feat: Go后端LDAP真实对接 — AES-256-GCM密码加解密 + 登录LDAP fallback
- 新增 crypto.go: AES-256-GCM 加解密，与 Python backend 兼容 - auth.go: Login 添加 LDAP fallback（本地优先→LDAP绑定→自动创建本地用户） - ldap.go: 实现真实 LDAP 连接/用户搜索/密码验证/OU列表/用户列表 - 所有 LDAP 操作解密 admin_password 后使用 - 新增/更新密码存储时加密 - router.go: 补充 delete-user 路由 - 添加 go-ldap/v3 依赖
This commit is contained in:
logan committed
1 parent
622923821b
commit
88e5f4e7ee
71 files changed
+20390
-64
No files matched your search
@@ -0,0 +1,231 @@
|
||||
"""Schema 漂移检测 API 端点测试。"""
|
||||
import pytest
|
||||
from unittest.mock import patch, MagicMock, AsyncMock
|
||||
from httpx import AsyncClient
|
||||
|
||||
from app.models.user import User
|
||||
from app.models.instance import Instance
|
||||
|
||||
|
||||
def auth_header(token: str) -> dict:
|
||||
return {"Authorization": f"Bearer {token}"}
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
class TestCaptureSchema:
|
||||
"""POST /api/v1/schema-drift/instances/{instance_id}/capture"""
|
||||
|
||||
async def test_capture_schema_success(
|
||||
self, client: AsyncClient, admin_token: str, test_instance
|
||||
):
|
||||
mock_snapshot = [
|
||||
{"table": "users", "column": "id", "type": "int"},
|
||||
{"table": "users", "column": "name", "type": "varchar"},
|
||||
]
|
||||
with patch(
|
||||
"app.api.v1.endpoints.schema_drift.SchemaDriftDetector"
|
||||
) as MockDetector, patch(
|
||||
"app.api.v1.endpoints.schema_drift.decrypt_password",
|
||||
return_value="decrypted_pw",
|
||||
):
|
||||
detector = MockDetector.return_value
|
||||
detector.capture_snapshot = AsyncMock(return_value=mock_snapshot)
|
||||
detector.save_baseline = AsyncMock()
|
||||
|
||||
resp = await client.post(
|
||||
f"/api/v1/schema-drift/instances/{test_instance.id}/capture",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert "已捕获" in data["message"]
|
||||
assert data["total_columns"] == 2
|
||||
assert data["instance_id"] == test_instance.id
|
||||
|
||||
async def test_capture_schema_with_database_param(
|
||||
self, client: AsyncClient, admin_token: str, test_instance
|
||||
):
|
||||
with patch(
|
||||
"app.api.v1.endpoints.schema_drift.SchemaDriftDetector"
|
||||
) as MockDetector, patch(
|
||||
"app.api.v1.endpoints.schema_drift.decrypt_password",
|
||||
return_value="decrypted_pw",
|
||||
):
|
||||
detector = MockDetector.return_value
|
||||
detector.capture_snapshot = AsyncMock(return_value=[])
|
||||
detector.save_baseline = AsyncMock()
|
||||
|
||||
resp = await client.post(
|
||||
f"/api/v1/schema-drift/instances/{test_instance.id}/capture?database=mydb",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert data["database"] == "mydb"
|
||||
|
||||
async def test_capture_schema_instance_not_found(
|
||||
self, client: AsyncClient, admin_token: str
|
||||
):
|
||||
resp = await client.post(
|
||||
"/api/v1/schema-drift/instances/9999/capture",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 404
|
||||
|
||||
async def test_capture_schema_forbidden_developer(
|
||||
self, client: AsyncClient, developer_token: str, test_instance
|
||||
):
|
||||
resp = await client.post(
|
||||
f"/api/v1/schema-drift/instances/{test_instance.id}/capture",
|
||||
headers=auth_header(developer_token),
|
||||
)
|
||||
assert resp.status_code == 403
|
||||
|
||||
async def test_capture_schema_dba_allowed(
|
||||
self, client: AsyncClient, dba_token: str, test_instance
|
||||
):
|
||||
with patch(
|
||||
"app.api.v1.endpoints.schema_drift.SchemaDriftDetector"
|
||||
) as MockDetector, patch(
|
||||
"app.api.v1.endpoints.schema_drift.decrypt_password",
|
||||
return_value="pw",
|
||||
):
|
||||
detector = MockDetector.return_value
|
||||
detector.capture_snapshot = AsyncMock(return_value=[])
|
||||
detector.save_baseline = AsyncMock()
|
||||
|
||||
resp = await client.post(
|
||||
f"/api/v1/schema-drift/instances/{test_instance.id}/capture",
|
||||
headers=auth_header(dba_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
class TestCheckDrift:
|
||||
"""POST /api/v1/schema-drift/instances/{instance_id}/check"""
|
||||
|
||||
async def test_check_drift_no_changes(
|
||||
self, client: AsyncClient, admin_token: str, test_instance
|
||||
):
|
||||
mock_report = MagicMock()
|
||||
mock_report.to_dict.return_value = {
|
||||
"has_drift": False,
|
||||
"changes": [],
|
||||
"instance_id": test_instance.id,
|
||||
}
|
||||
with patch(
|
||||
"app.api.v1.endpoints.schema_drift.SchemaDriftDetector"
|
||||
) as MockDetector, patch(
|
||||
"app.api.v1.endpoints.schema_drift.decrypt_password",
|
||||
return_value="pw",
|
||||
):
|
||||
detector = MockDetector.return_value
|
||||
detector.detect_drift = AsyncMock(return_value=mock_report)
|
||||
|
||||
resp = await client.post(
|
||||
f"/api/v1/schema-drift/instances/{test_instance.id}/check",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert data["has_drift"] is False
|
||||
|
||||
async def test_check_drift_with_changes(
|
||||
self, client: AsyncClient, admin_token: str, test_instance
|
||||
):
|
||||
mock_report = MagicMock()
|
||||
mock_report.to_dict.return_value = {
|
||||
"has_drift": True,
|
||||
"changes": [
|
||||
{"type": "column_added", "table": "users", "column": "email"},
|
||||
],
|
||||
"instance_id": test_instance.id,
|
||||
}
|
||||
with patch(
|
||||
"app.api.v1.endpoints.schema_drift.SchemaDriftDetector"
|
||||
) as MockDetector, patch(
|
||||
"app.api.v1.endpoints.schema_drift.decrypt_password",
|
||||
return_value="pw",
|
||||
):
|
||||
detector = MockDetector.return_value
|
||||
detector.detect_drift = AsyncMock(return_value=mock_report)
|
||||
|
||||
resp = await client.post(
|
||||
f"/api/v1/schema-drift/instances/{test_instance.id}/check",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert data["has_drift"] is True
|
||||
assert len(data["changes"]) == 1
|
||||
|
||||
async def test_check_drift_instance_not_found(
|
||||
self, client: AsyncClient, admin_token: str
|
||||
):
|
||||
resp = await client.post(
|
||||
"/api/v1/schema-drift/instances/9999/check",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 404
|
||||
|
||||
async def test_check_drift_dict_report(
|
||||
self, client: AsyncClient, admin_token: str, test_instance
|
||||
):
|
||||
"""Detector 返回普通 dict 而非对象时的序列化。"""
|
||||
plain_dict = {"has_drift": False, "instance_id": test_instance.id}
|
||||
with patch(
|
||||
"app.api.v1.endpoints.schema_drift.SchemaDriftDetector"
|
||||
) as MockDetector, patch(
|
||||
"app.api.v1.endpoints.schema_drift.decrypt_password",
|
||||
return_value="pw",
|
||||
):
|
||||
detector = MockDetector.return_value
|
||||
detector.detect_drift = AsyncMock(return_value=plain_dict)
|
||||
|
||||
resp = await client.post(
|
||||
f"/api/v1/schema-drift/instances/{test_instance.id}/check",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
class TestSchemaHistory:
|
||||
"""GET /api/v1/schema-drift/instances/{instance_id}/history"""
|
||||
|
||||
async def test_schema_history(
|
||||
self, client: AsyncClient, admin_token: str, test_instance
|
||||
):
|
||||
resp = await client.get(
|
||||
f"/api/v1/schema-drift/instances/{test_instance.id}/history",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert data["instance_id"] == test_instance.id
|
||||
assert "history" in data
|
||||
|
||||
async def test_schema_history_dba_allowed(
|
||||
self, client: AsyncClient, dba_token: str, test_instance
|
||||
):
|
||||
resp = await client.get(
|
||||
f"/api/v1/schema-drift/instances/{test_instance.id}/history",
|
||||
headers=auth_header(dba_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
|
||||
async def test_schema_history_forbidden_guest(
|
||||
self, client: AsyncClient, guest_token: str, test_instance
|
||||
):
|
||||
resp = await client.get(
|
||||
f"/api/v1/schema-drift/instances/{test_instance.id}/history",
|
||||
headers=auth_header(guest_token),
|
||||
)
|
||||
assert resp.status_code == 403
|
||||
|
||||
async def test_schema_history_unauthorized(self, client: AsyncClient, test_instance):
|
||||
resp = await client.get(
|
||||
f"/api/v1/schema-drift/instances/{test_instance.id}/history",
|
||||
)
|
||||
assert resp.status_code == 401
|
||||
Reference in new issue
Block a user