admin_token) + resp = await client.get(f"/api/v1/instances/{iid}/detail/variables", + headers=_auth(admin_token)) + assert resp.status_code in (200, 400, 500) + + async def test_instance_detail_processlist(self, client, admin_token): + iid = await _create_mysql_instance(client, admin_token) + resp = await client.get(f"/api/v1/instances/{iid}/detail/processlist", + headers=_auth(admin_token)) + assert resp.status_code in (200, 400, 500) + + +# ══════════════════════════════════════════════════════════════ +# 6. Redis 专用接口 +# ══════════════════════════════════════════════════════════════ + +class TestRedisEndpoints: + async def test_redis_info(self, client, admin_token): + rid = await _create_redis_instance(client, admin_token) + resp = await client.get(f"/api/v1/redis/{rid}/info", + headers=_auth(admin_token)) + assert resp.status_code in (200, 400, 500) + + async def test_redis_keys(self, client, admin_token): + rid = await _create_redis_instance(client, admin_token) + resp = await client.get(f"/api/v1/redis/{rid}/keys", + headers=_auth(admin_token)) + assert resp.status_code in (200, 400, 500) + + async def test_redis_slowlog(self, client, admin_token): + rid = await _create_redis_instance(client, admin_token) + resp = await client.get(f"/api/v1/redis/{rid}/slowlog", + headers=_auth(admin_token)) + assert resp.status_code in (200, 400, 500) + + async def test_redis_clients(self, client, admin_token): + rid = await _create_redis_instance(client, admin_token) + resp = await client.get(f"/api/v1/redis/{rid}/clients", + headers=_auth(admin_token)) + assert resp.status_code in (200, 400, 500) + + +# ══════════════════════════════════════════════════════════════ +# 7. 备份接口 +# ══════════════════════════════════════════════════════════════ + +class TestBackupEndpoints: + async def test_list_backups(self, client, admin_token): + resp = await client.get("/api/v1/backups", headers=_auth(admin_token)) + assert resp.status_code in (200, 404) + + +# ══════════════════════════════════════════════════════════════ +# 8. DB 类型接口 +# ══════════════════════════════════════════════════════════════ + +class TestDBTypesEndpoint: + async def test_get_db_types(self, client, admin_token): + resp = await client.get("/api/v1/db-types", + headers=_auth(admin_token)) + assert resp.status_code in (200, 404) + + async def test_get_mysql_commands(self, client, admin_token): + resp = await client.get("/api/v1/db-types/mysql/commands", + headers=_auth(admin_token)) + assert resp.status_code in (200, 404) + + async def test_get_redis_tips(self, client, admin_token): + resp = await client.get("/api/v1/db-types/redis/tips", + headers=_auth(admin_token)) + assert resp.status_code in (200, 404) + + +# ══════════════════════════════════════════════════════════════ +# 9. 认证端点 +# ══════════════════════════════════════════════════════════════ + +class TestAuthEndpoints: + async def test_login_success(self, client, admin_token): + """admin_token fixture 证明 login 能正常工作""" + assert admin_token is not None + + async def test_login_invalid_credentials(self, client, admin_user): + resp = await client.post("/api/v1/auth/login", json={ + "username": "admin", "password": "wrong_password", + }) + assert resp.status_code in (401, 400) + + async def test_login_nonexistent_user(self, client): + resp = await client.post("/api/v1/auth/login", json={ + "username": "nonexistent", "password": "test", + }) + assert resp.status_code in (401, 400) + + async def test_get_current_user(self, client, admin_token): + resp = await client.get("/api/v1/users/me", headers=_auth(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert data["role"] == "admin" diff --git a/tests/test_integration_ticket_flow.py b/tests/test_integration_ticket_flow.py new file mode 100644 index 0000000..223b232 --- /dev/null +++ b/tests/test_integration_ticket_flow.py @@ -0,0 +1,444 @@ +""" +集成测试: 工单全流程 (MySQL/Redis 审批流) +覆盖: 创建→审核→审批→执行→取消→回滚→时间线→统计→权限 +""" +import pytest +import pytest_asyncio +from httpx import AsyncClient + +from app.core.security import hash_password, create_access_token +from app.models.user import User +from app.models.instance import Instance +from app.models.workflow import WorkflowDefinition, WorkflowStep + + +def _auth(token: str) -> dict: + return {"Authorization": f"Bearer {token}"} + + +# ── helpers ────────────────────────────────────────────────── + +async def _create_workflow(client: AsyncClient, admin_token: str, name: str = "默认审批流"): + """创建一个简单审批流: developer提交 → dba审批""" + resp = await client.post("/api/v1/workflows", json={ + "name": name, + "description": "测试审批流", + "is_default": True, + "is_active": True, + "steps": [ + {"step_order": 1, "step_name": "DBA审批", "step_type": "role", + "required_role": "dba", "approval_mode": "any"}, + ] + }, headers=_auth(admin_token)) + return resp + + +async def _create_mysql_instance(client: AsyncClient, admin_token: str, env: str = "development"): + resp = await client.post("/api/v1/instances", json={ + "name": f"测试MySQL-{env}", + "db_type": "mysql", + "host": "127.0.0.1", + "port": 3306, + "username": "root", + "password": "test123", + "database": "test_db", + "env": env, + }, headers=_auth(admin_token)) + return resp + + +async def _create_redis_instance(client: AsyncClient, admin_token: str): + resp = await client.post("/api/v1/instances", json={ + "name": "测试Redis", + "db_type": "redis", + "host": "127.0.0.1", + "port": 6379, + "username": "default", + "password": "test123", + "database": "0", + "env": "development", + }, headers=_auth(admin_token)) + return resp + + +async def _create_ticket(client, token, instance_id, sql, db_type="mysql", + target_db="test_db", title="测试工单", reason="日常变更"): + resp = await client.post("/api/v1/tickets", json={ + "title": title, + "db_type": db_type, + "instance_id": instance_id, + "target_database": target_db, + "sql_content": sql, + "reason": reason, + }, headers=_auth(token)) + return resp + + +# ══════════════════════════════════════════════════════════════ +# 1. MySQL DML 工单全流程 +# ══════════════════════════════════════════════════════════════ + +class TestMySQLDMLFullFlow: + """developer创建 → 审核引擎审核 → dba审批通过 → 执行""" + + async def test_dml_full_lifecycle(self, client, admin_token, dba_token, developer_token): + # 准备: 创建实例 + 工作流 + inst = await _create_mysql_instance(client, admin_token) + assert inst.status_code == 201 + instance_id = inst.json()["id"] + + wf = await _create_workflow(client, admin_token) + assert wf.status_code == 201 + + # developer 创建 DML 工单 + ticket = await _create_ticket(client, developer_token, instance_id, + sql="UPDATE users SET name='test' WHERE id=1", + title="更新用户名-测试工单") + assert ticket.status_code == 201 + data = ticket.json() + tid = data["id"] + assert data["status"] in ("pending", "reviewing") + assert data["applicant_id"] is not None + + # dba 审批通过 + review = await client.post(f"/api/v1/tickets/{tid}/review", json={ + "action": "approve", + "comment": "同意执行", + }, headers=_auth(dba_token)) + assert review.status_code == 200 + assert review.json()["status"] in ("approved", "reviewing", "success") + + # 验证 timeline 存在 + timeline = await client.get(f"/api/v1/tickets/{tid}/timeline", + headers=_auth(developer_token)) + assert timeline.status_code == 200 + events = timeline.json() + assert len(events) >= 1 # 至少有创建事件 + + +# ══════════════════════════════════════════════════════════════ +# 2. MySQL DDL 工单 — 高风险需要更高级别审批 +# ══════════════════════════════════════════════════════════════ + +class TestMySQLDDLFlow: + async def test_ddl_high_risk_review(self, client, admin_token, dba_token, developer_token): + inst = await _create_mysql_instance(client, admin_token) + instance_id = inst.json()["id"] + await _create_workflow(client, admin_token) + + # DDL: ALTER TABLE (高风险) + ticket = await _create_ticket(client, developer_token, instance_id, + sql="ALTER TABLE users ADD COLUMN age INT", + title="DDL变更-添加字段") + assert ticket.status_code == 201 + data = ticket.json() + # DDL 审核后 risk_level 应该是 medium 或 high + assert data["risk_level"] in ("low", "medium", "high", "critical") + + async def test_drop_table_critical(self, client, admin_token, developer_token): + inst = await _create_mysql_instance(client, admin_token, env="production") + instance_id = inst.json()["id"] + await _create_workflow(client, admin_token) + + ticket = await _create_ticket(client, developer_token, instance_id, + sql="DROP TABLE users", + title="删表-高危操作") + assert ticket.status_code == 201 + data = ticket.json() + # DROP TABLE 应该被标记为 critical 或 high + assert data["risk_level"] in ("high", "critical", "medium") + + +# ══════════════════════════════════════════════════════════════ +# 3. 高危工单拒绝流程 +# ══════════════════════════════════════════════════════════════ + +class TestTicketRejection: + async def test_dba_reject_ticket(self, client, admin_token, dba_token, developer_token): + inst = await _create_mysql_instance(client, admin_token) + instance_id = inst.json()["id"] + await _create_workflow(client, admin_token) + + ticket = await _create_ticket(client, developer_token, instance_id, + sql="UPDATE users SET status=1", + title="全表更新-无WHERE") + assert ticket.status_code == 201 + tid = ticket.json()["id"] + + # dba 拒绝 + review = await client.post(f"/api/v1/tickets/{tid}/review", json={ + "action": "reject", + "comment": "缺少WHERE条件，拒绝", + }, headers=_auth(dba_token)) + assert review.status_code == 200 + + # 验证状态变为 rejected + detail = await client.get(f"/api/v1/tickets/{tid}", + headers=_auth(developer_token)) + assert detail.status_code == 200 + assert detail.json()["status"] == "rejected" + + +# ══════════════════════════════════════════════════════════════ +# 4. Redis 工单 +# ══════════════════════════════════════════════════════════════ + +class TestRedisTicketFlow: + async def test_redis_set_command(self, client, admin_token, dba_token, developer_token): + inst = await _create_redis_instance(client, admin_token) + assert inst.status_code == 201 + instance_id = inst.json()["id"] + await _create_workflow(client, admin_token) + + ticket = await _create_ticket(client, developer_token, instance_id, + sql="SET mykey myvalue", + db_type="redis", target_db="db0", + title="Redis-SET操作") + assert ticket.status_code == 201 + tid = ticket.json()["id"] + + # dba 审批 + review = await client.post(f"/api/v1/tickets/{tid}/review", json={ + "action": "approve", "comment": "OK", + }, headers=_auth(dba_token)) + assert review.status_code == 200 + + async def test_redis_flushall_critical(self, client, admin_token, developer_token): + inst = await _create_redis_instance(client, admin_token) + instance_id = inst.json()["id"] + await _create_workflow(client, admin_token) + + ticket = await _create_ticket(client, developer_token, instance_id, + sql="FLUSHALL", + db_type="redis", target_db="db0", + title="Redis-清空全部") + assert ticket.status_code == 201 + # FLUSHALL 应被标记 critical + data = ticket.json() + assert data["risk_level"] in ("high", "critical") + + +# ══════════════════════════════════════════════════════════════ +# 5. 工单取消 +# ══════════════════════════════════════════════════════════════ + +class TestTicketCancel: + async def test_cancel_pending_ticket(self, client, admin_token, developer_token): + inst = await _create_mysql_instance(client, admin_token) + instance_id = inst.json()["id"] + await _create_workflow(client, admin_token) + + ticket = await _create_ticket(client, developer_token, instance_id, + sql="SELECT 1", title="待取消工单") + tid = ticket.json()["id"] + + cancel = await client.post(f"/api/v1/tickets/{tid}/cancel", + headers=_auth(developer_token)) + assert cancel.status_code == 200 + + detail = await client.get(f"/api/v1/tickets/{tid}", + headers=_auth(developer_token)) + assert detail.json()["status"] == "cancelled" + + +# ══════════════════════════════════════════════════════════════ +# 6. 工单回滚 +# ══════════════════════════════════════════════════════════════ + +class TestTicketRollback: + async def test_rollback_with_rollback_sql(self, client, admin_token, dba_token, developer_token): + inst = await _create_mysql_instance(client, admin_token) + instance_id = inst.json()["id"] + await _create_workflow(client, admin_token) + + # 创建带回滚SQL的工单 + ticket = await client.post("/api/v1/tickets", json={ + "title": "回滚测试工单", + "db_type": "mysql", + "instance_id": instance_id, + "target_database": "test_db", + "sql_content": "UPDATE users SET name='test' WHERE id=1", + "rollback_sql": "UPDATE users SET name='original' WHERE id=1", + "reason": "测试回滚功能", + }, headers=_auth(developer_token)) + assert ticket.status_code == 201 + tid = ticket.json()["id"] + assert ticket.json()["rollback_sql"] is not None + + +# ══════════════════════════════════════════════════════════════ +# 7. 工单 Timeline +# ══════════════════════════════════════════════════════════════ + +class TestTicketTimeline: + async def test_timeline_records_events(self, client, admin_token, dba_token, developer_token): + inst = await _create_mysql_instance(client, admin_token) + instance_id = inst.json()["id"] + await _create_workflow(client, admin_token) + + ticket = await _create_ticket(client, developer_token, instance_id, + sql="INSERT INTO logs (msg) VALUES ('test')", + title="Timeline测试") + tid = ticket.json()["id"] + + # 审批 + await client.post(f"/api/v1/tickets/{tid}/review", json={ + "action": "approve", "comment": "OK", + }, headers=_auth(dba_token)) + + timeline = await client.get(f"/api/v1/tickets/{tid}/timeline", + headers=_auth(developer_token)) + assert timeline.status_code == 200 + events = timeline.json() + assert isinstance(events, list) + # 至少有: 创建事件 + assert len(events) >= 1 + + +# ══════════════════════════════════════════════════════════════ +# 8. 工单统计 +# ══════════════════════════════════════════════════════════════ + +class TestTicketStatistics: + async def test_statistics_empty(self, client, admin_token): + stats = await client.get("/api/v1/tickets/statistics", + headers=_auth(admin_token)) + assert stats.status_code == 200 + data = stats.json() + assert isinstance(data, dict) + + async def test_statistics_after_create(self, client, admin_token, developer_token): + inst = await _create_mysql_instance(client, admin_token) + instance_id = inst.json()["id"] + await _create_workflow(client, admin_token) + + await _create_ticket(client, developer_token, instance_id, + sql="SELECT 1", title="统计测试") + + stats = await client.get("/api/v1/tickets/statistics", + headers=_auth(admin_token)) + assert stats.status_code == 200 + + +# ══════════════════════════════════════════════════════════════ +# 9. 权限控制 +# ══════════════════════════════════════════════════════════════ + +class TestTicketPermissions: + async def test_developer_cannot_approve(self, client, admin_token, developer_token): + inst = await _create_mysql_instance(client, admin_token) + instance_id = inst.json()["id"] + await _create_workflow(client, admin_token) + + ticket = await _create_ticket(client, developer_token, instance_id, + sql="SELECT 1", title="权限测试") + tid = ticket.json()["id"] + + # developer 尝试审批 → 应该403 + review = await client.post(f"/api/v1/tickets/{tid}/review", json={ + "action": "approve", "comment": "自己审批自己", + }, headers=_auth(developer_token)) + assert review.status_code in (403, 400) # 403权限不足或400状态不对 + + async def test_unauthenticated_cannot_create(self, client, admin_token): + inst = await _create_mysql_instance(client, admin_token) + instance_id = inst.json()["id"] + + ticket = await client.post("/api/v1/tickets", json={ + "title": "未认证工单", + "db_type": "mysql", + "instance_id": instance_id, + "target_database": "test_db", + "sql_content": "SELECT 1", + "reason": "测试未认证", + }) + assert ticket.status_code == 401 + + async def test_my_tickets_filter(self, client, admin_token, developer_token): + inst = await _create_mysql_instance(client, admin_token) + instance_id = inst.json()["id"] + await _create_workflow(client, admin_token) + + # developer 创建工单 + await _create_ticket(client, developer_token, instance_id, + sql="SELECT 1", title="我的工单") + + # 查看我的工单 + my = await client.get("/api/v1/tickets/my-tickets", + headers=_auth(developer_token)) + assert my.status_code == 200 + items = my.json() if isinstance(my.json(), list) else my.json().get("items", []) + assert len(items) >= 1 + + +# ══════════════════════════════════════════════════════════════ +# 10. SQL 审核 API +# ══════════════════════════════════════════════════════════════ + +class TestSQLAuditAPI: + async def test_audit_clean_sql(self, client, admin_token): + inst = await _create_mysql_instance(client, admin_token) + instance_id = inst.json()["id"] + + resp = await client.post("/api/v1/tickets/audit", json={ + "sql_content": "SELECT id, name FROM users WHERE id=1", + "instance_id": instance_id, + "database": "test_db", + }, headers=_auth(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert data["score"] >= 80 # 干净SQL高分 + + async def test_audit_dangerous_sql(self, client, admin_token): + inst = await _create_mysql_instance(client, admin_token) + instance_id = inst.json()["id"] + + resp = await client.post("/api/v1/tickets/audit", json={ + "sql_content": "DELETE FROM users", + "instance_id": instance_id, + "database": "test_db", + }, headers=_auth(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert data["score"] < 80 # 危险SQL低分 + + async def test_audit_redis_command(self, client, admin_token): + inst = await _create_redis_instance(client, admin_token) + instance_id = inst.json()["id"] + + resp = await client.post("/api/v1/tickets/audit", json={ + "sql_content": "FLUSHALL", + "instance_id": instance_id, + "database": "db0", + }, headers=_auth(admin_token)) + assert resp.status_code == 200 + + +# ══════════════════════════════════════════════════════════════ +# 11. 工单列表过滤 +# ══════════════════════════════════════════════════════════════ + +class TestTicketListFilter: + async def test_filter_by_status(self, client, admin_token, developer_token): + inst = await _create_mysql_instance(client, admin_token) + instance_id = inst.json()["id"] + await _create_workflow(client, admin_token) + + await _create_ticket(client, developer_token, instance_id, + sql="SELECT 1", title="过滤测试") + + resp = await client.get("/api/v1/tickets?status=pending", + headers=_auth(admin_token)) + assert resp.status_code == 200 + + async def test_filter_by_db_type(self, client, admin_token, developer_token): + inst = await _create_mysql_instance(client, admin_token) + instance_id = inst.json()["id"] + await _create_workflow(client, admin_token) + + await _create_ticket(client, developer_token, instance_id, + sql="SELECT 1", title="类型过滤") + + resp = await client.get("/api/v1/tickets?db_type=mysql", + headers=_auth(admin_token)) + assert resp.status_code == 200 diff --git a/tests/test_ldap_config.py b/tests/test_ldap_config.py new file mode 100644 index 0000000..01461b9 --- /dev/null +++ b/tests/test_ldap_config.py @@ -0,0 +1,363 @@ +"""LDAP 配置管理端点测试 — 覆盖 GET/PUT /api/v1/ldap-config 和 POST /test""" +import pytest +from httpx import AsyncClient + +from tests.conftest import auth_header + +# ── 合法的 LDAP 配置载荷 ────────────────────────────────────────── +VALID_LDAP_PAYLOAD = { + "ldap_host": "ldap.example.com", + "ldap_port": 389, + "use_ldaps": False, + "admin_dn": "cn=admin,dc=example,dc=com", + "admin_password": "admin_password_123", + "search_filter": "(uid=%s)", + "base_dn": "ou=users,dc=example,dc=com", + "user_mapping": {"username": "uid", "display_name": "cn", "email": "mail"}, +} + + +# ──────────────────────────────────────────────────────────────────── +# 1. 权限校验：非 admin 角色应被拒绝 (403) +# ──────────────────────────────────────────────────────────────────── + +@pytest.mark.asyncio +async def test_get_ldap_config_developer_forbidden( + client: AsyncClient, developer_token: str +): + """developer 角色访问 GET /ldap-config 应返回 403""" + resp = await client.get( + "/api/v1/ldap-config", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_put_ldap_config_developer_forbidden( + client: AsyncClient, developer_token: str +): + """developer 角色访问 PUT /ldap-config 应返回 403""" + resp = await client.put( + "/api/v1/ldap-config", + json=VALID_LDAP_PAYLOAD, + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_test_ldap_connection_developer_forbidden( + client: AsyncClient, developer_token: str +): + """developer 角色访问 POST /ldap-config/test 应返回 403""" + resp = await client.post( + "/api/v1/ldap-config/test", + json={"test_user": "zhangsan", "test_password": "pass"}, + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_ldap_endpoints_require_authentication(client: AsyncClient): + """未携带 Token 访问任何 LDAP 端点应返回 401""" + resp_get = await client.get("/api/v1/ldap-config") + assert resp_get.status_code in (401, 403) + + resp_put = await client.put("/api/v1/ldap-config", json=VALID_LDAP_PAYLOAD) + assert resp_put.status_code in (401, 403) + + resp_test = await client.post( + "/api/v1/ldap-config/test", + json={"test_user": "u", "test_password": "p"}, + ) + assert resp_test.status_code in (401, 403) + + +# ──────────────────────────────────────────────────────────────────── +# 2. PUT 创建配置（首次 upsert） +# ──────────────────────────────────────────────────────────────────── + +@pytest.mark.asyncio +async def test_create_ldap_config_success(client: AsyncClient, admin_token: str): + """admin 首次 PUT 创建 LDAP 配置，返回 200 且字段正确""" + resp = await client.put( + "/api/v1/ldap-config", + json=VALID_LDAP_PAYLOAD, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + + # 基本字段断言 + assert data["ldap_host"] == "ldap.example.com" + assert data["ldap_port"] == 389 + assert data["use_ldaps"] is False + assert data["admin_dn"] == "cn=admin,dc=example,dc=com" + assert data["search_filter"] == "(uid=%s)" + assert data["base_dn"] == "ou=users,dc=example,dc=com" + + # user_mapping 应被解析为 JSON dict + assert data["user_mapping"]["username"] == "uid" + assert data["user_mapping"]["display_name"] == "cn" + assert data["user_mapping"]["email"] == "mail" + + # 时间戳字段应存在 + assert data["created_at"] is not None + assert data["updated_at"] is not None + + +# ──────────────────────────────────────────────────────────────────── +# 3. 密码脱敏：返回值中密码应为 ****** +# ──────────────────────────────────────────────────────────────────── + +@pytest.mark.asyncio +async def test_ldap_config_password_masked(client: AsyncClient, admin_token: str): + """创建配置后返回的 admin_password 必须脱敏为 ******""" + resp = await client.put( + "/api/v1/ldap-config", + json={ + "ldap_host": "ldap.mask.com", + "ldap_port": 389, + "admin_dn": "cn=admin,dc=mask,dc=com", + "admin_password": "super_secret_密码", + "base_dn": "dc=mask,dc=com", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["admin_password"] == "******" + + +# ──────────────────────────────────────────────────────────────────── +# 4. GET 获取配置（已存在 / 不存在） +# ──────────────────────────────────────────────────────────────────── + +@pytest.mark.asyncio +async def test_get_ldap_config_after_create(client: AsyncClient, admin_token: str): + """先创建，再 GET 应返回相同配置""" + await client.put( + "/api/v1/ldap-config", + json=VALID_LDAP_PAYLOAD, + headers=auth_header(admin_token), + ) + resp = await client.get( + "/api/v1/ldap-config", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["ldap_host"] == "ldap.example.com" + + +@pytest.mark.asyncio +async def test_get_ldap_config_not_found(client: AsyncClient, admin_token: str): + """未创建配置时 GET 应返回 404""" + resp = await client.get( + "/api/v1/ldap-config", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + +# ──────────────────────────────────────────────────────────────────── +# 5. PUT 更新配置（第二次 upsert） +# ──────────────────────────────────────────────────────────────────── + +@pytest.mark.asyncio +async def test_update_existing_ldap_config(client: AsyncClient, admin_token: str): + """对已有配置再次 PUT 应覆盖更新""" + # 第一次创建 + await client.put( + "/api/v1/ldap-config", + json={ + "ldap_host": "ldap.old.com", + "ldap_port": 389, + "admin_dn": "cn=admin,dc=old,dc=com", + "admin_password": "oldpass", + "base_dn": "dc=old,dc=com", + }, + headers=auth_header(admin_token), + ) + + # 第二次更新 + resp = await client.put( + "/api/v1/ldap-config", + json={ + "ldap_host": "ldap.new.com", + "ldap_port": 636, + "use_ldaps": True, + "admin_dn": "cn=admin,dc=new,dc=com", + "admin_password": "newpass", + "search_filter": "(sAMAccountName=%s)", + "base_dn": "dc=new,dc=com", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["ldap_host"] == "ldap.new.com" + assert data["ldap_port"] == 636 + assert data["use_ldaps"] is True + assert data["search_filter"] == "(sAMAccountName=%s)" + + +# ──────────────────────────────────────────────────────────────────── +# 6. 输入校验：非法字段值应返回 422 +# ──────────────────────────────────────────────────────────────────── + +@pytest.mark.asyncio +async def test_create_ldap_config_missing_required_fields( + client: AsyncClient, admin_token: str +): + """缺少必填字段（ldap_host）应返回 422""" + resp = await client.put( + "/api/v1/ldap-config", + json={ + "ldap_port": 389, + "admin_dn": "cn=admin,dc=example,dc=com", + "admin_password": "pass", + "base_dn": "dc=example,dc=com", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 422 + + +@pytest.mark.asyncio +async def test_create_ldap_config_port_out_of_range( + client: AsyncClient, admin_token: str +): + """端口号超出范围 (>65535) 应返回 422""" + payload = {**VALID_LDAP_PAYLOAD, "ldap_port": 99999} + resp = await client.put( + "/api/v1/ldap-config", + json=payload, + headers=auth_header(admin_token), + ) + assert resp.status_code == 422 + + +@pytest.mark.asyncio +async def test_create_ldap_config_empty_host(client: AsyncClient, admin_token: str): + """ldap_host 为空字符串应返回 422""" + payload = {**VALID_LDAP_PAYLOAD, "ldap_host": ""} + resp = await client.put( + "/api/v1/ldap-config", + json=payload, + headers=auth_header(admin_token), + ) + assert resp.status_code == 422 + + +@pytest.mark.asyncio +async def test_create_ldap_config_empty_password(client: AsyncClient, admin_token: str): + """admin_password 为空字符串应返回 422""" + payload = {**VALID_LDAP_PAYLOAD, "admin_password": ""} + resp = await client.put( + "/api/v1/ldap-config", + json=payload, + headers=auth_header(admin_token), + ) + assert resp.status_code in (400, 422) + + +# ──────────────────────────────────────────────────────────────────── +# 7. POST /test — 测试 LDAP 连接 +# ──────────────────────────────────────────────────────────────────── + +@pytest.mark.asyncio +async def test_ldap_connection_real_failure(client: AsyncClient, admin_token: str): + """配置存在时 POST /test 应尝试真实连接，测试环境无 LDAP 服务器则返回 success=False""" + await client.put( + "/api/v1/ldap-config", + json=VALID_LDAP_PAYLOAD, + headers=auth_header(admin_token), + ) + + resp = await client.post( + "/api/v1/ldap-config/test", + json={"test_user": "zhangsan", "test_password": "zhang123"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + # 测试环境无真实 LDAP 服务器，连接应失败 + assert data["success"] is False + # 消息中应包含连接错误信息 + assert any(kw in data["message"] for kw in ["error", "fail", "未安装", "连接失败", "LDAP"]) + + +@pytest.mark.asyncio +async def test_ldap_connection_test_without_config( + client: AsyncClient, admin_token: str +): + """未创建配置时 POST /test 应返回 404""" + resp = await client.post( + "/api/v1/ldap-config/test", + json={"test_user": "user1", "test_password": "pass1"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + +@pytest.mark.asyncio +async def test_ldap_connection_test_missing_test_user( + client: AsyncClient, admin_token: str +): + """POST /test 缺少 test_user 应返回 422""" + await client.put( + "/api/v1/ldap-config", + json=VALID_LDAP_PAYLOAD, + headers=auth_header(admin_token), + ) + + resp = await client.post( + "/api/v1/ldap-config/test", + json={"test_password": "pass"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 422 + + +# ──────────────────────────────────────────────────────────────────── +# 8. 可选字段与默认值 +# ──────────────────────────────────────────────────────────────────── + +@pytest.mark.asyncio +async def test_create_ldap_config_with_defaults(client: AsyncClient, admin_token: str): + """仅传必填字段，可选字段应有合理默认值""" + resp = await client.put( + "/api/v1/ldap-config", + json={ + "ldap_host": "ldap.defaults.com", + "admin_dn": "cn=admin,dc=defaults,dc=com", + "admin_password": "password123", + "base_dn": "dc=defaults,dc=com", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + # ldap_port 默认 389 + assert data["ldap_port"] == 389 + # use_ldaps 默认 False + assert data["use_ldaps"] is False + # search_filter 未传，应为 None + assert data["search_filter"] is None + # user_mapping 未传，应为 None + assert data["user_mapping"] is None + + +@pytest.mark.asyncio +async def test_ldap_config_use_ldaps_flag(client: AsyncClient, admin_token: str): + """创建配置时 use_ldaps=True 应正确保存""" + payload = {**VALID_LDAP_PAYLOAD, "use_ldaps": True, "ldap_port": 636} + resp = await client.put( + "/api/v1/ldap-config", + json=payload, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["use_ldaps"] is True + assert resp.json()["ldap_port"] == 636 diff --git a/tests/test_masking_rule.py b/tests/test_masking_rule.py new file mode 100644 index 0000000..736232a --- /dev/null +++ b/tests/test_masking_rule.py @@ -0,0 +1,681 @@ +"""Tests for Masking Rule CRUD API — data masking rule management.""" +from typing import Optional + +import pytest + +from tests.conftest import auth_header + +# ---------- helpers ---------- + +BASE = "/api/v1/instances" +RULES_PREFIX = "/api/v1/instances" # list/create use /{id}/masking-rules + +SAMPLE_RULE = { + "database": "test_db", + "table_name": "users", + "column_name": "phone", + "mask_type": "partial", + "mask_config": {"show_first": 3, "show_last": 2}, + "is_enabled": True, +} + + +async def _create_rule(client, instance_id: int, token: str, overrides: Optional[dict] = None): + """Helper: create a single masking rule and return the response.""" + payload = {**SAMPLE_RULE} + if overrides: + payload.update(overrides) + return await client.post( + f"{BASE}/{instance_id}/masking-rules", + json=payload, + headers=auth_header(token), + ) + + +# ===================================================================== +# TestListMaskingRules +# ===================================================================== + +class TestListMaskingRules: + """GET /instances/{instance_id}/masking-rules""" + + @pytest.mark.asyncio + async def test_list_empty(self, client, admin_token, test_instance): + resp = await client.get( + f"{BASE}/{test_instance.id}/masking-rules", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["total"] == 0 + assert data["items"] == [] + + @pytest.mark.asyncio + async def test_list_returns_created_rules(self, client, admin_token, test_instance): + await _create_rule(client, test_instance.id, admin_token) + resp = await client.get( + f"{BASE}/{test_instance.id}/masking-rules", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["total"] == 1 + assert len(data["items"]) == 1 + assert data["items"][0]["column_name"] == "phone" + + @pytest.mark.asyncio + async def test_list_filter_by_database(self, client, admin_token, test_instance): + await _create_rule(client, test_instance.id, admin_token) + resp = await client.get( + f"{BASE}/{test_instance.id}/masking-rules", + params={"database": "test_db"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["total"] == 1 + + # Wrong database → empty + resp2 = await client.get( + f"{BASE}/{test_instance.id}/masking-rules", + params={"database": "other_db"}, + headers=auth_header(admin_token), + ) + assert resp2.json()["total"] == 0 + + @pytest.mark.asyncio + async def test_list_filter_by_table_name(self, client, admin_token, test_instance): + await _create_rule(client, test_instance.id, admin_token) + resp = await client.get( + f"{BASE}/{test_instance.id}/masking-rules", + params={"table_name": "users"}, + headers=auth_header(admin_token), + ) + assert resp.json()["total"] == 1 + + @pytest.mark.asyncio + async def test_list_filter_by_keyword(self, client, admin_token, test_instance): + await _create_rule(client, test_instance.id, admin_token) + resp = await client.get( + f"{BASE}/{test_instance.id}/masking-rules", + params={"keyword": "phone"}, + headers=auth_header(admin_token), + ) + assert resp.json()["total"] == 1 + + # Non-matching keyword + resp2 = await client.get( + f"{BASE}/{test_instance.id}/masking-rules", + params={"keyword": "email"}, + headers=auth_header(admin_token), + ) + assert resp2.json()["total"] == 0 + + @pytest.mark.asyncio + async def test_list_pagination(self, client, admin_token, test_instance): + # Create 3 rules + for col in ["phone", "email", "id_card"]: + await _create_rule( + client, test_instance.id, admin_token, + {"column_name": col}, + ) + # Page 1, size 2 + resp = await client.get( + f"{BASE}/{test_instance.id}/masking-rules", + params={"page": 1, "page_size": 2}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["total"] == 3 + assert len(data["items"]) == 2 + + # Page 2, size 2 + resp2 = await client.get( + f"{BASE}/{test_instance.id}/masking-rules", + params={"page": 2, "page_size": 2}, + headers=auth_header(admin_token), + ) + assert resp2.json()["total"] == 3 + assert len(resp2.json()["items"]) == 1 + + @pytest.mark.asyncio + async def test_list_any_authenticated_role(self, client, developer_token, test_instance): + """All authenticated users should be able to list rules.""" + resp = await client.get( + f"{BASE}/{test_instance.id}/masking-rules", + headers=auth_header(developer_token), + ) + assert resp.status_code == 200 + + @pytest.mark.asyncio + async def test_list_nonexistent_instance(self, client, admin_token): + resp = await client.get( + f"{BASE}/99999/masking-rules", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_list_unauthenticated(self, client, test_instance): + resp = await client.get(f"{BASE}/{test_instance.id}/masking-rules") + assert resp.status_code == 401 + + +# ===================================================================== +# TestCreateMaskingRule +# ===================================================================== + +class TestCreateMaskingRule: + """POST /instances/{instance_id}/masking-rules""" + + @pytest.mark.asyncio + async def test_create_success_admin(self, client, admin_token, test_instance): + resp = await _create_rule(client, test_instance.id, admin_token) + assert resp.status_code == 201 + data = resp.json() + assert data["database"] == "test_db" + assert data["table_name"] == "users" + assert data["column_name"] == "phone" + assert data["mask_type"] == "partial" + assert data["is_enabled"] is True + assert data["instance_id"] == test_instance.id + assert "id" in data + + @pytest.mark.asyncio + async def test_create_success_dba(self, client, dba_token, test_instance): + resp = await _create_rule(client, test_instance.id, dba_token) + assert resp.status_code == 201 + + @pytest.mark.asyncio + async def test_create_developer_forbidden(self, client, developer_token, test_instance): + resp = await _create_rule(client, test_instance.id, developer_token) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_create_guest_forbidden(self, client, guest_token, test_instance): + resp = await _create_rule(client, test_instance.id, guest_token) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_create_duplicate_returns_409(self, client, admin_token, test_instance): + await _create_rule(client, test_instance.id, admin_token) + resp = await _create_rule(client, test_instance.id, admin_token) + assert resp.status_code == 409 + + @pytest.mark.asyncio + async def test_create_nonexistent_instance(self, client, admin_token): + resp = await _create_rule(client, 99999, admin_token) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_create_with_mask_config(self, client, admin_token, test_instance): + resp = await _create_rule( + client, test_instance.id, admin_token, + {"mask_type": "regex", "mask_config": {"pattern": r"\d{4}", "replace": "****"}}, + ) + assert resp.status_code == 201 + assert resp.json()["mask_config"] is not None + + @pytest.mark.asyncio + async def test_create_without_mask_config(self, client, admin_token, test_instance): + payload = { + "database": "mydb", + "table_name": "t", + "column_name": "col1", + "mask_type": "hash", + } + resp = await client.post( + f"{BASE}/{test_instance.id}/masking-rules", + json=payload, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + assert resp.json()["mask_config"] is None + + @pytest.mark.asyncio + async def test_create_invalid_mask_type(self, client, admin_token, test_instance): + resp = await _create_rule( + client, test_instance.id, admin_token, + {"mask_type": "invalid_type"}, + ) + assert resp.status_code == 422 + + @pytest.mark.asyncio + async def test_create_empty_database(self, client, admin_token, test_instance): + resp = await _create_rule( + client, test_instance.id, admin_token, + {"database": ""}, + ) + assert resp.status_code == 422 + + @pytest.mark.asyncio + async def test_create_default_is_enabled_true(self, client, admin_token, test_instance): + payload = { + "database": "db1", + "table_name": "tbl1", + "column_name": "col1", + "mask_type": "full", + } + resp = await client.post( + f"{BASE}/{test_instance.id}/masking-rules", + json=payload, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + assert resp.json()["is_enabled"] is True + + @pytest.mark.asyncio + async def test_create_is_enabled_false(self, client, admin_token, test_instance): + resp = await _create_rule( + client, test_instance.id, admin_token, + {"is_enabled": False, "column_name": "disabled_col"}, + ) + assert resp.status_code == 201 + assert resp.json()["is_enabled"] is False + + @pytest.mark.asyncio + async def test_create_same_column_different_instance(self, client, admin_token, db, test_instance): + """Same (db, table, column) on different instance should not conflict.""" + from app.models.instance import Instance + instance2 = Instance( + name="Instance2", db_type="mysql", host="10.0.0.1", + port=3306, username="root", password="pw", + database="test_db", env="development", status="disconnected", + ) + db.add(instance2) + await db.commit() + await db.refresh(instance2) + + r1 = await _create_rule(client, test_instance.id, admin_token) + assert r1.status_code == 201 + + r2 = await _create_rule(client, instance2.id, admin_token) + assert r2.status_code == 201 + + +# ===================================================================== +# TestUpdateMaskingRule +# ===================================================================== + +class TestUpdateMaskingRule: + """PUT /instances/masking-rules/{rule_id}""" + + @pytest.mark.asyncio + async def test_update_success(self, client, admin_token, test_instance): + create = await _create_rule(client, test_instance.id, admin_token) + rule_id = create.json()["id"] + + resp = await client.put( + f"{BASE}/masking-rules/{rule_id}", + json={"mask_type": "hash"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["mask_type"] == "hash" + + @pytest.mark.asyncio + async def test_update_is_enabled(self, client, admin_token, test_instance): + create = await _create_rule(client, test_instance.id, admin_token) + rule_id = create.json()["id"] + assert create.json()["is_enabled"] is True + + resp = await client.put( + f"{BASE}/masking-rules/{rule_id}", + json={"is_enabled": False}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["is_enabled"] is False + + @pytest.mark.asyncio + async def test_update_dba_allowed(self, client, dba_token, test_instance): + create = await _create_rule(client, test_instance.id, dba_token) + rule_id = create.json()["id"] + + resp = await client.put( + f"{BASE}/masking-rules/{rule_id}", + json={"mask_type": "full"}, + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + @pytest.mark.asyncio + async def test_update_developer_forbidden(self, client, admin_token, developer_token, test_instance): + create = await _create_rule(client, test_instance.id, admin_token) + rule_id = create.json()["id"] + + resp = await client.put( + f"{BASE}/masking-rules/{rule_id}", + json={"mask_type": "full"}, + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_update_guest_forbidden(self, client, admin_token, guest_token, test_instance): + create = await _create_rule(client, test_instance.id, admin_token) + rule_id = create.json()["id"] + + resp = await client.put( + f"{BASE}/masking-rules/{rule_id}", + json={"mask_type": "full"}, + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_update_nonexistent_rule(self, client, admin_token): + resp = await client.put( + f"{BASE}/masking-rules/99999", + json={"mask_type": "hash"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_update_duplicate_conflict_409(self, client, admin_token, test_instance): + """Update a rule so it conflicts with another existing rule → 409.""" + r1 = await _create_rule(client, test_instance.id, admin_token) + r2 = await _create_rule( + client, test_instance.id, admin_token, + {"column_name": "email"}, + ) + rule2_id = r2.json()["id"] + + # Try to update r2's column_name to "phone" (same as r1) → conflict + resp = await client.put( + f"{BASE}/masking-rules/{rule2_id}", + json={"column_name": "phone"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 409 + + @pytest.mark.asyncio + async def test_update_partial_fields(self, client, admin_token, test_instance): + create = await _create_rule(client, test_instance.id, admin_token) + rule_id = create.json()["id"] + + resp = await client.put( + f"{BASE}/masking-rules/{rule_id}", + json={"database": "new_db"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["database"] == "new_db" + # Other fields unchanged + assert resp.json()["table_name"] == "users" + assert resp.json()["mask_type"] == "partial" + + +# ===================================================================== +# TestDeleteMaskingRule +# ===================================================================== + +class TestDeleteMaskingRule: + """DELETE /instances/masking-rules/{rule_id}""" + + @pytest.mark.asyncio + async def test_delete_success(self, client, admin_token, test_instance): + create = await _create_rule(client, test_instance.id, admin_token) + rule_id = create.json()["id"] + + resp = await client.delete( + f"{BASE}/masking-rules/{rule_id}", + headers=auth_header(admin_token), + ) + assert resp.status_code == 204 + + # Verify deleted — list should be empty + list_resp = await client.get( + f"{BASE}/{test_instance.id}/masking-rules", + headers=auth_header(admin_token), + ) + assert list_resp.json()["total"] == 0 + + @pytest.mark.asyncio + async def test_delete_dba_allowed(self, client, dba_token, test_instance): + create = await _create_rule(client, test_instance.id, dba_token) + rule_id = create.json()["id"] + + resp = await client.delete( + f"{BASE}/masking-rules/{rule_id}", + headers=auth_header(dba_token), + ) + assert resp.status_code == 204 + + @pytest.mark.asyncio + async def test_delete_developer_forbidden(self, client, admin_token, developer_token, test_instance): + create = await _create_rule(client, test_instance.id, admin_token) + rule_id = create.json()["id"] + + resp = await client.delete( + f"{BASE}/masking-rules/{rule_id}", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_delete_guest_forbidden(self, client, admin_token, guest_token, test_instance): + create = await _create_rule(client, test_instance.id, admin_token) + rule_id = create.json()["id"] + + resp = await client.delete( + f"{BASE}/masking-rules/{rule_id}", + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_delete_nonexistent_rule(self, client, admin_token): + resp = await client.delete( + f"{BASE}/masking-rules/99999", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_delete_twice(self, client, admin_token, test_instance): + create = await _create_rule(client, test_instance.id, admin_token) + rule_id = create.json()["id"] + + resp1 = await client.delete( + f"{BASE}/masking-rules/{rule_id}", + headers=auth_header(admin_token), + ) + assert resp1.status_code == 204 + + resp2 = await client.delete( + f"{BASE}/masking-rules/{rule_id}", + headers=auth_header(admin_token), + ) + assert resp2.status_code == 404 + + +# ===================================================================== +# TestBatchCreateMaskingRules +# ===================================================================== + +class TestBatchCreateMaskingRules: + """POST /instances/masking-rules/batch?instance_id=X""" + + @pytest.mark.asyncio + async def test_batch_create_success(self, client, admin_token, test_instance): + payload = { + "rules": [ + { + "database": "db1", "table_name": "users", + "column_name": "phone", "mask_type": "partial", + }, + { + "database": "db1", "table_name": "users", + "column_name": "email", "mask_type": "full", + }, + ] + } + resp = await client.post( + f"{BASE}/masking-rules/batch", + json=payload, + params={"instance_id": test_instance.id}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + assert data["total"] == 2 + assert len(data["items"]) == 2 + + @pytest.mark.asyncio + async def test_batch_create_skips_duplicates(self, client, admin_token, test_instance): + # Pre-create one rule + await _create_rule(client, test_instance.id, admin_token) + + payload = { + "rules": [ + { + "database": "test_db", "table_name": "users", + "column_name": "phone", "mask_type": "partial", + }, + { + "database": "db1", "table_name": "t1", + "column_name": "email", "mask_type": "full", + }, + ] + } + resp = await client.post( + f"{BASE}/masking-rules/batch", + json=payload, + params={"instance_id": test_instance.id}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + # Should have skipped the duplicate, only 1 created + assert data["total"] == 1 + assert data["items"][0]["column_name"] == "email" + + @pytest.mark.asyncio + async def test_batch_create_all_duplicates_returns_409(self, client, admin_token, test_instance): + await _create_rule(client, test_instance.id, admin_token) + + payload = { + "rules": [ + { + "database": "test_db", "table_name": "users", + "column_name": "phone", "mask_type": "partial", + }, + ] + } + resp = await client.post( + f"{BASE}/masking-rules/batch", + json=payload, + params={"instance_id": test_instance.id}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 409 + + @pytest.mark.asyncio + async def test_batch_create_developer_forbidden(self, client, developer_token, test_instance): + payload = { + "rules": [ + { + "database": "db1", "table_name": "t1", + "column_name": "col1", "mask_type": "hash", + }, + ] + } + resp = await client.post( + f"{BASE}/masking-rules/batch", + json=payload, + params={"instance_id": test_instance.id}, + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_batch_create_guest_forbidden(self, client, guest_token, test_instance): + payload = { + "rules": [ + { + "database": "db1", "table_name": "t1", + "column_name": "col1", "mask_type": "hash", + }, + ] + } + resp = await client.post( + f"{BASE}/masking-rules/batch", + json=payload, + params={"instance_id": test_instance.id}, + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_batch_create_nonexistent_instance(self, client, admin_token): + payload = { + "rules": [ + { + "database": "db1", "table_name": "t1", + "column_name": "col1", "mask_type": "hash", + }, + ] + } + resp = await client.post( + f"{BASE}/masking-rules/batch", + json=payload, + params={"instance_id": 99999}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_batch_create_dba_allowed(self, client, dba_token, test_instance): + payload = { + "rules": [ + { + "database": "db1", "table_name": "t1", + "column_name": "col1", "mask_type": "truncate", + }, + ] + } + resp = await client.post( + f"{BASE}/masking-rules/batch", + json=payload, + params={"instance_id": test_instance.id}, + headers=auth_header(dba_token), + ) + assert resp.status_code == 201 + + @pytest.mark.asyncio + async def test_batch_create_empty_rules_rejected(self, client, admin_token, test_instance): + """Empty rules list should fail validation (min_length=1).""" + resp = await client.post( + f"{BASE}/masking-rules/batch", + json={"rules": []}, + params={"instance_id": test_instance.id}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 422 + + @pytest.mark.asyncio + async def test_batch_create_with_internal_duplicates(self, client, admin_token, test_instance): + """Two identical rules in the same batch — first succeeds, second skipped.""" + payload = { + "rules": [ + { + "database": "db2", "table_name": "t2", + "column_name": "secret", "mask_type": "full", + }, + { + "database": "db2", "table_name": "t2", + "column_name": "secret", "mask_type": "hash", + }, + ] + } + resp = await client.post( + f"{BASE}/masking-rules/batch", + json=payload, + params={"instance_id": test_instance.id}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + assert data["total"] == 1 diff --git a/tests/test_mongo.py b/tests/test_mongo.py new file mode 100644 index 0000000..9a838e9 --- /dev/null +++ b/tests/test_mongo.py @@ -0,0 +1,711 @@ +"""MongoDB 管理 API 端点测试 — 所有 MongoConnector 方法均 mock。""" +import pytest +from unittest.mock import AsyncMock, patch + +from tests.conftest import auth_header +from app.models.instance import Instance + + +# ── 辅助工具 ────────────────────────────────────────────────────── + +MONGO_INSTANCE_DATA = { + "name": "test-mongo", + "db_type": "mongo", + "host": "127.0.0.1", + "port": 27017, + "username": "root", + "password": "test", + "database": "test_mongo", + "env": "development", + "status": "disconnected", +} + +MYSQL_INSTANCE_DATA = { + "name": "Test MySQL", + "db_type": "mysql", + "host": "127.0.0.1", + "port": 3306, + "username": "root", + "password": "test123", + "database": "test_db", + "env": "development", +} + + +async def _create_mongo_instance(client, admin_token): + """创建一个 mongo 类型的实例并返回其 ID。""" + resp = await client.post( + "/api/v1/instances", + json=MONGO_INSTANCE_DATA, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + return resp.json()["id"] + + +async def _create_mysql_instance(client, admin_token): + """创建一个 mysql 类型的实例并返回其 ID。""" + resp = await client.post( + "/api/v1/instances", + json=MYSQL_INSTANCE_DATA, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + return resp.json()["id"] + + +# ==================================================================== +# 1. 数据库列表端点 GET /mongo/{id}/databases +# ==================================================================== + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_list_databases_success(mock_cls, client, admin_token): + """管理员列出 mongo 数据库 — 正常返回。""" + mock_cls.list_databases = AsyncMock( + return_value=["test_mongo", "myapp", "analytics"] + ) + iid = await _create_mongo_instance(client, admin_token) + + resp = await client.get( + f"/api/v1/mongo/{iid}/databases", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert "databases" in data + assert data["databases"] == ["test_mongo", "myapp", "analytics"] + mock_cls.list_databases.assert_awaited_once() + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_list_databases_empty(mock_cls, client, admin_token): + """数据库列表为空时返回空列表。""" + mock_cls.list_databases = AsyncMock(return_value=[]) + iid = await _create_mongo_instance(client, admin_token) + + resp = await client.get( + f"/api/v1/mongo/{iid}/databases", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["databases"] == [] + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_list_databases_connector_error(mock_cls, client, admin_token): + """MongoConnector 抛出异常时返回 500。""" + mock_cls.list_databases = AsyncMock(side_effect=Exception("连接超时")) + iid = await _create_mongo_instance(client, admin_token) + + resp = await client.get( + f"/api/v1/mongo/{iid}/databases", + headers=auth_header(admin_token), + ) + assert resp.status_code == 500 + assert "获取数据库列表失败" in resp.json()["detail"] + + +# ==================================================================== +# 2. 集合列表端点 GET /mongo/{id}/databases/{db}/collections +# ==================================================================== + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_list_collections_success(mock_cls, client, admin_token): + """列出指定数据库下的集合 — 正常返回。""" + mock_cls.list_collections = AsyncMock( + return_value=["users", "orders", "products"] + ) + iid = await _create_mongo_instance(client, admin_token) + + resp = await client.get( + f"/api/v1/mongo/{iid}/databases/myapp/collections", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["database"] == "myapp" + assert data["collections"] == ["users", "orders", "products"] + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_list_collections_error(mock_cls, client, admin_token): + """获取集合列表失败时返回 500。""" + mock_cls.list_collections = AsyncMock(side_effect=Exception("权限不足")) + iid = await _create_mongo_instance(client, admin_token) + + resp = await client.get( + f"/api/v1/mongo/{iid}/databases/myapp/collections", + headers=auth_header(admin_token), + ) + assert resp.status_code == 500 + assert "获取集合列表失败" in resp.json()["detail"] + + +# ==================================================================== +# 3. 集合统计 GET /mongo/{id}/collections/{coll}/stats?database=xxx +# ==================================================================== + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_collection_stats_success(mock_cls, client, admin_token): + """获取集合统计信息 — 正常返回。""" + mock_stats = { + "namespace": "myapp.users", + "document_count": 5000, + "size_bytes": 1048576, + "avg_document_size_bytes": 209, + "storage_size_bytes": 524288, + "index_count": 3, + "index_size_bytes": 131072, + "capped": False, + } + mock_cls.get_collection_stats = AsyncMock(return_value=mock_stats) + iid = await _create_mongo_instance(client, admin_token) + + resp = await client.get( + f"/api/v1/mongo/{iid}/collections/users/stats?database=myapp", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["document_count"] == 5000 + assert data["index_count"] == 3 + mock_cls.get_collection_stats.assert_awaited_once() + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_collection_stats_uses_instance_default_db(mock_cls, client, admin_token): + """未传 database 参数时使用实例默认数据库。""" + mock_stats = {"namespace": "test_mongo.users", "document_count": 100} + mock_cls.get_collection_stats = AsyncMock(return_value=mock_stats) + iid = await _create_mongo_instance(client, admin_token) + + # 实例默认 database = "test_mongo"，不传 database 参数 + resp = await client.get( + f"/api/v1/mongo/{iid}/collections/users/stats", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["document_count"] == 100 + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_collection_stats_no_database(mock_cls, client, admin_token, db): + """实例无默认数据库且未传 database 参数 — 返回 400。""" + mock_cls.get_collection_stats = AsyncMock(return_value={}) + iid = await _create_mongo_instance(client, admin_token) + + # 手动清空实例的 database 字段 + from sqlalchemy import select + result = await db.execute( + select(Instance).where(Instance.id == iid) + ) + inst = result.scalar_one() + inst.database = None + await db.commit() + + resp = await client.get( + f"/api/v1/mongo/{iid}/collections/users/stats", + headers=auth_header(admin_token), + ) + assert resp.status_code == 400 + assert "未指定数据库名称" in resp.json()["detail"] + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_collection_stats_error(mock_cls, client, admin_token): + """获取集合统计异常时返回 500。""" + mock_cls.get_collection_stats = AsyncMock( + side_effect=Exception("集合不存在") + ) + iid = await _create_mongo_instance(client, admin_token) + + resp = await client.get( + f"/api/v1/mongo/{iid}/collections/users/stats?database=myapp", + headers=auth_header(admin_token), + ) + assert resp.status_code == 500 + assert "获取集合统计失败" in resp.json()["detail"] + + +# ==================================================================== +# 4. 只读查询 POST /mongo/{id}/query +# ==================================================================== + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_query_find_success(mock_cls, client, admin_token): + """执行 find 查询 — 正常返回。""" + mock_result = [{"_id": "1", "name": "Alice"}, {"_id": "2", "name": "Bob"}] + mock_cls.execute_query_json = AsyncMock(return_value=mock_result) + iid = await _create_mongo_instance(client, admin_token) + + body = { + "database": "myapp", + "collection": "users", + "operation": "find", + "filter": {"age": {"$gt": 18}}, + "limit": 100, + } + resp = await client.post( + f"/api/v1/mongo/{iid}/query", + json=body, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["success"] is True + assert data["operation"] == "find" + assert len(data["result"]) == 2 + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_query_aggregate_success(mock_cls, client, admin_token): + """执行 aggregate 聚合查询 — 正常返回。""" + mock_result = [{"_id": "groupA", "total": 42}] + mock_cls.execute_query_json = AsyncMock(return_value=mock_result) + iid = await _create_mongo_instance(client, admin_token) + + body = { + "database": "myapp", + "collection": "orders", + "operation": "aggregate", + "pipeline": [{"$group": {"_id": "$category", "total": {"$sum": 1}}}], + } + resp = await client.post( + f"/api/v1/mongo/{iid}/query", + json=body, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["operation"] == "aggregate" + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_query_write_operation_rejected(mock_cls, client, admin_token): + """查询端点拒绝写操作（如 insertOne）— 返回 403。""" + mock_cls.execute_query_json = AsyncMock(return_value={}) + iid = await _create_mongo_instance(client, admin_token) + + body = { + "database": "myapp", + "collection": "users", + "operation": "insertOne", + "document": {"name": "hack"}, + } + resp = await client.post( + f"/api/v1/mongo/{iid}/query", + json=body, + headers=auth_header(admin_token), + ) + assert resp.status_code == 403 + assert "写操作" in resp.json()["detail"] or "禁止" in resp.json()["detail"] + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_query_unknown_operation_rejected(mock_cls, client, admin_token): + """查询端点拒绝未知操作 — 返回 403。""" + mock_cls.execute_query_json = AsyncMock(return_value={}) + iid = await _create_mongo_instance(client, admin_token) + + body = { + "database": "myapp", + "collection": "users", + "operation": "dropCollection", + } + resp = await client.post( + f"/api/v1/mongo/{iid}/query", + json=body, + headers=auth_header(admin_token), + ) + assert resp.status_code == 403 + assert "未知" in resp.json()["detail"] + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_query_no_database(mock_cls, client, admin_token, db): + """查询时无数据库名称 — 返回 400。""" + mock_cls.execute_query_json = AsyncMock(return_value=[]) + iid = await _create_mongo_instance(client, admin_token) + + # 清空实例默认 database + from sqlalchemy import select + result = await db.execute( + select(Instance).where(Instance.id == iid) + ) + inst = result.scalar_one() + inst.database = None + await db.commit() + + body = { + "collection": "users", + "operation": "find", + } + resp = await client.post( + f"/api/v1/mongo/{iid}/query", + json=body, + headers=auth_header(admin_token), + ) + assert resp.status_code == 400 + assert "未指定数据库名称" in resp.json()["detail"] + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_query_connector_error(mock_cls, client, admin_token): + """查询端点 connector 异常 — 返回 500。""" + mock_cls.execute_query_json = AsyncMock( + side_effect=Exception("cursor timeout") + ) + iid = await _create_mongo_instance(client, admin_token) + + body = { + "database": "myapp", + "collection": "users", + "operation": "find", + } + resp = await client.post( + f"/api/v1/mongo/{iid}/query", + json=body, + headers=auth_header(admin_token), + ) + assert resp.status_code == 500 + assert "查询执行失败" in resp.json()["detail"] + + +# ==================================================================== +# 5. 变更操作 POST /mongo/{id}/execute （仅 admin/dba） +# ==================================================================== + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_execute_insert_one_admin(mock_cls, client, admin_token): + """admin 执行 insertOne 变更 — 正常返回。""" + mock_cls.execute_change_json = AsyncMock( + return_value="507f1f77bcf86cd799439011" + ) + iid = await _create_mongo_instance(client, admin_token) + + body = { + "database": "myapp", + "collection": "users", + "operation": "insertOne", + "document": {"name": "Alice", "age": 25}, + } + resp = await client.post( + f"/api/v1/mongo/{iid}/execute", + json=body, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["success"] is True + assert data["operation"] == "insertOne" + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_execute_delete_many_dba(mock_cls, client, dba_token, admin_token): + """dba 执行 deleteMany 变更 — 正常返回。""" + mock_cls.execute_change_json = AsyncMock(return_value="删除 3 条文档") + iid = await _create_mongo_instance(client, admin_token) + + body = { + "database": "myapp", + "collection": "logs", + "operation": "deleteMany", + "filter": {"level": "debug"}, + } + resp = await client.post( + f"/api/v1/mongo/{iid}/execute", + json=body, + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + assert resp.json()["success"] is True + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_execute_update_many_success(mock_cls, client, admin_token): + """admin 执行 updateMany 变更 — 正常返回。""" + mock_cls.execute_change_json = AsyncMock( + return_value="匹配 5 条，修改 5 条" + ) + iid = await _create_mongo_instance(client, admin_token) + + body = { + "database": "myapp", + "collection": "users", + "operation": "updateMany", + "filter": {"status": "inactive"}, + "update": {"$set": {"status": "archived"}}, + } + resp = await client.post( + f"/api/v1/mongo/{iid}/execute", + json=body, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert "匹配 5 条" in resp.json()["result"] + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_execute_no_database(mock_cls, client, admin_token, db): + """变更操作无数据库名称 — 返回 400。""" + mock_cls.execute_change_json = AsyncMock(return_value="") + iid = await _create_mongo_instance(client, admin_token) + + # 清空实例默认 database + from sqlalchemy import select + result = await db.execute( + select(Instance).where(Instance.id == iid) + ) + inst = result.scalar_one() + inst.database = None + await db.commit() + + body = { + "collection": "users", + "operation": "insertOne", + "document": {"name": "test"}, + } + resp = await client.post( + f"/api/v1/mongo/{iid}/execute", + json=body, + headers=auth_header(admin_token), + ) + assert resp.status_code == 400 + assert "未指定数据库名称" in resp.json()["detail"] + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_execute_connector_error(mock_cls, client, admin_token): + """变更操作 connector 异常 — 返回 500。""" + mock_cls.execute_change_json = AsyncMock( + side_effect=Exception("写入失败") + ) + iid = await _create_mongo_instance(client, admin_token) + + body = { + "database": "myapp", + "collection": "users", + "operation": "insertOne", + "document": {"name": "test"}, + } + resp = await client.post( + f"/api/v1/mongo/{iid}/execute", + json=body, + headers=auth_header(admin_token), + ) + assert resp.status_code == 500 + assert "变更执行失败" in resp.json()["detail"] + + +# ==================================================================== +# 6. 测试连接 POST /mongo/{id}/test-connection +# ==================================================================== + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_test_connection_success(mock_cls, client, admin_token): + """测试连接成功 — 返回带 version 的结果。""" + from app.services.mongo_connector import ConnectionResult + mock_result = ConnectionResult( + success=True, version="7.0.4", latency_ms=12, message="连接成功" + ) + mock_cls.test_connection = AsyncMock(return_value=mock_result) + iid = await _create_mongo_instance(client, admin_token) + + resp = await client.post( + f"/api/v1/mongo/{iid}/test-connection", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["success"] is True + assert data["version"] == "7.0.4" + assert data["latency_ms"] == 12 + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_test_connection_failure(mock_cls, client, admin_token): + """测试连接失败 — 返回 500。""" + mock_cls.test_connection = AsyncMock( + side_effect=Exception("network unreachable") + ) + iid = await _create_mongo_instance(client, admin_token) + + resp = await client.post( + f"/api/v1/mongo/{iid}/test-connection", + headers=auth_header(admin_token), + ) + assert resp.status_code == 500 + assert "连接测试失败" in resp.json()["detail"] + + +# ==================================================================== +# 7. 实例验证：非 mongo 类型 / 实例不存在 +# ==================================================================== + +@pytest.mark.asyncio +async def test_non_mongo_instance_rejected(client, admin_token): + """MySQL 实例访问 mongo 端点 — 返回 400。""" + iid = await _create_mysql_instance(client, admin_token) + + resp = await client.get( + f"/api/v1/mongo/{iid}/databases", + headers=auth_header(admin_token), + ) + assert resp.status_code == 400 + assert "MongoDB" in resp.json()["detail"] + + +@pytest.mark.asyncio +async def test_non_mongo_instance_rejected_query(client, admin_token): + """MySQL 实例访问 mongo 查询端点 — 返回 400。""" + iid = await _create_mysql_instance(client, admin_token) + + body = { + "database": "myapp", + "collection": "users", + "operation": "find", + } + resp = await client.post( + f"/api/v1/mongo/{iid}/query", + json=body, + headers=auth_header(admin_token), + ) + assert resp.status_code == 400 + + +@pytest.mark.asyncio +async def test_non_mongo_instance_rejected_execute(client, admin_token): + """MySQL 实例访问 mongo 变更端点 — 返回 400。""" + iid = await _create_mysql_instance(client, admin_token) + + body = { + "database": "myapp", + "collection": "users", + "operation": "insertOne", + "document": {"name": "test"}, + } + resp = await client.post( + f"/api/v1/mongo/{iid}/execute", + json=body, + headers=auth_header(admin_token), + ) + assert resp.status_code == 400 + + +@pytest.mark.asyncio +async def test_instance_not_found(client, admin_token): + """不存在的实例 ID — 返回 404。""" + resp = await client.get( + "/api/v1/mongo/99999/databases", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + assert "不存在" in resp.json()["detail"] + + +# ==================================================================== +# 8. 权限检查：developer 不能执行变更操作 +# ==================================================================== + +@pytest.mark.asyncio +async def test_execute_requires_admin_or_dba(client, developer_token, admin_token): + """developer 角色无法执行变更操作 — 返回 403。""" + iid = await _create_mongo_instance(client, admin_token) + + body = { + "database": "myapp", + "collection": "users", + "operation": "insertOne", + "document": {"name": "unauthorized"}, + } + resp = await client.post( + f"/api/v1/mongo/{iid}/execute", + json=body, + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_query_allowed_for_developer(mock_cls, client, developer_token, admin_token): + """developer 可以执行只读查询（get_current_user 即可）。""" + mock_cls.execute_query_json = AsyncMock(return_value=[{"name": "Alice"}]) + iid = await _create_mongo_instance(client, admin_token) + + body = { + "database": "myapp", + "collection": "users", + "operation": "find", + } + resp = await client.post( + f"/api/v1/mongo/{iid}/query", + json=body, + headers=auth_header(developer_token), + ) + assert resp.status_code == 200 + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_test_connection_allowed_for_developer(mock_cls, client, developer_token, admin_token): + """developer 可以测试连接（get_current_user 即可）。""" + from app.services.mongo_connector import ConnectionResult + mock_result = ConnectionResult( + success=True, version="7.0.0", latency_ms=5, message="连接成功" + ) + mock_cls.test_connection = AsyncMock(return_value=mock_result) + iid = await _create_mongo_instance(client, admin_token) + + resp = await client.post( + f"/api/v1/mongo/{iid}/test-connection", + headers=auth_header(developer_token), + ) + assert resp.status_code == 200 + + +# ==================================================================== +# 9. dba 角色可以执行变更操作 +# ==================================================================== + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.mongo.MongoConnector") +async def test_execute_dba_allowed(mock_cls, client, dba_token, admin_token): + """dba 角色可以执行变更操作 — 正常返回。""" + mock_cls.execute_change_json = AsyncMock(return_value="507f1f77bcf86cd799439011") + iid = await _create_mongo_instance(client, admin_token) + + body = { + "database": "myapp", + "collection": "users", + "operation": "insertOne", + "document": {"name": "dba_user"}, + } + resp = await client.post( + f"/api/v1/mongo/{iid}/execute", + json=body, + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + assert resp.json()["success"] is True diff --git a/tests/test_notification.py b/tests/test_notification.py new file mode 100644 index 0000000..eab9cca --- /dev/null +++ b/tests/test_notification.py @@ -0,0 +1,463 @@ +"""Comprehensive tests for NotificationChannel CRUD, permissions, config masking, and test-send.""" +import pytest +from unittest.mock import AsyncMock, patch +from httpx import AsyncClient + +from tests.conftest import auth_header + +BASE = "/api/v1/notifications" + +# ─── Helpers ──────────────────────────────────────────────────────────── + +DINGTALK_PAYLOAD = { + "name": "钉钉告警通道", + "channel_type": "dingtalk", + "config": { + "webhook_url": "https://oapi.dingtalk.com/robot/send?access_token=abc123", + "secret": "SEC_MY_DINGTALK_SECRET", + }, + "is_enabled": True, +} + +FEISHU_PAYLOAD = { + "name": "飞书通知通道", + "channel_type": "webhook_feishu", + "config": { + "webhook_url": "https://open.feishu.cn/open-apis/bot/v2/hook/xxx", + "secret": "FEISHU_SIGN_SECRET", + }, +} + +EMAIL_PAYLOAD = { + "name": "邮件通知通道", + "channel_type": "email", + "config": { + "smtp_host": "smtp.example.com", + "smtp_port": 465, + "smtp_user": "alert@example.com", + "smtp_password": "super_secret_pass", + "from_addr": "alert@example.com", + "use_tls": True, + }, +} + + +# ─── CREATE (POST /notifications) ────────────────────────────────────── + + +@pytest.mark.asyncio +async def test_create_dingtalk_channel(client: AsyncClient, admin_token: str): + resp = await client.post(BASE, json=DINGTALK_PAYLOAD, headers=auth_header(admin_token)) + assert resp.status_code == 201 + data = resp.json() + assert data["name"] == "钉钉告警通道" + assert data["channel_type"] == "dingtalk" + assert data["is_enabled"] is True + assert "id" in data + assert data["config"]["webhook_url"] == DINGTALK_PAYLOAD["config"]["webhook_url"] + # secret must be masked + assert data["config"]["secret"] == "******" + + +@pytest.mark.asyncio +async def test_create_feishu_channel(client: AsyncClient, admin_token: str): + resp = await client.post(BASE, json=FEISHU_PAYLOAD, headers=auth_header(admin_token)) + assert resp.status_code == 201 + assert resp.json()["channel_type"] == "webhook_feishu" + + +@pytest.mark.asyncio +async def test_create_email_channel(client: AsyncClient, admin_token: str): + resp = await client.post(BASE, json=EMAIL_PAYLOAD, headers=auth_header(admin_token)) + assert resp.status_code == 201 + data = resp.json() + assert data["channel_type"] == "email" + # smtp_password must be masked + assert data["config"]["smtp_password"] == "******" + # non-sensitive fields preserved + assert data["config"]["smtp_host"] == "smtp.example.com" + assert data["config"]["smtp_port"] == 465 + + +@pytest.mark.asyncio +async def test_create_channel_default_enabled(client: AsyncClient, admin_token: str): + payload = { + "name": "默认启用", + "channel_type": "dingtalk", + "config": {"webhook_url": "https://example.com/hook"}, + } + resp = await client.post(BASE, json=payload, headers=auth_header(admin_token)) + assert resp.status_code == 201 + assert resp.json()["is_enabled"] is True + + +@pytest.mark.asyncio +async def test_create_channel_disabled(client: AsyncClient, admin_token: str): + payload = { + "name": "已禁用通道", + "channel_type": "dingtalk", + "config": {"webhook_url": "https://example.com/hook"}, + "is_enabled": False, + } + resp = await client.post(BASE, json=payload, headers=auth_header(admin_token)) + assert resp.status_code == 201 + assert resp.json()["is_enabled"] is False + + +@pytest.mark.asyncio +async def test_create_channel_invalid_type(client: AsyncClient, admin_token: str): + payload = { + "name": "坏通道", + "channel_type": "slack", + "config": {"webhook_url": "https://example.com"}, + } + resp = await client.post(BASE, json=payload, headers=auth_header(admin_token)) + assert resp.status_code == 422 + + +@pytest.mark.asyncio +async def test_create_channel_empty_name(client: AsyncClient, admin_token: str): + payload = { + "name": "", + "channel_type": "dingtalk", + "config": {"webhook_url": "https://example.com"}, + } + resp = await client.post(BASE, json=payload, headers=auth_header(admin_token)) + assert resp.status_code == 422 + + +@pytest.mark.asyncio +async def test_create_channel_name_too_long(client: AsyncClient, admin_token: str): + payload = { + "name": "x" * 101, + "channel_type": "dingtalk", + "config": {"webhook_url": "https://example.com"}, + } + resp = await client.post(BASE, json=payload, headers=auth_header(admin_token)) + assert resp.status_code == 422 + + +# ─── LIST (GET /notifications) ───────────────────────────────────────── + + +@pytest.mark.asyncio +async def test_list_channels_empty(client: AsyncClient, admin_token: str): + resp = await client.get(BASE, headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert resp.json() == [] + + +@pytest.mark.asyncio +async def test_list_channels_returns_all(client: AsyncClient, admin_token: str): + for payload in [DINGTALK_PAYLOAD, FEISHU_PAYLOAD, EMAIL_PAYLOAD]: + await client.post(BASE, json=payload, headers=auth_header(admin_token)) + + resp = await client.get(BASE, headers=auth_header(admin_token)) + assert resp.status_code == 200 + items = resp.json() + assert len(items) == 3 + types = {ch["channel_type"] for ch in items} + assert types == {"dingtalk", "webhook_feishu", "email"} + + +@pytest.mark.asyncio +async def test_list_channels_config_masked(client: AsyncClient, admin_token: str): + await client.post(BASE, json=DINGTALK_PAYLOAD, headers=auth_header(admin_token)) + + resp = await client.get(BASE, headers=auth_header(admin_token)) + items = resp.json() + assert len(items) == 1 + assert items[0]["config"]["secret"] == "******" + + +# ─── UPDATE (PUT /notifications/{channel_id}) ────────────────────────── + + +@pytest.mark.asyncio +async def test_update_channel_name(client: AsyncClient, admin_token: str): + create = await client.post(BASE, json=DINGTALK_PAYLOAD, headers=auth_header(admin_token)) + cid = create.json()["id"] + + resp = await client.put( + f"{BASE}/{cid}", + json={"name": "更新后的钉钉通道"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["name"] == "更新后的钉钉通道" + + +@pytest.mark.asyncio +async def test_update_channel_toggle_enabled(client: AsyncClient, admin_token: str): + create = await client.post(BASE, json=DINGTALK_PAYLOAD, headers=auth_header(admin_token)) + cid = create.json()["id"] + + resp = await client.put( + f"{BASE}/{cid}", + json={"is_enabled": False}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["is_enabled"] is False + + +@pytest.mark.asyncio +async def test_update_channel_config(client: AsyncClient, admin_token: str): + create = await client.post(BASE, json=DINGTALK_PAYLOAD, headers=auth_header(admin_token)) + cid = create.json()["id"] + + new_config = {"webhook_url": "https://new-hook.example.com", "secret": "NEW_SECRET"} + resp = await client.put( + f"{BASE}/{cid}", + json={"config": new_config}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["config"]["webhook_url"] == "https://new-hook.example.com" + # secret masked in response + assert data["config"]["secret"] == "******" + + +@pytest.mark.asyncio +async def test_update_nonexistent_channel(client: AsyncClient, admin_token: str): + resp = await client.put( + f"{BASE}/99999", + json={"name": "不存在"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + +@pytest.mark.asyncio +async def test_update_channel_invalid_type(client: AsyncClient, admin_token: str): + create = await client.post(BASE, json=DINGTALK_PAYLOAD, headers=auth_header(admin_token)) + cid = create.json()["id"] + + resp = await client.put( + f"{BASE}/{cid}", + json={"channel_type": "invalid_type"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 422 + + +# ─── DELETE (DELETE /notifications/{channel_id}) ─────────────────────── + + +@pytest.mark.asyncio +async def test_delete_channel(client: AsyncClient, admin_token: str): + create = await client.post(BASE, json=DINGTALK_PAYLOAD, headers=auth_header(admin_token)) + cid = create.json()["id"] + + resp = await client.delete(f"{BASE}/{cid}", headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert "message" in resp.json() + + # Verify it's gone from the list + items = (await client.get(BASE, headers=auth_header(admin_token))).json() + assert all(ch["id"] != cid for ch in items) + + +@pytest.mark.asyncio +async def test_delete_nonexistent_channel(client: AsyncClient, admin_token: str): + resp = await client.delete(f"{BASE}/99999", headers=auth_header(admin_token)) + assert resp.status_code == 404 + + +# ─── TEST SEND (POST /notifications/{channel_id}/test) ───────────────── + + +@pytest.mark.asyncio +@patch("app.services.notification_sender.NotificationSender.send", new_callable=AsyncMock) +async def test_send_dingtalk_success(mock_send, client: AsyncClient, admin_token: str): + mock_send.return_value = {"success": True, "message": "钉钉测试消息发送成功"} + create = await client.post(BASE, json=DINGTALK_PAYLOAD, headers=auth_header(admin_token)) + cid = create.json()["id"] + + resp = await client.post(f"{BASE}/{cid}/test", headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert data["success"] is True + assert "钉钉" in data["message"] + + +@pytest.mark.asyncio +async def test_send_dingtalk_missing_webhook(client: AsyncClient, admin_token: str): + payload = { + "name": "缺少webhook的钉钉", + "channel_type": "dingtalk", + "config": {"secret": "abc"}, + } + create = await client.post(BASE, json=payload, headers=auth_header(admin_token)) + cid = create.json()["id"] + + resp = await client.post(f"{BASE}/{cid}/test", headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert data["success"] is False + assert "webhook_url" in data["message"] + + +@pytest.mark.asyncio +@patch("app.services.notification_sender.NotificationSender.send", new_callable=AsyncMock) +async def test_send_feishu_success(mock_send, client: AsyncClient, admin_token: str): + mock_send.return_value = {"success": True, "message": "飞书测试消息发送成功"} + create = await client.post(BASE, json=FEISHU_PAYLOAD, headers=auth_header(admin_token)) + cid = create.json()["id"] + + resp = await client.post(f"{BASE}/{cid}/test", headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert data["success"] is True + assert "飞书" in data["message"] + + +@pytest.mark.asyncio +async def test_send_feishu_missing_webhook(client: AsyncClient, admin_token: str): + payload = { + "name": "缺少webhook的飞书", + "channel_type": "webhook_feishu", + "config": {}, + } + create = await client.post(BASE, json=payload, headers=auth_header(admin_token)) + cid = create.json()["id"] + + resp = await client.post(f"{BASE}/{cid}/test", headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert resp.json()["success"] is False + assert "webhook_url" in resp.json()["message"] + + +@pytest.mark.asyncio +@patch("app.services.notification_sender.NotificationSender.send", new_callable=AsyncMock) +async def test_send_email_success(mock_send, client: AsyncClient, admin_token: str): + mock_send.return_value = {"success": True, "message": "邮件测试消息发送成功"} + create = await client.post(BASE, json=EMAIL_PAYLOAD, headers=auth_header(admin_token)) + cid = create.json()["id"] + + resp = await client.post(f"{BASE}/{cid}/test", headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert data["success"] is True + assert "邮件" in data["message"] + + +@pytest.mark.asyncio +async def test_send_email_missing_smtp_config(client: AsyncClient, admin_token: str): + payload = { + "name": "不完整的邮件", + "channel_type": "email", + "config": {"smtp_host": "smtp.example.com"}, + # missing smtp_port, smtp_user, from_addr + } + create = await client.post(BASE, json=payload, headers=auth_header(admin_token)) + cid = create.json()["id"] + + resp = await client.post(f"{BASE}/{cid}/test", headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert data["success"] is False + assert "smtp_user" in data["message"] + + +@pytest.mark.asyncio +async def test_send_test_nonexistent_channel(client: AsyncClient, admin_token: str): + resp = await client.post(f"{BASE}/99999/test", headers=auth_header(admin_token)) + assert resp.status_code == 404 + + +# ─── PERMISSION CHECKS (all admin-only, others get 403) ──────────────── + + +@pytest.mark.asyncio +async def test_permission_dba_list_forbidden(client: AsyncClient, dba_token: str): + resp = await client.get(BASE, headers=auth_header(dba_token)) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_permission_developer_list_forbidden(client: AsyncClient, developer_token: str): + resp = await client.get(BASE, headers=auth_header(developer_token)) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_permission_guest_list_forbidden(client: AsyncClient, guest_token: str): + resp = await client.get(BASE, headers=auth_header(guest_token)) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_permission_dba_create_forbidden(client: AsyncClient, dba_token: str): + resp = await client.post(BASE, json=DINGTALK_PAYLOAD, headers=auth_header(dba_token)) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_permission_developer_update_forbidden(client: AsyncClient, developer_token: str): + resp = await client.put(f"{BASE}/1", json={"name": "x"}, headers=auth_header(developer_token)) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_permission_guest_delete_forbidden(client: AsyncClient, guest_token: str): + resp = await client.delete(f"{BASE}/1", headers=auth_header(guest_token)) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_permission_dba_test_send_forbidden(client: AsyncClient, dba_token: str): + resp = await client.post(f"{BASE}/1/test", headers=auth_header(dba_token)) + assert resp.status_code == 403 + + +# ─── EDGE CASES ───────────────────────────────────────────────────────── + + +@pytest.mark.asyncio +async def test_no_auth_returns_401(client: AsyncClient): + """All endpoints require authentication — without a token expect 401.""" + for method, url in [ + ("get", BASE), + ("post", BASE), + ("put", f"{BASE}/1"), + ("delete", f"{BASE}/1"), + ("post", f"{BASE}/1/test"), + ]: + resp = await getattr(client, method)(url) + assert resp.status_code == 401, f"{method.upper()} {url} should be 401, got {resp.status_code}" + + +@pytest.mark.asyncio +async def test_config_without_sensitive_keys(client: AsyncClient, admin_token: str): + """Config with no sensitive keys should pass through unchanged.""" + payload = { + "name": "无敏感配置", + "channel_type": "dingtalk", + "config": {"webhook_url": "https://example.com/hook", "extra": "value"}, + } + resp = await client.post(BASE, json=payload, headers=auth_header(admin_token)) + assert resp.status_code == 201 + config = resp.json()["config"] + assert config["webhook_url"] == "https://example.com/hook" + assert config["extra"] == "value" + assert "secret" not in config + + +@pytest.mark.asyncio +async def test_update_partial_preserves_others(client: AsyncClient, admin_token: str): + """Updating only name should not change config or channel_type.""" + create = await client.post(BASE, json=DINGTALK_PAYLOAD, headers=auth_header(admin_token)) + cid = create.json()["id"] + + resp = await client.put( + f"{BASE}/{cid}", + json={"name": "只改名字"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["name"] == "只改名字" + assert data["channel_type"] == "dingtalk" + assert data["config"]["webhook_url"] == DINGTALK_PAYLOAD["config"]["webhook_url"] diff --git a/tests/test_permission_workflow.py b/tests/test_permission_workflow.py new file mode 100644 index 0000000..5107c42 --- /dev/null +++ b/tests/test_permission_workflow.py @@ -0,0 +1,467 @@ +"""权限组 + 审批流 全链路测试。 + +覆盖: +1. 查询权限: 用户只能查自己被授权的数据源 +2. 工单权限: 用户只能对被授权的数据源提交变更 +3. 审批流: 工单创建自动启动审批流，多级审批 +""" +import json +import sys +import pytest +from contextlib import asynccontextmanager +from unittest.mock import patch, AsyncMock, MagicMock + +from app.core.security import create_access_token, hash_password +from app.models.user import User +from app.models.instance import Instance +from app.models.instance_group import InstanceGroup, user_groups +from app.models.ticket import Ticket +from app.models.workflow import WorkflowDefinition, WorkflowStep, TicketApproval +from tests.conftest import auth_header + + +def _make_aiomysql_mock(): + aiomysql = MagicMock() + aiomysql.connect = AsyncMock() + aiomysql.DictCursor = MagicMock() + return aiomysql + + +def _make_mock_conn(): + mock_cursor = AsyncMock() + mock_cursor.description = [("id",), ("name",)] + mock_cursor.fetchall.return_value = [{"id": 1, "name": "test"}] + mock_cursor.execute = AsyncMock() + + @asynccontextmanager + async def mock_cursor_ctx(*args, **kwargs): + yield mock_cursor + + mock_conn = AsyncMock() + mock_conn.cursor = mock_cursor_ctx + mock_conn.close = MagicMock() + return mock_conn + + +# ── Fixtures ───────────────────────────────────────────────────────── + +@pytest.fixture +async def grouped_instance(db): + inst = Instance( + name="生产MySQL", + db_type="mysql", + host="10.0.0.1", + port=3306, + username="root", + password="test123", + database="prod_db", + env="production", + status="disconnected", + ) + db.add(inst) + await db.commit() + await db.refresh(inst) + return inst + + +@pytest.fixture +async def public_instance(db): + inst = Instance( + name="测试PG", + db_type="postgres", + host="127.0.0.1", + port=5432, + username="postgres", + password="test123", + database="test_db", + env="development", + status="disconnected", + ) + db.add(inst) + await db.commit() + await db.refresh(inst) + return inst + + +@pytest.fixture +async def dev_group(db, grouped_instance): + group = InstanceGroup( + name="开发组", + description="开发人员可用数据源", + db_type="mysql", + permissions=json.dumps(["query:select", "ticket:create"]), + ) + db.add(group) + await db.commit() + await db.refresh(group) + + grouped_instance.group_id = group.id + await db.commit() + await db.refresh(grouped_instance) + return group + + +@pytest.fixture +async def dev_in_group(db, dev_group, developer_user): + await db.execute( + user_groups.insert().values(user_id=developer_user.id, group_id=dev_group.id) + ) + await db.commit() + return developer_user + + +@pytest.fixture +async def dev_in_group_token(dev_in_group): + return create_access_token(data={"sub": str(dev_in_group.id), "role": dev_in_group.role}) + + +@pytest.fixture +async def default_workflow(db): + wf = WorkflowDefinition( + name="标准审批流", + description="DBA审核后Admin确认", + is_default=True, + is_active=True, + ) + db.add(wf) + await db.commit() + await db.refresh(wf) + + step1 = WorkflowStep( + workflow_id=wf.id, + step_number=1, + name="DBA审核", + step_type="serial", + approver_role="dba", + is_required=True, + timeout_hours=24, + ) + step2 = WorkflowStep( + workflow_id=wf.id, + step_number=2, + name="管理员确认", + step_type="serial", + approver_role="admin", + is_required=True, + timeout_hours=24, + ) + db.add_all([step1, step2]) + await db.commit() + return wf + + +# ── 1. 查询权限测试 ────────────────────────────────────────────────── + +class TestQueryPermission: + async def test_admin_can_query_grouped_instance(self, client, admin_token, grouped_instance, dev_group): + """admin 可以查询绑定权限组的实例""" + mock_conn = _make_mock_conn() + mock_aiomysql = _make_aiomysql_mock() + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + + with patch.dict(sys.modules, {"aiomysql": mock_aiomysql}): + resp = await client.post( + "/api/v1/query", + json={"instance_id": grouped_instance.id, "database": "prod_db", "sql": "SELECT 1"}, + params={"save_history": "false"}, + headers=auth_header(admin_token), + ) + assert resp.status_code != 403 + + async def test_dev_in_group_can_query(self, client, dev_in_group_token, grouped_instance, dev_group): + """developer 在权限组内 → 可以查询""" + mock_conn = _make_mock_conn() + mock_aiomysql = _make_aiomysql_mock() + mock_aiomysql.connect = AsyncMock(return_value=mock_conn) + + with patch.dict(sys.modules, {"aiomysql": mock_aiomysql}): + resp = await client.post( + "/api/v1/query", + json={"instance_id": grouped_instance.id, "database": "prod_db", "sql": "SELECT 1"}, + params={"save_history": "false"}, + headers=auth_header(dev_in_group_token), + ) + assert resp.status_code != 403 + + async def test_dev_not_in_group_blocked(self, client, developer_token, grouped_instance, dev_group): + """developer 不在权限组 → 403""" + resp = await client.post( + "/api/v1/query", + json={"instance_id": grouped_instance.id, "database": "prod_db", "sql": "SELECT 1"}, + params={"save_history": "false"}, + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + assert "权限" in resp.json()["detail"] + + async def test_dev_can_query_public_instance(self, client, developer_token, public_instance): + """无权限组的公共实例 → 所有认证用户可查""" + resp = await client.post( + "/api/v1/query", + json={"instance_id": public_instance.id, "database": "test_db", "sql": "SELECT 1"}, + params={"save_history": "false"}, + headers=auth_header(developer_token), + ) + assert resp.status_code != 403 + + async def test_guest_still_blocked(self, client, guest_token, public_instance): + """guest 被禁止查询""" + resp = await client.post( + "/api/v1/query", + json={"instance_id": public_instance.id, "database": "test_db", "sql": "SELECT 1"}, + params={"save_history": "false"}, + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + async def test_dba_not_in_group_blocked(self, client, dba_token, grouped_instance, dev_group): + """dba 不在权限组也 → 403""" + resp = await client.post( + "/api/v1/query", + json={"instance_id": grouped_instance.id, "database": "prod_db", "sql": "SELECT 1"}, + params={"save_history": "false"}, + headers=auth_header(dba_token), + ) + assert resp.status_code == 403 + + +# ── 2. 工单权限测试 ────────────────────────────────────────────────── + +class TestTicketPermission: + async def test_admin_can_create_ticket_any(self, client, admin_token, grouped_instance, dev_group): + """admin 可以为任何实例创建工单""" + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "管理员修改表结构", + "db_type": "mysql", + "instance_id": grouped_instance.id, + "target_database": "prod_db", + "sql_content": "ALTER TABLE users ADD COLUMN age INT", + "reason": "业务需求，增加年龄字段", + "priority": "medium", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code != 403 + + async def test_dev_in_group_can_create_ticket(self, client, dev_in_group_token, grouped_instance, dev_group): + """developer 在权限组内 → 可以创建工单""" + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "开发修正错误数据", + "db_type": "mysql", + "instance_id": grouped_instance.id, + "target_database": "prod_db", + "sql_content": "UPDATE users SET age = 20 WHERE id = 1", + "reason": "修正用户年龄数据错误", + "priority": "low", + }, + headers=auth_header(dev_in_group_token), + ) + assert resp.status_code != 403 + + async def test_dev_not_in_group_cannot_create_ticket(self, client, developer_token, grouped_instance, dev_group): + """developer 不在权限组 → 403""" + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "未授权操作工单", + "db_type": "mysql", + "instance_id": grouped_instance.id, + "target_database": "prod_db", + "sql_content": "DELETE FROM users WHERE id = 1", + "reason": "测试未授权操作权限", + "priority": "low", + }, + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + assert "权限" in resp.json()["detail"] + + +# ── 3. 审批流对接测试 ────────────────────────────────────────────────── + +class TestWorkflowIntegration: + async def test_no_workflow_status_pending(self, client, admin_token, test_instance): + """无默认审批流 → 状态为 pending""" + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "简单测试工单", + "db_type": "mysql", + "instance_id": test_instance.id, + "target_database": "test_db", + "sql_content": "UPDATE users SET name = 'test' WHERE id = 1", + "reason": "测试审批流功能", + "priority": "low", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + assert resp.json()["status"] == "pending" + + async def test_with_workflow_status_reviewing(self, client, admin_token, test_instance, default_workflow): + """有默认审批流 → 状态为 reviewing""" + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "审批流测试工单", + "db_type": "mysql", + "instance_id": test_instance.id, + "target_database": "test_db", + "sql_content": "UPDATE users SET name = 'test' WHERE id = 1", + "reason": "测试审批流功能", + "priority": "medium", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + assert data["status"] == "reviewing" + ticket_id = data["id"] + + resp2 = await client.get( + f"/api/v1/tickets/{ticket_id}/approvals", + headers=auth_header(admin_token), + ) + assert resp2.status_code == 200 + approvals = resp2.json() + assert len(approvals) == 2 + assert approvals[0]["step_number"] == 1 + assert approvals[0]["approver_role"] == "dba" + assert approvals[0]["action"] == "pending" + assert approvals[1]["step_number"] == 2 + assert approvals[1]["approver_role"] == "admin" + + async def test_multi_step_first_approve_still_reviewing(self, client, admin_token, dba_token, test_instance, default_workflow): + """多级审批: 第一步通过 → reviewing""" + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "多级审批测试工单", + "db_type": "mysql", + "instance_id": test_instance.id, + "target_database": "test_db", + "sql_content": "UPDATE users SET age = 25 WHERE id = 1", + "reason": "测试审批流功能", + "priority": "medium", + }, + headers=auth_header(admin_token), + ) + ticket_id = resp.json()["id"] + + resp2 = await client.post( + f"/api/v1/tickets/{ticket_id}/review", + json={"action": "approve", "comment": "DBA审核通过"}, + headers=auth_header(dba_token), + ) + assert resp2.status_code == 200 + assert resp2.json()["status"] == "reviewing" + + async def test_multi_step_all_approve_becomes_approved(self, client, admin_token, dba_token, test_instance, default_workflow): + """多级审批: 全部通过 → approved""" + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "完整审批测试工单", + "db_type": "mysql", + "instance_id": test_instance.id, + "target_database": "test_db", + "sql_content": "UPDATE users SET status = 'active' WHERE id = 1", + "reason": "测试审批流功能", + "priority": "medium", + }, + headers=auth_header(admin_token), + ) + ticket_id = resp.json()["id"] + + await client.post( + f"/api/v1/tickets/{ticket_id}/review", + json={"action": "approve", "comment": "DBA通过"}, + headers=auth_header(dba_token), + ) + + resp3 = await client.post( + f"/api/v1/tickets/{ticket_id}/review", + json={"action": "approve", "comment": "管理员确认通过"}, + headers=auth_header(admin_token), + ) + assert resp3.status_code == 200 + assert resp3.json()["status"] == "approved" + + async def test_reject_at_any_step(self, client, admin_token, dba_token, test_instance, default_workflow): + """多级审批: 拒绝 → rejected""" + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "被拒绝的测试工单", + "db_type": "mysql", + "instance_id": test_instance.id, + "target_database": "test_db", + "sql_content": "DELETE FROM logs WHERE id < 1000", + "reason": "清理过期日志数据", + "priority": "high", + }, + headers=auth_header(admin_token), + ) + ticket_id = resp.json()["id"] + + resp2 = await client.post( + f"/api/v1/tickets/{ticket_id}/review", + json={"action": "reject", "comment": "风险太高"}, + headers=auth_header(dba_token), + ) + assert resp2.status_code == 200 + assert resp2.json()["status"] == "rejected" + + async def test_no_workflow_single_step_approve(self, client, admin_token, dba_token, test_instance): + """无审批流: 传统单步审批直接 approved""" + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "单步审批测试工单", + "db_type": "mysql", + "instance_id": test_instance.id, + "target_database": "test_db", + "sql_content": "UPDATE users SET name = 'x' WHERE id = 1", + "reason": "测试审批流功能", + "priority": "low", + }, + headers=auth_header(admin_token), + ) + ticket_id = resp.json()["id"] + assert resp.json()["status"] == "pending" + + resp2 = await client.post( + f"/api/v1/tickets/{ticket_id}/review", + json={"action": "approve", "comment": "通过"}, + headers=auth_header(dba_token), + ) + assert resp2.status_code == 200 + assert resp2.json()["status"] == "approved" + + async def test_approvals_endpoint_empty(self, client, admin_token, test_instance): + """无审批流 → approvals 返回空列表""" + resp = await client.post( + "/api/v1/tickets", + json={ + "title": "无审批流测试工单", + "db_type": "mysql", + "instance_id": test_instance.id, + "target_database": "test_db", + "sql_content": "SELECT 1", + "reason": "测试审批流功能", + "priority": "low", + }, + headers=auth_header(admin_token), + ) + ticket_id = resp.json()["id"] + + resp2 = await client.get( + f"/api/v1/tickets/{ticket_id}/approvals", + headers=auth_header(admin_token), + ) + assert resp2.status_code == 200 + assert resp2.json() == [] diff --git a/tests/test_phase1_features.py b/tests/test_phase1_features.py new file mode 100644 index 0000000..7520576 --- /dev/null +++ b/tests/test_phase1_features.py @@ -0,0 +1,280 @@ +"""风险等级评估 + 维护窗口 + 通知脱敏 + SQL items 测试。""" + +import json +import pytest +from unittest.mock import patch, MagicMock + +# ===== 风险等级评估测试 ===== + +class TestRiskEvaluator: + """风险等级自动计算测试。""" + + def test_select_is_low(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("SELECT * FROM users WHERE id = 1") == "low" + + def test_show_is_low(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("SHOW TABLES") == "low" + + def test_explain_is_low(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("EXPLAIN SELECT * FROM users") == "low" + + def test_create_table_is_medium(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("CREATE TABLE t1 (id INT)") == "medium" + + def test_alter_table_is_medium(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("ALTER TABLE users ADD COLUMN age INT") == "medium" + + def test_insert_with_where_is_medium(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level( + "INSERT INTO users (name) VALUES ('test')", + sql_type="DML", + ) == "medium" + + def test_update_without_where_is_high(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("UPDATE users SET status = 1") == "high" + + def test_delete_without_where_is_high(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("DELETE FROM users") == "high" + + def test_alter_drop_column_is_high(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("ALTER TABLE users DROP COLUMN age") == "high" + + def test_alter_modify_column_is_high(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("ALTER TABLE users MODIFY COLUMN age BIGINT") == "high" + + def test_drop_table_is_critical(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("DROP TABLE users") == "critical" + + def test_truncate_is_critical(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("TRUNCATE TABLE users") == "critical" + + def test_drop_database_is_critical(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("DROP DATABASE mydb") == "critical" + + def test_many_statements_is_high(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level( + "SELECT 1", statement_count=10 + ) == "high" + + def test_multiple_audit_errors_is_high(self): + from app.services.risk_evaluator import evaluate_risk_level + findings = [ + {"level": "error", "rule_id": "R1"}, + {"level": "error", "rule_id": "R2"}, + ] + assert evaluate_risk_level( + "UPDATE users SET x=1 WHERE id=1", + sql_type="DML", + audit_findings=findings, + ) == "high" + + def test_delete_with_where_no_limit_is_medium(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level( + "DELETE FROM users WHERE id > 100" + ) == "medium" + + def test_delete_with_where_and_limit_is_low(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level( + "DELETE FROM users WHERE id > 100 LIMIT 10" + ) == "low" + + # Redis 风险 + def test_redis_flushall_is_critical(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("FLUSHALL", db_type="redis") == "critical" + + def test_redis_flushdb_is_critical(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("FLUSHDB", db_type="redis") == "critical" + + def test_redis_set_is_medium(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("SET key value", db_type="redis") == "medium" + + def test_redis_get_is_low(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("GET key", db_type="redis") == "low" + + # MongoDB 风险 + def test_mongo_drop_database_is_critical(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("db.dropDatabase()", db_type="mongodb") == "critical" + + def test_mongo_drop_database_upper_is_critical(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("DROP DATABASE mydb", db_type="mongodb") == "critical" + + def test_mongo_insert_is_medium(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("db.users.insertOne({name: 'test'})", db_type="mongodb") == "medium" + + def test_mongo_find_is_low(self): + from app.services.risk_evaluator import evaluate_risk_level + assert evaluate_risk_level("db.users.find({})", db_type="mongodb") == "low" + + +# ===== 风险等级配置测试 ===== + +class TestRiskLevelConfig: + """风险等级配置验证。""" + + def test_all_levels_have_config(self): + from app.services.risk_evaluator import RISK_LEVEL_CONFIG + for level in ["low", "medium", "high", "critical"]: + assert level in RISK_LEVEL_CONFIG + cfg = RISK_LEVEL_CONFIG[level] + assert "label" in cfg + assert "color" in cfg + assert "min_approvers" in cfg + + def test_high_and_critical_require_2_approvers(self): + from app.services.risk_evaluator import RISK_LEVEL_CONFIG + assert RISK_LEVEL_CONFIG["high"]["min_approvers"] >= 2 + assert RISK_LEVEL_CONFIG["critical"]["min_approvers"] >= 2 + + +# ===== 通知脱敏测试 ===== + +class TestNotificationMasking: + """通知内容脱敏测试。""" + + def test_mask_password_in_sql_preview(self): + from app.services.notification_sender import NotificationSender + data = {"sql_preview": "SET password='secret123' WHERE id=1"} + masked = NotificationSender._mask_sensitive_data(data) + assert "secret123" not in masked["sql_preview"] + assert "***" in masked["sql_preview"] + + def test_mask_drop_table_in_sql_preview(self): + from app.services.notification_sender import NotificationSender + data = {"sql_preview": "DROP TABLE users"} + masked = NotificationSender._mask_sensitive_data(data) + assert "***" in masked["sql_preview"] + + def test_mask_error_field(self): + from app.services.notification_sender import NotificationSender + data = {"error": "Connection failed: password='mysecret'"} + masked = NotificationSender._mask_sensitive_data(data) + assert "mysecret" not in masked["error"] + + def test_truncate_long_sql_preview(self): + from app.services.notification_sender import NotificationSender + long_sql = "SELECT * FROM users WHERE " + "x=1 AND " * 50 + data = {"sql_preview": long_sql} + masked = NotificationSender._mask_sensitive_data(data) + assert len(masked["sql_preview"]) <= 110 # 100 + "..." + + def test_non_sensitive_data_unchanged(self): + from app.services.notification_sender import NotificationSender + data = {"title": "测试工单", "applicant": "张三"} + masked = NotificationSender._mask_sensitive_data(data) + assert masked["title"] == "测试工单" + assert masked["applicant"] == "张三" + + +# ===== 维护窗口测试 ===== + +class TestMaintenanceWindow: + """维护窗口逻辑测试。""" + + def test_no_config_allows_execution(self): + """无配置时允许执行。""" + from app.api.v1.endpoints.ticket import _check_maintenance_window + from unittest.mock import AsyncMock + import asyncio + + mock_db = AsyncMock() + mock_result = MagicMock() + mock_result.scalar_one_or_none.return_value = None + mock_db.execute.return_value = mock_result + + async def run(): + result = await _check_maintenance_window(mock_db) + assert result is None + + asyncio.get_event_loop().run_until_complete(run()) + + def test_disabled_window_allows_execution(self): + """disabled 的窗口允许执行。""" + from app.api.v1.endpoints.ticket import _check_maintenance_window + from app.models.system_setting import SystemSetting + from unittest.mock import AsyncMock + import asyncio + + setting = SystemSetting(key="maintenance_window", value='{"enabled": false}') + mock_db = AsyncMock() + mock_result = MagicMock() + mock_result.scalar_one_or_none.return_value = setting + mock_db.execute.return_value = mock_result + + async def run(): + result = await _check_maintenance_window(mock_db) + assert result is None + + asyncio.get_event_loop().run_until_complete(run()) + + +# ===== SQL 类型分类测试 ===== + +class TestClassifySqlType: + """SQL 类型分类辅助函数测试。""" + + def test_select_is_dql(self): + from app.api.v1.endpoints.ticket import _classify_sql_type + assert _classify_sql_type("SELECT * FROM t") == "DQL" + + def test_insert_is_dml(self): + from app.api.v1.endpoints.ticket import _classify_sql_type + assert _classify_sql_type("INSERT INTO t VALUES (1)") == "DML" + + def test_update_is_dml(self): + from app.api.v1.endpoints.ticket import _classify_sql_type + assert _classify_sql_type("UPDATE t SET x=1") == "DML" + + def test_delete_is_dml(self): + from app.api.v1.endpoints.ticket import _classify_sql_type + assert _classify_sql_type("DELETE FROM t") == "DML" + + def test_create_is_ddl(self): + from app.api.v1.endpoints.ticket import _classify_sql_type + assert _classify_sql_type("CREATE TABLE t (id INT)") == "DDL" + + def test_alter_is_ddl(self): + from app.api.v1.endpoints.ticket import _classify_sql_type + assert _classify_sql_type("ALTER TABLE t ADD COLUMN x INT") == "DDL" + + def test_drop_is_ddl(self): + from app.api.v1.endpoints.ticket import _classify_sql_type + assert _classify_sql_type("DROP TABLE t") == "DDL" + + def test_grant_is_dcl(self): + from app.api.v1.endpoints.ticket import _classify_sql_type + assert _classify_sql_type("GRANT SELECT ON t TO user") == "DCL" + + def test_redis_set(self): + from app.api.v1.endpoints.ticket import _classify_sql_type + assert _classify_sql_type("SET key value") == "SET" + + def test_redis_get(self): + from app.api.v1.endpoints.ticket import _classify_sql_type + assert _classify_sql_type("GET key") == "SET" + + def test_unknown(self): + from app.api.v1.endpoints.ticket import _classify_sql_type + assert _classify_sql_type("UNKNOWN COMMAND") == "OTHER" diff --git a/tests/test_phase2_features.py b/tests/test_phase2_features.py new file mode 100644 index 0000000..3423549 --- /dev/null +++ b/tests/test_phase2_features.py @@ -0,0 +1,189 @@ +"""Phase 2 影响分析测试 — EXPLAIN预检 + 部分失败策略 + 上下文感知规则。""" + +import pytest +from unittest.mock import MagicMock, AsyncMock, patch + + +# ===== EXPLAIN 预检: 表名提取 ===== + +class TestExtractTableNames: + """SQL 表名提取测试。""" + + def test_update_table(self): + from app.services.explain_preview import _extract_table_names + assert "users" in _extract_table_names("UPDATE users SET x=1") + + def test_delete_from_table(self): + from app.services.explain_preview import _extract_table_names + assert "users" in _extract_table_names("DELETE FROM users WHERE id=1") + + def test_alter_table(self): + from app.services.explain_preview import _extract_table_names + assert "orders" in _extract_table_names("ALTER TABLE orders ADD COLUMN price DECIMAL") + + def test_drop_table(self): + from app.services.explain_preview import _extract_table_names + assert "temp" in _extract_table_names("DROP TABLE temp") + + def test_drop_table_if_exists(self): + from app.services.explain_preview import _extract_table_names + assert "temp" in _extract_table_names("DROP TABLE IF EXISTS temp") + + def test_insert_into(self): + from app.services.explain_preview import _extract_table_names + assert "logs" in _extract_table_names("INSERT INTO logs (msg) VALUES ('hi')") + + def test_select_from(self): + from app.services.explain_preview import _extract_table_names + names = _extract_table_names("SELECT * FROM users WHERE id=1") + assert "users" in names + + def test_join_tables(self): + from app.services.explain_preview import _extract_table_names + names = _extract_table_names("SELECT * FROM users JOIN orders ON users.id = orders.user_id") + assert "users" in names + assert "orders" in names + + def test_create_table(self): + from app.services.explain_preview import _extract_table_names + assert "new_table" in _extract_table_names("CREATE TABLE new_table (id INT)") + + def test_create_table_if_not_exists(self): + from app.services.explain_preview import _extract_table_names + assert "new_table" in _extract_table_names("CREATE TABLE IF NOT EXISTS new_table (id INT)") + + def test_deduplication(self): + from app.services.explain_preview import _extract_table_names + names = _extract_table_names("SELECT * FROM users JOIN users AS u2 ON users.id = u2.id") + assert names.count("users") == 1 + + def test_empty_sql(self): + from app.services.explain_preview import _extract_table_names + assert _extract_table_names("") == [] + + +# ===== ExplainResult 测试 ===== + +class TestExplainResult: + """EXPLAIN 结果数据结构测试。""" + + def test_to_dict(self): + from app.services.explain_preview import ExplainResult + r = ExplainResult( + sql="SELECT * FROM users", + sql_type="DQL", + estimated_rows=1000, + full_table_scan=True, + warnings=["Using filesort"], + ) + d = r.to_dict() + assert d["sql_type"] == "DQL" + assert d["estimated_rows"] == 1000 + assert d["full_table_scan"] is True + assert "Using filesort" in d["warnings"] + + def test_error_field(self): + from app.services.explain_preview import ExplainResult + r = ExplainResult(error="Connection refused") + d = r.to_dict() + assert d["error"] == "Connection refused" + + +# ===== 执行策略测试 ===== + +class TestExecStrategy: + """部分失败策略测试。""" + + def test_schema_default_strategy(self): + """TicketCreate schema 默认策略是 stop_on_error。""" + from app.schemas.ticket import TicketCreate + data = TicketCreate( + title="测试工单12345", + db_type="mysql", + instance_id=1, + target_database="test_db", + sql_content="SELECT 1", + reason="测试原因abcde", + ) + assert data.exec_strategy == "stop_on_error" + + def test_schema_continue_strategy(self): + from app.schemas.ticket import TicketCreate + data = TicketCreate( + title="测试工单12345", + db_type="mysql", + instance_id=1, + target_database="test_db", + sql_content="SELECT 1", + reason="测试原因abcde", + exec_strategy="continue", + ) + assert data.exec_strategy == "continue" + + def test_schema_transaction_strategy(self): + from app.schemas.ticket import TicketCreate + data = TicketCreate( + title="测试工单12345", + db_type="mysql", + instance_id=1, + target_database="test_db", + sql_content="SELECT 1", + reason="测试原因abcde", + exec_strategy="transaction", + ) + assert data.exec_strategy == "transaction" + + +# ===== 上下文感知规则测试 ===== + +class TestRiskEvaluatorTableSizes: + """risk_evaluator 大表检测测试（合并自原 CTX-001）。""" + + def test_alter_large_table_upgraded_to_high(self): + """大表 ALTER 升级为 high。""" + from app.services.risk_evaluator import evaluate_risk_level + level = evaluate_risk_level( + "ALTER TABLE big_table ADD COLUMN status INT", + db_type="mysql", + table_sizes={"big_table": 500000}, + ) + assert level == "high" + + def test_alter_small_table_not_upgraded(self): + """小表 ALTER 保持 medium。""" + from app.services.risk_evaluator import evaluate_risk_level + level = evaluate_risk_level( + "ALTER TABLE users ADD COLUMN age INT", + db_type="mysql", + table_sizes={"users": 100}, + ) + assert level == "medium" + + def test_update_large_table_upgraded_to_high(self): + """大表 UPDATE 无 WHERE 升级为 high。""" + from app.services.risk_evaluator import evaluate_risk_level + level = evaluate_risk_level( + "UPDATE big_table SET status = 1", + db_type="mysql", + table_sizes={"big_table": 200000}, + ) + assert level == "high" + + def test_no_table_sizes_no_upgrade(self): + """无 table_sizes 时不升级。""" + from app.services.risk_evaluator import evaluate_risk_level + level = evaluate_risk_level( + "ALTER TABLE users ADD COLUMN age INT", + db_type="mysql", + ) + assert level == "medium" + + def test_select_large_table_stays_low(self): + """SELECT 大表不升级。""" + from app.services.risk_evaluator import evaluate_risk_level + level = evaluate_risk_level( + "SELECT * FROM big_table", + db_type="mysql", + table_sizes={"big_table": 500000}, + ) + assert level == "low" diff --git a/tests/test_pool.py b/tests/test_pool.py new file mode 100644 index 0000000..2c77055 --- /dev/null +++ b/tests/test_pool.py @@ -0,0 +1,329 @@ +"""连接池管理端点完整测试 — pool.py + +覆盖端点: + GET /api/v1/pools/instances/{instance_id}/stats 连接池状态 + POST /api/v1/pools/instances/{instance_id}/reset 重置连接池 + GET /api/v1/pools/overview 所有连接池概览 +""" +import pytest +from unittest.mock import patch, AsyncMock, MagicMock +from httpx import AsyncClient + +from tests.conftest import auth_header + + +# ═══════════════════════════════════════════════════════════════ +# GET /pools/instances/{instance_id}/stats — 连接池状态 +# ═══════════════════════════════════════════════════════════════ + + +class TestPoolStats: + + async def test_stats_not_initialized( + self, client: AsyncClient, admin_token, test_instance + ): + """连接池未初始化时返回 not_initialized。""" + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + manager = MagicMock() + manager.get_pool_stats.return_value = None + mock_pm.return_value = manager + + resp = await client.get( + f"/api/v1/pools/instances/{test_instance.id}/stats", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["status"] == "not_initialized" + assert body["instance_id"] == test_instance.id + + async def test_stats_with_active_pool( + self, client: AsyncClient, admin_token, test_instance + ): + """已初始化的连接池返回统计数据。""" + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + stats = MagicMock() + stats.to_dict.return_value = { + "instance_id": test_instance.id, + "active": 3, + "idle": 2, + "max_size": 10, + } + manager = MagicMock() + manager.get_pool_stats.return_value = stats + mock_pm.return_value = manager + + resp = await client.get( + f"/api/v1/pools/instances/{test_instance.id}/stats", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["active"] == 3 + assert body["idle"] == 2 + + async def test_stats_instance_not_found( + self, client: AsyncClient, admin_token + ): + """数据源不存在返回 404。""" + resp = await client.get( + "/api/v1/pools/instances/9999/stats", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + async def test_stats_dba_allowed( + self, client: AsyncClient, dba_token, test_instance + ): + """DBA 角色可以查看连接池状态。""" + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + stats = MagicMock() + stats.to_dict.return_value = {"active": 0, "idle": 0} + manager = MagicMock() + manager.get_pool_stats.return_value = stats + mock_pm.return_value = manager + + resp = await client.get( + f"/api/v1/pools/instances/{test_instance.id}/stats", + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + async def test_stats_developer_forbidden( + self, client: AsyncClient, developer_token, test_instance + ): + """developer 角色无权查看连接池状态。""" + resp = await client.get( + f"/api/v1/pools/instances/{test_instance.id}/stats", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + async def test_stats_guest_forbidden( + self, client: AsyncClient, guest_token, test_instance + ): + """guest 角色无权查看连接池状态。""" + resp = await client.get( + f"/api/v1/pools/instances/{test_instance.id}/stats", + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + async def test_stats_unauthenticated( + self, client: AsyncClient, test_instance + ): + """未认证请求返回 401。""" + resp = await client.get( + f"/api/v1/pools/instances/{test_instance.id}/stats", + ) + assert resp.status_code == 401 + + async def test_stats_returns_not_initialized_message( + self, client: AsyncClient, admin_token, test_instance + ): + """未初始化时返回友好提示信息。""" + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + manager = MagicMock() + manager.get_pool_stats.return_value = None + mock_pm.return_value = manager + + resp = await client.get( + f"/api/v1/pools/instances/{test_instance.id}/stats", + headers=auth_header(admin_token), + ) + body = resp.json() + assert "message" in body + assert "首次查询" in body["message"] or "初始化" in body["message"] + + +# ═══════════════════════════════════════════════════════════════ +# POST /pools/instances/{instance_id}/reset — 重置连接池 +# ═══════════════════════════════════════════════════════════════ + + +class TestPoolReset: + + async def test_reset_success( + self, client: AsyncClient, admin_token, test_instance + ): + """管理员重置连接池成功。""" + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + manager = MagicMock() + manager.reset_pool = AsyncMock() + mock_pm.return_value = manager + + resp = await client.post( + f"/api/v1/pools/instances/{test_instance.id}/reset", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert "已重置" in body["message"] + assert body["instance_id"] == test_instance.id + + async def test_reset_dba_allowed( + self, client: AsyncClient, dba_token, test_instance + ): + """DBA 角色可以重置连接池。""" + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + manager = MagicMock() + manager.reset_pool = AsyncMock() + mock_pm.return_value = manager + + resp = await client.post( + f"/api/v1/pools/instances/{test_instance.id}/reset", + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + async def test_reset_developer_forbidden( + self, client: AsyncClient, developer_token, test_instance + ): + """developer 角色无权重置连接池。""" + resp = await client.post( + f"/api/v1/pools/instances/{test_instance.id}/reset", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + async def test_reset_guest_forbidden( + self, client: AsyncClient, guest_token, test_instance + ): + """guest 角色无权重置连接池。""" + resp = await client.post( + f"/api/v1/pools/instances/{test_instance.id}/reset", + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + async def test_reset_unauthenticated( + self, client: AsyncClient, test_instance + ): + """未认证请求返回 401。""" + resp = await client.post( + f"/api/v1/pools/instances/{test_instance.id}/reset", + ) + assert resp.status_code == 401 + + async def test_reset_calls_manager_reset_pool( + self, client: AsyncClient, admin_token, test_instance + ): + """验证 reset_pool 被正确调用。""" + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + manager = MagicMock() + manager.reset_pool = AsyncMock() + mock_pm.return_value = manager + + await client.post( + f"/api/v1/pools/instances/{test_instance.id}/reset", + headers=auth_header(admin_token), + ) + manager.reset_pool.assert_awaited_once_with(test_instance.id) + + +# ═══════════════════════════════════════════════════════════════ +# GET /pools/overview — 所有连接池概览 +# ═══════════════════════════════════════════════════════════════ + + +class TestPoolsOverview: + + async def test_overview_empty(self, client: AsyncClient, admin_token): + """无活跃连接池时返回空概览。""" + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + manager = MagicMock() + manager.get_all_stats.return_value = {} + mock_pm.return_value = manager + + resp = await client.get( + "/api/v1/pools/overview", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["total_pools"] == 0 + assert body["pools"] == [] + + async def test_overview_with_pools(self, client: AsyncClient, admin_token): + """有连接池时返回正确概览。""" + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + stats1 = MagicMock() + stats1.to_dict.return_value = {"instance_id": 1, "active": 2} + stats2 = MagicMock() + stats2.to_dict.return_value = {"instance_id": 2, "active": 1} + + manager = MagicMock() + manager.get_all_stats.return_value = {1: stats1, 2: stats2} + mock_pm.return_value = manager + + resp = await client.get( + "/api/v1/pools/overview", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["total_pools"] == 2 + assert len(body["pools"]) == 2 + + async def test_overview_dba_allowed(self, client: AsyncClient, dba_token): + """DBA 角色可以查看连接池概览。""" + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + manager = MagicMock() + manager.get_all_stats.return_value = {} + mock_pm.return_value = manager + + resp = await client.get( + "/api/v1/pools/overview", + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + async def test_overview_developer_forbidden( + self, client: AsyncClient, developer_token + ): + """developer 角色无权查看连接池概览。""" + resp = await client.get( + "/api/v1/pools/overview", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + async def test_overview_guest_forbidden( + self, client: AsyncClient, guest_token + ): + """guest 角色无权查看连接池概览。""" + resp = await client.get( + "/api/v1/pools/overview", + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + async def test_overview_unauthenticated(self, client: AsyncClient): + """未认证请求返回 401。""" + resp = await client.get("/api/v1/pools/overview") + assert resp.status_code == 401 + + async def test_overview_single_pool_data( + self, client: AsyncClient, admin_token + ): + """单个连接池数据验证。""" + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + stats = MagicMock() + stats.to_dict.return_value = { + "instance_id": 42, + "active": 5, + "idle": 3, + "max_size": 10, + } + manager = MagicMock() + manager.get_all_stats.return_value = {42: stats} + mock_pm.return_value = manager + + resp = await client.get( + "/api/v1/pools/overview", + headers=auth_header(admin_token), + ) + body = resp.json() + assert body["total_pools"] == 1 + assert body["pools"][0]["instance_id"] == 42 + assert body["pools"][0]["active"] == 5 diff --git a/tests/test_pool_endpoint.py b/tests/test_pool_endpoint.py new file mode 100644 index 0000000..a674631 --- /dev/null +++ b/tests/test_pool_endpoint.py @@ -0,0 +1,186 @@ +"""连接池管理 API 端点测试。""" +import pytest +from unittest.mock import patch, MagicMock, AsyncMock +from httpx import AsyncClient + +from app.models.user import User +from app.models.instance import Instance +from app.core.security import hash_password, create_access_token + + +def auth_header(token: str) -> dict: + return {"Authorization": f"Bearer {token}"} + + +@pytest.mark.asyncio +class TestPoolStats: + """GET /api/v1/pools/instances/{instance_id}/stats""" + + async def test_pool_stats_initialized( + self, client: AsyncClient, admin_token: str, test_instance + ): + mock_stats = MagicMock() + mock_stats.to_dict.return_value = { + "instance_id": test_instance.id, + "status": "active", + "total_connections": 5, + "active_connections": 2, + "idle_connections": 3, + } + with patch( + "app.api.v1.endpoints.pool.get_pool_manager" + ) as mock_mgr: + mock_mgr.return_value.get_pool_stats.return_value = mock_stats + resp = await client.get( + f"/api/v1/pools/instances/{test_instance.id}/stats", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["status"] == "active" + assert data["total_connections"] == 5 + + async def test_pool_stats_not_initialized( + self, client: AsyncClient, admin_token: str, test_instance + ): + with patch( + "app.api.v1.endpoints.pool.get_pool_manager" + ) as mock_mgr: + mock_mgr.return_value.get_pool_stats.return_value = None + resp = await client.get( + f"/api/v1/pools/instances/{test_instance.id}/stats", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["status"] == "not_initialized" + + async def test_pool_stats_instance_not_found( + self, client: AsyncClient, admin_token: str + ): + resp = await client.get( + "/api/v1/pools/instances/9999/stats", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + async def test_pool_stats_forbidden_developer( + self, client: AsyncClient, developer_token: str, test_instance + ): + resp = await client.get( + f"/api/v1/pools/instances/{test_instance.id}/stats", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + async def test_pool_stats_dba_allowed( + self, client: AsyncClient, dba_token: str, test_instance + ): + with patch( + "app.api.v1.endpoints.pool.get_pool_manager" + ) as mock_mgr: + mock_mgr.return_value.get_pool_stats.return_value = None + resp = await client.get( + f"/api/v1/pools/instances/{test_instance.id}/stats", + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + +@pytest.mark.asyncio +class TestResetPool: + """POST /api/v1/pools/instances/{instance_id}/reset""" + + async def test_reset_pool_success( + self, client: AsyncClient, admin_token: str, test_instance + ): + with patch( + "app.api.v1.endpoints.pool.get_pool_manager" + ) as mock_mgr: + mock_mgr.return_value.reset_pool = AsyncMock() + resp = await client.post( + f"/api/v1/pools/instances/{test_instance.id}/reset", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert "已重置" in data["message"] + assert data["instance_id"] == test_instance.id + + async def test_reset_pool_dba_allowed( + self, client: AsyncClient, dba_token: str, test_instance + ): + with patch( + "app.api.v1.endpoints.pool.get_pool_manager" + ) as mock_mgr: + mock_mgr.return_value.reset_pool = AsyncMock() + resp = await client.post( + f"/api/v1/pools/instances/{test_instance.id}/reset", + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + async def test_reset_pool_forbidden_developer( + self, client: AsyncClient, developer_token: str, test_instance + ): + resp = await client.post( + f"/api/v1/pools/instances/{test_instance.id}/reset", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +class TestPoolsOverview: + """GET /api/v1/pools/overview""" + + async def test_pools_overview_empty( + self, client: AsyncClient, admin_token: str + ): + with patch( + "app.api.v1.endpoints.pool.get_pool_manager" + ) as mock_mgr: + mock_mgr.return_value.get_all_stats.return_value = {} + resp = await client.get( + "/api/v1/pools/overview", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["total_pools"] == 0 + assert data["pools"] == [] + + async def test_pools_overview_with_pools( + self, client: AsyncClient, admin_token: str + ): + mock_stats = MagicMock() + mock_stats.to_dict.return_value = { + "instance_id": 1, + "status": "active", + "total_connections": 10, + } + with patch( + "app.api.v1.endpoints.pool.get_pool_manager" + ) as mock_mgr: + mock_mgr.return_value.get_all_stats.return_value = {1: mock_stats} + resp = await client.get( + "/api/v1/pools/overview", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["total_pools"] == 1 + assert len(data["pools"]) == 1 + + async def test_pools_overview_unauthorized(self, client: AsyncClient): + resp = await client.get("/api/v1/pools/overview") + assert resp.status_code == 401 + + async def test_pools_overview_forbidden_guest( + self, client: AsyncClient, guest_token: str + ): + resp = await client.get( + "/api/v1/pools/overview", + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 diff --git a/tests/test_query.py b/tests/test_query.py new file mode 100644 index 0000000..10c281d --- /dev/null +++ b/tests/test_query.py @@ -0,0 +1,532 @@ +import sys +from contextlib import asynccontextmanager +from unittest.mock import patch, AsyncMock, MagicMock + +import pytest +from httpx import AsyncClient + +from app.core.crypto import encrypt_password +from app.models.instance_group import InstanceGroup, user_groups +from tests.conftest import auth_header + + +# --------------------------------------------------------------------------- +# Helpers +# --------------------------------------------------------------------------- + +def _make_aiomysql_mock(): + aiomysql = MagicMock() + aiomysql.connect = AsyncMock() + aiomysql.DictCursor = MagicMock() + return aiomysql + + +def _build_mock_query_result(): + """Return a mock UnifiedQueryResult for SELECT queries.""" + from app.schemas.query import UnifiedQueryResult + return UnifiedQueryResult( + columns=["id", "name"], + rows=[{"id": 1, "name": "test"}], + total=1, + elapsed_ms=10, + truncated=False, + db_type="mysql", + query_type="SELECT", + ) + + +async def _create_grouped_instance(db, group_id, **overrides): + """Create an instance bound to the given group.""" + from app.models.instance import Instance + defaults = dict( + name="GroupedMySQL", + db_type="mysql", + host="127.0.0.1", + port=3306, + username="root", + password=encrypt_password("test123"), + database="test_db", + env="development", + status="disconnected", + group_id=group_id, + ) + defaults.update(overrides) + inst = Instance(**defaults) + db.add(inst) + await db.commit() + await db.refresh(inst) + return inst + + +# =================================================================== +# 1. POST /query — execute_query +# =================================================================== + +class TestExecuteQuery: + """Tests for POST /api/v1/query""" + + # ---- happy path ------------------------------------------------ + + async def test_select_query_success( + self, client: AsyncClient, test_instance, admin_token + ): + mock_result = _build_mock_query_result() + + with patch( + "app.api.v1.endpoints.query.QueryService.execute_query", + new_callable=AsyncMock, + return_value=mock_result, + ): + resp = await client.post( + "/api/v1/query", + headers=auth_header(admin_token), + json={ + "instance_id": test_instance.id, + "database": "test_db", + "sql": "SELECT * FROM users LIMIT 10", + }, + ) + assert resp.status_code == 200 + data = resp.json() + assert "columns" in data + assert "rows" in data + assert data["total"] == 1 + assert data["query_type"] == "SELECT" + + # ---- forbidden SQL (DDL / DML) --------------------------------- + + async def test_drop_rejected( + self, client: AsyncClient, test_instance, admin_token + ): + """DDL like DROP should be rejected by the query service (ValueError → 400).""" + with patch( + "app.api.v1.endpoints.query.QueryService.execute_query", + new_callable=AsyncMock, + side_effect=ValueError("不允许执行非SELECT语句"), + ): + resp = await client.post( + "/api/v1/query", + headers=auth_header(admin_token), + json={ + "instance_id": test_instance.id, + "database": "test_db", + "sql": "DROP TABLE users", + }, + ) + assert resp.status_code == 400 + + async def test_delete_rejected( + self, client: AsyncClient, test_instance, admin_token + ): + with patch( + "app.api.v1.endpoints.query.QueryService.execute_query", + new_callable=AsyncMock, + side_effect=ValueError("不允许执行非SELECT语句"), + ): + resp = await client.post( + "/api/v1/query", + headers=auth_header(admin_token), + json={ + "instance_id": test_instance.id, + "database": "test_db", + "sql": "DELETE FROM users WHERE 1=1", + }, + ) + assert resp.status_code == 400 + + # ---- guest blocked --------------------------------------------- + + async def test_guest_cannot_query( + self, client: AsyncClient, test_instance, guest_token + ): + resp = await client.post( + "/api/v1/query", + headers=auth_header(guest_token), + json={ + "instance_id": test_instance.id, + "database": "test_db", + "sql": "SELECT 1", + }, + ) + assert resp.status_code == 403 + + # ---- instance not found ---------------------------------------- + + async def test_nonexistent_instance(self, client: AsyncClient, admin_token): + resp = await client.post( + "/api/v1/query", + headers=auth_header(admin_token), + json={ + "instance_id": 99999, + "database": "test_db", + "sql": "SELECT 1", + }, + ) + assert resp.status_code == 404 + + # ---- missing sql parameter (validation) ------------------------ + + async def test_missing_sql_parameter( + self, client: AsyncClient, test_instance, admin_token + ): + resp = await client.post( + "/api/v1/query", + headers=auth_header(admin_token), + json={ + "instance_id": test_instance.id, + "database": "test_db", + # no "sql" field + }, + ) + assert resp.status_code == 422 # Pydantic validation error + + # ---- empty sql string ------------------------------------------ + + async def test_empty_sql_string( + self, client: AsyncClient, test_instance, admin_token + ): + resp = await client.post( + "/api/v1/query", + headers=auth_header(admin_token), + json={ + "instance_id": test_instance.id, + "database": "test_db", + "sql": "", + }, + ) + assert resp.status_code == 422 + + # ---- internal server error from query service ------------------ + + async def test_query_service_exception( + self, client: AsyncClient, test_instance, admin_token + ): + with patch( + "app.api.v1.endpoints.query.QueryService.execute_query", + new_callable=AsyncMock, + side_effect=RuntimeError("connection lost"), + ): + resp = await client.post( + "/api/v1/query", + headers=auth_header(admin_token), + json={ + "instance_id": test_instance.id, + "database": "test_db", + "sql": "SELECT 1", + }, + ) + assert resp.status_code == 500 + + # ---- mask=false query param ------------------------------------ + + async def test_select_query_no_mask( + self, client: AsyncClient, test_instance, admin_token + ): + mock_result = _build_mock_query_result() + + with patch( + "app.api.v1.endpoints.query.QueryService.execute_query", + new_callable=AsyncMock, + return_value=mock_result, + ): + resp = await client.post( + "/api/v1/query?mask=false", + headers=auth_header(admin_token), + json={ + "instance_id": test_instance.id, + "database": "test_db", + "sql": "SELECT * FROM users LIMIT 10", + }, + ) + assert resp.status_code == 200 + + # ---- save_history=false query param ---------------------------- + + async def test_select_query_no_history( + self, client: AsyncClient, test_instance, admin_token + ): + mock_result = _build_mock_query_result() + + with patch( + "app.api.v1.endpoints.query.QueryService.execute_query", + new_callable=AsyncMock, + return_value=mock_result, + ), patch( + "app.api.v1.endpoints.query.QueryHistoryService.record_query", + new_callable=AsyncMock, + ) as mock_hist: + resp = await client.post( + "/api/v1/query?save_history=false", + headers=auth_header(admin_token), + json={ + "instance_id": test_instance.id, + "database": "test_db", + "sql": "SELECT 1", + }, + ) + assert resp.status_code == 200 + # history should NOT be recorded + mock_hist.assert_not_called() + + # ---- unauthenticated request ----------------------------------- + + async def test_unauthenticated_request(self, client: AsyncClient, test_instance): + resp = await client.post( + "/api/v1/query", + json={ + "instance_id": test_instance.id, + "database": "test_db", + "sql": "SELECT 1", + }, + ) + assert resp.status_code == 401 + + # ---- developer can query public instance ----------------------- + + async def test_developer_can_query_public_instance( + self, client: AsyncClient, test_instance, developer_token + ): + """Public instance (no group_id) is accessible to developer.""" + mock_result = _build_mock_query_result() + + with patch( + "app.api.v1.endpoints.query.QueryService.execute_query", + new_callable=AsyncMock, + return_value=mock_result, + ): + resp = await client.post( + "/api/v1/query", + headers=auth_header(developer_token), + json={ + "instance_id": test_instance.id, + "database": "test_db", + "sql": "SELECT 1", + }, + ) + assert resp.status_code == 200 + + # ---- developer blocked from grouped instance without membership -- + + async def test_developer_blocked_from_grouped_instance( + self, client: AsyncClient, db, developer_token + ): + """Instance in a group where developer is not a member → 403.""" + group = InstanceGroup(name="private-group", db_type="mysql") + db.add(group) + await db.commit() + await db.refresh(group) + + inst = await _create_grouped_instance(db, group.id) + + resp = await client.post( + "/api/v1/query", + headers=auth_header(developer_token), + json={ + "instance_id": inst.id, + "database": "test_db", + "sql": "SELECT 1", + }, + ) + assert resp.status_code == 403 + + # ---- developer with group membership can query ----------------- + + async def test_developer_with_group_membership_can_query( + self, client: AsyncClient, db, developer_user, developer_token + ): + """Developer belongs to the instance group → 200.""" + group = InstanceGroup( + name="dev-group", + db_type="mysql", + permissions='["query:select"]', + ) + db.add(group) + await db.commit() + await db.refresh(group) + + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, + group_id=group.id, + permissions='["query:select"]', + ) + ) + await db.commit() + + inst = await _create_grouped_instance(db, group.id) + + mock_result = _build_mock_query_result() + with patch( + "app.api.v1.endpoints.query.QueryService.execute_query", + new_callable=AsyncMock, + return_value=mock_result, + ): + resp = await client.post( + "/api/v1/query", + headers=auth_header(developer_token), + json={ + "instance_id": inst.id, + "database": "test_db", + "sql": "SELECT 1", + }, + ) + assert resp.status_code == 200 + + # ---- permission check: missing query:select → 403 -------------- + + async def test_developer_without_query_select_permission( + self, client: AsyncClient, db, developer_user, developer_token + ): + """Developer in group but without query:select permission → 403.""" + group = InstanceGroup( + name="no-query-group", + db_type="mysql", + permissions='["slowlog:view"]', # no query:select + ) + db.add(group) + await db.commit() + await db.refresh(group) + + await db.execute( + user_groups.insert().values( + user_id=developer_user.id, + group_id=group.id, + permissions='["slowlog:view"]', + ) + ) + await db.commit() + + inst = await _create_grouped_instance(db, group.id) + + resp = await client.post( + "/api/v1/query", + headers=auth_header(developer_token), + json={ + "instance_id": inst.id, + "database": "test_db", + "sql": "SELECT 1", + }, + ) + assert resp.status_code == 403 + + # ---- DBA can always query (admin bypass) ----------------------- + + async def test_dba_can_query_any_instance( + self, client: AsyncClient, db, dba_token + ): + """DBA is not admin, but can query a public instance.""" + from app.models.instance import Instance + + inst = Instance( + name="dba-test", + db_type="mysql", + host="127.0.0.1", + port=3306, + username="root", + password=encrypt_password("pw"), + database="test_db", + env="development", + status="disconnected", + ) + db.add(inst) + await db.commit() + await db.refresh(inst) + + mock_result = _build_mock_query_result() + with patch( + "app.api.v1.endpoints.query.QueryService.execute_query", + new_callable=AsyncMock, + return_value=mock_result, + ): + resp = await client.post( + "/api/v1/query", + headers=auth_header(dba_token), + json={ + "instance_id": inst.id, + "database": "test_db", + "sql": "SELECT 1", + }, + ) + assert resp.status_code == 200 + + +# =================================================================== +# 2. GET /query/supported-types +# =================================================================== + +class TestSupportedTypes: + """Tests for GET /api/v1/query/supported-types""" + + async def test_supported_types_returns_200( + self, client: AsyncClient, admin_token + ): + resp = await client.get( + "/api/v1/query/supported-types", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert "types" in data + types = data["types"] + assert len(types) >= 4 + type_names = [t["type"] for t in types] + assert "mysql" in type_names + assert "postgres" in type_names + assert "redis" in type_names + assert "mongo" in type_names + + async def test_supported_types_each_entry_has_required_fields( + self, client: AsyncClient, admin_token + ): + resp = await client.get( + "/api/v1/query/supported-types", + headers=auth_header(admin_token), + ) + data = resp.json() + for entry in data["types"]: + assert "type" in entry + assert "name" in entry + assert "query_format" in entry + assert "example" in entry + assert "security" in entry + assert "features" in entry + + async def test_supported_types_unauthenticated( + self, client: AsyncClient + ): + resp = await client.get("/api/v1/query/supported-types") + assert resp.status_code == 401 + + async def test_supported_types_developer( + self, client: AsyncClient, developer_token + ): + """Non-admin authenticated user can also view supported types.""" + resp = await client.get( + "/api/v1/query/supported-types", + headers=auth_header(developer_token), + ) + assert resp.status_code == 200 + + async def test_supported_types_redis_has_readonly_commands( + self, client: AsyncClient, admin_token + ): + resp = await client.get( + "/api/v1/query/supported-types", + headers=auth_header(admin_token), + ) + data = resp.json() + redis_entry = next(t for t in data["types"] if t["type"] == "redis") + assert "readonly_commands" in redis_entry + assert "GET" in redis_entry["readonly_commands"] + + async def test_supported_types_mongo_has_readonly_operations( + self, client: AsyncClient, admin_token + ): + resp = await client.get( + "/api/v1/query/supported-types", + headers=auth_header(admin_token), + ) + data = resp.json() + mongo_entry = next(t for t in data["types"] if t["type"] == "mongo") + assert "readonly_operations" in mongo_entry + assert "find" in mongo_entry["readonly_operations"] diff --git a/tests/test_query_history_service.py b/tests/test_query_history_service.py new file mode 100644 index 0000000..408f5f3 --- /dev/null +++ b/tests/test_query_history_service.py @@ -0,0 +1,768 @@ +"""查询历史和快捷查询 持久化测试 — 验证 SQLite 存储。 + +测试范围: +- 查询历史记录和查看（CRUD + 分页 + 过滤） +- 收藏切换 +- 快捷查询 CRUD +- 查询统计 +- 权限控制 +- 预置模板 +""" +import pytest +import pytest_asyncio +from sqlalchemy.ext.asyncio import AsyncSession + +from app.core.security import create_access_token, hash_password +from app.models.user import User +from app.models.query_history import QueryHistory, QuickQueryModel +from app.services.query_history_service import QueryHistoryService + + +@pytest_asyncio.fixture +async def admin_headers(admin_token: str) -> dict: + return {"Authorization": f"Bearer {admin_token}"} + + +@pytest_asyncio.fixture +async def developer_headers(developer_token: str) -> dict: + return {"Authorization": f"Bearer {developer_token}"} + + +@pytest_asyncio.fixture +async def guest_headers(guest_token: str) -> dict: + return {"Authorization": f"Bearer {guest_token}"} + + +# ── 查询历史记录 ── + + +class TestQueryHistoryRecord: + """查询历史记录功能测试。""" + + @pytest.mark.asyncio + async def test_record_query(self, db: AsyncSession): + """测试记录一条查询。""" + entry = await QueryHistoryService.record_query( + db=db, + user_id=1, + username="admin", + instance_id=1, + instance_name="测试MySQL", + db_type="mysql", + database_name="test_db", + query_content="SELECT * FROM users LIMIT 10", + query_type="SELECT", + execution_time_ms=50, + result_rows=10, + ) + await db.commit() + assert entry.id > 0 + assert entry.user_id == 1 + assert entry.db_type == "mysql" + assert entry.query_type == "SELECT" + assert entry.execution_time_ms == 50 + assert entry.result_rows == 10 + assert entry.is_success is True + assert entry.error_message is None + + @pytest.mark.asyncio + async def test_record_failed_query(self, db: AsyncSession): + """测试记录失败的查询。""" + entry = await QueryHistoryService.record_query( + db=db, + user_id=1, + username="admin", + instance_id=1, + instance_name="测试MySQL", + db_type="mysql", + database_name="test_db", + query_content="SELECT * FROM nonexistent", + query_type="SELECT", + execution_time_ms=10, + result_rows=0, + is_success=False, + error_message="Table doesn't exist", + ) + await db.commit() + assert entry.is_success is False + assert entry.error_message == "Table doesn't exist" + + @pytest.mark.asyncio + async def test_record_multiple_db_types(self, db: AsyncSession): + """测试记录不同数据库类型的查询。""" + for db_type, query, q_type in [ + ("mysql", "SELECT 1", "SELECT"), + ("postgres", "SELECT version()", "SELECT"), + ("redis", "GET mykey", "GET"), + ("mongo", '{"collection": "users", "operation": "find"}', "find"), + ]: + entry = await QueryHistoryService.record_query( + db=db, + user_id=1, + username="admin", + instance_id=1, + instance_name="测试", + db_type=db_type, + database_name="test", + query_content=query, + query_type=q_type, + execution_time_ms=10, + result_rows=1, + ) + await db.commit() + assert entry.db_type == db_type + assert entry.query_type == q_type + + @pytest.mark.asyncio + async def test_record_query_long_content_truncated(self, db: AsyncSession): + """测试超长查询内容被截断。""" + long_sql = "SELECT * FROM t WHERE id = " + "1" * 3000 + entry = await QueryHistoryService.record_query( + db=db, + user_id=1, + username="admin", + instance_id=1, + instance_name="测试", + db_type="mysql", + database_name="test", + query_content=long_sql, + query_type="SELECT", + execution_time_ms=10, + result_rows=0, + ) + await db.commit() + assert len(entry.query_content) == 2000 + + @pytest.mark.asyncio + async def test_record_query_max_history_per_user(self, db: AsyncSession): + """测试每个用户最多保留500条记录。""" + # 创建超过限制的记录 + for i in range(510): + await QueryHistoryService.record_query( + db=db, + user_id=99, + username="test_user", + instance_id=1, + instance_name="测试", + db_type="mysql", + database_name="test", + query_content=f"SELECT {i}", + query_type="SELECT", + execution_time_ms=i, + result_rows=0, + ) + await db.commit() + + from sqlalchemy import select, func + count_stmt = select(func.count()).select_from(QueryHistory).where( + QueryHistory.user_id == 99 + ) + total = (await db.execute(count_stmt)).scalar() + assert total <= 500 + + +# ── 查询历史查看 ── + + +class TestQueryHistoryView: + """查询历史查看功能测试。""" + + async def _setup_history(self, db: AsyncSession): + """准备测试数据。""" + entries = [ + ("SELECT * FROM users", "mysql", 1, 50, 10), + ("SELECT * FROM orders", "mysql", 1, 30, 20), + ("GET mykey", "redis", 2, 5, 1), + ("SELECT version()", "postgres", 3, 15, 1), + ] + for sql, db_type, inst_id, time_ms, rows in entries: + await QueryHistoryService.record_query( + db=db, + user_id=1, + username="admin", + instance_id=inst_id, + instance_name=f"测试{db_type}", + db_type=db_type, + database_name="test", + query_content=sql, + query_type="SELECT" if db_type != "redis" else "GET", + execution_time_ms=time_ms, + result_rows=rows, + ) + await db.commit() + + @pytest.mark.asyncio + async def test_get_history_default(self, db: AsyncSession): + """测试默认查看历史。""" + await self._setup_history(db) + result = await QueryHistoryService.get_history(db=db, user_id=1) + assert result["total"] == 4 + assert result["page"] == 1 + assert result["page_size"] == 20 + assert len(result["items"]) == 4 + + @pytest.mark.asyncio + async def test_get_history_filter_by_db_type(self, db: AsyncSession): + """测试按数据库类型筛选。""" + await self._setup_history(db) + result = await QueryHistoryService.get_history(db=db, user_id=1, db_type="mysql") + assert result["total"] == 2 + for item in result["items"]: + assert item["db_type"] == "mysql" + + @pytest.mark.asyncio + async def test_get_history_filter_by_instance(self, db: AsyncSession): + """测试按实例ID筛选。""" + await self._setup_history(db) + result = await QueryHistoryService.get_history(db=db, user_id=1, instance_id=2) + assert result["total"] == 1 + assert result["items"][0]["db_type"] == "redis" + + @pytest.mark.asyncio + async def test_get_history_filter_by_keyword(self, db: AsyncSession): + """测试按关键词筛选。""" + await self._setup_history(db) + result = await QueryHistoryService.get_history(db=db, user_id=1, keyword="users") + assert result["total"] == 1 + assert "users" in result["items"][0]["query_content"].lower() + + @pytest.mark.asyncio + async def test_get_history_pagination(self, db: AsyncSession): + """测试分页。""" + await self._setup_history(db) + result = await QueryHistoryService.get_history(db=db, user_id=1, page=1, page_size=2) + assert result["total"] == 4 + assert len(result["items"]) == 2 + + result2 = await QueryHistoryService.get_history(db=db, user_id=1, page=2, page_size=2) + assert result2["total"] == 4 + assert len(result2["items"]) == 2 + + @pytest.mark.asyncio + async def test_get_history_other_user_empty(self, db: AsyncSession): + """测试查看其他用户的历史为空。""" + await self._setup_history(db) + result = await QueryHistoryService.get_history(db=db, user_id=999) + assert result["total"] == 0 + assert result["items"] == [] + + @pytest.mark.asyncio + async def test_history_sorted_by_time_desc(self, db: AsyncSession): + """测试历史按时间倒序排列。""" + await self._setup_history(db) + result = await QueryHistoryService.get_history(db=db, user_id=1) + times = [item["created_at"] for item in result["items"]] + assert times == sorted(times, reverse=True) + + +# ── 收藏功能 ── + + +class TestQueryHistoryFavorite: + """查询收藏功能测试。""" + + async def _setup_for_favorite(self, db: AsyncSession): + entry = await QueryHistoryService.record_query( + db=db, + user_id=1, username="admin", instance_id=1, + instance_name="测试", db_type="mysql", database_name="test", + query_content="SELECT 1", query_type="SELECT", + execution_time_ms=10, result_rows=1, + ) + await db.commit() + return entry.id + + @pytest.mark.asyncio + async def test_toggle_favorite_add(self, db: AsyncSession): + """测试添加收藏。""" + entry_id = await self._setup_for_favorite(db) + is_fav = await QueryHistoryService.toggle_favorite(db=db, user_id=1, history_id=entry_id) + await db.commit() + assert is_fav is True + + @pytest.mark.asyncio + async def test_toggle_favorite_remove(self, db: AsyncSession): + """测试取消收藏。""" + entry_id = await self._setup_for_favorite(db) + await QueryHistoryService.toggle_favorite(db=db, user_id=1, history_id=entry_id) + await db.commit() + is_fav = await QueryHistoryService.toggle_favorite(db=db, user_id=1, history_id=entry_id) + await db.commit() + assert is_fav is False + + @pytest.mark.asyncio + async def test_get_favorites(self, db: AsyncSession): + """测试获取收藏列表。""" + entry_id = await self._setup_for_favorite(db) + await QueryHistoryService.toggle_favorite(db=db, user_id=1, history_id=entry_id) + await db.commit() + + result = await QueryHistoryService.get_favorites(db=db, user_id=1) + assert result["total"] == 1 + assert result["items"][0]["id"] == entry_id + + @pytest.mark.asyncio + async def test_get_favorites_empty(self, db: AsyncSession): + """测试无收藏时返回空列表。""" + result = await QueryHistoryService.get_favorites(db=db, user_id=1) + assert result["total"] == 0 + assert result["items"] == [] + + @pytest.mark.asyncio + async def test_favorites_per_user(self, db: AsyncSession): + """测试收藏是用户隔离的。""" + entry_id = await self._setup_for_favorite(db) + await QueryHistoryService.toggle_favorite(db=db, user_id=1, history_id=entry_id) + await db.commit() + + result = await QueryHistoryService.get_favorites(db=db, user_id=999) + assert result["total"] == 0 + + +# ── 快捷查询 ── + + +class TestQuickQueries: + """快捷查询功能测试。""" + + @pytest.mark.asyncio + async def test_create_quick_query(self, db: AsyncSession): + """测试创建快捷查询。""" + qq = await QueryHistoryService.create_quick_query( + db=db, + name="查看活跃用户", + description="查看最近活跃的用户列表", + query_content="SELECT * FROM users WHERE last_login > DATE_SUB(NOW(), INTERVAL 7 DAY)", + db_type="mysql", + database_pattern="*", + is_shared=False, + created_by=1, + created_by_name="admin", + ) + await db.commit() + assert qq.id > 0 + assert qq.name == "查看活跃用户" + assert qq.is_shared is False + assert qq.created_by == 1 + + @pytest.mark.asyncio + async def test_get_quick_queries_personal(self, db: AsyncSession): + """测试获取个人快捷查询。""" + await QueryHistoryService.create_quick_query( + db=db, name="个人查询", description="", query_content="SELECT 1", + db_type="mysql", database_pattern="*", + is_shared=False, created_by=1, created_by_name="admin", + ) + await QueryHistoryService.create_quick_query( + db=db, name="他人查询", description="", query_content="SELECT 2", + db_type="mysql", database_pattern="*", + is_shared=False, created_by=2, created_by_name="dba", + ) + await db.commit() + + # 用户1只能看到自己的 + 共享的 + items = await QueryHistoryService.get_quick_queries(db=db, user_id=1) + assert len(items) == 1 + assert items[0]["name"] == "个人查询" + + @pytest.mark.asyncio + async def test_get_quick_queries_shared(self, db: AsyncSession): + """测试获取共享快捷查询。""" + await QueryHistoryService.create_quick_query( + db=db, name="共享查询", description="", query_content="SELECT 1", + db_type="mysql", database_pattern="*", + is_shared=True, created_by=2, created_by_name="dba", + ) + await db.commit() + + items = await QueryHistoryService.get_quick_queries(db=db, user_id=1) + assert len(items) == 1 + assert items[0]["is_shared"] is True + + @pytest.mark.asyncio + async def test_get_quick_queries_filter_db_type(self, db: AsyncSession): + """测试按数据库类型筛选快捷查询。""" + await QueryHistoryService.create_quick_query( + db=db, name="MySQL查询", description="", query_content="SELECT 1", + db_type="mysql", database_pattern="*", + is_shared=True, created_by=1, created_by_name="admin", + ) + await QueryHistoryService.create_quick_query( + db=db, name="Redis查询", description="", query_content="GET key", + db_type="redis", database_pattern="*", + is_shared=True, created_by=1, created_by_name="admin", + ) + await db.commit() + + items = await QueryHistoryService.get_quick_queries(db=db, user_id=1, db_type="redis") + assert len(items) == 1 + assert items[0]["db_type"] == "redis" + + @pytest.mark.asyncio + async def test_get_quick_queries_filter_keyword(self, db: AsyncSession): + """测试按关键词筛选快捷查询。""" + await QueryHistoryService.create_quick_query( + db=db, name="查看活跃用户", description="", query_content="SELECT 1", + db_type="mysql", database_pattern="*", + is_shared=True, created_by=1, created_by_name="admin", + ) + await QueryHistoryService.create_quick_query( + db=db, name="查看慢查询", description="", query_content="SELECT 2", + db_type="mysql", database_pattern="*", + is_shared=True, created_by=1, created_by_name="admin", + ) + await db.commit() + + items = await QueryHistoryService.get_quick_queries(db=db, user_id=1, keyword="活跃") + assert len(items) == 1 + assert "活跃" in items[0]["name"] + + @pytest.mark.asyncio + async def test_use_quick_query(self, db: AsyncSession): + """测试使用快捷查询。""" + qq = await QueryHistoryService.create_quick_query( + db=db, name="测试", description="", query_content="SELECT 1", + db_type="mysql", database_pattern="*", + is_shared=True, created_by=1, created_by_name="admin", + ) + await db.commit() + + content = await QueryHistoryService.use_quick_query(db, qq.id) + await db.commit() + assert content == "SELECT 1" + + @pytest.mark.asyncio + async def test_use_quick_query_increments_count(self, db: AsyncSession): + """测试使用快捷查询增加使用次数。""" + qq = await QueryHistoryService.create_quick_query( + db=db, name="测试", description="", query_content="SELECT 1", + db_type="mysql", database_pattern="*", + is_shared=True, created_by=1, created_by_name="admin", + ) + await db.commit() + assert qq.usage_count == 0 + + await QueryHistoryService.use_quick_query(db, qq.id) + await db.commit() + assert qq.usage_count == 1 + + await QueryHistoryService.use_quick_query(db, qq.id) + await db.commit() + assert qq.usage_count == 2 + + @pytest.mark.asyncio + async def test_use_quick_query_not_found(self, db: AsyncSession): + """测试使用不存在的快捷查询。""" + content = await QueryHistoryService.use_quick_query(db, 99999) + assert content is None + + +# ── 预置模板 ── + + +class TestDefaultQuickQueries: + """预置快捷查询模板测试。""" + + @pytest.mark.asyncio + async def test_default_templates_exist(self, db: AsyncSession): + """测试预置模板存在。""" + await QueryHistoryService.seed_default_quick_queries(db) + await db.commit() + + items = await QueryHistoryService.get_quick_queries(db=db, user_id=1) + # 预置了10个模板 + assert len(items) == 10 + + @pytest.mark.asyncio + async def test_default_templates_cover_db_types(self, db: AsyncSession): + """测试预置模板覆盖所有数据库类型。""" + await QueryHistoryService.seed_default_quick_queries(db) + await db.commit() + + items = await QueryHistoryService.get_quick_queries(db=db, user_id=1) + db_types = {item["db_type"] for item in items} + assert "mysql" in db_types + assert "redis" in db_types + assert "postgres" in db_types + assert "mongo" in db_types + + @pytest.mark.asyncio + async def test_default_templates_all_shared(self, db: AsyncSession): + """测试预置模板都是共享的。""" + await QueryHistoryService.seed_default_quick_queries(db) + await db.commit() + + items = await QueryHistoryService.get_quick_queries(db=db, user_id=1) + for item in items: + assert item["is_shared"] is True + + @pytest.mark.asyncio + async def test_default_templates_system_created(self, db: AsyncSession): + """测试预置模板由系统创建。""" + await QueryHistoryService.seed_default_quick_queries(db) + await db.commit() + + items = await QueryHistoryService.get_quick_queries(db=db, user_id=1) + for item in items: + assert item["created_by_name"] == "系统" + + @pytest.mark.asyncio + async def test_seed_idempotent(self, db: AsyncSession): + """测试 seed 是幂等的（多次调用不会重复插入）。""" + await QueryHistoryService.seed_default_quick_queries(db) + await db.commit() + await QueryHistoryService.seed_default_quick_queries(db) + await db.commit() + + items = await QueryHistoryService.get_quick_queries(db=db, user_id=1) + assert len(items) == 10 + + +# ── 查询统计 ── + + +class TestQueryStatistics: + """查询统计功能测试。""" + + async def _setup_stats(self, db: AsyncSession): + for i in range(5): + await QueryHistoryService.record_query( + db=db, user_id=1, username="admin", instance_id=1, + instance_name="测试", db_type="mysql", database_name="test", + query_content=f"SELECT * FROM table_{i} WHERE id = 1", + query_type="SELECT", + execution_time_ms=10 + i * 10, + result_rows=i + 1, + ) + for i in range(3): + await QueryHistoryService.record_query( + db=db, user_id=1, username="admin", instance_id=2, + instance_name="测试Redis", db_type="redis", database_name="db0", + query_content="GET mykey", + query_type="GET", + execution_time_ms=5, + result_rows=1, + ) + await db.commit() + + @pytest.mark.asyncio + async def test_statistics_basic(self, db: AsyncSession): + """测试基本统计。""" + await self._setup_stats(db) + stats = await QueryHistoryService.get_query_statistics(db=db, user_id=1) + + assert stats["total_queries"] == 8 + assert stats["avg_execution_time_ms"] > 0 + assert stats["success_rate"] == 100.0 + + @pytest.mark.asyncio + async def test_statistics_db_type_distribution(self, db: AsyncSession): + """测试数据库类型分布统计。""" + await self._setup_stats(db) + stats = await QueryHistoryService.get_query_statistics(db=db, user_id=1) + + assert "mysql" in stats["db_type_distribution"] + assert "redis" in stats["db_type_distribution"] + assert stats["db_type_distribution"]["mysql"] == 5 + assert stats["db_type_distribution"]["redis"] == 3 + + @pytest.mark.asyncio + async def test_statistics_daily_trend(self, db: AsyncSession): + """测试每日趋势。""" + await self._setup_stats(db) + stats = await QueryHistoryService.get_query_statistics(db=db, user_id=1) + + assert "daily_trend" in stats + assert len(stats["daily_trend"]) == 7 + + @pytest.mark.asyncio + async def test_statistics_empty(self, db: AsyncSession): + """测试无记录时返回提示。""" + stats = await QueryHistoryService.get_query_statistics(db=db, user_id=999) + assert "message" in stats + assert stats["message"] == "暂无查询记录" + + @pytest.mark.asyncio + async def test_statistics_top_tables(self, db: AsyncSession): + """测试高频表统计。""" + await self._setup_stats(db) + stats = await QueryHistoryService.get_query_statistics(db=db, user_id=1) + + assert "top_tables" in stats + # 应该能从SQL中提取表名 + assert len(stats["top_tables"]) > 0 + + +# ── API端点集成测试 ── + + +class TestQueryHistoryAPI: + """查询历史 API 端点集成测试。""" + + @pytest.mark.asyncio + async def test_my_history_unauthorized(self, client): + """测试未认证访问历史。""" + resp = await client.get("/api/v1/query-history/my") + assert resp.status_code == 401 + + @pytest.mark.asyncio + async def test_my_history_empty(self, client, admin_headers, db): + """测试空历史记录。""" + resp = await client.get("/api/v1/query-history/my", headers=admin_headers) + assert resp.status_code == 200 + data = resp.json() + assert data["total"] == 0 + assert data["items"] == [] + + @pytest.mark.asyncio + async def test_my_history_with_data(self, client, admin_headers, db, admin_user): + """测试有数据的历史记录。""" + await QueryHistoryService.record_query( + db=db, user_id=admin_user.id, username="admin", instance_id=1, + instance_name="测试", db_type="mysql", database_name="test", + query_content="SELECT 1", query_type="SELECT", + execution_time_ms=10, result_rows=1, + ) + await db.commit() + + resp = await client.get("/api/v1/query-history/my", headers=admin_headers) + assert resp.status_code == 200 + data = resp.json() + assert data["total"] >= 1 + + @pytest.mark.asyncio + async def test_my_history_filter_db_type(self, client, admin_headers, db, admin_user): + """测试按类型筛选。""" + await QueryHistoryService.record_query( + db=db, user_id=admin_user.id, username="admin", instance_id=1, + instance_name="测试", db_type="mysql", database_name="test", + query_content="SELECT 1", query_type="SELECT", + execution_time_ms=10, result_rows=1, + ) + await QueryHistoryService.record_query( + db=db, user_id=admin_user.id, username="admin", instance_id=2, + instance_name="测试Redis", db_type="redis", database_name="db0", + query_content="GET key", query_type="GET", + execution_time_ms=5, result_rows=1, + ) + await db.commit() + + resp = await client.get( + "/api/v1/query-history/my?db_type=mysql", + headers=admin_headers, + ) + assert resp.status_code == 200 + data = resp.json() + assert data["total"] == 1 + assert data["items"][0]["db_type"] == "mysql" + + @pytest.mark.asyncio + async def test_toggle_favorite_api(self, client, admin_headers, db, admin_user): + """测试收藏API。""" + entry = await QueryHistoryService.record_query( + db=db, user_id=admin_user.id, username="admin", instance_id=1, + instance_name="测试", db_type="mysql", database_name="test", + query_content="SELECT 1", query_type="SELECT", + execution_time_ms=10, result_rows=1, + ) + await db.commit() + + resp = await client.post( + f"/api/v1/query-history/{entry.id}/favorite", + headers=admin_headers, + ) + assert resp.status_code == 200 + data = resp.json() + assert data["is_favorite"] is True + + @pytest.mark.asyncio + async def test_favorites_api(self, client, admin_headers, db): + """测试收藏列表API。""" + resp = await client.get("/api/v1/query-history/favorites", headers=admin_headers) + assert resp.status_code == 200 + data = resp.json() + assert "total" in data + assert "items" in data + + @pytest.mark.asyncio + async def test_statistics_api(self, client, admin_headers, db): + """测试统计API。""" + resp = await client.get("/api/v1/query-history/statistics", headers=admin_headers) + assert resp.status_code == 200 + data = resp.json() + assert "message" in data or "total_queries" in data + + @pytest.mark.asyncio + async def test_quick_queries_list_api(self, client, admin_headers, db): + """测试快捷查询列表API。""" + await QueryHistoryService.seed_default_quick_queries(db) + await db.commit() + + resp = await client.get("/api/v1/query-history/quick-queries", headers=admin_headers) + assert resp.status_code == 200 + data = resp.json() + assert data["total"] == 10 + assert len(data["items"]) == 10 + + @pytest.mark.asyncio + async def test_quick_queries_create_api(self, client, admin_headers, db): + """测试创建快捷查询API。""" + resp = await client.post( + "/api/v1/query-history/quick-queries", + params={ + "name": "我的查询", + "query_content": "SELECT * FROM users", + "db_type": "mysql", + "description": "测试快捷查询", + "is_shared": False, + }, + headers=admin_headers, + ) + assert resp.status_code == 200 + data = resp.json() + assert data["name"] == "我的查询" + assert "id" in data + + @pytest.mark.asyncio + async def test_quick_queries_filter_api(self, client, admin_headers, db): + """测试快捷查询筛选API。""" + await QueryHistoryService.seed_default_quick_queries(db) + await db.commit() + + resp = await client.get( + "/api/v1/query-history/quick-queries?db_type=redis", + headers=admin_headers, + ) + assert resp.status_code == 200 + data = resp.json() + for item in data["items"]: + assert item["db_type"] == "redis" + + @pytest.mark.asyncio + async def test_guest_can_view_own_history(self, client, guest_headers, db): + """测试访客可以查看自己的历史（但无权执行查询）。""" + resp = await client.get("/api/v1/query-history/my", headers=guest_headers) + assert resp.status_code == 200 + + @pytest.mark.asyncio + async def test_pagination_parameters(self, client, admin_headers, db, admin_user): + """测试分页参数。""" + for i in range(15): + await QueryHistoryService.record_query( + db=db, user_id=admin_user.id, username="admin", instance_id=1, + instance_name="测试", db_type="mysql", database_name="test", + query_content=f"SELECT {i}", query_type="SELECT", + execution_time_ms=10, result_rows=1, + ) + await db.commit() + + resp = await client.get( + "/api/v1/query-history/my?page=1&page_size=5", + headers=admin_headers, + ) + assert resp.status_code == 200 + data = resp.json() + assert data["total"] == 15 + assert len(data["items"]) == 5 + assert data["page"] == 1 + assert data["page_size"] == 5 diff --git a/tests/test_query_service.py b/tests/test_query_service.py new file mode 100644 index 0000000..ae35623 --- /dev/null +++ b/tests/test_query_service.py @@ -0,0 +1,584 @@ +"""多数据库查询服务测试 — 验证 QueryService 统一查询路由和各处理器。 + +覆盖: +1. MySQL 查询处理器: 只读验证、自动 LIMIT、结果格式 +2. PostgreSQL 查询处理器: 只读验证、自动 LIMIT +3. Redis 查询处理器: 白名单验证、子命令验证、结果格式化 +4. MongoDB 查询处理器: JSON 解析、只读操作白名单、aggregate 管道安全 +5. QueryService 路由: 按 db_type 分发、不支持的类型拒绝 +""" + +import json +import pytest +from unittest.mock import MagicMock + +from app.services.query_service import ( + QueryService, + MySQLQueryHandler, + PostgresQueryHandler, + RedisQueryHandler, + MongoQueryHandler, + REDIS_READONLY_COMMANDS, + REDIS_SUBCOMMAND_ALLOWLIST, + MONGODB_READONLY_OPS, + MONGODB_WRITE_OPS, +) +from app.schemas.query import UnifiedQueryResult + + +# ===== MySQL 查询处理器 ===== + + +class TestMySQLQueryHandler: + """MySQL 查询处理器单元测试。""" + + def setup_method(self): + self.handler = MySQLQueryHandler() + + def test_validate_readonly_select_pass(self): + """SELECT 语句应通过只读验证。""" + is_safe, msg = self.handler.validate_readonly("SELECT * FROM users LIMIT 10") + assert is_safe is True + assert msg == "" + + def test_validate_readonly_drop_rejected(self): + """DROP 语句应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("DROP TABLE users") + assert is_safe is False + assert "DROP" in msg.upper() or "只读" in msg or "禁止" in msg + + def test_validate_readonly_insert_rejected(self): + """INSERT 语句应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("INSERT INTO users (name) VALUES ('test')") + assert is_safe is False + + def test_validate_readonly_update_rejected(self): + """UPDATE 语句应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("UPDATE users SET name='x' WHERE id=1") + assert is_safe is False + + def test_validate_readonly_delete_rejected(self): + """DELETE 语句应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("DELETE FROM users WHERE id=1") + assert is_safe is False + + def test_validate_readonly_alter_rejected(self): + """ALTER 语句应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("ALTER TABLE users ADD COLUMN age INT") + assert is_safe is False + + def test_auto_add_limit_no_existing(self): + """没有 LIMIT 的 SQL 应自动添加 LIMIT。""" + sql = "SELECT * FROM users" + result = self.handler._auto_add_limit(sql) + assert "LIMIT 10000" in result.upper() + + def test_auto_add_limit_already_has(self): + """已有 LIMIT 的 SQL 不应重复添加。""" + sql = "SELECT * FROM users LIMIT 5" + result = self.handler._auto_add_limit(sql) + assert "10000" not in result + assert "LIMIT 5" in result.upper() + + def test_auto_add_limit_show_no_limit(self): + """SHOW 语句不应添加 LIMIT。""" + sql = "SHOW CREATE TABLE users" + result = self.handler._auto_add_limit(sql) + assert "LIMIT" not in result.upper() + assert result == sql + + def test_auto_add_limit_desc_no_limit(self): + """DESC 语句不应添加 LIMIT。""" + sql = "DESC users" + result = self.handler._auto_add_limit(sql) + assert "LIMIT" not in result.upper() + + @pytest.mark.asyncio + async def test_execute_non_readonly_raises(self): + """非只读查询应抛出 ValueError。""" + instance = MagicMock() + instance.db_type = "mysql" + with pytest.raises(ValueError): + await self.handler.execute(instance, "test_db", "DROP TABLE users", 1) + + +# ===== PostgreSQL 查询处理器 ===== + + +class TestPostgresQueryHandler: + """PostgreSQL 查询处理器单元测试。""" + + def setup_method(self): + self.handler = PostgresQueryHandler() + + def test_validate_readonly_select_pass(self): + """SELECT 语句应通过只读验证。""" + is_safe, msg = self.handler.validate_readonly("SELECT * FROM users LIMIT 10") + assert is_safe is True + + def test_validate_readonly_update_rejected(self): + """UPDATE 语句应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("UPDATE users SET name='x' WHERE id=1") + assert is_safe is False + + def test_validate_readonly_create_rejected(self): + """CREATE 语句应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("CREATE TABLE test (id INT)") + assert is_safe is False + + def test_auto_add_limit(self): + """应自动添加 LIMIT。""" + sql = "SELECT * FROM users" + result = self.handler._auto_add_limit(sql) + assert "LIMIT 10000" in result.upper() + + @pytest.mark.asyncio + async def test_execute_non_readonly_raises(self): + """非只读查询应抛出 ValueError。""" + instance = MagicMock() + instance.db_type = "postgres" + with pytest.raises(ValueError): + await self.handler.execute(instance, "test_db", "DELETE FROM users", 1) + + +# ===== Redis 查询处理器 ===== + + +class TestRedisQueryHandler: + """Redis 查询处理器单元测试。""" + + def setup_method(self): + self.handler = RedisQueryHandler() + + # --- 白名单验证 --- + + def test_validate_get_pass(self): + """GET 命令应在白名单中。""" + is_safe, msg = self.handler.validate_readonly("GET mykey") + assert is_safe is True + + def test_validate_hgetall_pass(self): + """HGETALL 命令应在白名单中。""" + is_safe, msg = self.handler.validate_readonly("HGETALL myhash") + assert is_safe is True + + def test_validate_keys_pass(self): + """KEYS 命令应在白名单中。""" + is_safe, msg = self.handler.validate_readonly("KEYS user:*") + assert is_safe is True + + def test_validate_info_pass(self): + """INFO 命令应在白名单中。""" + is_safe, msg = self.handler.validate_readonly("INFO") + assert is_safe is True + + def test_validate_scan_pass(self): + """SCAN 命令应在白名单中。""" + is_safe, msg = self.handler.validate_readonly("SCAN 0 MATCH user:* COUNT 100") + assert is_safe is True + + def test_validate_ttl_pass(self): + """TTL 命令应在白名单中。""" + is_safe, msg = self.handler.validate_readonly("TTL mykey") + assert is_safe is True + + def test_validate_exists_pass(self): + """EXISTS 命令应在白名单中。""" + is_safe, msg = self.handler.validate_readonly("EXISTS mykey") + assert is_safe is True + + def test_validate_type_pass(self): + """TYPE 命令应在白名单中。""" + is_safe, msg = self.handler.validate_readonly("TYPE mykey") + assert is_safe is True + + def test_validate_config_get_pass(self): + """CONFIG GET 子命令应在白名单中。""" + is_safe, msg = self.handler.validate_readonly("CONFIG GET maxmemory") + assert is_safe is True + + def test_validate_memory_usage_pass(self): + """MEMORY USAGE 子命令应在白名单中。""" + is_safe, msg = self.handler.validate_readonly("MEMORY USAGE mykey") + assert is_safe is True + + def test_validate_object_encoding_pass(self): + """OBJECT ENCODING 子命令应在白名单中。""" + is_safe, msg = self.handler.validate_readonly("OBJECT ENCODING mykey") + assert is_safe is True + + # --- 写命令拒绝 --- + + def test_validate_set_rejected(self): + """SET 命令应被拒绝（写操作）。""" + is_safe, msg = self.handler.validate_readonly("SET mykey value") + assert is_safe is False + assert "SET" in msg + + def test_validate_del_rejected(self): + """DEL 命令应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("DEL mykey") + assert is_safe is False + + def test_validate_flushdb_rejected(self): + """FLUSHDB 命令应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("FLUSHDB") + assert is_safe is False + + def test_validate_flushall_rejected(self): + """FLUSHALL 命令应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("FLUSHALL") + assert is_safe is False + + def test_validate_hset_rejected(self): + """HSET 命令应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("HSET myhash field value") + assert is_safe is False + + def test_validate_lpush_rejected(self): + """LPUSH 命令应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("LPUSH mylist value") + assert is_safe is False + + def test_validate_sadd_rejected(self): + """SADD 命令应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("SADD myset member") + assert is_safe is False + + def test_validate_zadd_rejected(self): + """ZADD 命令应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("ZADD myzset 1 member") + assert is_safe is False + + def test_validate_config_set_rejected(self): + """CONFIG SET 子命令应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("CONFIG SET maxmemory 100mb") + assert is_safe is False + + def test_validate_empty_rejected(self): + """空命令应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("") + assert is_safe is False + assert "空" in msg + + def test_validate_unknown_rejected(self): + """未知命令应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("UNKNOWNCMD arg1") + assert is_safe is False + + # --- 结果格式化 --- + + def test_format_result_nil(self): + """(nil) 结果应返回单行。""" + cols, rows = self.handler._format_result("GET", "(nil)") + assert cols == ["result"] + assert rows == [{"result": "(nil)"}] + + def test_format_result_simple_string(self): + """简单字符串结果应返回单行。""" + cols, rows = self.handler._format_result("GET", "hello") + assert cols == ["result"] + assert rows[0]["result"] == "hello" + + def test_format_result_info_keyvalue(self): + """INFO 结果应解析为 key-value 表格。""" + info_output = "# Server\nredis_version:7.0.0\ntcp_port:6379\nuptime_in_days:10" + cols, rows = self.handler._format_result("INFO", info_output) + assert cols == ["key", "value"] + assert len(rows) == 3 + assert rows[0]["key"] == "redis_version" + assert rows[0]["value"] == "7.0.0" + + def test_format_result_hgetall(self): + """HGETALL 结果应解析为 field-value 表格。""" + hgetall_output = "name\n" + "张三\n" + "age\n" + "25\n" + "email\n" + "test@example.com" + cols, rows = self.handler._format_result("HGETALL", hgetall_output) + assert cols == ["field", "value"] + assert len(rows) == 3 + assert rows[0]["field"] == "name" + assert rows[0]["value"] == "张三" + + def test_format_result_keys_list(self): + """KEYS 结果应解析为 value 列表。""" + keys_output = "user:1\nuser:2\nuser:3" + cols, rows = self.handler._format_result("KEYS", keys_output) + assert cols == ["value"] + assert len(rows) == 3 + + def test_format_result_empty(self): + """空结果应返回 (nil)。""" + cols, rows = self.handler._format_result("GET", "") + assert cols == ["result"] + assert rows == [{"result": "(nil)"}] + + @pytest.mark.asyncio + async def test_execute_non_readonly_raises(self): + """非只读命令应抛出 ValueError。""" + instance = MagicMock() + with pytest.raises(ValueError): + await self.handler.execute(instance, "0", "SET mykey value", 1) + + +# ===== MongoDB 查询处理器 ===== + + +class TestMongoQueryHandler: + """MongoDB 查询处理器单元测试。""" + + def setup_method(self): + self.handler = MongoQueryHandler() + + # --- JSON 解析 --- + + def test_validate_invalid_json_rejected(self): + """无效 JSON 应被拒绝。""" + is_safe, msg = self.handler.validate_readonly("not json at all") + assert is_safe is False + assert "JSON" in msg + + def test_validate_missing_operation_rejected(self): + """缺少 operation 字段应被拒绝。""" + is_safe, msg = self.handler.validate_readonly(json.dumps({"collection": "users"})) + assert is_safe is False + assert "operation" in msg + + # --- 只读操作白名单 --- + + def test_validate_find_pass(self): + """find 操作应通过验证。""" + query = json.dumps({"collection": "users", "operation": "find", "filter": {}}) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is True + + def test_validate_findone_pass(self): + """findOne 操作应通过验证。""" + query = json.dumps({"collection": "users", "operation": "findOne", "filter": {"_id": 1}}) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is True + + def test_validate_countdocuments_pass(self): + """countDocuments 操作应通过验证。""" + query = json.dumps({"collection": "users", "operation": "countDocuments", "filter": {}}) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is True + + def test_validate_estimatedcount_pass(self): + """estimatedDocumentCount 操作应通过验证。""" + query = json.dumps({"collection": "users", "operation": "estimatedDocumentCount"}) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is True + + def test_validate_distinct_pass(self): + """distinct 操作应通过验证。""" + query = json.dumps({"collection": "users", "operation": "distinct", "field": "status"}) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is True + + def test_validate_aggregate_pass(self): + """安全的 aggregate 管道应通过验证。""" + query = json.dumps({ + "collection": "users", + "operation": "aggregate", + "pipeline": [{"$match": {"status": "active"}}, {"$group": {"_id": "$city", "count": {"$sum": 1}}}] + }) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is True + + # --- 写操作拒绝 --- + + def test_validate_insertone_rejected(self): + """insertOne 操作应被拒绝。""" + query = json.dumps({"collection": "users", "operation": "insertOne", "document": {"name": "test"}}) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is False + assert "写操作" in msg or "禁止" in msg + + def test_validate_updatemany_rejected(self): + """updateMany 操作应被拒绝。""" + query = json.dumps({"collection": "users", "operation": "updateMany", "filter": {}, "update": {"$set": {"x": 1}}}) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is False + + def test_validate_deleteone_rejected(self): + """deleteOne 操作应被拒绝。""" + query = json.dumps({"collection": "users", "operation": "deleteOne", "filter": {"_id": 1}}) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is False + + def test_validate_deletemany_rejected(self): + """deleteMany 操作应被拒绝。""" + query = json.dumps({"collection": "users", "operation": "deleteMany", "filter": {}}) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is False + + def test_validate_drop_rejected(self): + """drop 操作应被拒绝。""" + query = json.dumps({"collection": "users", "operation": "drop"}) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is False + + # --- aggregate 管道安全检查 --- + + def test_validate_aggregate_with_out_rejected(self): + """aggregate 包含 $out 阶段应被拒绝。""" + query = json.dumps({ + "collection": "users", + "operation": "aggregate", + "pipeline": [{"$match": {}}, {"$out": "backup_users"}] + }) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is False + assert "$out" in msg or "写操作" in msg + + def test_validate_aggregate_with_merge_rejected(self): + """aggregate 包含 $merge 阶段应被拒绝。""" + query = json.dumps({ + "collection": "users", + "operation": "aggregate", + "pipeline": [{"$match": {}}, {"$merge": {"into": "backup_users"}}] + }) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is False + assert "$merge" in msg or "写操作" in msg + + def test_validate_aggregate_pipeline_not_list_rejected(self): + """aggregate 的 pipeline 不是数组应被拒绝。""" + query = json.dumps({ + "collection": "users", + "operation": "aggregate", + "pipeline": "not a list" + }) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is False + assert "数组" in msg + + def test_validate_unknown_operation_rejected(self): + """未知操作应被拒绝。""" + query = json.dumps({"collection": "users", "operation": "mapReduce"}) + is_safe, msg = self.handler.validate_readonly(query) + assert is_safe is False + assert "允许" in msg or "不在" in msg + + @pytest.mark.asyncio + async def test_execute_non_readonly_raises(self): + """写操作应抛出 ValueError。""" + instance = MagicMock() + query = json.dumps({"collection": "users", "operation": "insertOne", "document": {"name": "test"}}) + with pytest.raises(ValueError): + await self.handler.execute(instance, "test_db", query, 1) + + @pytest.mark.asyncio + async def test_execute_invalid_json_raises(self): + """无效 JSON 应抛出 ValueError。""" + instance = MagicMock() + with pytest.raises(ValueError): + await self.handler.execute(instance, "test_db", "not json", 1) + + +# ===== QueryService 路由 ===== + + +class TestQueryServiceRouter: + """QueryService 统一路由测试。""" + + def test_handlers_include_all_db_types(self): + """应支持所有 4 种数据库类型。""" + handlers = QueryService._handlers + assert "mysql" in handlers + assert "postgres" in handlers + assert "postgresql" in handlers + assert "redis" in handlers + assert "mongo" in handlers + + def test_postgres_and_postgresql_same_type(self): + """postgres 和 postgresql 应使用同一类型的处理器。""" + handlers = QueryService._handlers + assert isinstance(handlers["postgres"], PostgresQueryHandler) + assert isinstance(handlers["postgresql"], PostgresQueryHandler) + + @pytest.mark.asyncio + async def test_unsupported_db_type_raises(self): + """不支持的数据库类型应抛出 ValueError。""" + instance = MagicMock() + instance.db_type = "oracle" + with pytest.raises(ValueError, match="暂不支持"): + await QueryService.execute_query(instance, "test_db", "SELECT 1", 1) + + @pytest.mark.asyncio + async def test_unsupported_db_type_sqlite(self): + """SQLite 不应被支持（通过统一查询）。""" + instance = MagicMock() + instance.db_type = "sqlite" + with pytest.raises(ValueError): + await QueryService.execute_query(instance, "test_db", "SELECT 1", 1) + + +# ===== Redis 白名单完整性检查 ===== + + +class TestRedisWhitelistCompleteness: + """检查 Redis 只读白名单的完整性。""" + + def test_common_readonly_commands_present(self): + """常用只读命令应在白名单中。""" + required = { + "GET", "MGET", "HGET", "HGETALL", "HKEYS", "HVALS", "HLEN", + "LRANGE", "LLEN", "LINDEX", + "SMEMBERS", "SCARD", "SISMEMBER", + "ZRANGE", "ZCARD", "ZSCORE", "ZRANK", + "EXISTS", "TTL", "PTTL", "TYPE", "DBSIZE", + "SCAN", "HSCAN", "SSCAN", "ZSCAN", "KEYS", + "INFO", "PING", "ECHO", "TIME", + } + missing = required - REDIS_READONLY_COMMANDS + assert not missing, "缺少只读命令: " + str(missing) + + def test_write_commands_not_in_readonly(self): + """写命令不应出现在只读白名单中。""" + write_cmds = { + "SET", "SETEX", "SETNX", "MSET", "DEL", + "HSET", "HMSET", "HDEL", "HINCRBY", + "LPUSH", "RPUSH", "LPOP", "RPOP", "LREM", "LSET", + "SADD", "SREM", "SPOP", + "ZADD", "ZREM", "ZINCRBY", + "INCR", "INCRBY", "DECR", "DECRBY", + "EXPIRE", "EXPIREAT", "PERSIST", "RENAME", + "FLUSHDB", "FLUSHALL", "SAVE", "BGSAVE", + } + leaked = write_cmds & REDIS_READONLY_COMMANDS + assert not leaked, "写命令不应在只读白名单中: " + str(leaked) + + def test_subcommand_allowlist_has_config_get(self): + """CONFIG GET 子命令应在白名单中。""" + assert ("CONFIG", "GET") in REDIS_SUBCOMMAND_ALLOWLIST + + def test_subcommand_allowlist_has_memory_usage(self): + """MEMORY USAGE 子命令应在白名单中。""" + assert ("MEMORY", "USAGE") in REDIS_SUBCOMMAND_ALLOWLIST + + +# ===== MongoDB 白名单完整性检查 ===== + + +class TestMongoWhitelistCompleteness: + """检查 MongoDB 只读操作白名单的完整性。""" + + def test_readonly_ops_present(self): + """所有只读操作应在白名单中。""" + required = {"find", "findOne", "countDocuments", "estimatedDocumentCount", "distinct", "aggregate"} + assert required == MONGODB_READONLY_OPS + + def test_write_ops_present(self): + """所有写操作应在 MONGODB_WRITE_OPS 中。""" + required = { + "insertOne", "insertMany", "updateOne", "updateMany", + "deleteOne", "deleteMany", "drop", "createIndex", "dropIndex", + "replaceOne", "renameCollection", "findOneAndUpdate", + "findOneAndReplace", "findOneAndDelete", "bulkWrite", + } + assert required == MONGODB_WRITE_OPS + + def test_readonly_and_write_no_overlap(self): + """只读和写操作不应有重叠。""" + overlap = MONGODB_READONLY_OPS & MONGODB_WRITE_OPS + assert not overlap, "只读和写操作不应重叠: " + str(overlap) diff --git a/tests/test_redis.py b/tests/test_redis.py new file mode 100644 index 0000000..843f148 --- /dev/null +++ b/tests/test_redis.py @@ -0,0 +1,296 @@ +"""Tests for Redis management API endpoints — all methods mocked.""" +import pytest +from unittest.mock import AsyncMock, patch + +from tests.conftest import auth_header + + +# ── Helpers ────────────────────────────────────────────────────── + +REDIS_INSTANCE_DATA = { + "name": "Test Redis", + "db_type": "redis", + "host": "127.0.0.1", + "port": 6379, + "username": "default", + "password": "test123", + "database": "0", + "env": "development", + "description": "Test Redis instance", +} + +MOCK_INFO = { + "redis_version": "7.2.3", + "uptime_in_days": 30, + "connected_clients": 42, + "db0": {"keys": 1000, "expires": 500}, + "used_memory_human": "256M", + "keyspace_hits": 10000, + "keyspace_misses": 100, +} + + +async def _create_redis_instance(client, admin_token): + """Create a Redis instance and return its ID.""" + resp = await client.post( + "/api/v1/instances", + json=REDIS_INSTANCE_DATA, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + return resp.json()["id"] + + +# ── Info endpoint ──────────────────────────────────────────────── + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.redis.redis_connector.RedisConnector") +async def test_get_redis_info(mock_cls, client, admin_token): + mock_cls.get_info = AsyncMock(return_value=MOCK_INFO) + iid = await _create_redis_instance(client, admin_token) + + resp = await client.get( + "/api/v1/redis/" + str(iid) + "/info", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["redis_version"] == "7.2.3" + + +# ── DBSIZE endpoint ────────────────────────────────────────────── + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.redis.redis_connector.RedisConnector") +async def test_get_redis_dbsize(mock_cls, client, admin_token): + mock_cls.get_dbsize = AsyncMock(return_value=1000) + iid = await _create_redis_instance(client, admin_token) + + resp = await client.get( + "/api/v1/redis/" + str(iid) + "/dbsize?db=0", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["size"] == 1000 + + +# ── Keys list ──────────────────────────────────────────────────── + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.redis.redis_connector.RedisConnector") +async def test_get_redis_keys(mock_cls, client, admin_token): + mock_keys = [ + {"key": "user:1", "type": "string", "ttl": 3600}, + {"key": "session:abc", "type": "hash", "ttl": -1}, + ] + mock_cls.scan_keys = AsyncMock(return_value=(0, mock_keys)) + iid = await _create_redis_instance(client, admin_token) + + resp = await client.get( + "/api/v1/redis/" + str(iid) + "/keys?db=0&pattern=*&count=50", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert len(data["keys"]) == 2 + assert data["keys"][0]["key"] == "user:1" + + +# ── Key detail ─────────────────────────────────────────────────── + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.redis.redis_connector.RedisConnector") +async def test_get_redis_key_detail(mock_cls, client, admin_token): + mock_cls.get_key_value = AsyncMock(return_value={ + "key": "user:1", "type": "string", "value": "hello", "ttl": 3600, + }) + iid = await _create_redis_instance(client, admin_token) + + resp = await client.get( + "/api/v1/redis/" + str(iid) + "/keys/user:1?db=0", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["value"] == "hello" + + +# ── Key CRUD ───────────────────────────────────────────────────── + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.redis.redis_connector.RedisConnector") +async def test_create_redis_key(mock_cls, client, admin_token): + mock_cls.set_key_value = AsyncMock(return_value="OK") + iid = await _create_redis_instance(client, admin_token) + + resp = await client.post( + "/api/v1/redis/" + str(iid) + "/keys", + json={"db": 0, "key": "test_key", "value": "test_value", "type": "string", "ttl": 60}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["message"] == "操作成功" + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.redis.redis_connector.RedisConnector") +async def test_delete_redis_key(mock_cls, client, admin_token): + mock_cls.del_key = AsyncMock(return_value=1) + iid = await _create_redis_instance(client, admin_token) + + resp = await client.delete( + "/api/v1/redis/" + str(iid) + "/keys/test_key?db=0", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["deleted"] == 1 + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.redis.redis_connector.RedisConnector") +async def test_set_expire(mock_cls, client, admin_token): + mock_cls.set_ttl = AsyncMock(return_value=True) + iid = await _create_redis_instance(client, admin_token) + + resp = await client.put( + "/api/v1/redis/" + str(iid) + "/keys/test_key/expire", + json={"db": 0, "seconds": 300}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + +# ── Command execution ──────────────────────────────────────────── + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.redis.redis_connector.RedisConnector") +async def test_execute_command(mock_cls, client, admin_token): + mock_cls.execute_command = AsyncMock(return_value="PONG") + iid = await _create_redis_instance(client, admin_token) + + resp = await client.post( + "/api/v1/redis/" + str(iid) + "/command", + json={"db": 0, "command": "PING"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["output"] == "PONG" + + +# ── Slowlog & Clients ──────────────────────────────────────────── + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.redis.redis_connector.RedisConnector") +async def test_get_slowlog(mock_cls, client, admin_token): + mock_cls.get_slowlog = AsyncMock(return_value=[ + {"id": 1, "timestamp": 1700000000, "duration_us": 5000, "command": "KEYS *"}, + ]) + iid = await _create_redis_instance(client, admin_token) + + resp = await client.get( + "/api/v1/redis/" + str(iid) + "/slowlog?count=10", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert len(resp.json()) == 1 + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.redis.redis_connector.RedisConnector") +async def test_get_clients(mock_cls, client, admin_token): + mock_cls.get_clients = AsyncMock(return_value=[ + {"id": "1", "addr": "127.0.0.1:54321", "cmd": "ping"}, + ]) + iid = await _create_redis_instance(client, admin_token) + + resp = await client.get( + "/api/v1/redis/" + str(iid) + "/clients", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert len(resp.json()) == 1 + + +# ── Permission checks ──────────────────────────────────────────── + +@pytest.mark.asyncio +async def test_create_key_requires_admin_or_dba(client, developer_token, admin_token): + """Non-admin/dba cannot create keys.""" + # Need a redis instance first + iid_data = dict(REDIS_INSTANCE_DATA) + resp = await client.post( + "/api/v1/instances", + json=iid_data, + headers=auth_header(admin_token), + ) + iid = resp.json()["id"] + + resp = await client.post( + "/api/v1/redis/" + str(iid) + "/keys", + json={"db": 0, "key": "k", "value": "v", "type": "string"}, + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_flushdb_requires_admin(client, dba_token, admin_token): + """Non-admin cannot flush DB.""" + iid_data = dict(REDIS_INSTANCE_DATA) + resp = await client.post( + "/api/v1/instances", + json=iid_data, + headers=auth_header(admin_token), + ) + iid = resp.json()["id"] + + resp = await client.delete( + "/api/v1/redis/" + str(iid) + "/flushdb?db=0", + headers=auth_header(dba_token), + ) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +@patch("app.api.v1.endpoints.redis.redis_connector.RedisConnector") +async def test_flushdb_admin_can(mock_cls, client, admin_token): + """Admin can flush DB.""" + mock_cls.flush_db = AsyncMock(return_value="OK") + iid = await _create_redis_instance(client, admin_token) + + resp = await client.delete( + "/api/v1/redis/" + str(iid) + "/flushdb?db=0", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + +# ── Non-Redis instance rejection ────────────────────────────────── + +@pytest.mark.asyncio +async def test_non_redis_instance_rejected(client, admin_token): + """A MySQL instance should be rejected on Redis endpoints.""" + mysql_data = { + "name": "Test MySQL", + "db_type": "mysql", + "host": "127.0.0.1", + "port": 3306, + "username": "root", + "password": "test123", + "database": "test_db", + "env": "development", + } + resp = await client.post( + "/api/v1/instances", + json=mysql_data, + headers=auth_header(admin_token), + ) + iid = resp.json()["id"] + + resp = await client.get( + "/api/v1/redis/" + str(iid) + "/info", + headers=auth_header(admin_token), + ) + assert resp.status_code == 400 + assert "Redis" in resp.json()["detail"] diff --git a/tests/test_rollback.py b/tests/test_rollback.py new file mode 100644 index 0000000..40cd6c9 --- /dev/null +++ b/tests/test_rollback.py @@ -0,0 +1,182 @@ +"""回滚 SQL API 测试 — 覆盖 generate-rollback 和 preview 端点。""" +import pytest +from unittest.mock import patch, AsyncMock, MagicMock +from httpx import AsyncClient + +from tests.conftest import auth_header + + +async def _create_ticket(client: AsyncClient, admin_token: str, instance_id: int) -> dict: + """Helper: create a ticket and return the response body.""" + payload = { + "title": "测试工单-回滚验证", + "instance_id": instance_id, + "target_database": "test_db", + "sql_content": "UPDATE users SET name='test' WHERE id=1", + "reason": "执行回滚测试用例", + "priority": "medium", + "db_type": "mysql", + } + resp = await client.post( + "/api/v1/tickets", json=payload, headers=auth_header(admin_token) + ) + return resp + + +# ────────────────────────── Generate Rollback Tests ────────────────────────── + + +class TestGenerateRollback: + + @pytest.mark.asyncio + async def test_generate_success(self, client, admin_token, test_instance): + """生成回滚 SQL — mock RollbackGenerator 以避免真实连接。""" + ticket_resp = await _create_ticket(client, admin_token, test_instance.id) + assert ticket_resp.status_code == 201 + ticket_id = ticket_resp.json()["id"] + + with patch("app.api.v1.endpoints.rollback.RollbackGenerator") as MockGen: + instance_mock = MagicMock() + instance_mock.generate = AsyncMock(return_value="SELECT * FROM users WHERE id=1") + MockGen.return_value = instance_mock + + resp = await client.post( + f"/api/v1/tickets/{ticket_id}/generate-rollback", + json={"auto_save": False}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["ticket_id"] == ticket_id + assert "UPDATE" in body["original_sql"] + assert body["rollback_sql"] == "SELECT * FROM users WHERE id=1" + assert body["saved"] is False + + @pytest.mark.asyncio + async def test_generate_with_auto_save(self, client, admin_token, test_instance): + """auto_save=True 应保存回滚 SQL 到工单。""" + ticket_resp = await _create_ticket(client, admin_token, test_instance.id) + ticket_id = ticket_resp.json()["id"] + + with patch("app.api.v1.endpoints.rollback.RollbackGenerator") as MockGen: + instance_mock = MagicMock() + instance_mock.generate = AsyncMock(return_value="DELETE FROM users WHERE id=1 AND name='test'") + MockGen.return_value = instance_mock + + resp = await client.post( + f"/api/v1/tickets/{ticket_id}/generate-rollback", + json={"auto_save": True}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["saved"] is True + + @pytest.mark.asyncio + async def test_generate_ticket_not_found(self, client, admin_token): + resp = await client.post( + "/api/v1/tickets/9999/generate-rollback", + json={"auto_save": False}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_generate_developer_forbidden(self, client, developer_token, test_instance): + resp = await client.post( + "/api/v1/tickets/1/generate-rollback", + json={"auto_save": False}, + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_generate_guest_forbidden(self, client, guest_token): + resp = await client.post( + "/api/v1/tickets/1/generate-rollback", + json={"auto_save": False}, + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + +# ────────────────────────── Preview Rollback Tests ────────────────────────── + + +class TestPreviewRollback: + + @pytest.mark.asyncio + async def test_preview_success(self, client, admin_token, test_instance): + with patch("app.api.v1.endpoints.rollback.RollbackGenerator") as MockGen: + instance_mock = MagicMock() + instance_mock.preview = AsyncMock(return_value="SELECT * FROM users WHERE id=1") + MockGen.return_value = instance_mock + + resp = await client.post( + "/api/v1/rollback/preview", + json={ + "instance_id": test_instance.id, + "database": "test_db", + "sql": "UPDATE users SET name='x' WHERE id=1", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert "UPDATE" in body["original_sql"] + assert body["rollback_sql"] == "SELECT * FROM users WHERE id=1" + + @pytest.mark.asyncio + async def test_preview_instance_not_found(self, client, admin_token): + with patch("app.api.v1.endpoints.rollback.RollbackGenerator") as MockGen: + MockGen.return_value = MagicMock() + resp = await client.post( + "/api/v1/rollback/preview", + json={ + "instance_id": 9999, + "database": "test_db", + "sql": "DELETE FROM t WHERE id=1", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_preview_any_authenticated_user(self, client, developer_token, test_instance): + """preview 允许所有认证用户 (get_current_user)。""" + with patch("app.api.v1.endpoints.rollback.RollbackGenerator") as MockGen: + instance_mock = MagicMock() + instance_mock.preview = AsyncMock(return_value="-- 回滚SQL预览") + MockGen.return_value = instance_mock + + resp = await client.post( + "/api/v1/rollback/preview", + json={ + "instance_id": test_instance.id, + "database": "test_db", + "sql": "UPDATE t SET a=1 WHERE id=1", + }, + headers=auth_header(developer_token), + ) + assert resp.status_code == 200 + + @pytest.mark.asyncio + async def test_preview_no_auth_401(self, client): + resp = await client.post( + "/api/v1/rollback/preview", + json={ + "instance_id": 1, + "database": "test_db", + "sql": "UPDATE t SET a=1", + }, + ) + assert resp.status_code == 401 + + @pytest.mark.asyncio + async def test_preview_validation_error(self, client, admin_token): + """缺少必填字段 → 422。""" + resp = await client.post( + "/api/v1/rollback/preview", + json={"instance_id": 1}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 422 diff --git a/tests/test_schema_drift.py b/tests/test_schema_drift.py new file mode 100644 index 0000000..d912604 --- /dev/null +++ b/tests/test_schema_drift.py @@ -0,0 +1,413 @@ +"""Schema 漂移检测端点完整测试 — schema_drift.py + +覆盖端点: + POST /api/v1/schema-drift/instances/{instance_id}/capture 捕获快照 + POST /api/v1/schema-drift/instances/{instance_id}/check 检测漂移 + GET /api/v1/schema-drift/instances/{instance_id}/history 变更历史 +""" +import pytest +from unittest.mock import patch, AsyncMock, MagicMock +from httpx import AsyncClient + +from tests.conftest import auth_header + + +# ═══════════════════════════════════════════════════════════════ +# POST /schema-drift/instances/{instance_id}/capture — 捕获快照 +# ═══════════════════════════════════════════════════════════════ + + +class TestSchemaDriftCapture: + + async def test_capture_success( + self, client: AsyncClient, admin_token, test_instance + ): + """管理员成功捕获 Schema 快照。""" + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDet, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="decrypted_pw", + ): + detector_mock = MagicMock() + detector_mock.capture_snapshot = AsyncMock( + return_value=[{"table": "users", "column": "id"}] + ) + detector_mock.save_baseline = AsyncMock() + MockDet.return_value = detector_mock + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["message"] == "Schema 快照已捕获" + assert body["instance_id"] == test_instance.id + assert body["total_columns"] == 1 + + async def test_capture_with_explicit_database( + self, client: AsyncClient, admin_token, test_instance + ): + """通过 query param 指定 database。""" + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDet, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="decrypted_pw", + ): + detector_mock = MagicMock() + detector_mock.capture_snapshot = AsyncMock(return_value=[]) + detector_mock.save_baseline = AsyncMock() + MockDet.return_value = detector_mock + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture?database=mydb", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["database"] == "mydb" + + async def test_capture_uses_instance_database_as_default( + self, client: AsyncClient, admin_token, test_instance + ): + """不传 database 时使用 instance 的 database 字段。""" + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDet, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="decrypted_pw", + ): + detector_mock = MagicMock() + detector_mock.capture_snapshot = AsyncMock(return_value=[]) + detector_mock.save_baseline = AsyncMock() + MockDet.return_value = detector_mock + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + # test_instance.database == "test_db" + assert resp.json()["database"] == "test_db" + + async def test_capture_instance_not_found( + self, client: AsyncClient, admin_token + ): + """数据源不存在返回 404。""" + resp = await client.post( + "/api/v1/schema-drift/instances/9999/capture", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + assert "不存在" in resp.json()["detail"] + + async def test_capture_developer_forbidden( + self, client: AsyncClient, developer_token, test_instance + ): + """developer 角色无权捕获快照。""" + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + async def test_capture_guest_forbidden( + self, client: AsyncClient, guest_token, test_instance + ): + """guest 角色无权捕获快照。""" + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture", + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + async def test_capture_dba_allowed( + self, client: AsyncClient, dba_token, test_instance + ): + """DBA 角色可以捕获快照。""" + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDet, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="decrypted_pw", + ): + detector_mock = MagicMock() + detector_mock.capture_snapshot = AsyncMock(return_value=[]) + detector_mock.save_baseline = AsyncMock() + MockDet.return_value = detector_mock + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture", + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + async def test_capture_unauthenticated( + self, client: AsyncClient, test_instance + ): + """未认证请求返回 401。""" + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture", + ) + assert resp.status_code == 401 + + async def test_capture_multiple_columns( + self, client: AsyncClient, admin_token, test_instance + ): + """快照包含多个列。""" + snapshot = [ + {"table": "users", "column": "id"}, + {"table": "users", "column": "name"}, + {"table": "orders", "column": "id"}, + ] + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDet, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="decrypted_pw", + ): + detector_mock = MagicMock() + detector_mock.capture_snapshot = AsyncMock(return_value=snapshot) + detector_mock.save_baseline = AsyncMock() + MockDet.return_value = detector_mock + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["total_columns"] == 3 + + +# ═══════════════════════════════════════════════════════════════ +# POST /schema-drift/instances/{instance_id}/check — 检测漂移 +# ═══════════════════════════════════════════════════════════════ + + +class TestSchemaDriftCheck: + + async def test_check_no_drift( + self, client: AsyncClient, admin_token, test_instance + ): + """无漂移时返回正确报告。""" + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDet, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="decrypted_pw", + ): + report = MagicMock() + report.to_dict.return_value = { + "drifted": False, + "changes": [], + "instance_id": test_instance.id, + } + detector_mock = MagicMock() + detector_mock.detect_drift = AsyncMock(return_value=report) + MockDet.return_value = detector_mock + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/check", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["drifted"] is False + assert body["changes"] == [] + + async def test_check_with_drift( + self, client: AsyncClient, admin_token, test_instance + ): + """检测到漂移时返回变更列表。""" + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDet, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="decrypted_pw", + ): + report = MagicMock() + report.to_dict.return_value = { + "drifted": True, + "changes": [ + {"type": "column_added", "table": "users", "column": "age"}, + ], + } + detector_mock = MagicMock() + detector_mock.detect_drift = AsyncMock(return_value=report) + MockDet.return_value = detector_mock + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/check", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["drifted"] is True + assert len(body["changes"]) == 1 + + async def test_check_instance_not_found( + self, client: AsyncClient, admin_token + ): + """数据源不存在返回 404。""" + resp = await client.post( + "/api/v1/schema-drift/instances/9999/check", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + async def test_check_dba_allowed( + self, client: AsyncClient, dba_token, test_instance + ): + """DBA 角色可以检测漂移。""" + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDet, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="decrypted_pw", + ): + report = MagicMock() + report.to_dict.return_value = {"drifted": False, "changes": []} + detector_mock = MagicMock() + detector_mock.detect_drift = AsyncMock(return_value=report) + MockDet.return_value = detector_mock + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/check", + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + async def test_check_developer_forbidden( + self, client: AsyncClient, developer_token, test_instance + ): + """developer 角色无权检测漂移。""" + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/check", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + async def test_check_guest_forbidden( + self, client: AsyncClient, guest_token, test_instance + ): + """guest 角色无权检测漂移。""" + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/check", + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + async def test_check_unauthenticated( + self, client: AsyncClient, test_instance + ): + """未认证请求返回 401。""" + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/check", + ) + assert resp.status_code == 401 + + async def test_check_with_explicit_database( + self, client: AsyncClient, admin_token, test_instance + ): + """通过 query param 指定 database 检测漂移。""" + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDet, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="decrypted_pw", + ): + report = MagicMock() + report.to_dict.return_value = {"drifted": False} + detector_mock = MagicMock() + detector_mock.detect_drift = AsyncMock(return_value=report) + MockDet.return_value = detector_mock + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/check?database=other_db", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + +# ═══════════════════════════════════════════════════════════════ +# GET /schema-drift/instances/{instance_id}/history — 变更历史 +# ═══════════════════════════════════════════════════════════════ + + +class TestSchemaHistory: + + async def test_history_returns_data( + self, client: AsyncClient, admin_token, test_instance + ): + """管理员可以获取 Schema 变更历史。""" + resp = await client.get( + f"/api/v1/schema-drift/instances/{test_instance.id}/history", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["instance_id"] == test_instance.id + assert "history" in body + + async def test_history_is_list( + self, client: AsyncClient, admin_token, test_instance + ): + """history 字段为列表。""" + resp = await client.get( + f"/api/v1/schema-drift/instances/{test_instance.id}/history", + headers=auth_header(admin_token), + ) + body = resp.json() + assert isinstance(body["history"], list) + + async def test_history_dba_allowed( + self, client: AsyncClient, dba_token, test_instance + ): + """DBA 角色可以查看变更历史。""" + resp = await client.get( + f"/api/v1/schema-drift/instances/{test_instance.id}/history", + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + async def test_history_developer_forbidden( + self, client: AsyncClient, developer_token, test_instance + ): + """developer 角色无权查看变更历史。""" + resp = await client.get( + f"/api/v1/schema-drift/instances/{test_instance.id}/history", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + async def test_history_guest_forbidden( + self, client: AsyncClient, guest_token, test_instance + ): + """guest 角色无权查看变更历史。""" + resp = await client.get( + f"/api/v1/schema-drift/instances/{test_instance.id}/history", + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + async def test_history_unauthenticated( + self, client: AsyncClient, test_instance + ): + """未认证请求返回 401。""" + resp = await client.get( + f"/api/v1/schema-drift/instances/{test_instance.id}/history", + ) + assert resp.status_code == 401 + + async def test_history_contains_message( + self, client: AsyncClient, admin_token, test_instance + ): + """响应包含 message 字段。""" + resp = await client.get( + f"/api/v1/schema-drift/instances/{test_instance.id}/history", + headers=auth_header(admin_token), + ) + body = resp.json() + assert "message" in body diff --git a/tests/test_schema_drift_endpoint.py b/tests/test_schema_drift_endpoint.py new file mode 100644 index 0000000..5f777d1 --- /dev/null +++ b/tests/test_schema_drift_endpoint.py @@ -0,0 +1,231 @@ +"""Schema 漂移检测 API 端点测试。""" +import pytest +from unittest.mock import patch, MagicMock, AsyncMock +from httpx import AsyncClient + +from app.models.user import User +from app.models.instance import Instance + + +def auth_header(token: str) -> dict: + return {"Authorization": f"Bearer {token}"} + + +@pytest.mark.asyncio +class TestCaptureSchema: + """POST /api/v1/schema-drift/instances/{instance_id}/capture""" + + async def test_capture_schema_success( + self, client: AsyncClient, admin_token: str, test_instance + ): + mock_snapshot = [ + {"table": "users", "column": "id", "type": "int"}, + {"table": "users", "column": "name", "type": "varchar"}, + ] + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDetector, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="decrypted_pw", + ): + detector = MockDetector.return_value + detector.capture_snapshot = AsyncMock(return_value=mock_snapshot) + detector.save_baseline = AsyncMock() + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert "已捕获" in data["message"] + assert data["total_columns"] == 2 + assert data["instance_id"] == test_instance.id + + async def test_capture_schema_with_database_param( + self, client: AsyncClient, admin_token: str, test_instance + ): + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDetector, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="decrypted_pw", + ): + detector = MockDetector.return_value + detector.capture_snapshot = AsyncMock(return_value=[]) + detector.save_baseline = AsyncMock() + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture?database=mydb", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["database"] == "mydb" + + async def test_capture_schema_instance_not_found( + self, client: AsyncClient, admin_token: str + ): + resp = await client.post( + "/api/v1/schema-drift/instances/9999/capture", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + async def test_capture_schema_forbidden_developer( + self, client: AsyncClient, developer_token: str, test_instance + ): + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + async def test_capture_schema_dba_allowed( + self, client: AsyncClient, dba_token: str, test_instance + ): + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDetector, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="pw", + ): + detector = MockDetector.return_value + detector.capture_snapshot = AsyncMock(return_value=[]) + detector.save_baseline = AsyncMock() + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture", + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + +@pytest.mark.asyncio +class TestCheckDrift: + """POST /api/v1/schema-drift/instances/{instance_id}/check""" + + async def test_check_drift_no_changes( + self, client: AsyncClient, admin_token: str, test_instance + ): + mock_report = MagicMock() + mock_report.to_dict.return_value = { + "has_drift": False, + "changes": [], + "instance_id": test_instance.id, + } + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDetector, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="pw", + ): + detector = MockDetector.return_value + detector.detect_drift = AsyncMock(return_value=mock_report) + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/check", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["has_drift"] is False + + async def test_check_drift_with_changes( + self, client: AsyncClient, admin_token: str, test_instance + ): + mock_report = MagicMock() + mock_report.to_dict.return_value = { + "has_drift": True, + "changes": [ + {"type": "column_added", "table": "users", "column": "email"}, + ], + "instance_id": test_instance.id, + } + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDetector, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="pw", + ): + detector = MockDetector.return_value + detector.detect_drift = AsyncMock(return_value=mock_report) + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/check", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["has_drift"] is True + assert len(data["changes"]) == 1 + + async def test_check_drift_instance_not_found( + self, client: AsyncClient, admin_token: str + ): + resp = await client.post( + "/api/v1/schema-drift/instances/9999/check", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + async def test_check_drift_dict_report( + self, client: AsyncClient, admin_token: str, test_instance + ): + """Detector 返回普通 dict 而非对象时的序列化。""" + plain_dict = {"has_drift": False, "instance_id": test_instance.id} + with patch( + "app.api.v1.endpoints.schema_drift.SchemaDriftDetector" + ) as MockDetector, patch( + "app.api.v1.endpoints.schema_drift.decrypt_password", + return_value="pw", + ): + detector = MockDetector.return_value + detector.detect_drift = AsyncMock(return_value=plain_dict) + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/check", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + +@pytest.mark.asyncio +class TestSchemaHistory: + """GET /api/v1/schema-drift/instances/{instance_id}/history""" + + async def test_schema_history( + self, client: AsyncClient, admin_token: str, test_instance + ): + resp = await client.get( + f"/api/v1/schema-drift/instances/{test_instance.id}/history", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["instance_id"] == test_instance.id + assert "history" in data + + async def test_schema_history_dba_allowed( + self, client: AsyncClient, dba_token: str, test_instance + ): + resp = await client.get( + f"/api/v1/schema-drift/instances/{test_instance.id}/history", + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + async def test_schema_history_forbidden_guest( + self, client: AsyncClient, guest_token: str, test_instance + ): + resp = await client.get( + f"/api/v1/schema-drift/instances/{test_instance.id}/history", + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 + + async def test_schema_history_unauthorized(self, client: AsyncClient, test_instance): + resp = await client.get( + f"/api/v1/schema-drift/instances/{test_instance.id}/history", + ) + assert resp.status_code == 401 diff --git a/tests/test_schema_drift_pool.py b/tests/test_schema_drift_pool.py new file mode 100644 index 0000000..55f7be2 --- /dev/null +++ b/tests/test_schema_drift_pool.py @@ -0,0 +1,241 @@ +"""Schema 漂移检测 + 连接池管理 API 测试。""" +import pytest +from unittest.mock import patch, AsyncMock, MagicMock +from httpx import AsyncClient + +from tests.conftest import auth_header + + +# ════════════════════════════════════════════════════════════════════ +# Schema Drift Tests +# ════════════════════════════════════════════════════════════════════ + + +class TestSchemaDriftCapture: + """捕获 Schema 快照。""" + + @pytest.mark.asyncio + async def test_capture_success(self, client, admin_token, test_instance): + with patch("app.api.v1.endpoints.schema_drift.SchemaDriftDetector") as MockDet: + instance_mock = MagicMock() + instance_mock.capture_snapshot = AsyncMock(return_value=[{"col": "id"}]) + instance_mock.save_baseline = AsyncMock() + MockDet.return_value = instance_mock + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["message"] == "Schema 快照已捕获" + assert body["total_columns"] == 1 + + @pytest.mark.asyncio + async def test_capture_instance_not_found(self, client, admin_token): + resp = await client.post( + "/api/v1/schema-drift/instances/9999/capture", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_capture_developer_forbidden(self, client, developer_token, test_instance): + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_capture_dba_allowed(self, client, dba_token, test_instance): + with patch("app.api.v1.endpoints.schema_drift.SchemaDriftDetector") as MockDet: + instance_mock = MagicMock() + instance_mock.capture_snapshot = AsyncMock(return_value=[]) + instance_mock.save_baseline = AsyncMock() + MockDet.return_value = instance_mock + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/capture", + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + +class TestSchemaDriftCheck: + """检测 Schema 漂移。""" + + @pytest.mark.asyncio + async def test_check_success(self, client, admin_token, test_instance): + with patch("app.api.v1.endpoints.schema_drift.SchemaDriftDetector") as MockDet: + report = MagicMock() + report.to_dict.return_value = {"drifted": False, "changes": []} + instance_mock = MagicMock() + instance_mock.detect_drift = AsyncMock(return_value=report) + MockDet.return_value = instance_mock + + resp = await client.post( + f"/api/v1/schema-drift/instances/{test_instance.id}/check", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["drifted"] is False + + @pytest.mark.asyncio + async def test_check_instance_not_found(self, client, admin_token): + resp = await client.post( + "/api/v1/schema-drift/instances/9999/check", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + +class TestSchemaHistory: + + @pytest.mark.asyncio + async def test_history_returns_data(self, client, admin_token, test_instance): + resp = await client.get( + f"/api/v1/schema-drift/instances/{test_instance.id}/history", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["instance_id"] == test_instance.id + assert "history" in body + + +# ════════════════════════════════════════════════════════════════════ +# Connection Pool Tests +# ════════════════════════════════════════════════════════════════════ + + +class TestPoolStats: + + @pytest.mark.asyncio + async def test_stats_not_initialized(self, client, admin_token, test_instance): + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + manager = MagicMock() + manager.get_pool_stats.return_value = None + mock_pm.return_value = manager + + resp = await client.get( + f"/api/v1/pools/instances/{test_instance.id}/stats", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["status"] == "not_initialized" + + @pytest.mark.asyncio + async def test_stats_with_data(self, client, admin_token, test_instance): + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + stats = MagicMock() + stats.to_dict.return_value = {"active": 2, "idle": 3} + manager = MagicMock() + manager.get_pool_stats.return_value = stats + mock_pm.return_value = manager + + resp = await client.get( + f"/api/v1/pools/instances/{test_instance.id}/stats", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["active"] == 2 + + @pytest.mark.asyncio + async def test_stats_instance_not_found(self, client, admin_token): + resp = await client.get( + "/api/v1/pools/instances/9999/stats", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_stats_developer_forbidden(self, client, developer_token, test_instance): + resp = await client.get( + f"/api/v1/pools/instances/{test_instance.id}/stats", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +class TestPoolReset: + + @pytest.mark.asyncio + async def test_reset_success(self, client, admin_token, test_instance): + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + manager = MagicMock() + manager.reset_pool = AsyncMock() + mock_pm.return_value = manager + + resp = await client.post( + f"/api/v1/pools/instances/{test_instance.id}/reset", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert "已重置" in resp.json()["message"] + + @pytest.mark.asyncio + async def test_reset_dba_allowed(self, client, dba_token, test_instance): + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + manager = MagicMock() + manager.reset_pool = AsyncMock() + mock_pm.return_value = manager + + resp = await client.post( + f"/api/v1/pools/instances/{test_instance.id}/reset", + headers=auth_header(dba_token), + ) + assert resp.status_code == 200 + + @pytest.mark.asyncio + async def test_reset_developer_forbidden(self, client, developer_token, test_instance): + resp = await client.post( + f"/api/v1/pools/instances/{test_instance.id}/reset", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +class TestPoolsOverview: + + @pytest.mark.asyncio + async def test_overview_empty(self, client, admin_token): + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + manager = MagicMock() + manager.get_all_stats.return_value = {} + mock_pm.return_value = manager + + resp = await client.get( + "/api/v1/pools/overview", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["total_pools"] == 0 + + @pytest.mark.asyncio + async def test_overview_with_pools(self, client, admin_token): + with patch("app.api.v1.endpoints.pool.get_pool_manager") as mock_pm: + stats = MagicMock() + stats.to_dict.return_value = {"instance_id": 1, "active": 1} + manager = MagicMock() + manager.get_all_stats.return_value = {1: stats} + mock_pm.return_value = manager + + resp = await client.get( + "/api/v1/pools/overview", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + body = resp.json() + assert body["total_pools"] == 1 + assert len(body["pools"]) == 1 + + @pytest.mark.asyncio + async def test_overview_guest_forbidden(self, client, guest_token): + resp = await client.get( + "/api/v1/pools/overview", + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 diff --git a/tests/test_settings.py b/tests/test_settings.py new file mode 100644 index 0000000..4764215 --- /dev/null +++ b/tests/test_settings.py @@ -0,0 +1,381 @@ +"""Tests for Settings modules: Announcement, NotificationChannel, LDAP Config.""" +import json + +import pytest +from unittest.mock import AsyncMock, patch +from httpx import AsyncClient + +from tests.conftest import auth_header + + +# ─── Announcement Tests ──────────────────────────────────────────── + +@pytest.mark.asyncio +async def test_create_announcement(client: AsyncClient, admin_token: str): + resp = await client.post( + "/api/v1/announcements", + json={"title": "系统公告", "content": "# Hello\n这是公告内容"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + assert data["title"] == "系统公告" + assert data["content"] == "# Hello\n这是公告内容" + assert data["is_published"] is False + + +@pytest.mark.asyncio +async def test_list_announcements(client: AsyncClient, admin_token: str, developer_token: str): + # Create two announcements + for i in range(2): + await client.post( + "/api/v1/announcements", + json={"title": f"公告{i}", "content": f"内容{i}"}, + headers=auth_header(admin_token), + ) + + # Admin can list + resp = await client.get("/api/v1/announcements", headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert len(resp.json()) == 2 + + # Developer can also list + resp = await client.get("/api/v1/announcements", headers=auth_header(developer_token)) + assert resp.status_code == 200 + assert len(resp.json()) == 2 + + +@pytest.mark.asyncio +async def test_update_announcement(client: AsyncClient, admin_token: str): + create = await client.post( + "/api/v1/announcements", + json={"title": "原始标题", "content": "原始内容"}, + headers=auth_header(admin_token), + ) + aid = create.json()["id"] + + resp = await client.put( + f"/api/v1/announcements/{aid}", + json={"title": "更新标题", "is_published": True}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["title"] == "更新标题" + assert data["is_published"] is True + assert data["published_at"] is not None + + +@pytest.mark.asyncio +async def test_delete_announcement(client: AsyncClient, admin_token: str): + create = await client.post( + "/api/v1/announcements", + json={"title": "待删除", "content": "内容"}, + headers=auth_header(admin_token), + ) + aid = create.json()["id"] + + resp = await client.delete( + f"/api/v1/announcements/{aid}", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + # Verify deleted + resp = await client.get("/api/v1/announcements", headers=auth_header(admin_token)) + assert all(a["id"] != aid for a in resp.json()) + + +@pytest.mark.asyncio +async def test_announcement_non_admin_forbidden(client: AsyncClient, developer_token: str): + # Create forbidden + resp = await client.post( + "/api/v1/announcements", + json={"title": "test", "content": "test"}, + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + # Update forbidden + resp = await client.put( + "/api/v1/announcements/1", + json={"title": "test"}, + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + # Delete forbidden + resp = await client.delete( + "/api/v1/announcements/1", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +# ─── NotificationChannel Tests ───────────────────────────────────── + +@pytest.mark.asyncio +async def test_create_notification_channel(client: AsyncClient, admin_token: str): + resp = await client.post( + "/api/v1/notifications", + json={ + "name": "钉钉告警", + "channel_type": "dingtalk", + "config": {"webhook_url": "https://oapi.dingtalk.com/robot/send?access_token=xxx", "secret": "mysecret"}, + "is_enabled": True, + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + assert data["name"] == "钉钉告警" + assert data["channel_type"] == "dingtalk" + # Password/secret should be masked + assert data["config"]["secret"] == "******" + + +@pytest.mark.asyncio +async def test_list_notification_channels(client: AsyncClient, admin_token: str): + resp = await client.get( + "/api/v1/notifications", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert isinstance(resp.json(), list) + + +@pytest.mark.asyncio +async def test_update_notification_channel(client: AsyncClient, admin_token: str): + create = await client.post( + "/api/v1/notifications", + json={ + "name": "飞书通知", + "channel_type": "webhook_feishu", + "config": {"webhook_url": "https://open.feishu.cn/open-apis/bot/v2/hook/xxx"}, + }, + headers=auth_header(admin_token), + ) + cid = create.json()["id"] + + resp = await client.put( + f"/api/v1/notifications/{cid}", + json={"name": "飞书通知-更新", "is_enabled": False}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["name"] == "飞书通知-更新" + assert resp.json()["is_enabled"] is False + + +@pytest.mark.asyncio +async def test_delete_notification_channel(client: AsyncClient, admin_token: str): + create = await client.post( + "/api/v1/notifications", + json={ + "name": "待删除", + "channel_type": "email", + "config": { + "smtp_host": "smtp.example.com", + "smtp_port": 465, + "smtp_user": "user@example.com", + "smtp_password": "pass123", + "from_addr": "user@example.com", + "use_tls": True, + }, + }, + headers=auth_header(admin_token), + ) + cid = create.json()["id"] + + resp = await client.delete( + f"/api/v1/notifications/{cid}", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + +@pytest.mark.asyncio +@patch("app.services.notification_sender.NotificationSender.send", new_callable=AsyncMock) +async def test_notification_test_endpoint(mock_send, client: AsyncClient, admin_token: str): + mock_send.return_value = {"success": True, "message": "钉钉测试消息发送成功"} + create = await client.post( + "/api/v1/notifications", + json={ + "name": "钉钉测试", + "channel_type": "dingtalk", + "config": {"webhook_url": "https://oapi.dingtalk.com/robot/send?access_token=***"}, + "is_enabled": True, + }, + headers=auth_header(admin_token), + ) + cid = create.json()["id"] + + resp = await client.post( + f"/api/v1/notifications/{cid}/test", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["success"] is True + + +@pytest.mark.asyncio +async def test_notification_non_admin_forbidden(client: AsyncClient, developer_token: str): + resp = await client.get( + "/api/v1/notifications", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +async def test_email_config_mask_password(client: AsyncClient, admin_token: str): + create = await client.post( + "/api/v1/notifications", + json={ + "name": "邮件通道", + "channel_type": "email", + "config": { + "smtp_host": "smtp.example.com", + "smtp_port": 587, + "smtp_user": "admin@example.com", + "smtp_password": "super_secret_pass", + "from_addr": "admin@example.com", + "use_tls": True, + }, + }, + headers=auth_header(admin_token), + ) + data = create.json() + assert data["config"]["smtp_password"] == "******" + + +# ─── LDAP Config Tests ───────────────────────────────────────────── + +@pytest.mark.asyncio +async def test_create_ldap_config(client: AsyncClient, admin_token: str): + resp = await client.put( + "/api/v1/ldap-config", + json={ + "ldap_host": "ldap.example.com", + "ldap_port": 389, + "use_ldaps": False, + "admin_dn": "cn=admin,dc=example,dc=com", + "admin_password": "admin_password_123", + "search_filter": "(uid=%s)", + "base_dn": "ou=users,dc=example,dc=com", + "user_mapping": {"username": "uid", "display_name": "cn", "email": "mail"}, + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["ldap_host"] == "ldap.example.com" + assert data["ldap_port"] == 389 + # Password should be masked + assert data["admin_password"] == "******" + assert data["user_mapping"]["username"] == "uid" + + +@pytest.mark.asyncio +async def test_get_ldap_config(client: AsyncClient, admin_token: str): + # First create + await client.put( + "/api/v1/ldap-config", + json={ + "ldap_host": "ldap.test.com", + "ldap_port": 636, + "use_ldaps": True, + "admin_dn": "cn=admin,dc=test,dc=com", + "admin_password": "testpass", + "base_dn": "dc=test,dc=com", + }, + headers=auth_header(admin_token), + ) + + resp = await client.get( + "/api/v1/ldap-config", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["ldap_host"] == "ldap.test.com" + assert data["use_ldaps"] is True + assert data["admin_password"] == "******" + + +@pytest.mark.asyncio +async def test_update_ldap_config(client: AsyncClient, admin_token: str): + # Create + await client.put( + "/api/v1/ldap-config", + json={ + "ldap_host": "ldap.old.com", + "ldap_port": 389, + "admin_dn": "cn=admin,dc=old,dc=com", + "admin_password": "oldpass", + "base_dn": "dc=old,dc=com", + }, + headers=auth_header(admin_token), + ) + + # Update + resp = await client.put( + "/api/v1/ldap-config", + json={ + "ldap_host": "ldap.new.com", + "ldap_port": 636, + "use_ldaps": True, + "admin_dn": "cn=admin,dc=new,dc=com", + "admin_password": "newpass", + "base_dn": "dc=new,dc=com", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["ldap_host"] == "ldap.new.com" + assert resp.json()["use_ldaps"] is True + + +@pytest.mark.asyncio +async def test_ldap_config_not_found(client: AsyncClient, admin_token: str): + resp = await client.get( + "/api/v1/ldap-config", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + +@pytest.mark.asyncio +async def test_ldap_test_connection(client: AsyncClient, admin_token: str): + # Create config first + await client.put( + "/api/v1/ldap-config", + json={ + "ldap_host": "ldap.example.com", + "ldap_port": 389, + "admin_dn": "cn=admin,dc=example,dc=com", + "admin_password": "admin123", + "base_dn": "dc=example,dc=com", + }, + headers=auth_header(admin_token), + ) + + resp = await client.post( + "/api/v1/ldap-config/test", + json={"test_user": "testuser", "test_password": "testpass"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + # 测试环境无真实 LDAP 服务器，应返回失败 + assert data["success"] is False + + +@pytest.mark.asyncio +async def test_ldap_non_admin_forbidden(client: AsyncClient, developer_token: str): + resp = await client.get( + "/api/v1/ldap-config", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 diff --git a/tests/test_sql_analyzer.py b/tests/test_sql_analyzer.py new file mode 100644 index 0000000..ec33faa --- /dev/null +++ b/tests/test_sql_analyzer.py @@ -0,0 +1,157 @@ +"""Tests for SQL AST Analyzer (Phase 4.1).""" +import pytest +from app.services.sql_analyzer import SQLAnalyzer, SQLType, RiskLevel + + +analyzer = SQLAnalyzer() + + +class TestSQLTypeDetection: + def test_select(self): + result = analyzer.analyze("SELECT id, name FROM users WHERE id = 1;") + assert result.sql_type == SQLType.SELECT + + def test_insert(self): + result = analyzer.analyze("INSERT INTO users (name) VALUES ('test');") + assert result.sql_type == SQLType.INSERT + + def test_update(self): + result = analyzer.analyze("UPDATE users SET name = 'test' WHERE id = 1;") + assert result.sql_type == SQLType.UPDATE + + def test_delete(self): + result = analyzer.analyze("DELETE FROM users WHERE id = 1;") + assert result.sql_type == SQLType.DELETE + + def test_drop_table(self): + result = analyzer.analyze("DROP TABLE users;") + assert result.sql_type == SQLType.DROP + + def test_truncate(self): + result = analyzer.analyze("TRUNCATE TABLE logs;") + assert result.sql_type == SQLType.TRUNCATE + + def test_alter_table(self): + result = analyzer.analyze("ALTER TABLE users ADD COLUMN age INT;") + assert result.sql_type == SQLType.ALTER + + def test_create_table(self): + result = analyzer.analyze("CREATE TABLE test (id INT PRIMARY KEY);") + assert result.sql_type == SQLType.CREATE + + def test_cte_select(self): + result = analyzer.analyze("WITH cte AS (SELECT 1) SELECT * FROM cte;") + assert result.sql_type == SQLType.SELECT + + def test_explain(self): + result = analyzer.analyze("EXPLAIN SELECT * FROM users;") + assert result.sql_type == SQLType.SELECT + + +class TestReadonlyValidation: + def test_select_is_safe(self): + safe, msg = analyzer.validate_readonly("SELECT id FROM users LIMIT 10;") + assert safe is True + + def test_insert_not_safe(self): + safe, msg = analyzer.validate_readonly("INSERT INTO users (name) VALUES ('test');") + assert safe is False + assert "INSERT" in msg + + def test_update_not_safe(self): + safe, msg = analyzer.validate_readonly("UPDATE users SET name = 'test' WHERE id = 1;") + assert safe is False + + def test_delete_not_safe(self): + safe, msg = analyzer.validate_readonly("DELETE FROM users WHERE id = 1;") + assert safe is False + + def test_drop_not_safe(self): + safe, msg = analyzer.validate_readonly("DROP TABLE users;") + assert safe is False + + def test_truncate_not_safe(self): + safe, msg = analyzer.validate_readonly("TRUNCATE TABLE logs;") + assert safe is False + + def test_alter_not_safe(self): + safe, msg = analyzer.validate_readonly("ALTER TABLE users ADD COLUMN age INT;") + assert safe is False + + def test_create_not_safe(self): + safe, msg = analyzer.validate_readonly("CREATE TABLE test (id INT);") + assert safe is False + + +class TestRiskLevels: + def test_select_is_safe_risk(self): + result = analyzer.analyze("SELECT * FROM users;") + assert result.risk_level == RiskLevel.SAFE + + def test_dml_with_where_is_medium(self): + result = analyzer.analyze("UPDATE users SET name = 'a' WHERE id = 1;") + assert result.risk_level == RiskLevel.MEDIUM + + def test_dml_without_where_is_high(self): + result = analyzer.analyze("UPDATE users SET name = 'a';") + assert result.risk_level == RiskLevel.HIGH + + def test_ddl_is_dangerous(self): + result = analyzer.analyze("DROP TABLE users;") + assert result.risk_level == RiskLevel.DANGEROUS + + +class TestSecurityChecks: + def test_multi_statement_rejected(self): + safe, msg = analyzer.validate_readonly("SELECT 1; DROP TABLE users;") + assert safe is False + assert "多条" in msg or "分号" in msg + + def test_into_outfile_rejected(self): + safe, msg = analyzer.validate_readonly("SELECT * INTO OUTFILE '/tmp/data.txt' FROM users;") + assert safe is False + assert "OUTFILE" in msg + + def test_subquery_dml_rejected(self): + safe, msg = analyzer.validate_readonly("SELECT * FROM (DELETE FROM users) AS t;") + assert safe is False + + def test_normal_subquery_ok(self): + safe, msg = analyzer.validate_readonly("SELECT * FROM (SELECT id FROM users) AS t;") + assert safe is True + + def test_semicolon_in_string_ok(self): + safe, msg = analyzer.validate_readonly("SELECT 'hello;world' FROM users;") + assert safe is True + + +class TestAnalysis: + def test_has_where(self): + result = analyzer.analyze("SELECT * FROM users WHERE id = 1;") + assert result.has_where is True + + def test_no_where(self): + result = analyzer.analyze("SELECT * FROM users;") + assert result.has_where is False + + def test_to_dict(self): + result = analyzer.analyze("SELECT id FROM users;") + d = result.to_dict() + assert "sql_type" in d + assert "risk_level" in d + assert "is_readonly" in d + assert d["sql_type"] == "SELECT" + assert d["is_readonly"] is True + + def test_complex_select(self): + result = analyzer.analyze(""" + SELECT u.id, u.name, o.total + FROM users u + JOIN orders o ON u.id = o.user_id + WHERE u.status = 'active' + ORDER BY o.total DESC + LIMIT 50; + """) + assert result.sql_type == SQLType.SELECT + assert result.is_readonly is True + assert result.has_where is True diff --git a/tests/test_sql_assistant.py b/tests/test_sql_assistant.py new file mode 100644 index 0000000..c7aff07 --- /dev/null +++ b/tests/test_sql_assistant.py @@ -0,0 +1,326 @@ +"""SQL 助手服务测试 — 验证格式化、高亮、风险检测、EXPLAIN 解析和查询建议。""" + +import pytest +from app.services.sql_assistant import SQLAssistant + + +# ===== SQL 格式化 ===== + + +class TestSQLFormat: + """SQL 格式化测试。""" + + def test_format_simple_select(self): + """应格式化简单 SELECT。""" + result = SQLAssistant.format_sql("select * from users where id = 1") + assert result.is_valid is True + assert "SELECT" in result.formatted + assert "FROM" in result.formatted + + def test_format_empty_sql(self): + """空 SQL 应返回无效。""" + result = SQLAssistant.format_sql("") + assert result.is_valid is False + assert result.error is not None + + def test_format_none_sql(self): + """None 应返回无效。""" + result = SQLAssistant.format_sql(None) + assert result.is_valid is False + + def test_format_whitespace_sql(self): + """纯空格 SQL 应返回无效。""" + result = SQLAssistant.format_sql(" ") + assert result.is_valid is False + + def test_format_preserves_content(self): + """格式化不应丢失 SQL 内容。""" + sql = "SELECT id, name FROM users WHERE status = 'active' ORDER BY id LIMIT 10" + result = SQLAssistant.format_sql(sql) + assert result.is_valid is True + assert "users" in result.formatted + assert "status" in result.formatted + + def test_format_complex_join(self): + """应格式化复杂 JOIN 查询。""" + sql = "select u.id, u.name, o.total from users u join orders o on u.id = o.user_id where o.total > 100" + result = SQLAssistant.format_sql(sql) + assert result.is_valid is True + assert "JOIN" in result.formatted.upper() or "join" in result.formatted + + +# ===== SQL 高亮 ===== + + +class TestSQLHighlight: + """SQL 语法高亮和风险分析测试。""" + + def test_highlight_select(self): + """应标记 SELECT 关键字。""" + result = SQLAssistant.highlight_sql("SELECT * FROM users") + assert "SELECT" in result.keywords + + def test_highlight_extract_table(self): + """应从 FROM 子句提取表名。""" + result = SQLAssistant.highlight_sql("SELECT * FROM users WHERE id = 1") + assert "users" in result.tables + + def test_highlight_extract_join_table(self): + """应从 JOIN 子句提取表名。""" + result = SQLAssistant.highlight_sql("SELECT * FROM users u JOIN orders o ON u.id = o.user_id") + assert "users" in result.tables + assert "orders" in result.tables + + def test_highlight_delete_risk(self): + """DELETE 应被标记为高风险。""" + result = SQLAssistant.highlight_sql("DELETE FROM users WHERE id = 1") + assert len(result.risks) > 0 + risk_ops = [r["operation"] for r in result.risks] + assert "DELETE" in risk_ops + + def test_highlight_update_risk(self): + """UPDATE 应被标记为中等风险。""" + result = SQLAssistant.highlight_sql("UPDATE users SET name='x' WHERE id=1") + assert len(result.risks) > 0 + risk_ops = [r["operation"] for r in result.risks] + assert "UPDATE" in risk_ops + + def test_highlight_drop_critical_risk(self): + """DROP 应被标记为关键风险。""" + result = SQLAssistant.highlight_sql("DROP TABLE users") + assert len(result.risks) > 0 + critical = [r for r in result.risks if r["level"] == "critical"] + assert len(critical) > 0 + + def test_highlight_update_no_where_critical(self): + """缺少 WHERE 的 UPDATE 应被标记为关键风险。""" + result = SQLAssistant.highlight_sql("UPDATE users SET name='x'") + assert len(result.risks) > 0 + critical = [r for r in result.risks if r["level"] == "critical"] + assert len(critical) > 0 + + def test_highlight_delete_no_where_critical(self): + """缺少 WHERE 的 DELETE 应被标记为关键风险。""" + result = SQLAssistant.highlight_sql("DELETE FROM users") + assert len(result.risks) > 0 + critical = [r for r in result.risks if r["level"] == "critical"] + assert len(critical) > 0 + + def test_highlight_select_no_risk(self): + """SELECT 语句不应有风险标记。""" + result = SQLAssistant.highlight_sql("SELECT id, name FROM users LIMIT 10") + assert len(result.risks) == 0 + + def test_highlight_produces_html(self): + """高亮结果应包含 HTML 标签。""" + result = SQLAssistant.highlight_sql("SELECT * FROM users") + assert "sql-keyword" in result.highlighted + + +# ===== EXPLAIN 解析 ===== + + +class TestExplainParse: + """MySQL EXPLAIN 结果解析测试。""" + + def test_parse_empty_explain(self): + """空 EXPLAIN 应返回警告。""" + result = SQLAssistant.parse_explain([]) + assert result.is_simple is True + assert len(result.warnings) > 0 + + def test_parse_simple_index_scan(self): + """索引扫描的 EXPLAIN 应被正确解析。""" + rows = [{ + "table": "users", + "type": "ref", + "key": "idx_status", + "rows": 100, + "Extra": "", + }] + result = SQLAssistant.parse_explain(rows) + assert result.has_index is True + assert result.has_full_scan is False + assert result.estimated_rows == 100 + + def test_parse_full_table_scan(self): + """全表扫描的 EXPLAIN 应标记警告。""" + rows = [{ + "table": "orders", + "type": "ALL", + "key": None, + "rows": 500000, + "Extra": "", + }] + result = SQLAssistant.parse_explain(rows) + assert result.has_full_scan is True + assert result.has_index is False + assert result.estimated_rows == 500000 + assert len(result.warnings) > 0 + + def test_parse_filesort_warning(self): + """Using filesort 应产生警告。""" + rows = [{ + "table": "users", + "type": "ref", + "key": "idx_status", + "rows": 100, + "Extra": "Using filesort", + }] + result = SQLAssistant.parse_explain(rows) + filesort_warnings = [w for w in result.warnings if "filesort" in w.lower() or "排序" in w] + assert len(filesort_warnings) > 0 + + def test_parse_temporary_table_warning(self): + """Using temporary 应产生警告。""" + rows = [{ + "table": "users", + "type": "ref", + "key": "idx_status", + "rows": 100, + "Extra": "Using temporary", + }] + result = SQLAssistant.parse_explain(rows) + temp_warnings = [w for w in result.warnings if "临时表" in w or "temporary" in w.lower()] + assert len(temp_warnings) > 0 + + def test_parse_large_rows_warning(self): + """预估行数过大应产生警告。""" + rows = [{ + "table": "big_table", + "type": "ALL", + "key": None, + "rows": 500000, + "Extra": "", + }] + result = SQLAssistant.parse_explain(rows) + large_warnings = [w for w in result.warnings if "较大" in w or "较慢" in w] + assert len(large_warnings) > 0 + + def test_parse_multi_table_join(self): + """多表 JOIN 应返回非简单查询。""" + rows = [ + {"table": "users", "type": "ref", "key": "PRIMARY", "rows": 1, "Extra": ""}, + {"table": "orders", "type": "ref", "key": "idx_user", "rows": 10, "Extra": ""}, + ] + result = SQLAssistant.parse_explain(rows) + assert result.is_simple is False + assert result.has_index is True + assert result.estimated_rows == 11 + + def test_parse_produces_human_readable(self): + """应生成人类可读的执行计划描述。""" + rows = [{ + "table": "users", + "type": "ref", + "key": "idx_name", + "rows": 50, + "Extra": "", + }] + result = SQLAssistant.parse_explain(rows) + assert result.human_readable != "" + assert "users" in result.human_readable + + def test_parse_case_insensitive_keys(self): + """应处理大写的 EXPLAIN 键名。""" + rows = [{ + "TABLE": "users", + "TYPE": "ALL", + "KEY": None, + "ROWS": 1000, + "EXTRA": "", + }] + result = SQLAssistant.parse_explain(rows) + assert result.estimated_rows == 1000 + + +# ===== 查询建议 ===== + + +class TestQuerySuggestions: + """SQL 查询建议测试。""" + + def test_select_star_suggestion(self): + """SELECT * 应触发优化建议。""" + suggestions = SQLAssistant.get_query_suggestions("SELECT * FROM users") + types = [s["type"] for s in suggestions] + assert "optimization" in types + + def test_no_limit_suggestion(self): + """缺少 LIMIT 应触发安全建议。""" + suggestions = SQLAssistant.get_query_suggestions("SELECT id, name FROM users WHERE status = 'active'") + msgs = [s["message"] for s in suggestions] + assert any("LIMIT" in m for m in msgs) + + def test_order_by_rand_suggestion(self): + """ORDER BY RAND() 应触发优化建议。""" + suggestions = SQLAssistant.get_query_suggestions("SELECT * FROM users ORDER BY RAND() LIMIT 5") + msgs = [s["message"] for s in suggestions] + assert any("RAND" in m for m in msgs) + + def test_update_no_where_suggestion(self): + """缺少 WHERE 的 UPDATE 应触发危险建议。""" + suggestions = SQLAssistant.get_query_suggestions("UPDATE users SET name='x'") + danger = [s for s in suggestions if s["type"] == "danger"] + assert len(danger) > 0 + + def test_delete_no_where_suggestion(self): + """缺少 WHERE 的 DELETE 应触发危险建议。""" + suggestions = SQLAssistant.get_query_suggestions("DELETE FROM users") + danger = [s for s in suggestions if s["type"] == "danger"] + assert len(danger) > 0 + + def test_complex_query_comment_suggestion(self): + """无注释的复杂查询应触发风格建议。""" + long_sql = "SELECT * FROM users WHERE " + " AND ".join(["column_name_" + str(i) + " = 'value_number_" + str(i) + "'" for i in range(30)]) + suggestions = SQLAssistant.get_query_suggestions(long_sql) + style = [s for s in suggestions if s["type"] == "style"] + assert len(style) > 0 + + def test_many_joins_suggestion(self): + """多个 JOIN 应触发优化建议。""" + sql = "SELECT * FROM a JOIN b ON a.id = b.aid JOIN c ON b.id = c.bid JOIN d ON c.id = d.cid JOIN e ON d.id = e.did" + suggestions = SQLAssistant.get_query_suggestions(sql) + join_suggestions = [s for s in suggestions if "JOIN" in s["message"]] + assert len(join_suggestions) > 0 + + def test_clean_select_no_suggestions(self): + """干净的 SELECT 查询不应有危险建议。""" + suggestions = SQLAssistant.get_query_suggestions("SELECT id, name FROM users WHERE status = 'active' LIMIT 10") + danger = [s for s in suggestions if s["type"] == "danger"] + assert len(danger) == 0 + + +# ===== 统一分析入口 ===== + + +class TestAnalyze: + """SQLAssistant.analyze 统一入口测试。""" + + def test_analyze_returns_all_fields(self): + """应返回所有分析字段。""" + result = SQLAssistant.analyze("SELECT * FROM users LIMIT 10") + assert "formatted" in result + assert "is_valid" in result + assert "highlighted" in result + assert "keywords" in result + assert "tables" in result + assert "risks" in result + assert "suggestions" in result + assert "risk_count" in result + assert "suggestion_count" in result + + def test_analyze_select_star(self): + """SELECT * 分析应有优化建议。""" + result = SQLAssistant.analyze("SELECT * FROM users") + assert result["suggestion_count"] > 0 + + def test_analyze_dangerous_update(self): + """危险 UPDATE 分析应有风险标记和建议。""" + result = SQLAssistant.analyze("UPDATE users SET name='x'") + assert result["risk_count"] > 0 + + def test_analyze_with_db_type(self): + """应支持指定数据库类型。""" + result = SQLAssistant.analyze("SELECT * FROM users", db_type="postgres") + assert result["is_valid"] is True diff --git a/tests/test_system_settings.py b/tests/test_system_settings.py new file mode 100644 index 0000000..d223efc --- /dev/null +++ b/tests/test_system_settings.py @@ -0,0 +1,228 @@ +"""系统设置 API 测试 — GET/PUT 设置 + 公共查询设置 + 查询集成。""" + +import pytest +from httpx import AsyncClient, ASGITransport +from app.main import app + +from tests.conftest import auth_header + + +async def _ensure_user(client: AsyncClient, admin_token: str, username: str, role: str = "developer") -> str: + """确保用户存在并返回 token。""" + from app.core.security import hash_password, create_access_token + from app.models.user import User + from sqlalchemy import select + from app.core.database import get_db + + # 通过 API 创建用户 + resp = await client.post("/api/v1/users", headers=auth_header(admin_token), json={ + "username": username, "password": "123456", + "display_name": username, "role": role + }) + if resp.status_code in (200, 201): + data = resp.json() + user_id = data.get("id") + return create_access_token(data={"sub": str(user_id), "role": role}) + # 如果已存在，尝试登录 + resp = await client.post("/api/v1/auth/login", json={"username": username, "password": "123456"}) + if resp.status_code == 200: + return resp.json()["access_token"] + # Fallback: 直接生成 token + raise RuntimeError(f"无法创建/获取用户 {username}: {resp.status_code} {resp.text}") + + +# ── 1. GET /settings ── + +@pytest.mark.asyncio +async def test_get_settings(client, admin_token): + """管理员可以获取所有系统设置。""" + token = admin_token + resp = await client.get("/api/v1/settings", headers=auth_header(token)) + assert resp.status_code == 200 + data = resp.json() + assert "query" in data + assert "security" in data + # 查询控制至少 3 项 (max_limit, timeout, auto_limit) + assert len(data["query"]) >= 3 + + +@pytest.mark.asyncio +async def test_get_settings_non_admin(client, admin_token): + """非管理员不能获取设置。""" + user_token = await _ensure_user(client, admin_token, "testuser_settings") + + resp = await client.get("/api/v1/settings", headers=auth_header(user_token)) + # require_role("admin") 应该返回 403 + assert resp.status_code == 403 + + +# ── 2. PUT /settings ── + +@pytest.mark.asyncio +async def test_update_settings_boolean(client, admin_token): + """更新布尔设置项。""" + token = admin_token + resp = await client.put("/api/v1/settings", headers=auth_header(token), json=[ + {"key": "query_auto_limit", "value": "false"} + ]) + assert resp.status_code == 200 + assert "query_auto_limit" in resp.json()["updated"] + + # 验证 + resp = await client.get("/api/v1/settings", headers=auth_header(token)) + items = resp.json()["query"] + auto_limit = next(i for i in items if i["key"] == "query_auto_limit") + assert auto_limit["value"] == "false" + + # 恢复 + await client.put("/api/v1/settings", headers=auth_header(token), json=[ + {"key": "query_auto_limit", "value": "true"} + ]) + + +@pytest.mark.asyncio +async def test_update_settings_integer(client, admin_token): + """更新整数设置项。""" + token = admin_token + resp = await client.put("/api/v1/settings", headers=auth_header(token), json=[ + {"key": "query_max_limit", "value": "5000"} + ]) + assert resp.status_code == 200 + + # 恢复 + await client.put("/api/v1/settings", headers=auth_header(token), json=[ + {"key": "query_max_limit", "value": "10000"} + ]) + + +@pytest.mark.asyncio +async def test_update_settings_validation(client, admin_token): + """设置值校验。""" + token = admin_token + + # 布尔值错误 + resp = await client.put("/api/v1/settings", headers=auth_header(token), json=[ + {"key": "query_auto_limit", "value": "yes"} + ]) + assert resp.status_code == 400 + + # 整数范围错误 (query_max_limit min=100) + resp = await client.put("/api/v1/settings", headers=auth_header(token), json=[ + {"key": "query_max_limit", "value": "10"} + ]) + assert resp.status_code == 400 + + # 超时范围错误 (query_timeout min=5) + resp = await client.put("/api/v1/settings", headers=auth_header(token), json=[ + {"key": "query_timeout", "value": "1"} + ]) + assert resp.status_code == 400 + + +# ── 3. GET /settings/public/query ── + +@pytest.mark.asyncio +async def test_public_query_settings(client): + """公共查询设置无需鉴权。""" + resp = await client.get("/api/v1/settings/public/query") + assert resp.status_code == 200 + data = resp.json() + assert "query_max_limit" in data + assert "query_timeout" in data + assert isinstance(data["query_max_limit"], int) + + +# ── 4. 查询集成 — 审批开关 ── + +@pytest.mark.asyncio +async def test_query_require_approval(client, admin_token): + """开启查询审批后普通用户无法直接查询。""" + user_token = await _ensure_user(client, admin_token, "testuser_approval") + + # 开启查询审批 + await client.put("/api/v1/settings", headers=auth_header(admin_token), json=[ + {"key": "query_require_approval", "value": "true"} + ]) + + # 普通用户查询应被拦截 + resp = await client.post("/api/v1/query/execute", headers=auth_header(user_token), json={ + "instance_id": 1, "database": "test", "sql": "SELECT 1" + }) + assert resp.status_code == 403 + assert "审批" in resp.json()["detail"] + + # 管理员仍然可以查询（不被审批限制拦截，可能因连接报其他错） + resp = await client.post("/api/v1/query/execute", headers=auth_header(admin_token), json={ + "instance_id": 1, "database": "test", "sql": "SELECT 1" + }) + assert resp.status_code != 403, "管理员不应被审批限制拦截" + + # 恢复 + await client.put("/api/v1/settings", headers=auth_header(admin_token), json=[ + {"key": "query_require_approval", "value": "false"} + ]) + + +# ── 5. 查询集成 — 语句长度检查 ── + +@pytest.mark.asyncio +async def test_query_max_length(client, admin_token): + """超长查询语句被拦截。""" + # 设置较短限制（在合法范围 500~50000 内） + await client.put("/api/v1/settings", headers=auth_header(admin_token), json=[ + {"key": "query_max_length", "value": "500"} + ]) + + # 超长 SQL（> 500 字符） + long_sql = "SELECT * FROM users WHERE id = " + "1" * 600 + resp = await client.post("/api/v1/query/execute", headers=auth_header(admin_token), json={ + "instance_id": 1, "database": "test", "sql": long_sql + }) + assert resp.status_code == 400, f"Expected 400, got {resp.status_code}: {resp.text}" + assert "过长" in resp.json()["detail"] + + # 正常长度 SQL 不被拦截（可能因连接失败但不应是400长度错误） + short_sql = "SELECT 1" + resp = await client.post("/api/v1/query/execute", headers=auth_header(admin_token), json={ + "instance_id": 1, "database": "test", "sql": short_sql + }) + assert resp.status_code != 400 or "过长" not in resp.text + + # 恢复 + await client.put("/api/v1/settings", headers=auth_header(admin_token), json=[ + {"key": "query_max_length", "value": "50000"} + ]) + + +# ── 6. 批量更新 ── + +@pytest.mark.asyncio +async def test_bulk_update(client, admin_token): + """批量更新多个设置。""" + token = admin_token + resp = await client.put("/api/v1/settings", headers=auth_header(token), json=[ + {"key": "query_timeout", "value": "60"}, + {"key": "query_max_limit", "value": "2000"}, + ]) + assert resp.status_code == 200 + assert len(resp.json()["updated"]) == 2 + + # 恢复 + await client.put("/api/v1/settings", headers=auth_header(token), json=[ + {"key": "query_timeout", "value": "30"}, + {"key": "query_max_limit", "value": "10000"}, + ]) + + +# ── 7. 设置种子数据自动初始化 ── + +@pytest.mark.asyncio +async def test_settings_auto_seed(client, admin_token): + """设置接口自动初始化种子数据。""" + token = admin_token + resp = await client.get("/api/v1/settings", headers=auth_header(token)) + assert resp.status_code == 200 + data = resp.json() + # 确认至少 9 个设置项 (query:3 + security:2 + cleanup:3 + executor:1) + total = sum(len(v) for v in data.values()) + assert total >= 9 diff --git a/tests/test_ticket_executor.py b/tests/test_ticket_executor.py new file mode 100644 index 0000000..c81b144 --- /dev/null +++ b/tests/test_ticket_executor.py @@ -0,0 +1,601 @@ +"""TicketExecutor 多数据库工单执行引擎测试。 + +覆盖: +1. ExecutionReport 序列化/反序列化 +2. MySQL 语法预校验 +3. PostgreSQL 语法预校验 +4. Redis 命令解析和校验 +5. MongoDB 操作解析和校验 +6. SQL 工具方法: 表名提取、WHERE 子句提取、语句分割 +""" + +import json +import pytest +from unittest.mock import MagicMock + +from app.services.ticket_executor import ( + TicketExecutor, + ExecutionReport, + SyntaxValidationError, + REDIS_WRITE_COMMANDS, + MONGO_SUPPORTED_OPERATIONS, +) +from app.models.instance import Instance +from app.models.ticket import Ticket + + +# ===== ExecutionReport 测试 ===== + + +class TestExecutionReport: + """ExecutionReport 数据类测试。""" + + def test_default_values(self): + """默认值应为 success。""" + report = ExecutionReport() + assert report.status == "success" + assert report.affected_rows == 0 + assert report.duration_ms == 0 + assert report.validation_passed is True + assert report.warnings == [] + assert report.errors == [] + + def test_to_json(self): + """应正确序列化为 JSON。""" + report = ExecutionReport( + status="success", + affected_rows=10, + duration_ms=150, + before_snapshot="10 rows", + after_snapshot="15 rows", + validation_passed=True, + warnings=["UPDATE 缺少 WHERE"], + errors=[], + raw_output="UPDATE 10 rows", + ) + j = report.to_json() + data = json.loads(j) + assert data["status"] == "success" + assert data["affected_rows"] == 10 + assert data["duration_ms"] == 150 + assert data["warnings"] == ["UPDATE 缺少 WHERE"] + + def test_from_exception(self): + """从异常创建失败的报告。""" + exc = RuntimeError("连接超时") + report = ExecutionReport.from_exception(exc, "执行") + assert report.status == "failed" + assert report.validation_passed is False + assert len(report.errors) == 1 + assert "连接超时" in report.errors[0] + + def test_to_json_chinese(self): + """JSON 序列化应保留中文字符。""" + report = ExecutionReport(raw_output="更新了3行数据") + j = report.to_json() + assert "更新了3行数据" in j + + +# ===== TicketExecutor 初始化 ===== + + +class TestTicketExecutorInit: + """TicketExecutor 初始化测试。""" + + def test_init_creates_analyzer(self): + """初始化应创建 SQLAnalyzer。""" + executor = TicketExecutor() + assert executor._analyzer is not None + + +# ===== MySQL 语法预校验 ===== + + +class TestMySQLSyntaxValidation: + """MySQL 语法预校验测试。""" + + def setup_method(self): + self.executor = TicketExecutor() + + def test_empty_sql_rejected(self): + """空 SQL 应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="不能为空"): + self.executor._validate_mysql_syntax("") + + def test_whitespace_sql_rejected(self): + """纯空格 SQL 应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="不能为空"): + self.executor._validate_mysql_syntax(" ") + + def test_insert_pass(self): + """INSERT 语句应通过校验。""" + self.executor._validate_mysql_syntax("INSERT INTO users (name) VALUES ('test')") + + def test_update_pass(self): + """UPDATE 语句应通过校验。""" + self.executor._validate_mysql_syntax("UPDATE users SET name='x' WHERE id=1") + + def test_delete_pass(self): + """DELETE 语句应通过校验。""" + self.executor._validate_mysql_syntax("DELETE FROM users WHERE id=1") + + def test_drop_pass(self): + """DROP 语句应通过校验（DDL 通过工单审批执行）。""" + self.executor._validate_mysql_syntax("DROP TABLE users") + + def test_create_pass(self): + """CREATE 语句应通过校验。""" + self.executor._validate_mysql_syntax("CREATE TABLE test (id INT)") + + def test_alter_pass(self): + """ALTER 语句应通过校验。""" + self.executor._validate_mysql_syntax("ALTER TABLE users ADD COLUMN age INT") + + def test_truncate_pass(self): + """TRUNCATE 语句应通过校验。""" + self.executor._validate_mysql_syntax("TRUNCATE TABLE users") + + +# ===== PostgreSQL 语法预校验 ===== + + +class TestPostgresSyntaxValidation: + """PostgreSQL 语法预校验测试。""" + + def setup_method(self): + self.executor = TicketExecutor() + + def test_insert_pass(self): + """INSERT 语句应通过校验。""" + self.executor._validate_postgres_syntax("INSERT INTO users (name) VALUES ('test')") + + def test_update_pass(self): + """UPDATE 语句应通过校验。""" + self.executor._validate_postgres_syntax("UPDATE users SET name='x' WHERE id=1") + + def test_delete_pass(self): + """DELETE 语句应通过校验。""" + self.executor._validate_postgres_syntax("DELETE FROM users WHERE id=1") + + def test_drop_pass(self): + """DROP 语句应通过校验（DDL 通过工单审批执行）。""" + self.executor._validate_postgres_syntax("DROP TABLE users") + + +# ===== Redis 命令解析 ===== + + +class TestRedisCommandParsing: + """Redis 命令解析测试。""" + + def setup_method(self): + self.executor = TicketExecutor() + + def test_parse_json_commands(self): + """应解析 JSON 格式的命令列表。""" + content = json.dumps({ + "commands": [ + {"command": "SET key1 value1", "db": 0}, + {"command": "SET key2 value2", "db": 1}, + ] + }) + commands = self.executor._parse_redis_commands(content) + assert len(commands) == 2 + assert commands[0]["command"] == "SET key1 value1" + assert commands[0]["db"] == 0 + assert commands[1]["db"] == 1 + + def test_parse_json_single_command(self): + """应解析单条 JSON 命令。""" + content = json.dumps({"command": "SET key1 value1", "db": 2}) + commands = self.executor._parse_redis_commands(content) + assert len(commands) == 1 + assert commands[0]["command"] == "SET key1 value1" + assert commands[0]["db"] == 2 + + def test_parse_text_commands(self): + """应解析文本格式命令（每行一个）。""" + content = "SET key1 value1\nSET key2 value2\n# this is a comment" + commands = self.executor._parse_redis_commands(content) + assert len(commands) == 2 + assert commands[0]["command"] == "SET key1 value1" + assert commands[1]["command"] == "SET key2 value2" + + def test_parse_empty_content(self): + """空内容应返回空列表。""" + commands = self.executor._parse_redis_commands("") + assert commands == [] + + def test_parse_invalid_json_as_text(self): + """无效 JSON 应作为文本解析。""" + content = "{not valid json" + commands = self.executor._parse_redis_commands(content) + # Should fall through to text parsing + assert len(commands) == 1 + assert commands[0]["command"] == content + + +# ===== Redis 命令校验 ===== + + +class TestRedisCommandValidation: + """Redis 命令格式校验测试。""" + + def setup_method(self): + self.executor = TicketExecutor() + + def test_valid_set_command(self): + """合法的 SET 命令应通过校验。""" + self.executor._validate_redis_commands([{"command": "SET key1 value1", "db": 0}]) + + def test_valid_hset_command(self): + """合法的 HSET 命令应通过校验。""" + self.executor._validate_redis_commands([{"command": "HSET myhash field value", "db": 0}]) + + def test_empty_command_rejected(self): + """空命令应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="不能为空"): + self.executor._validate_redis_commands([{"command": "", "db": 0}]) + + def test_no_args_command_with_ping(self): + """PING 等无参数命令应通过。""" + self.executor._validate_redis_commands([{"command": "PING", "db": 0}]) + + def test_no_args_command_without_special(self): + """需要参数的命令缺少参数应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="缺少参数"): + self.executor._validate_redis_commands([{"command": "GET", "db": 0}]) + + def test_invalid_command_name_rejected(self): + """非法命令名应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="非法"): + self.executor._validate_redis_commands([{"command": "123BAD key", "db": 0}]) + + +# ===== MongoDB 操作解析 ===== + + +class TestMongoOperationParsing: + """MongoDB 操作解析测试。""" + + def setup_method(self): + self.executor = TicketExecutor() + + def test_parse_valid_insert(self): + """应解析有效的 insertOne 操作。""" + content = json.dumps({ + "collection": "users", + "operation": "insertOne", + "document": {"name": "test", "age": 25}, + }) + result = self.executor._parse_mongo_operation(content) + assert result["collection"] == "users" + assert result["operation"] == "insertOne" + assert result["document"]["name"] == "test" + + def test_parse_valid_update(self): + """应解析有效的 updateMany 操作。""" + content = json.dumps({ + "collection": "users", + "operation": "updateMany", + "filter": {"status": "inactive"}, + "update": {"$set": {"status": "active"}}, + }) + result = self.executor._parse_mongo_operation(content) + assert result["operation"] == "updateMany" + + def test_parse_empty_content_rejected(self): + """空内容应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="不能为空"): + self.executor._parse_mongo_operation("") + + def test_parse_invalid_json_rejected(self): + """无效 JSON 应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="JSON"): + self.executor._parse_mongo_operation("not json") + + def test_parse_non_dict_rejected(self): + """非 JSON 对象应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="JSON 对象"): + self.executor._parse_mongo_operation("[1, 2, 3]") + + +# ===== MongoDB 操作校验 ===== + + +class TestMongoOperationValidation: + """MongoDB 操作格式校验测试。""" + + def setup_method(self): + self.executor = TicketExecutor() + + def test_insertone_valid(self): + """insertOne 应通过校验。""" + self.executor._validate_mongo_operation({ + "collection": "users", + "operation": "insertOne", + "document": {"name": "test"}, + }) + + def test_insertmany_valid(self): + """insertMany 应通过校验。""" + self.executor._validate_mongo_operation({ + "collection": "users", + "operation": "insertMany", + "documents": [{"name": "a"}, {"name": "b"}], + }) + + def test_updateone_valid(self): + """updateOne 应通过校验。""" + self.executor._validate_mongo_operation({ + "collection": "users", + "operation": "updateOne", + "filter": {"_id": 1}, + "update": {"$set": {"name": "x"}}, + }) + + def test_updatemany_valid(self): + """updateMany 应通过校验。""" + self.executor._validate_mongo_operation({ + "collection": "users", + "operation": "updateMany", + "filter": {"status": "old"}, + "update": {"$set": {"status": "new"}}, + }) + + def test_deleteone_valid(self): + """deleteOne 应通过校验。""" + self.executor._validate_mongo_operation({ + "collection": "users", + "operation": "deleteOne", + "filter": {"_id": 1}, + }) + + def test_deletemany_valid(self): + """deleteMany 应通过校验。""" + self.executor._validate_mongo_operation({ + "collection": "users", + "operation": "deleteMany", + "filter": {"status": "inactive"}, + }) + + def test_replaceone_valid(self): + """replaceOne 应通过校验。""" + self.executor._validate_mongo_operation({ + "collection": "users", + "operation": "replaceOne", + "filter": {"_id": 1}, + "document": {"name": "new"}, + }) + + def test_missing_collection_rejected(self): + """缺少 collection 字段应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="collection"): + self.executor._validate_mongo_operation({ + "operation": "insertOne", + "document": {"name": "test"}, + }) + + def test_missing_operation_rejected(self): + """缺少 operation 字段应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="操作类型"): + self.executor._validate_mongo_operation({ + "collection": "users", + }) + + def test_unsupported_operation_rejected(self): + """不支持的操作应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="不支持"): + self.executor._validate_mongo_operation({ + "collection": "users", + "operation": "createIndex", + "keys": {"name": 1}, + }) + + def test_insertone_missing_document_rejected(self): + """insertOne 缺少 document 应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="document"): + self.executor._validate_mongo_operation({ + "collection": "users", + "operation": "insertOne", + }) + + def test_insertmany_missing_documents_rejected(self): + """insertMany 缺少 documents 应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="documents"): + self.executor._validate_mongo_operation({ + "collection": "users", + "operation": "insertMany", + }) + + def test_updateone_missing_filter_rejected(self): + """updateOne 缺少 filter 应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="filter"): + self.executor._validate_mongo_operation({ + "collection": "users", + "operation": "updateOne", + "update": {"$set": {"x": 1}}, + }) + + def test_updateone_missing_update_rejected(self): + """updateOne 缺少 update 应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="update"): + self.executor._validate_mongo_operation({ + "collection": "users", + "operation": "updateOne", + "filter": {"_id": 1}, + }) + + def test_replaceone_missing_document_rejected(self): + """replaceOne 缺少 document 应被拒绝。""" + with pytest.raises(SyntaxValidationError, match="document"): + self.executor._validate_mongo_operation({ + "collection": "users", + "operation": "replaceOne", + "filter": {"_id": 1}, + }) + + +# ===== SQL 工具方法 ===== + + +class TestSQLUtilities: + """SQL 工具方法测试。""" + + def setup_method(self): + self.executor = TicketExecutor() + + def test_split_statements_basic(self): + """应按分号分割语句。""" + sql = "INSERT INTO t1 VALUES (1); INSERT INTO t2 VALUES (2);" + stmts = self.executor._split_statements(sql) + assert len(stmts) == 2 + + def test_split_statements_single(self): + """单条语句无分号应返回一条。""" + sql = "INSERT INTO t1 VALUES (1)" + stmts = self.executor._split_statements(sql) + assert len(stmts) == 1 + + def test_split_statements_empty(self): + """空内容应返回空列表。""" + stmts = self.executor._split_statements("") + assert stmts == [] + + def test_extract_table_name_insert(self): + """应从 INSERT 语句中提取表名。""" + from app.services.sql_analyzer import SQLType + name = self.executor._extract_table_name( + "INSERT INTO users (name) VALUES ('test')", SQLType.INSERT + ) + assert name == "USERS" + + def test_extract_table_name_update(self): + """应从 UPDATE 语句中提取表名。""" + from app.services.sql_analyzer import SQLType + name = self.executor._extract_table_name( + "UPDATE users SET name='x' WHERE id=1", SQLType.UPDATE + ) + assert name == "USERS" + + def test_extract_table_name_delete(self): + """应从 DELETE 语句中提取表名。""" + from app.services.sql_analyzer import SQLType + name = self.executor._extract_table_name( + "DELETE FROM users WHERE id=1", SQLType.DELETE + ) + assert name == "USERS" + + def test_extract_where_clause_found(self): + """应从带 WHERE 的 SQL 中提取条件。""" + where = self.executor._extract_where_clause_text( + "UPDATE users SET name='x' WHERE id=1 AND status='active'" + ) + assert where is not None + assert "id=1" in where + + def test_extract_where_clause_not_found(self): + """没有 WHERE 的 SQL 应返回 None。""" + where = self.executor._extract_where_clause_text( + "INSERT INTO users (name) VALUES ('test')" + ) + assert where is None + + def test_format_redis_result_nil(self): + """None 应格式化为 (nil)。""" + result = self.executor._format_redis_result(None) + assert result == "(nil)" + + def test_format_redis_result_bool(self): + """布尔值应格式化为 1/0。""" + assert self.executor._format_redis_result(True) == "1" + assert self.executor._format_redis_result(False) == "0" + + def test_format_redis_result_list(self): + """列表应格式化为方括号。""" + result = self.executor._format_redis_result([b"a", b"b", b"c"]) + assert "[" in result + assert "a" in result + + def test_format_redis_result_string(self): + """字符串应原样返回。""" + result = self.executor._format_redis_result("OK") + assert result == "OK" + + +# ===== 路由分发 ===== + + +class TestTicketExecutorRouting: + """TicketExecutor 路由分发测试。""" + + def setup_method(self): + self.executor = TicketExecutor() + + def _make_ticket(self, sql_content, db_type="mysql", database="test_db"): + """创建测试用 Ticket 对象。""" + ticket = MagicMock(spec=Ticket) + ticket.sql_content = sql_content + ticket.target_database = database + return ticket + + def _make_instance(self, db_type="mysql"): + """创建测试用 Instance 对象。""" + instance = MagicMock(spec=Instance) + instance.db_type = db_type + instance.host = "127.0.0.1" + instance.port = 3306 + instance.username = "root" + instance.password = "test123" + instance.database = "test_db" + return instance + + @pytest.mark.asyncio + async def test_unsupported_db_type_raises(self): + """不支持的数据库类型应抛出 ValueError。""" + ticket = self._make_ticket("SELECT 1") + instance = self._make_instance("oracle") + with pytest.raises(ValueError, match="不支持的执行类型"): + await self.executor.execute(ticket, instance) + + @pytest.mark.asyncio + async def test_mysql_drop_rejected(self): + """MySQL DROP 语句应被语法预校验拒绝。""" + ticket = self._make_ticket("DROP TABLE users") + instance = self._make_instance("mysql") + report = await self.executor.execute(ticket, instance) + assert report.status == "failed" + assert report.validation_passed is False + + @pytest.mark.asyncio + async def test_postgres_drop_rejected(self): + """PostgreSQL DROP 语句应被语法预校验拒绝。""" + ticket = self._make_ticket("DROP TABLE users") + instance = self._make_instance("postgres") + report = await self.executor.execute(ticket, instance) + assert report.status == "failed" + assert report.validation_passed is False + + @pytest.mark.asyncio + async def test_redis_empty_commands_rejected(self): + """Redis 空命令应被拒绝。""" + ticket = self._make_ticket("") + instance = self._make_instance("redis") + report = await self.executor.execute(ticket, instance) + assert report.status == "failed" + + @pytest.mark.asyncio + async def test_mongo_invalid_json_rejected(self): + """MongoDB 无效 JSON 应被拒绝。""" + ticket = self._make_ticket("not json") + instance = self._make_instance("mongo") + report = await self.executor.execute(ticket, instance) + assert report.status == "failed" + + @pytest.mark.asyncio + async def test_mongo_missing_collection_rejected(self): + """MongoDB 缺少 collection 应被拒绝。""" + ticket = self._make_ticket(json.dumps({"operation": "insertOne"})) + instance = self._make_instance("mongo") + report = await self.executor.execute(ticket, instance) + assert report.status == "failed" diff --git a/tests/test_tickets.py b/tests/test_tickets.py new file mode 100644 index 0000000..cfe60d4 --- /dev/null +++ b/tests/test_tickets.py @@ -0,0 +1,176 @@ +from httpx import AsyncClient + +from tests.conftest import auth_header + + +async def _create_ticket(client: AsyncClient, token: str, instance_id: int): + return await client.post("/api/v1/tickets", headers=auth_header(token), json={ + "title": "测试工单标题", + "db_type": "mysql", + "instance_id": instance_id, + "target_database": "test_db", + "sql_content": "SELECT * FROM users LIMIT 10;", + "rollback_sql": "", + "reason": "测试原因12345", + "priority": "medium", + }) + + +class TestListTickets: + async def test_developer_sees_own_tickets( + self, client: AsyncClient, developer_user, developer_token, test_instance + ): + await _create_ticket(client, developer_token, test_instance.id) + resp = await client.get("/api/v1/tickets", headers=auth_header(developer_token)) + assert resp.status_code == 200 + data = resp.json() + for item in data["items"]: + assert item["applicant_id"] == developer_user.id + + async def test_admin_sees_all_tickets( + self, client: AsyncClient, admin_token, developer_user, developer_token, + test_instance, admin_user, + ): + await _create_ticket(client, developer_token, test_instance.id) + resp = await client.get("/api/v1/tickets", headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert data["total"] >= 1 + + +class TestCreateTicket: + async def test_create_ticket_success( + self, client: AsyncClient, developer_token, test_instance + ): + resp = await _create_ticket(client, developer_token, test_instance.id) + assert resp.status_code == 201 + data = resp.json() + assert data["status"] == "pending" + assert data["title"] == "测试工单标题" + + async def test_create_ticket_instance_not_found(self, client: AsyncClient, developer_token): + resp = await _create_ticket(client, developer_token, instance_id=9999) + assert resp.status_code == 404 + + +class TestGetTicket: + async def test_get_ticket_detail( + self, client: AsyncClient, developer_token, test_instance + ): + create_resp = await _create_ticket(client, developer_token, test_instance.id) + ticket_id = create_resp.json()["id"] + resp = await client.get(f"/api/v1/tickets/{ticket_id}", headers=auth_header(developer_token)) + assert resp.status_code == 200 + assert resp.json()["id"] == ticket_id + + async def test_developer_cannot_see_others_ticket( + self, client: AsyncClient, admin_token, admin_user, + developer_token, developer_user, test_instance, + ): + create_resp = await _create_ticket(client, developer_token, test_instance.id) + ticket_id = create_resp.json()["id"] + # admin creates a separate developer to test access + resp = await client.get(f"/api/v1/tickets/{ticket_id}", headers=auth_header(admin_token)) + assert resp.status_code == 200 # admin can see all + + +class TestReviewTicket: + async def test_approve_ticket( + self, client: AsyncClient, developer_token, dba_token, + dba_user, test_instance, + ): + create_resp = await _create_ticket(client, developer_token, test_instance.id) + ticket_id = create_resp.json()["id"] + resp = await client.post( + f"/api/v1/tickets/{ticket_id}/review", + headers=auth_header(dba_token), + json={"action": "approve", "comment": "通过"}, + ) + assert resp.status_code == 200 + assert resp.json()["status"] == "approved" + + async def test_reject_ticket( + self, client: AsyncClient, developer_token, dba_token, test_instance, + ): + create_resp = await _create_ticket(client, developer_token, test_instance.id) + ticket_id = create_resp.json()["id"] + resp = await client.post( + f"/api/v1/tickets/{ticket_id}/review", + headers=auth_header(dba_token), + json={"action": "reject", "comment": "拒绝"}, + ) + assert resp.status_code == 200 + assert resp.json()["status"] == "rejected" + + async def test_non_dba_cannot_review( + self, client: AsyncClient, developer_token, test_instance, + ): + create_resp = await _create_ticket(client, developer_token, test_instance.id) + ticket_id = create_resp.json()["id"] + resp = await client.post( + f"/api/v1/tickets/{ticket_id}/review", + headers=auth_header(developer_token), + json={"action": "approve", "comment": "非法审批"}, + ) + assert resp.status_code == 403 + + async def test_review_already_executed_ticket( + self, client: AsyncClient, developer_token, dba_token, test_instance, + ): + create_resp = await _create_ticket(client, developer_token, test_instance.id) + ticket_id = create_resp.json()["id"] + # Approve first + await client.post( + f"/api/v1/tickets/{ticket_id}/review", + headers=auth_header(dba_token), + json={"action": "approve", "comment": "通过"}, + ) + # The status is "approved" which is not in ("pending", "reviewing") so re-review should fail + resp = await client.post( + f"/api/v1/tickets/{ticket_id}/review", + headers=auth_header(dba_token), + json={"action": "approve", "comment": "再次审批"}, + ) + assert resp.status_code == 400 + + +class TestExecuteTicket: + async def test_execute_unapproved_ticket( + self, client: AsyncClient, developer_token, dba_token, test_instance, + ): + create_resp = await _create_ticket(client, developer_token, test_instance.id) + ticket_id = create_resp.json()["id"] + resp = await client.post( + f"/api/v1/tickets/{ticket_id}/execute", + headers=auth_header(dba_token), + ) + assert resp.status_code == 400 + + +class TestTicketStatistics: + async def test_ticket_statistics( + self, client: AsyncClient, developer_token, test_instance, + ): + await _create_ticket(client, developer_token, test_instance.id) + resp = await client.get("/api/v1/tickets/statistics", headers=auth_header(developer_token)) + assert resp.status_code == 200 + data = resp.json() + assert "total" in data + assert "pending" in data + + +class TestPagination: + async def test_pagination( + self, client: AsyncClient, developer_token, test_instance, + ): + for i in range(3): + await _create_ticket(client, developer_token, test_instance.id) + resp = await client.get( + "/api/v1/tickets?page=1&page_size=2", + headers=auth_header(developer_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["page"] == 1 + assert data["page_size"] == 2 + assert len(data["items"]) <= 2 diff --git a/tests/test_user.py b/tests/test_user.py new file mode 100644 index 0000000..5bec14f --- /dev/null +++ b/tests/test_user.py @@ -0,0 +1,458 @@ +"""用户管理端点完整测试 — user.py + +覆盖端点: + GET /api/v1/users 列表（支持 role / is_active 筛选） + POST /api/v1/users 创建用户 + GET /api/v1/users/{user_id} 获取单个用户 + PUT /api/v1/users/{user_id} 更新用户 + DELETE /api/v1/users/{user_id} 删除用户 +""" +import pytest +from httpx import AsyncClient + +from tests.conftest import auth_header + + +# ═══════════════════════════════════════════════════════════════ +# GET /users — 列表 +# ═══════════════════════════════════════════════════════════════ + + +class TestListUsers: + + async def test_list_all_users(self, client: AsyncClient, admin_user, admin_token): + """管理员可以获取全部用户列表。""" + resp = await client.get("/api/v1/users", headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + items = data.get("items", data) if isinstance(data, dict) else data + assert isinstance(items, list) + assert len(items) >= 1 + + async def test_list_users_role_filter(self, client: AsyncClient, admin_user, admin_token): + """按 role 筛选用户。""" + resp = await client.get( + "/api/v1/users?role=admin", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + items = data.get("items", data) if isinstance(data, dict) else data + for u in items: + assert u["role"] == "admin" + + async def test_list_users_is_active_filter( + self, client: AsyncClient, admin_user, disabled_user, admin_token + ): + """按 is_active 筛选用户。""" + resp = await client.get( + "/api/v1/users?is_active=false", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + items = data.get("items", data) if isinstance(data, dict) else data + for u in items: + assert u["is_active"] is False + + async def test_list_users_combined_filters( + self, client: AsyncClient, admin_user, disabled_user, admin_token + ): + """同时使用 role + is_active 筛选。""" + resp = await client.get( + "/api/v1/users?role=developer&is_active=false", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + items = data.get("items", data) if isinstance(data, dict) else data + for u in items: + assert u["role"] == "developer" + assert u["is_active"] is False + + async def test_list_users_empty_result(self, client: AsyncClient, admin_token): + """不存在的角色返回空列表。""" + resp = await client.get( + "/api/v1/users?role=guest", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + items = data.get("items", data) if isinstance(data, dict) else data + assert items == [] + + async def test_list_users_non_admin_forbidden( + self, client: AsyncClient, developer_token + ): + """developer 角色无权访问用户列表。""" + resp = await client.get( + "/api/v1/users", headers=auth_header(developer_token) + ) + assert resp.status_code == 403 + + async def test_list_users_guest_forbidden( + self, client: AsyncClient, guest_token + ): + """guest 角色无权访问用户列表。""" + resp = await client.get( + "/api/v1/users", headers=auth_header(guest_token) + ) + assert resp.status_code == 403 + + async def test_list_users_unauthenticated(self, client: AsyncClient): + """未认证请求返回 401。""" + resp = await client.get("/api/v1/users") + assert resp.status_code == 401 + + +# ═══════════════════════════════════════════════════════════════ +# POST /users — 创建 +# ═══════════════════════════════════════════════════════════════ + + +class TestCreateUser: + + async def test_create_user_success(self, client: AsyncClient, admin_token): + """成功创建用户。""" + resp = await client.post( + "/api/v1/users", + headers=auth_header(admin_token), + json={ + "username": "newuser", + "display_name": "新用户", + "password": "secure123", + "role": "developer", + }, + ) + assert resp.status_code == 201 + data = resp.json() + assert data["username"] == "newuser" + assert data["display_name"] == "新用户" + assert data["role"] == "developer" + assert "id" in data + assert "hashed_password" not in data + + async def test_create_user_with_all_fields(self, client: AsyncClient, admin_token): + """创建用户时填写所有可选字段。""" + resp = await client.post( + "/api/v1/users", + headers=auth_header(admin_token), + json={ + "username": "fulluser", + "display_name": "完整用户", + "password": "secure123", + "email": "full@example.com", + "phone": "13800138000", + "role": "dba", + }, + ) + assert resp.status_code == 201 + data = resp.json() + assert data["email"] == "full@example.com" + assert data["phone"] == "13800138000" + assert data["role"] == "dba" + + async def test_create_duplicate_username( + self, client: AsyncClient, admin_user, admin_token + ): + """用户名重复返回 400。""" + resp = await client.post( + "/api/v1/users", + headers=auth_header(admin_token), + json={ + "username": "admin", + "display_name": "重复", + "password": "123456", + "role": "developer", + }, + ) + assert resp.status_code == 400 + assert "已存在" in resp.json()["detail"] + + async def test_create_user_short_password(self, client: AsyncClient, admin_token): + """密码少于 6 位返回 422。""" + resp = await client.post( + "/api/v1/users", + headers=auth_header(admin_token), + json={ + "username": "shortpw", + "display_name": "短密码", + "password": "123", + "role": "developer", + }, + ) + assert resp.status_code == 422 + + async def test_create_user_invalid_role(self, client: AsyncClient, admin_token): + """无效角色返回 422。""" + resp = await client.post( + "/api/v1/users", + headers=auth_header(admin_token), + json={ + "username": "badrole", + "display_name": "坏角色", + "password": "123456", + "role": "superadmin", + }, + ) + assert resp.status_code == 422 + + async def test_create_user_missing_username(self, client: AsyncClient, admin_token): + """缺少 username 字段返回 422。""" + resp = await client.post( + "/api/v1/users", + headers=auth_header(admin_token), + json={ + "display_name": "无用户名", + "password": "123456", + "role": "developer", + }, + ) + assert resp.status_code == 422 + + async def test_create_user_non_admin_forbidden( + self, client: AsyncClient, developer_token + ): + """developer 角色无权创建用户。""" + resp = await client.post( + "/api/v1/users", + headers=auth_header(developer_token), + json={ + "username": "unauthorized", + "display_name": "不应成功", + "password": "123456", + "role": "developer", + }, + ) + assert resp.status_code == 403 + + async def test_create_user_default_role(self, client: AsyncClient, admin_token): + """不传 role 时默认为 developer。""" + resp = await client.post( + "/api/v1/users", + headers=auth_header(admin_token), + json={ + "username": "defaultrole", + "display_name": "默认角色", + "password": "123456", + }, + ) + assert resp.status_code == 201 + assert resp.json()["role"] == "developer" + + +# ═══════════════════════════════════════════════════════════════ +# GET /users/{user_id} — 获取单个 +# ═══════════════════════════════════════════════════════════════ + + +class TestGetUser: + + async def test_get_user_success( + self, client: AsyncClient, admin_user, admin_token + ): + """成功获取单个用户。""" + resp = await client.get( + f"/api/v1/users/{admin_user.id}", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["username"] == "admin" + + async def test_get_user_nonexistent(self, client: AsyncClient, admin_token): + """查询不存在的用户返回 404。""" + resp = await client.get( + "/api/v1/users/9999", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + assert "不存在" in resp.json()["detail"] + + async def test_get_user_non_admin_forbidden( + self, client: AsyncClient, admin_user, developer_token + ): + """developer 角色无权查看用户详情。""" + resp = await client.get( + f"/api/v1/users/{admin_user.id}", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + async def test_get_user_unauthenticated(self, client: AsyncClient, admin_user): + """未认证请求返回 401。""" + resp = await client.get(f"/api/v1/users/{admin_user.id}") + assert resp.status_code == 401 + + +# ═══════════════════════════════════════════════════════════════ +# PUT /users/{user_id} — 更新 +# ═══════════════════════════════════════════════════════════════ + + +class TestUpdateUser: + + async def test_update_display_name( + self, client: AsyncClient, admin_user, admin_token + ): + """更新 display_name。""" + resp = await client.put( + f"/api/v1/users/{admin_user.id}", + headers=auth_header(admin_token), + json={"display_name": "管理员改名"}, + ) + assert resp.status_code == 200 + assert resp.json()["display_name"] == "管理员改名" + + async def test_update_email( + self, client: AsyncClient, admin_user, admin_token + ): + """更新 email。""" + resp = await client.put( + f"/api/v1/users/{admin_user.id}", + headers=auth_header(admin_token), + json={"email": "admin@example.com"}, + ) + assert resp.status_code == 200 + assert resp.json()["email"] == "admin@example.com" + + async def test_update_role( + self, client: AsyncClient, admin_user, dba_user, admin_token + ): + """更新用户角色。""" + resp = await client.put( + f"/api/v1/users/{dba_user.id}", + headers=auth_header(admin_token), + json={"role": "developer"}, + ) + assert resp.status_code == 200 + assert resp.json()["role"] == "developer" + + async def test_update_is_active( + self, client: AsyncClient, dba_user, admin_token + ): + """禁用用户。""" + resp = await client.put( + f"/api/v1/users/{dba_user.id}", + headers=auth_header(admin_token), + json={"is_active": False}, + ) + assert resp.status_code == 200 + assert resp.json()["is_active"] is False + + async def test_update_multiple_fields( + self, client: AsyncClient, dba_user, admin_token + ): + """同时更新多个字段。""" + resp = await client.put( + f"/api/v1/users/{dba_user.id}", + headers=auth_header(admin_token), + json={ + "display_name": "DBA改名", + "phone": "13900139000", + }, + ) + assert resp.status_code == 200 + data = resp.json() + assert data["display_name"] == "DBA改名" + assert data["phone"] == "13900139000" + + async def test_update_nonexistent_user(self, client: AsyncClient, admin_token): + """更新不存在的用户返回 404。""" + resp = await client.put( + "/api/v1/users/9999", + headers=auth_header(admin_token), + json={"display_name": "不存在"}, + ) + assert resp.status_code == 404 + + async def test_update_invalid_role( + self, client: AsyncClient, admin_user, admin_token + ): + """无效角色返回 422。""" + resp = await client.put( + f"/api/v1/users/{admin_user.id}", + headers=auth_header(admin_token), + json={"role": "superadmin"}, + ) + assert resp.status_code == 422 + + async def test_update_non_admin_forbidden( + self, client: AsyncClient, admin_user, developer_token + ): + """developer 角色无权更新用户。""" + resp = await client.put( + f"/api/v1/users/{admin_user.id}", + headers=auth_header(developer_token), + json={"display_name": "越权"}, + ) + assert resp.status_code == 403 + + +# ═══════════════════════════════════════════════════════════════ +# DELETE /users/{user_id} — 删除 +# ═══════════════════════════════════════════════════════════════ + + +class TestDeleteUser: + + async def test_delete_user_success( + self, client: AsyncClient, dba_user, admin_token + ): + """成功删除用户。""" + resp = await client.delete( + f"/api/v1/users/{dba_user.id}", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert "已删除" in resp.json()["message"] + + # 确认已被删除 + resp2 = await client.get( + f"/api/v1/users/{dba_user.id}", + headers=auth_header(admin_token), + ) + assert resp2.status_code == 404 + + async def test_delete_self( + self, client: AsyncClient, admin_user, admin_token + ): + """不能删除自己。""" + resp = await client.delete( + f"/api/v1/users/{admin_user.id}", + headers=auth_header(admin_token), + ) + assert resp.status_code == 400 + assert "不能删除自己" in resp.json()["detail"] + + async def test_delete_nonexistent_user(self, client: AsyncClient, admin_token): + """删除不存在的用户返回 404。""" + resp = await client.delete( + "/api/v1/users/9999", + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + async def test_delete_non_admin_forbidden( + self, client: AsyncClient, admin_user, developer_token + ): + """developer 角色无权删除用户。""" + resp = await client.delete( + f"/api/v1/users/{admin_user.id}", + headers=auth_header(developer_token), + ) + assert resp.status_code == 403 + + async def test_delete_unauthenticated(self, client: AsyncClient, admin_user): + """未认证请求返回 401。""" + resp = await client.delete(f"/api/v1/users/{admin_user.id}") + assert resp.status_code == 401 + + async def test_delete_guest_forbidden( + self, client: AsyncClient, admin_user, guest_token + ): + """guest 角色无权删除用户。""" + resp = await client.delete( + f"/api/v1/users/{admin_user.id}", + headers=auth_header(guest_token), + ) + assert resp.status_code == 403 diff --git a/tests/test_user_endpoint.py b/tests/test_user_endpoint.py new file mode 100644 index 0000000..b37cd77 --- /dev/null +++ b/tests/test_user_endpoint.py @@ -0,0 +1,232 @@ +"""用户管理 API 端点测试。""" +import pytest +from httpx import AsyncClient + +from app.core.security import hash_password, create_access_token +from app.models.user import User + + +def auth_header(token: str) -> dict: + return {"Authorization": f"Bearer {token}"} + + +@pytest.mark.asyncio +class TestListUsers: + """GET /api/v1/users""" + + async def test_list_users_empty(self, client: AsyncClient, admin_token: str): + resp = await client.get("/api/v1/users", headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + # admin_user fixture 创建了 1 个 + assert isinstance(data, dict) and "items" in data + + async def test_list_users_filter_role( + self, client: AsyncClient, db, admin_token: str + ): + # 创建一个 dba 用户 + dba = User( + username="dba_test", + display_name="DBA", + role="dba", + hashed_password=hash_password("123456"), + ) + db.add(dba) + await db.commit() + + resp = await client.get( + "/api/v1/users?role=dba", headers=auth_header(admin_token) + ) + assert resp.status_code == 200 + data = resp.json() + items = data.get("items", data) if isinstance(data, dict) else data + assert all(u["role"] == "dba" for u in items) + + async def test_list_users_filter_active( + self, client: AsyncClient, db, admin_token: str + ): + dev = User( + username="inactive_dev", + display_name="离线", + role="developer", + is_active=False, + hashed_password=hash_password("123456"), + ) + db.add(dev) + await db.commit() + + resp = await client.get( + "/api/v1/users?is_active=false", headers=auth_header(admin_token) + ) + assert resp.status_code == 200 + data = resp.json() + items = data.get("items", data) if isinstance(data, dict) else data + assert all(u["is_active"] is False for u in items) + + async def test_list_users_forbidden_non_admin( + self, client: AsyncClient, developer_token: str + ): + resp = await client.get("/api/v1/users", headers=auth_header(developer_token)) + assert resp.status_code == 403 + + async def test_list_users_unauthorized(self, client: AsyncClient): + resp = await client.get("/api/v1/users") + assert resp.status_code == 401 + + +@pytest.mark.asyncio +class TestCreateUser: + """POST /api/v1/users""" + + async def test_create_user_success(self, client: AsyncClient, admin_token: str): + resp = await client.post( + "/api/v1/users", + json={ + "username": "newuser", + "display_name": "新用户", + "email": "new@test.com", + "phone": "13800001111", + "role": "developer", + "password": "pass123", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 201 + data = resp.json() + assert data["username"] == "newuser" + assert data["role"] == "developer" + assert "hashed_password" not in data + + async def test_create_user_duplicate_username( + self, client: AsyncClient, admin_token: str, admin_user: User + ): + resp = await client.post( + "/api/v1/users", + json={ + "username": "admin", + "display_name": "重复", + "role": "developer", + "password": "123456", + }, + headers=auth_header(admin_token), + ) + assert resp.status_code == 400 + assert "已存在" in resp.json()["detail"] + + async def test_create_user_forbidden_dba( + self, client: AsyncClient, dba_token: str + ): + resp = await client.post( + "/api/v1/users", + json={ + "username": "hack", + "display_name": "hack", + "role": "developer", + "password": "123", + }, + headers=auth_header(dba_token), + ) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +class TestGetUser: + """GET /api/v1/users/{user_id}""" + + async def test_get_user_success( + self, client: AsyncClient, admin_token: str, admin_user: User + ): + resp = await client.get( + f"/api/v1/users/{admin_user.id}", headers=auth_header(admin_token) + ) + assert resp.status_code == 200 + data = resp.json() + assert data["username"] == "admin" + + async def test_get_user_not_found(self, client: AsyncClient, admin_token: str): + resp = await client.get( + "/api/v1/users/9999", headers=auth_header(admin_token) + ) + assert resp.status_code == 404 + + async def test_get_user_forbidden(self, client: AsyncClient, developer_token: str): + resp = await client.get( + "/api/v1/users/1", headers=auth_header(developer_token) + ) + assert resp.status_code == 403 + + +@pytest.mark.asyncio +class TestUpdateUser: + """PUT /api/v1/users/{user_id}""" + + async def test_update_user_display_name( + self, client: AsyncClient, admin_token: str, dba_user + ): + resp = await client.put( + f"/api/v1/users/{dba_user.id}", + json={"display_name": "DBA王五"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + data = resp.json() + assert data["display_name"] == "DBA王五" + + async def test_update_user_role( + self, client: AsyncClient, admin_token: str, developer_user + ): + resp = await client.put( + f"/api/v1/users/{developer_user.id}", + json={"role": "dba"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["role"] == "dba" + + async def test_update_user_not_found(self, client: AsyncClient, admin_token: str): + resp = await client.put( + "/api/v1/users/9999", + json={"display_name": "x"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 404 + + async def test_update_user_partial( + self, client: AsyncClient, admin_token: str, dba_user + ): + resp = await client.put( + f"/api/v1/users/{dba_user.id}", + json={"email": "dba@test.com"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["email"] == "dba@test.com" + + +@pytest.mark.asyncio +class TestDeleteUser: + """DELETE /api/v1/users/{user_id}""" + + async def test_delete_user_success( + self, client: AsyncClient, admin_token: str, developer_user + ): + resp = await client.delete( + f"/api/v1/users/{developer_user.id}", headers=auth_header(admin_token) + ) + assert resp.status_code == 200 + assert "已删除" in resp.json()["message"] + + async def test_delete_self_forbidden( + self, client: AsyncClient, admin_token: str, admin_user: User + ): + resp = await client.delete( + f"/api/v1/users/{admin_user.id}", headers=auth_header(admin_token) + ) + assert resp.status_code == 400 + assert "不能删除自己" in resp.json()["detail"] + + async def test_delete_user_not_found(self, client: AsyncClient, admin_token: str): + resp = await client.delete( + "/api/v1/users/9999", headers=auth_header(admin_token) + ) + assert resp.status_code == 404 diff --git a/tests/test_users.py b/tests/test_users.py new file mode 100644 index 0000000..0d2008b --- /dev/null +++ b/tests/test_users.py @@ -0,0 +1,78 @@ +import pytest +from httpx import AsyncClient + +from tests.conftest import auth_header + + +class TestListUsers: + async def test_admin_list_users(self, client: AsyncClient, admin_token): + resp = await client.get("/api/v1/users", headers=auth_header(admin_token)) + assert resp.status_code == 200 + data = resp.json() + assert isinstance(data, dict) and "items" in data + + async def test_non_admin_list_users(self, client: AsyncClient, developer_token): + resp = await client.get("/api/v1/users", headers=auth_header(developer_token)) + assert resp.status_code == 403 + + +class TestCreateUser: + async def test_create_user_success(self, client: AsyncClient, admin_token): + resp = await client.post("/api/v1/users", headers=auth_header(admin_token), json={ + "username": "newuser", + "display_name": "新用户", + "password": "123456", + "role": "developer", + }) + assert resp.status_code == 201 + data = resp.json() + assert data["username"] == "newuser" + assert data["role"] == "developer" + assert "id" in data + + async def test_create_duplicate_username(self, client: AsyncClient, admin_user, admin_token): + resp = await client.post("/api/v1/users", headers=auth_header(admin_token), json={ + "username": "admin", + "display_name": "重复", + "password": "123456", + "role": "developer", + }) + assert resp.status_code == 400 + + +class TestGetUser: + async def test_get_single_user(self, client: AsyncClient, admin_user, admin_token): + resp = await client.get(f"/api/v1/users/{admin_user.id}", headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert resp.json()["username"] == "admin" + + async def test_get_nonexistent_user(self, client: AsyncClient, admin_token): + resp = await client.get("/api/v1/users/9999", headers=auth_header(admin_token)) + assert resp.status_code == 404 + + +class TestUpdateUser: + async def test_update_user(self, client: AsyncClient, admin_user, admin_token): + resp = await client.put( + f"/api/v1/users/{admin_user.id}", + headers=auth_header(admin_token), + json={"display_name": "管理员改名"}, + ) + assert resp.status_code == 200 + assert resp.json()["display_name"] == "管理员改名" + + +class TestDeleteUser: + async def test_delete_user(self, client: AsyncClient, admin_user, dba_user, admin_token): + resp = await client.delete( + f"/api/v1/users/{dba_user.id}", + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + + async def test_delete_self(self, client: AsyncClient, admin_user, admin_token): + resp = await client.delete( + f"/api/v1/users/{admin_user.id}", + headers=auth_header(admin_token), + ) + assert resp.status_code == 400 diff --git a/tests/test_workflow.py b/tests/test_workflow.py new file mode 100644 index 0000000..cf668db --- /dev/null +++ b/tests/test_workflow.py @@ -0,0 +1,324 @@ +"""审批流程管理 API 测试 — 覆盖 CRUD + 设默认 + 克隆功能。""" +import pytest +from httpx import AsyncClient + +from tests.conftest import auth_header + +BASE = "/api/v1/workflows" + +SAMPLE_WORKFLOW = { + "name": "标准审批流", + "description": "DBA初审 + 管理员终审", + "is_default": True, + "steps": [ + { + "step_number": 1, + "name": "DBA审核", + "step_type": "serial", + "approver_role": "dba", + "is_required": True, + "timeout_hours": 24, + "auto_approve_on_timeout": False, + }, + { + "step_number": 2, + "name": "管理员审核", + "step_type": "serial", + "approver_role": "admin", + "is_required": True, + "timeout_hours": 48, + "auto_approve_on_timeout": False, + }, + ], +} + + +async def _create_workflow(client: AsyncClient, token: str, overrides: dict = None) -> dict: + payload = {**SAMPLE_WORKFLOW} + if overrides: + payload.update(overrides) + resp = await client.post(BASE, json=payload, headers=auth_header(token)) + return resp + + +# ────────────────────────── Permission Tests ────────────────────────── + + +class TestWorkflowPermissions: + """权限检查 — workflow 管理 admin/dba 可读，仅 admin 可写。""" + + @pytest.mark.asyncio + async def test_list_dba_allowed(self, client, dba_token): + resp = await client.get(BASE, headers=auth_header(dba_token)) + assert resp.status_code == 200 + + @pytest.mark.asyncio + async def test_list_developer_forbidden(self, client, developer_token): + resp = await client.get(BASE, headers=auth_header(developer_token)) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_list_guest_forbidden(self, client, guest_token): + resp = await client.get(BASE, headers=auth_header(guest_token)) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_create_dba_forbidden(self, client, dba_token): + resp = await _create_workflow(client, dba_token) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_create_developer_forbidden(self, client, developer_token): + resp = await _create_workflow(client, developer_token) + assert resp.status_code == 403 + + @pytest.mark.asyncio + async def test_no_auth_returns_401(self, client): + resp = await client.get(BASE) + assert resp.status_code == 401 + resp2 = await client.post(BASE, json=SAMPLE_WORKFLOW) + assert resp2.status_code == 401 + + +# ────────────────────────── Create Tests ────────────────────────── + + +class TestCreateWorkflow: + """创建审批流程。""" + + @pytest.mark.asyncio + async def test_create_success(self, client, admin_token): + resp = await _create_workflow(client, admin_token) + assert resp.status_code == 201 + body = resp.json() + assert body["name"] == "标准审批流" + assert body["is_default"] is True + assert len(body["steps"]) == 2 + assert body["steps"][0]["name"] == "DBA审核" + assert body["steps"][1]["name"] == "管理员审核" + + @pytest.mark.asyncio + async def test_create_non_default(self, client, admin_token): + resp = await _create_workflow(client, admin_token, {"is_default": False}) + assert resp.status_code == 201 + assert resp.json()["is_default"] is False + + @pytest.mark.asyncio + async def test_create_only_default_one(self, client, admin_token): + """设为默认时，取消其他默认。""" + r1 = await _create_workflow(client, admin_token, {"name": "WF1", "is_default": True}) + assert r1.status_code == 201 + r2 = await _create_workflow(client, admin_token, {"name": "WF2", "is_default": True}) + assert r2.status_code == 201 + # r2 should be default now + assert r2.json()["is_default"] is True + # list and verify only one default + resp = await client.get(BASE, headers=auth_header(admin_token)) + workflows = resp.json() + defaults = [w for w in workflows if w["is_default"]] + assert len(defaults) == 1 + assert defaults[0]["name"] == "WF2" + + +# ────────────────────────── List Tests ────────────────────────── + + +class TestListWorkflows: + + @pytest.mark.asyncio + async def test_list_empty(self, client, admin_token): + resp = await client.get(BASE, headers=auth_header(admin_token)) + assert resp.status_code == 200 + assert resp.json() == [] + + @pytest.mark.asyncio + async def test_list_returns_created(self, client, admin_token): + await _create_workflow(client, admin_token, {"name": "WF-A"}) + await _create_workflow(client, admin_token, {"name": "WF-B", "is_default": False}) + resp = await client.get(BASE, headers=auth_header(admin_token)) + assert resp.status_code == 200 + names = [w["name"] for w in resp.json()] + assert "WF-A" in names + assert "WF-B" in names + + +# ────────────────────────── Get Detail Tests ────────────────────────── + + +class TestGetWorkflow: + + @pytest.mark.asyncio + async def test_get_success(self, client, admin_token): + created = (await _create_workflow(client, admin_token)).json() + resp = await client.get( + f"{BASE}/{created['id']}", headers=auth_header(admin_token) + ) + assert resp.status_code == 200 + assert resp.json()["name"] == created["name"] + + @pytest.mark.asyncio + async def test_get_not_found(self, client, admin_token): + resp = await client.get(f"{BASE}/9999", headers=auth_header(admin_token)) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_get_dba_allowed(self, client, admin_token, dba_token): + created = (await _create_workflow(client, admin_token)).json() + resp = await client.get( + f"{BASE}/{created['id']}", headers=auth_header(dba_token) + ) + assert resp.status_code == 200 + + +# ────────────────────────── Update Tests ────────────────────────── + + +class TestUpdateWorkflow: + + @pytest.mark.asyncio + async def test_update_name(self, client, admin_token): + created = (await _create_workflow(client, admin_token)).json() + resp = await client.put( + f"{BASE}/{created['id']}", + json={"name": "新名称"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["name"] == "新名称" + + @pytest.mark.asyncio + async def test_update_description(self, client, admin_token): + created = (await _create_workflow(client, admin_token)).json() + resp = await client.put( + f"{BASE}/{created['id']}", + json={"description": "新描述"}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["description"] == "新描述" + + @pytest.mark.asyncio + async def test_deactivate(self, client, admin_token): + created = (await _create_workflow(client, admin_token)).json() + resp = await client.put( + f"{BASE}/{created['id']}", + json={"is_active": False}, + headers=auth_header(admin_token), + ) + assert resp.status_code == 200 + assert resp.json()["is_active"] is False + + @pytest.mark.asyncio + async def test_update_not_found(self, client, admin_token): + resp = await client.put( + f"{BASE}/9999", json={"name": "x"}, headers=auth_header(admin_token) + ) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_update_dba_forbidden(self, client, admin_token, dba_token): + created = (await _create_workflow(client, admin_token)).json() + resp = await client.put( + f"{BASE}/{created['id']}", + json={"name": "x"}, + headers=auth_header(dba_token), + ) + assert resp.status_code == 403 + + +# ────────────────────────── Delete Tests ────────────────────────── + + +class TestDeleteWorkflow: + """删除 = 软删除 (is_active=False)。""" + + @pytest.mark.asyncio + async def test_delete_success(self, client, admin_token): + created = (await _create_workflow(client, admin_token)).json() + resp = await client.delete( + f"{BASE}/{created['id']}", headers=auth_header(admin_token) + ) + assert resp.status_code == 200 + # should not appear in list (only active) + resp2 = await client.get(BASE, headers=auth_header(admin_token)) + ids = [w["id"] for w in resp2.json()] + assert created["id"] not in ids + + @pytest.mark.asyncio + async def test_delete_not_found(self, client, admin_token): + resp = await client.delete(f"{BASE}/9999", headers=auth_header(admin_token)) + assert resp.status_code == 404 + + @pytest.mark.asyncio + async def test_delete_dba_forbidden(self, client, admin_token, dba_token): + created = (await _create_workflow(client, admin_token)).json() + resp = await client.delete( + f"{BASE}/{created['id']}", headers=auth_header(dba_token) + ) + assert resp.status_code == 403 + + +# ────────────────────────── Set Default Tests ────────────────────────── + + +class TestSetDefaultWorkflow: + + @pytest.mark.asyncio + async def test_set_default(self, client, admin_token): + r1 = await _create_workflow(client, admin_token, {"name": "WF1", "is_default": True}) + r2 = await _create_workflow(client, admin_token, {"name": "WF2", "is_default": False}) + wf1_id = r1.json()["id"] + wf2_id = r2.json()["id"] + + # Set WF2 as default + resp = await client.post( + f"{BASE}/{wf2_id}/set-default", headers=auth_header(admin_token) + ) + assert resp.status_code == 200 + assert "已设为默认" in resp.json()["message"] + + # Verify WF2 is default + resp2 = await client.get(BASE, headers=auth_header(admin_token)) + workflows = resp2.json() + defaults = [w for w in workflows if w["is_default"]] + assert len(defaults) == 1 + assert defaults[0]["id"] == wf2_id + + @pytest.mark.asyncio + async def test_set_default_not_found(self, client, admin_token): + resp = await client.post(f"{BASE}/9999/set-default", headers=auth_header(admin_token)) + assert resp.status_code == 404 + + +# ────────────────────────── Clone Tests ────────────────────────── + + +class TestCloneWorkflow: + + @pytest.mark.asyncio + async def test_clone_success(self, client, admin_token): + created = (await _create_workflow(client, admin_token)).json() + resp = await client.post( + f"{BASE}/{created['id']}/clone", headers=auth_header(admin_token) + ) + assert resp.status_code == 200 + cloned = resp.json() + assert cloned["name"] == "标准审批流 (副本)" + assert cloned["is_default"] is False + assert cloned["id"] != created["id"] + # Steps cloned + assert len(cloned["steps"]) == 2 + assert cloned["steps"][0]["workflow_id"] == cloned["id"] + + @pytest.mark.asyncio + async def test_clone_not_found(self, client, admin_token): + resp = await client.post(f"{BASE}/9999/clone", headers=auth_header(admin_token)) + assert resp.status_code in (404, 422) + + @pytest.mark.asyncio + async def test_clone_dba_forbidden(self, client, admin_token, dba_token): + created = (await _create_workflow(client, admin_token)).json() + resp = await client.post( + f"{BASE}/{created['id']}/clone", headers=auth_header(dba_token) + ) + assert resp.status_code == 403