feat: Go后端LDAP真实对接 — AES-256-GCM密码加解密 + 登录LDAP fallback
- 新增 crypto.go: AES-256-GCM 加解密，与 Python backend 兼容 - auth.go: Login 添加 LDAP fallback（本地优先→LDAP绑定→自动创建本地用户） - ldap.go: 实现真实 LDAP 连接/用户搜索/密码验证/OU列表/用户列表 - 所有 LDAP 操作解密 admin_password 后使用 - 新增/更新密码存储时加密 - router.go: 补充 delete-user 路由 - 添加 go-ldap/v3 依赖
This commit is contained in:
logan committed
1 parent
622923821b
commit
88e5f4e7ee
71 files changed
+20390
-64
No files matched your search
@@ -0,0 +1,173 @@
|
||||
"""Tests for Audit Log API (Phase 3.4)."""
|
||||
import pytest
|
||||
from tests.conftest import auth_header
|
||||
|
||||
|
||||
class TestAuditLogAPI:
|
||||
@pytest.mark.asyncio
|
||||
async def test_list_audit_logs_admin(self, client, admin_token):
|
||||
"""Admin can list audit logs."""
|
||||
resp = await client.get(
|
||||
"/api/v1/audit/logs",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert "items" in data
|
||||
assert "total" in data
|
||||
assert "page" in data
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_list_audit_logs_dba(self, client, dba_token):
|
||||
"""DBA can also list audit logs."""
|
||||
resp = await client.get(
|
||||
"/api/v1/audit/logs",
|
||||
headers=auth_header(dba_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_list_audit_logs_developer_forbidden(self, client, developer_token):
|
||||
"""Developer cannot access audit logs."""
|
||||
resp = await client.get(
|
||||
"/api/v1/audit/logs",
|
||||
headers=auth_header(developer_token),
|
||||
)
|
||||
assert resp.status_code == 403
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_create_instance_logs_audit(self, client, db, admin_token):
|
||||
"""Creating an instance produces an audit log entry."""
|
||||
from app.models.audit_log import AuditLog
|
||||
from sqlalchemy import select
|
||||
|
||||
resp = await client.post(
|
||||
"/api/v1/instances",
|
||||
json={
|
||||
"name": "审计测试实例",
|
||||
"db_type": "mysql",
|
||||
"host": "10.0.0.100",
|
||||
"port": 3306,
|
||||
"username": "root",
|
||||
"password": "test123",
|
||||
"database": "test",
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
|
||||
# Check audit log was created
|
||||
result = await db.execute(
|
||||
select(AuditLog).where(AuditLog.action == "CREATE_INSTANCE")
|
||||
)
|
||||
log = result.scalar_one_or_none()
|
||||
assert log is not None
|
||||
assert "审计测试实例" in log.detail
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_create_user_logs_audit(self, client, admin_token):
|
||||
"""Creating a user produces an audit log entry."""
|
||||
resp = await client.post(
|
||||
"/api/v1/users",
|
||||
json={
|
||||
"username": "audit_test_user",
|
||||
"display_name": "审计测试",
|
||||
"password": "test123456",
|
||||
"role": "developer",
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
# Audit middleware writes to its own session; verified via API in integration tests
|
||||
# Here we just confirm the create succeeded
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_create_ticket_logs_audit(self, client, admin_token, test_instance):
|
||||
"""Creating a ticket produces an audit log entry."""
|
||||
resp = await client.post(
|
||||
"/api/v1/tickets",
|
||||
json={
|
||||
"title": "审计日志工单测试",
|
||||
"db_type": "mysql",
|
||||
"instance_id": test_instance.id,
|
||||
"target_database": "test_db",
|
||||
"sql_content": "SELECT id FROM users LIMIT 10;",
|
||||
"reason": "测试审计日志",
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
# Audit middleware writes to its own session; verified via API in integration tests
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_audit_log_pagination(self, client, admin_token):
|
||||
"""Audit log pagination works."""
|
||||
resp = await client.get(
|
||||
"/api/v1/audit/logs?page=1&page_size=5",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert data["page_size"] == 5
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_audit_log_filter_by_action(self, client, admin_token, db, test_instance):
|
||||
"""Can filter audit logs by action."""
|
||||
# Create a ticket first
|
||||
await client.post(
|
||||
"/api/v1/tickets",
|
||||
json={
|
||||
"title": "过滤测试工单",
|
||||
"db_type": "mysql",
|
||||
"instance_id": test_instance.id,
|
||||
"target_database": "test_db",
|
||||
"sql_content": "SELECT 1;",
|
||||
"reason": "过滤测试用",
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
|
||||
resp = await client.get(
|
||||
"/api/v1/audit/logs?action=CREATE_TICKET",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
for item in data["items"]:
|
||||
assert item["action"] == "CREATE_TICKET"
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_review_ticket_logs_audit(self, client, db, admin_token, dba_token, test_instance):
|
||||
"""Reviewing a ticket creates an audit log."""
|
||||
from app.models.audit_log import AuditLog
|
||||
from sqlalchemy import select
|
||||
|
||||
# Create ticket as admin
|
||||
resp = await client.post(
|
||||
"/api/v1/tickets",
|
||||
json={
|
||||
"title": "审核日志测试",
|
||||
"db_type": "mysql",
|
||||
"instance_id": test_instance.id,
|
||||
"target_database": "test_db",
|
||||
"sql_content": "SELECT 1;",
|
||||
"reason": "审核日志测试",
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
ticket_id = resp.json()["id"]
|
||||
|
||||
# Review as DBA
|
||||
resp = await client.post(
|
||||
f"/api/v1/tickets/{ticket_id}/review",
|
||||
json={"action": "approve", "comment": "批准"},
|
||||
headers=auth_header(dba_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
|
||||
result = await db.execute(
|
||||
select(AuditLog).where(AuditLog.action == "REVIEW_TICKET")
|
||||
)
|
||||
log = result.scalar_one_or_none()
|
||||
assert log is not None
|
||||
assert "approve" in log.detail
|
||||
Reference in new issue
Block a user