feat: Go后端LDAP真实对接 — AES-256-GCM密码加解密 + 登录LDAP fallback

- 新增 crypto.go: AES-256-GCM 加解密，与 Python backend 兼容 - auth.go: Login 添加 LDAP fallback（本地优先→LDAP绑定→自动创建本地用户） - ldap.go: 实现真实 LDAP 连接/用户搜索/密码验证/OU列表/用户列表 - 所有 LDAP 操作解密 admin_password 后使用 - 新增/更新密码存储时加密 - router.go: 补充 delete-user 路由 - 添加 go-ldap/v3 依赖
2026-05-25 23:32:15 +08:00
1 parent 622923821b
commit 88e5f4e7ee
@@ -0,0 +1,261 @@
+"""
+集成测试: 审核策略是否生效
+覆盖: DDL/DML/安全/性能规则 → Redis/MongoDB规则 → 开关控制 → 评分系统
+"""
+import pytest
+from httpx import AsyncClient
+
+
+def _auth(token: str) -> dict:
+    return {"Authorization": f"Bearer {token}"}
+
+
+async def _setup(admin_token, client):
+    """创建测试实例"""
+    inst = await client.post("/api/v1/instances", json={
+        "name": "审核测试MySQL", "db_type": "mysql",
+        "host": "127.0.0.1", "port": 3306,
+        "username": "root", "password": "test", "database": "test_db",
+        "env": "production",
+    }, headers=_auth(admin_token))
+    assert inst.status_code == 201
+    mysql_id = inst.json()["id"]
+
+    redis = await client.post("/api/v1/instances", json={
+        "name": "审核测试Redis", "db_type": "redis",
+        "host": "127.0.0.1", "port": 6379,
+        "username": "", "password": "test", "database": "0",
+        "env": "production",
+    }, headers=_auth(admin_token))
+    assert redis.status_code == 201
+    redis_id = redis.json()["id"]
+
+    return mysql_id, redis_id
+
+
+async def _audit(client, token, sql, instance_id, database="test_db"):
+    return await client.post("/api/v1/tickets/audit", json={
+        "sql_content": sql, "instance_id": instance_id, "database": database,
+    }, headers=_auth(token))
+
+
+# ══════════════════════════════════════════════════════════════
+# 1. DDL 规则生效验证
+# ══════════════════════════════════════════════════════════════
+
+class TestDDLRulesEnforcement:
+    async def test_create_table_no_pk(self, client, admin_token):
+        mysql_id, _ = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token,
+            "CREATE TABLE t1 (name VARCHAR(50))", mysql_id)
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["score"] < 100  # 无主键应该扣分
+
+    async def test_drop_table_production(self, client, admin_token):
+        mysql_id, _ = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token,
+            "DROP TABLE users", mysql_id)
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["score"] < 80  # DROP TABLE 应该低分
+
+    async def test_truncate_warning(self, client, admin_token):
+        mysql_id, _ = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token,
+            "TRUNCATE TABLE users", mysql_id)
+        assert resp.status_code == 200
+        # TRUNCATE 应该触发警告或错误
+        data = resp.json()
+        assert data["score"] < 100
+
+    async def test_float_type_warning(self, client, admin_token):
+        mysql_id, _ = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token,
+            "CREATE TABLE t (id INT PRIMARY KEY, price FLOAT)", mysql_id)
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["score"] < 100  # FLOAT 类型应扣分
+
+
+# ══════════════════════════════════════════════════════════════
+# 2. DML 规则生效验证
+# ══════════════════════════════════════════════════════════════
+
+class TestDMLRulesEnforcement:
+    async def test_update_no_where(self, client, admin_token):
+        mysql_id, _ = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token,
+            "UPDATE users SET name='test'", mysql_id)
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["score"] < 60  # 无WHERE的UPDATE应严重扣分
+
+    async def test_delete_no_where(self, client, admin_token):
+        mysql_id, _ = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token,
+            "DELETE FROM users", mysql_id)
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["score"] < 60
+
+    async def test_insert_with_where_ok(self, client, admin_token):
+        mysql_id, _ = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token,
+            "UPDATE users SET name='test' WHERE id=1", mysql_id)
+        assert resp.status_code == 200
+        # 有WHERE的UPDATE应该高分
+        assert resp.json()["score"] >= 70
+
+
+# ══════════════════════════════════════════════════════════════
+# 3. 性能规则
+# ══════════════════════════════════════════════════════════════
+
+class TestPerformanceRules:
+    async def test_select_star(self, client, admin_token):
+        mysql_id, _ = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token,
+            "SELECT * FROM users WHERE id=1", mysql_id)
+        assert resp.status_code == 200
+        # SELECT * 应该扣分
+        assert resp.json()["score"] < 100
+
+    async def test_clean_select(self, client, admin_token):
+        mysql_id, _ = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token,
+            "SELECT id, name FROM users WHERE id=1", mysql_id)
+        assert resp.status_code == 200
+        assert resp.json()["score"] >= 80
+
+    async def test_join_no_on(self, client, admin_token):
+        mysql_id, _ = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token,
+            "SELECT * FROM users JOIN orders", mysql_id)
+        assert resp.status_code == 200
+        assert resp.json()["score"] < 100
+
+    async def test_large_in_list(self, client, admin_token):
+        mysql_id, _ = await _setup(admin_token, client)
+        ids = ",".join(str(i) for i in range(200))
+        resp = await _audit(client, admin_token,
+            f"SELECT * FROM users WHERE id IN ({ids})", mysql_id)
+        assert resp.status_code == 200
+        assert resp.json()["score"] < 100
+
+
+# ══════════════════════════════════════════════════════════════
+# 4. Redis 审核规则
+# ══════════════════════════════════════════════════════════════
+
+class TestRedisAuditRules:
+    async def test_flushall_critical(self, client, admin_token):
+        _, redis_id = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token, "FLUSHALL", redis_id, "db0")
+        assert resp.status_code == 200
+        assert resp.json()["risk_level"] in ("high", "critical")
+
+    async def test_flushdb_critical(self, client, admin_token):
+        _, redis_id = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token, "FLUSHDB", redis_id, "db0")
+        assert resp.status_code == 200
+        assert resp.json()["risk_level"] in ("high", "critical")
+
+    async def test_keys_pattern_high(self, client, admin_token):
+        _, redis_id = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token, "KEYS *", redis_id, "db0")
+        assert resp.status_code == 200
+        assert resp.json()["risk_level"] in ("medium", "high", "critical")
+
+    async def test_get_low_risk(self, client, admin_token):
+        _, redis_id = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token, "GET mykey", redis_id, "db0")
+        assert resp.status_code == 200
+        assert resp.json()["risk_level"] in ("low", "medium")
+
+    async def test_config_set_warning(self, client, admin_token):
+        _, redis_id = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token,
+            "CONFIG SET maxmemory 100mb", redis_id, "db0")
+        assert resp.status_code == 200
+
+
+# ══════════════════════════════════════════════════════════════
+# 5. 审核评分系统
+# ══════════════════════════════════════════════════════════════
+
+class TestAuditScoring:
+    async def test_clean_sql_high_score(self, client, admin_token):
+        mysql_id, _ = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token,
+            "SELECT id, name FROM users WHERE id=1 LIMIT 10", mysql_id)
+        assert resp.status_code == 200
+        assert resp.json()["score"] >= 80
+
+    async def test_dangerous_sql_low_score(self, client, admin_token):
+        mysql_id, _ = await _setup(admin_token, client)
+        resp = await _audit(client, admin_token,
+            "DELETE FROM users", mysql_id)
+        assert resp.status_code == 200
+        assert resp.json()["score"] < 60
+
+    async def test_score_between_0_100(self, client, admin_token):
+        mysql_id, _ = await _setup(admin_token, client)
+        for sql in ["SELECT 1", "DROP TABLE t", "UPDATE t SET a=1",
+                     "SELECT * FROM t WHERE id=1"]:
+            resp = await _audit(client, admin_token, sql, mysql_id)
+            assert resp.status_code == 200
+            score = resp.json()["score"]
+            assert 0 <= score <= 100, f"Score {score} out of range for: {sql}"
+
+
+# ══════════════════════════════════════════════════════════════
+# 6. 审核规则 CRUD + 开关
+# ══════════════════════════════════════════════════════════════
+
+class TestAuditRuleManagement:
+    async def test_list_rules(self, client, admin_token):
+        resp = await client.get("/api/v1/audit-rules",
+                                 headers=_auth(admin_token))
+        assert resp.status_code == 200
+        rules = resp.json()
+        assert isinstance(rules, list)
+        assert len(rules) > 0  # 应有种子数据
+
+    async def test_create_and_toggle_rule(self, client, admin_token):
+        # 创建自定义规则
+        resp = await client.post("/api/v1/audit-rules", json={
+            "rule_id": "custom_test_001",
+            "name": "自定义测试规则",
+            "type": "DML",
+            "severity": "warning",
+            "enabled": True,
+            "description": "集成测试用规则",
+        }, headers=_auth(admin_token))
+        assert resp.status_code in (200, 201)
+        rule_id = resp.json().get("id")
+
+        if rule_id:
+            # 禁用规则
+            resp2 = await client.put(f"/api/v1/audit-rules/{rule_id}", json={
+                "enabled": False,
+            }, headers=_auth(admin_token))
+            assert resp2.status_code == 200
+
+            # 重新启用
+            resp3 = await client.put(f"/api/v1/audit-rules/{rule_id}", json={
+                "enabled": True,
+            }, headers=_auth(admin_token))
+            assert resp3.status_code == 200
+
+    async def test_rule_type_filter(self, client, admin_token):
+        for rule_type in ["DDL", "DML", "security", "performance"]:
+            resp = await client.get(f"/api/v1/audit-rules?type={rule_type}",
+                                     headers=_auth(admin_token))
+            assert resp.status_code == 200
+
+    async def test_rules_stats(self, client, admin_token):
+        resp = await client.get("/api/v1/audit-rules/stats",
+                                 headers=_auth(admin_token))
+        # stats 可能存在也可能不存在
+        assert resp.status_code in (200, 404)