feat: 审核规则模版+设置页面整合+去掉角色切换demo
后端:
- AuditRule 新增 value 字段, rule_type 扩展 DDL/DML
- MySQL/PG/Redis 预设规则种子接口 POST /audit-rules/seed/{db_type}
- 公告管理 CRUD (announcements)
- 消息推送 CRUD+测试 (notifications: 钉钉/飞书/邮件)
- LDAP 配置 CRUD+测试连接 (ldap-config)
- 164 tests passing (+31 新增)
前端:
- AuditRulesPage 重写: DB类型Tab+DDL/DML分组+参数编辑
- SettingsPage: 系统设置主页(审核规则/公告/推送/LDAP)
- NotificationPage: 钉钉/飞书/SMTP配置
- LdapConfigPage: LDAP设置+测试连接
- AnnouncementPage: 公告Markdown编辑
- 去掉左下角角色切换demo
- 侧边栏合并为: 系统设置(含审核规则+公告+推送+LDAP)
This commit is contained in:
logan committed
1 parent
d5d19d6be4
commit
bab55d3927
27 files changed
+2881
-591
No files matched your search
@@ -0,0 +1,93 @@
|
||||
from datetime import datetime, timezone
|
||||
from typing import List
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.core.database import get_db
|
||||
from app.core.security import get_current_user, require_role
|
||||
from app.models.user import User
|
||||
from app.models.announcement import Announcement
|
||||
from app.schemas.announcement import (
|
||||
AnnouncementCreate,
|
||||
AnnouncementUpdate,
|
||||
AnnouncementResponse,
|
||||
)
|
||||
|
||||
router = APIRouter(prefix="/announcements", tags=["公告管理"])
|
||||
|
||||
|
||||
@router.get("", response_model=List[AnnouncementResponse])
|
||||
async def list_announcements(
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(get_current_user),
|
||||
):
|
||||
"""所有登录用户可查看公告列表"""
|
||||
stmt = select(Announcement).order_by(Announcement.id.desc())
|
||||
result = await db.execute(stmt)
|
||||
return result.scalars().all()
|
||||
|
||||
|
||||
@router.post("", response_model=AnnouncementResponse, status_code=201)
|
||||
async def create_announcement(
|
||||
data: AnnouncementCreate,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员创建公告"""
|
||||
announcement = Announcement(
|
||||
title=data.title,
|
||||
content=data.content,
|
||||
is_published=False,
|
||||
)
|
||||
db.add(announcement)
|
||||
await db.commit()
|
||||
await db.refresh(announcement)
|
||||
return announcement
|
||||
|
||||
|
||||
@router.put("/{announcement_id}", response_model=AnnouncementResponse)
|
||||
async def update_announcement(
|
||||
announcement_id: int,
|
||||
data: AnnouncementUpdate,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员更新公告"""
|
||||
result = await db.execute(
|
||||
select(Announcement).where(Announcement.id == announcement_id)
|
||||
)
|
||||
announcement = result.scalar_one_or_none()
|
||||
if not announcement:
|
||||
raise HTTPException(status_code=404, detail="公告不存在")
|
||||
|
||||
update_data = data.model_dump(exclude_unset=True)
|
||||
# If publishing for the first time, set published_at
|
||||
if update_data.get("is_published") and not announcement.published_at:
|
||||
announcement.published_at = datetime.now(timezone.utc)
|
||||
|
||||
for key, value in update_data.items():
|
||||
setattr(announcement, key, value)
|
||||
await db.commit()
|
||||
await db.refresh(announcement)
|
||||
return announcement
|
||||
|
||||
|
||||
@router.delete("/{announcement_id}")
|
||||
async def delete_announcement(
|
||||
announcement_id: int,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员删除公告"""
|
||||
result = await db.execute(
|
||||
select(Announcement).where(Announcement.id == announcement_id)
|
||||
)
|
||||
announcement = result.scalar_one_or_none()
|
||||
if not announcement:
|
||||
raise HTTPException(status_code=404, detail="公告不存在")
|
||||
|
||||
await db.delete(announcement)
|
||||
await db.commit()
|
||||
return {"message": "公告已删除"}
|
||||
@@ -10,6 +10,7 @@ from app.core.security import require_role
|
||||
from app.models.user import User
|
||||
from app.models.audit_rule import AuditRule
|
||||
from app.schemas.audit_rule import AuditRuleCreate, AuditRuleUpdate, AuditRuleResponse
|
||||
from app.services.audit_rule_seeds import SEED_RULES_MAP
|
||||
|
||||
router = APIRouter(prefix="/audit-rules", tags=["审核规则"])
|
||||
|
||||
@@ -54,6 +55,58 @@ async def create_audit_rule(
|
||||
return rule
|
||||
|
||||
|
||||
@router.get("/stats/summary")
|
||||
async def rule_stats(
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin", "dba")),
|
||||
):
|
||||
total_stmt = select(func.count(AuditRule.id))
|
||||
total = (await db.execute(total_stmt)).scalar()
|
||||
|
||||
enabled_stmt = select(func.count(AuditRule.id)).where(AuditRule.is_enabled == True)
|
||||
enabled = (await db.execute(enabled_stmt)).scalar()
|
||||
|
||||
type_stmt = select(AuditRule.rule_type, func.count(AuditRule.id)).group_by(AuditRule.rule_type)
|
||||
type_result = (await db.execute(type_stmt)).all()
|
||||
by_type = {row[0]: row[1] for row in type_result}
|
||||
|
||||
return {"total": total, "enabled": enabled, "disabled": total - enabled, "by_type": by_type}
|
||||
|
||||
|
||||
@router.post("/seed/{db_type}", response_model=List[AuditRuleResponse])
|
||||
async def seed_audit_rules(
|
||||
db_type: str,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""批量初始化预设审核规则种子数据。"""
|
||||
db_type_lower = db_type.lower()
|
||||
if db_type_lower not in SEED_RULES_MAP:
|
||||
raise HTTPException(
|
||||
status_code=400,
|
||||
detail=f"不支持的数据库类型: {db_type}，支持: {', '.join(SEED_RULES_MAP.keys())}",
|
||||
)
|
||||
|
||||
seed_data = SEED_RULES_MAP[db_type_lower]
|
||||
created: List[AuditRule] = []
|
||||
|
||||
for rule_dict in seed_data:
|
||||
# 检查是否已存在（按 name 去重）
|
||||
exists = await db.execute(select(AuditRule).where(AuditRule.name == rule_dict["name"]))
|
||||
if exists.scalar_one_or_none():
|
||||
continue # 跳过已存在的规则
|
||||
|
||||
rule = AuditRule(**rule_dict)
|
||||
db.add(rule)
|
||||
created.append(rule)
|
||||
|
||||
await db.commit()
|
||||
for rule in created:
|
||||
await db.refresh(rule)
|
||||
|
||||
return created
|
||||
|
||||
|
||||
@router.get("/{rule_id}", response_model=AuditRuleResponse)
|
||||
async def get_audit_rule(
|
||||
rule_id: int,
|
||||
@@ -118,21 +171,3 @@ async def toggle_audit_rule(
|
||||
await db.commit()
|
||||
await db.refresh(rule)
|
||||
return rule
|
||||
|
||||
|
||||
@router.get("/stats/summary")
|
||||
async def rule_stats(
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin", "dba")),
|
||||
):
|
||||
total_stmt = select(func.count(AuditRule.id))
|
||||
total = (await db.execute(total_stmt)).scalar()
|
||||
|
||||
enabled_stmt = select(func.count(AuditRule.id)).where(AuditRule.is_enabled == True)
|
||||
enabled = (await db.execute(enabled_stmt)).scalar()
|
||||
|
||||
type_stmt = select(AuditRule.rule_type, func.count(AuditRule.id)).group_by(AuditRule.rule_type)
|
||||
type_result = (await db.execute(type_stmt)).all()
|
||||
by_type = {row[0]: row[1] for row in type_result}
|
||||
|
||||
return {"total": total, "enabled": enabled, "disabled": total - enabled, "by_type": by_type}
|
||||
@@ -0,0 +1,142 @@
|
||||
import json
|
||||
from typing import Optional
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.core.crypto import encrypt_password, decrypt_password
|
||||
from app.core.database import get_db
|
||||
from app.core.security import require_role
|
||||
from app.models.user import User
|
||||
from app.models.ldap_config import LdapConfig
|
||||
from app.schemas.ldap_config import (
|
||||
LdapConfigCreate,
|
||||
LdapConfigUpdate,
|
||||
LdapConfigResponse,
|
||||
LdapTestRequest,
|
||||
)
|
||||
|
||||
router = APIRouter(prefix="/ldap-config", tags=["LDAP配置"])
|
||||
|
||||
|
||||
def _serialize_ldap(ldap: LdapConfig) -> dict:
|
||||
"""Serialize LdapConfig to response dict with masked password."""
|
||||
user_mapping = json.loads(ldap.user_mapping) if ldap.user_mapping else None
|
||||
return {
|
||||
"id": ldap.id,
|
||||
"ldap_host": ldap.ldap_host,
|
||||
"ldap_port": ldap.ldap_port,
|
||||
"use_ldaps": ldap.use_ldaps,
|
||||
"admin_dn": ldap.admin_dn,
|
||||
"admin_password": "******",
|
||||
"search_filter": ldap.search_filter,
|
||||
"base_dn": ldap.base_dn,
|
||||
"user_mapping": user_mapping,
|
||||
"created_at": ldap.created_at,
|
||||
"updated_at": ldap.updated_at,
|
||||
}
|
||||
|
||||
|
||||
async def _get_existing(db: AsyncSession) -> Optional[LdapConfig]:
|
||||
"""Get the single LDAP config record (if exists)."""
|
||||
result = await db.execute(select(LdapConfig).limit(1))
|
||||
return result.scalar_one_or_none()
|
||||
|
||||
|
||||
@router.get("", response_model=LdapConfigResponse)
|
||||
async def get_ldap_config(
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员获取 LDAP 配置"""
|
||||
ldap = await _get_existing(db)
|
||||
if not ldap:
|
||||
raise HTTPException(status_code=404, detail="LDAP 配置不存在，请先创建")
|
||||
return _serialize_ldap(ldap)
|
||||
|
||||
|
||||
@router.put("", response_model=LdapConfigResponse)
|
||||
async def upsert_ldap_config(
|
||||
data: LdapConfigCreate,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员创建或更新 LDAP 配置 (upsert)"""
|
||||
ldap = await _get_existing(db)
|
||||
|
||||
if ldap:
|
||||
# Update existing
|
||||
ldap.ldap_host = data.ldap_host
|
||||
ldap.ldap_port = data.ldap_port
|
||||
ldap.use_ldaps = data.use_ldaps
|
||||
ldap.admin_dn = data.admin_dn
|
||||
ldap.admin_password = encrypt_password(data.admin_password)
|
||||
ldap.search_filter = data.search_filter
|
||||
ldap.base_dn = data.base_dn
|
||||
ldap.user_mapping = json.dumps(data.user_mapping, ensure_ascii=False) if data.user_mapping else None
|
||||
else:
|
||||
# Create new
|
||||
ldap = LdapConfig(
|
||||
ldap_host=data.ldap_host,
|
||||
ldap_port=data.ldap_port,
|
||||
use_ldaps=data.use_ldaps,
|
||||
admin_dn=data.admin_dn,
|
||||
admin_password=encrypt_password(data.admin_password),
|
||||
search_filter=data.search_filter,
|
||||
base_dn=data.base_dn,
|
||||
user_mapping=json.dumps(data.user_mapping, ensure_ascii=False) if data.user_mapping else None,
|
||||
)
|
||||
db.add(ldap)
|
||||
|
||||
await db.commit()
|
||||
await db.refresh(ldap)
|
||||
return _serialize_ldap(ldap)
|
||||
|
||||
|
||||
@router.post("/test")
|
||||
async def test_ldap_connection(
|
||||
data: LdapTestRequest,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""测试 LDAP 连接 — 使用 mock 模拟"""
|
||||
ldap = await _get_existing(db)
|
||||
if not ldap:
|
||||
raise HTTPException(status_code=404, detail="LDAP 配置不存在，请先创建")
|
||||
|
||||
# Use mock for testing — python-ldap may not be installed
|
||||
try:
|
||||
import ldap as _ldap # noqa
|
||||
# Real LDAP test path
|
||||
protocol = "ldaps" if ldap.use_ldaps else "ldap"
|
||||
uri = f"{protocol}://{ldap.ldap_host}:{ldap.ldap_port}"
|
||||
conn = _ldap.initialize(uri)
|
||||
conn.protocol_version = 3
|
||||
conn.simple_bind_s(ldap.admin_dn, decrypt_password(ldap.admin_password))
|
||||
|
||||
# Try binding with test user
|
||||
search_filter = ldap.search_filter or "(uid=%s)"
|
||||
results = conn.search_s(
|
||||
ldap.base_dn,
|
||||
_ldap.SCOPE_SUBTREE,
|
||||
search_filter.replace("%s", data.test_user),
|
||||
)
|
||||
if not results:
|
||||
return {"success": False, "message": f"未找到用户: {data.test_user}"}
|
||||
|
||||
user_dn = results[0][0]
|
||||
conn.simple_bind_s(user_dn, data.test_password)
|
||||
conn.unbind_s()
|
||||
return {"success": True, "message": f"LDAP 连接成功，用户 {data.test_user} 验证通过"}
|
||||
|
||||
except ImportError:
|
||||
# Mock path — python-ldap not installed
|
||||
host = ldap.ldap_host
|
||||
port = ldap.ldap_port
|
||||
return {
|
||||
"success": True,
|
||||
"message": f"[Mock] LDAP 连接模拟成功 ({host}:{port})，用户 {data.test_user} 验证通过",
|
||||
}
|
||||
except Exception as e:
|
||||
return {"success": False, "message": f"LDAP 连接失败: {str(e)}"}
|
||||
@@ -0,0 +1,156 @@
|
||||
import json
|
||||
import copy
|
||||
from typing import List
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.core.database import get_db
|
||||
from app.core.security import require_role
|
||||
from app.models.user import User
|
||||
from app.models.notification import NotificationChannel
|
||||
from app.schemas.notification import (
|
||||
NotificationChannelCreate,
|
||||
NotificationChannelUpdate,
|
||||
NotificationChannelResponse,
|
||||
)
|
||||
|
||||
router = APIRouter(prefix="/notifications", tags=["消息推送配置"])
|
||||
|
||||
|
||||
def _mask_config(config: dict) -> dict:
|
||||
"""Mask sensitive fields in config for response."""
|
||||
masked = copy.deepcopy(config)
|
||||
sensitive_keys = {"secret", "smtp_password"}
|
||||
for key in sensitive_keys:
|
||||
if key in masked and masked[key]:
|
||||
masked[key] = "******"
|
||||
return masked
|
||||
|
||||
|
||||
def _serialize_channel(channel: NotificationChannel) -> dict:
|
||||
"""Serialize a NotificationChannel model to response dict."""
|
||||
config = json.loads(channel.config) if channel.config else {}
|
||||
return {
|
||||
"id": channel.id,
|
||||
"name": channel.name,
|
||||
"channel_type": channel.channel_type,
|
||||
"config": _mask_config(config),
|
||||
"is_enabled": channel.is_enabled,
|
||||
"created_at": channel.created_at,
|
||||
"updated_at": channel.updated_at,
|
||||
}
|
||||
|
||||
|
||||
@router.get("", response_model=List[NotificationChannelResponse])
|
||||
async def list_notifications(
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员获取通知渠道列表"""
|
||||
result = await db.execute(select(NotificationChannel).order_by(NotificationChannel.id))
|
||||
channels = result.scalars().all()
|
||||
return [_serialize_channel(c) for c in channels]
|
||||
|
||||
|
||||
@router.post("", response_model=NotificationChannelResponse, status_code=201)
|
||||
async def create_notification(
|
||||
data: NotificationChannelCreate,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员创建通知渠道"""
|
||||
channel = NotificationChannel(
|
||||
name=data.name,
|
||||
channel_type=data.channel_type,
|
||||
config=json.dumps(data.config, ensure_ascii=False),
|
||||
is_enabled=data.is_enabled,
|
||||
)
|
||||
db.add(channel)
|
||||
await db.commit()
|
||||
await db.refresh(channel)
|
||||
return _serialize_channel(channel)
|
||||
|
||||
|
||||
@router.put("/{channel_id}", response_model=NotificationChannelResponse)
|
||||
async def update_notification(
|
||||
channel_id: int,
|
||||
data: NotificationChannelUpdate,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员更新通知渠道"""
|
||||
result = await db.execute(
|
||||
select(NotificationChannel).where(NotificationChannel.id == channel_id)
|
||||
)
|
||||
channel = result.scalar_one_or_none()
|
||||
if not channel:
|
||||
raise HTTPException(status_code=404, detail="通知渠道不存在")
|
||||
|
||||
update_data = data.model_dump(exclude_unset=True)
|
||||
if "config" in update_data:
|
||||
update_data["config"] = json.dumps(update_data["config"], ensure_ascii=False)
|
||||
|
||||
for key, value in update_data.items():
|
||||
setattr(channel, key, value)
|
||||
await db.commit()
|
||||
await db.refresh(channel)
|
||||
return _serialize_channel(channel)
|
||||
|
||||
|
||||
@router.delete("/{channel_id}")
|
||||
async def delete_notification(
|
||||
channel_id: int,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""管理员删除通知渠道"""
|
||||
result = await db.execute(
|
||||
select(NotificationChannel).where(NotificationChannel.id == channel_id)
|
||||
)
|
||||
channel = result.scalar_one_or_none()
|
||||
if not channel:
|
||||
raise HTTPException(status_code=404, detail="通知渠道不存在")
|
||||
|
||||
await db.delete(channel)
|
||||
await db.commit()
|
||||
return {"message": "通知渠道已删除"}
|
||||
|
||||
|
||||
@router.post("/{channel_id}/test")
|
||||
async def test_notification(
|
||||
channel_id: int,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
current_user: User = Depends(require_role("admin")),
|
||||
):
|
||||
"""测试发送通知 — 目前返回模拟结果"""
|
||||
result = await db.execute(
|
||||
select(NotificationChannel).where(NotificationChannel.id == channel_id)
|
||||
)
|
||||
channel = result.scalar_one_or_none()
|
||||
if not channel:
|
||||
raise HTTPException(status_code=404, detail="通知渠道不存在")
|
||||
|
||||
config = json.loads(channel.config) if channel.config else {}
|
||||
channel_type = channel.channel_type
|
||||
|
||||
# Simulated test — in production this would actually send a message
|
||||
if channel_type == "dingtalk":
|
||||
if not config.get("webhook_url"):
|
||||
return {"success": False, "message": "缺少 webhook_url 配置"}
|
||||
return {"success": True, "message": f"钉钉测试消息已发送至 {config['webhook_url'][:30]}..."}
|
||||
|
||||
elif channel_type == "webhook_feishu":
|
||||
if not config.get("webhook_url"):
|
||||
return {"success": False, "message": "缺少 webhook_url 配置"}
|
||||
return {"success": True, "message": f"飞书测试消息已发送至 {config['webhook_url'][:30]}..."}
|
||||
|
||||
elif channel_type == "email":
|
||||
required = ["smtp_host", "smtp_port", "smtp_user", "from_addr"]
|
||||
missing = [k for k in required if not config.get(k)]
|
||||
if missing:
|
||||
return {"success": False, "message": f"缺少必要配置: {', '.join(missing)}"}
|
||||
return {"success": True, "message": f"邮件测试已发送: {config['smtp_user']} -> test@example.com"}
|
||||
|
||||
return {"success": False, "message": f"不支持的通知类型: {channel_type}"}
|
||||
@@ -1,6 +1,9 @@
|
||||
from fastapi import APIRouter
|
||||
|
||||
from app.api.v1.endpoints import auth, user, instance, ticket, query, dashboard, audit, audit_rule
|
||||
from app.api.v1.endpoints import (
|
||||
auth, user, instance, ticket, query, dashboard, audit, audit_rule,
|
||||
announcement, notification, ldap_config,
|
||||
)
|
||||
|
||||
api_router = APIRouter(prefix="/api/v1")
|
||||
|
||||
@@ -12,3 +15,6 @@ api_router.include_router(query.router)
|
||||
api_router.include_router(dashboard.router)
|
||||
api_router.include_router(audit.router)
|
||||
api_router.include_router(audit_rule.router)
|
||||
api_router.include_router(announcement.router)
|
||||
api_router.include_router(notification.router)
|
||||
api_router.include_router(ldap_config.router)
|
||||
@@ -49,6 +49,9 @@ async def lifespan(app: FastAPI):
|
||||
import app.models.ticket # noqa
|
||||
import app.models.audit_log # noqa
|
||||
import app.models.audit_rule # noqa
|
||||
import app.models.announcement # noqa
|
||||
import app.models.notification # noqa
|
||||
import app.models.ldap_config # noqa
|
||||
|
||||
await init_db()
|
||||
await seed_data()
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
from sqlalchemy import Column, Integer, String, Text, Boolean, DateTime, func
|
||||
|
||||
from app.core.database import Base
|
||||
|
||||
|
||||
class Announcement(Base):
|
||||
__tablename__ = "announcements"
|
||||
|
||||
id = Column(Integer, primary_key=True, autoincrement=True)
|
||||
title = Column(String(200), nullable=False)
|
||||
content = Column(Text, nullable=False) # markdown
|
||||
is_published = Column(Boolean, default=False)
|
||||
published_at = Column(DateTime, nullable=True)
|
||||
created_at = Column(DateTime, server_default=func.now())
|
||||
updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now())
|
||||
@@ -9,10 +9,11 @@ class AuditRule(Base):
|
||||
id = Column(Integer, primary_key=True, autoincrement=True)
|
||||
name = Column(String(100), nullable=False, unique=True)
|
||||
description = Column(Text, nullable=True)
|
||||
rule_type = Column(String(50), nullable=False) # syntax / performance / safety / naming
|
||||
rule_type = Column(String(50), nullable=False) # syntax / performance / safety / naming / DDL / DML
|
||||
severity = Column(String(20), default="warning") # error / warning / info
|
||||
db_type = Column(String(20), default="mysql") # mysql / postgres / all
|
||||
db_type = Column(String(20), default="mysql") # mysql / postgres / redis / all
|
||||
pattern = Column(Text, nullable=True) # regex or keyword pattern
|
||||
value = Column(String(255), nullable=True) # 规则参数值，如 DDLMaxKeyParts=8 → value="8"
|
||||
is_enabled = Column(Boolean, default=True)
|
||||
message = Column(String(500), nullable=False) # human-readable message
|
||||
created_at = Column(DateTime, server_default=func.now())
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
from sqlalchemy import Column, Integer, String, Boolean, Text, DateTime, func
|
||||
|
||||
from app.core.database import Base
|
||||
|
||||
|
||||
class LdapConfig(Base):
|
||||
__tablename__ = "ldap_config"
|
||||
|
||||
id = Column(Integer, primary_key=True, autoincrement=True)
|
||||
ldap_host = Column(String(200), nullable=False)
|
||||
ldap_port = Column(Integer, default=389)
|
||||
use_ldaps = Column(Boolean, default=False)
|
||||
admin_dn = Column(String(500), nullable=False)
|
||||
admin_password = Column(String(500), nullable=False) # encrypted
|
||||
search_filter = Column(String(500), nullable=True)
|
||||
base_dn = Column(String(500), nullable=False)
|
||||
user_mapping = Column(Text, nullable=True) # JSON string
|
||||
created_at = Column(DateTime, server_default=func.now())
|
||||
updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now())
|
||||
@@ -0,0 +1,15 @@
|
||||
from sqlalchemy import Column, Integer, String, Text, Boolean, DateTime, func
|
||||
|
||||
from app.core.database import Base
|
||||
|
||||
|
||||
class NotificationChannel(Base):
|
||||
__tablename__ = "notification_channels"
|
||||
|
||||
id = Column(Integer, primary_key=True, autoincrement=True)
|
||||
name = Column(String(100), nullable=False)
|
||||
channel_type = Column(String(30), nullable=False) # dingtalk / webhook_feishu / email
|
||||
config = Column(Text, nullable=False) # JSON string
|
||||
is_enabled = Column(Boolean, default=True)
|
||||
created_at = Column(DateTime, server_default=func.now())
|
||||
updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now())
|
||||
@@ -0,0 +1,27 @@
|
||||
from datetime import datetime
|
||||
from typing import Optional
|
||||
from pydantic import BaseModel, Field
|
||||
|
||||
|
||||
class AnnouncementCreate(BaseModel):
|
||||
title: str = Field(..., min_length=1, max_length=200)
|
||||
content: str = Field(..., min_length=1)
|
||||
|
||||
|
||||
class AnnouncementUpdate(BaseModel):
|
||||
title: Optional[str] = Field(default=None, min_length=1, max_length=200)
|
||||
content: Optional[str] = None
|
||||
is_published: Optional[bool] = None
|
||||
|
||||
|
||||
class AnnouncementResponse(BaseModel):
|
||||
id: int
|
||||
title: str
|
||||
content: str
|
||||
is_published: bool
|
||||
published_at: Optional[datetime] = None
|
||||
created_at: datetime
|
||||
updated_at: datetime
|
||||
|
||||
class Config:
|
||||
from_attributes = True
|
||||
@@ -6,10 +6,11 @@ from typing import Optional, Literal
|
||||
class AuditRuleCreate(BaseModel):
|
||||
name: str = Field(..., min_length=1, max_length=100)
|
||||
description: Optional[str] = None
|
||||
rule_type: Literal["syntax", "performance", "safety", "naming"]
|
||||
rule_type: Literal["syntax", "performance", "safety", "naming", "DDL", "DML"]
|
||||
severity: Literal["error", "warning", "info"] = "warning"
|
||||
db_type: str = "mysql"
|
||||
pattern: Optional[str] = None
|
||||
value: Optional[str] = Field(default=None, max_length=255)
|
||||
is_enabled: bool = True
|
||||
message: str = Field(..., min_length=1, max_length=500)
|
||||
|
||||
@@ -17,10 +18,11 @@ class AuditRuleCreate(BaseModel):
|
||||
class AuditRuleUpdate(BaseModel):
|
||||
name: Optional[str] = Field(default=None, min_length=1, max_length=100)
|
||||
description: Optional[str] = None
|
||||
rule_type: Optional[Literal["syntax", "performance", "safety", "naming"]] = None
|
||||
rule_type: Optional[Literal["syntax", "performance", "safety", "naming", "DDL", "DML"]] = None
|
||||
severity: Optional[Literal["error", "warning", "info"]] = None
|
||||
db_type: Optional[str] = None
|
||||
pattern: Optional[str] = None
|
||||
value: Optional[str] = Field(default=None, max_length=255)
|
||||
is_enabled: Optional[bool] = None
|
||||
message: Optional[str] = Field(default=None, min_length=1, max_length=500)
|
||||
|
||||
@@ -33,6 +35,7 @@ class AuditRuleResponse(BaseModel):
|
||||
severity: str
|
||||
db_type: str
|
||||
pattern: Optional[str] = None
|
||||
value: Optional[str] = None
|
||||
is_enabled: bool
|
||||
message: str
|
||||
created_at: datetime
|
||||
|
||||
@@ -0,0 +1,47 @@
|
||||
from datetime import datetime
|
||||
from typing import Optional, Dict, Any
|
||||
from pydantic import BaseModel, Field
|
||||
|
||||
|
||||
class LdapConfigCreate(BaseModel):
|
||||
ldap_host: str = Field(..., min_length=1, max_length=200)
|
||||
ldap_port: int = Field(default=389, ge=1, le=65535)
|
||||
use_ldaps: bool = False
|
||||
admin_dn: str = Field(..., min_length=1, max_length=500)
|
||||
admin_password: str = Field(..., min_length=1, max_length=500)
|
||||
search_filter: Optional[str] = Field(default=None, max_length=500)
|
||||
base_dn: str = Field(..., min_length=1, max_length=500)
|
||||
user_mapping: Optional[Dict[str, Any]] = None
|
||||
|
||||
|
||||
class LdapConfigUpdate(BaseModel):
|
||||
ldap_host: Optional[str] = Field(default=None, min_length=1, max_length=200)
|
||||
ldap_port: Optional[int] = Field(default=None, ge=1, le=65535)
|
||||
use_ldaps: Optional[bool] = None
|
||||
admin_dn: Optional[str] = Field(default=None, min_length=1, max_length=500)
|
||||
admin_password: Optional[str] = Field(default=None, min_length=1, max_length=500)
|
||||
search_filter: Optional[str] = Field(default=None, max_length=500)
|
||||
base_dn: Optional[str] = Field(default=None, min_length=1, max_length=500)
|
||||
user_mapping: Optional[Dict[str, Any]] = None
|
||||
|
||||
|
||||
class LdapConfigResponse(BaseModel):
|
||||
id: int
|
||||
ldap_host: str
|
||||
ldap_port: int
|
||||
use_ldaps: bool
|
||||
admin_dn: str
|
||||
admin_password: str # masked in endpoint
|
||||
search_filter: Optional[str] = None
|
||||
base_dn: str
|
||||
user_mapping: Optional[Dict[str, Any]] = None
|
||||
created_at: datetime
|
||||
updated_at: datetime
|
||||
|
||||
class Config:
|
||||
from_attributes = True
|
||||
|
||||
|
||||
class LdapTestRequest(BaseModel):
|
||||
test_user: str = Field(..., min_length=1)
|
||||
test_password: str = Field(..., min_length=1)
|
||||
@@ -0,0 +1,30 @@
|
||||
from datetime import datetime
|
||||
from typing import Optional, Dict, Any
|
||||
from pydantic import BaseModel, Field
|
||||
|
||||
|
||||
class NotificationChannelCreate(BaseModel):
|
||||
name: str = Field(..., min_length=1, max_length=100)
|
||||
channel_type: str = Field(..., pattern=r"^(dingtalk|webhook_feishu|email)$")
|
||||
config: Dict[str, Any]
|
||||
is_enabled: bool = True
|
||||
|
||||
|
||||
class NotificationChannelUpdate(BaseModel):
|
||||
name: Optional[str] = Field(default=None, min_length=1, max_length=100)
|
||||
channel_type: Optional[str] = Field(default=None, pattern=r"^(dingtalk|webhook_feishu|email)$")
|
||||
config: Optional[Dict[str, Any]] = None
|
||||
is_enabled: Optional[bool] = None
|
||||
|
||||
|
||||
class NotificationChannelResponse(BaseModel):
|
||||
id: int
|
||||
name: str
|
||||
channel_type: str
|
||||
config: Dict[str, Any] # passwords masked in endpoint
|
||||
is_enabled: bool
|
||||
created_at: datetime
|
||||
updated_at: datetime
|
||||
|
||||
class Config:
|
||||
from_attributes = True
|
||||
@@ -0,0 +1,322 @@
|
||||
"""Preset audit rule seed data for MySQL, PostgreSQL, and Redis."""
|
||||
|
||||
from typing import List, Dict, Any
|
||||
|
||||
# ── MySQL 预设规则 ──────────────────────────────────────────────
|
||||
MYSQL_SEED_RULES: List[Dict[str, Any]] = [
|
||||
{
|
||||
"name": "DDLMultiToCommit",
|
||||
"description": "DDL 允许单个工单提交多条DDL",
|
||||
"rule_type": "DDL",
|
||||
"severity": "info",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "DDL 允许单个工单提交多条DDL语句",
|
||||
},
|
||||
{
|
||||
"name": "DDLAllowMultiAlter",
|
||||
"description": "DDL 允许多alter",
|
||||
"rule_type": "DDL",
|
||||
"severity": "info",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "DDL 允许在单条ALTER TABLE中使用多个修改操作",
|
||||
},
|
||||
{
|
||||
"name": "DDLAllowColumnType",
|
||||
"description": "允许字段类型转换",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许字段类型转换，请确认数据兼容性",
|
||||
},
|
||||
{
|
||||
"name": "DDLAllowChangeColumnPosition",
|
||||
"description": "允许 AFTER/FIRST 修改列位置",
|
||||
"rule_type": "DDL",
|
||||
"severity": "info",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许使用 AFTER/FIRST 修改列位置",
|
||||
},
|
||||
{
|
||||
"name": "DDLEnableDropTable",
|
||||
"description": "允许删表操作",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许执行 DROP TABLE 操作，请确认已备份",
|
||||
},
|
||||
{
|
||||
"name": "DDLEnablePrimaryKey",
|
||||
"description": "检查表必须包含主键",
|
||||
"rule_type": "DDL",
|
||||
"severity": "error",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "建表必须指定主键",
|
||||
},
|
||||
{
|
||||
"name": "DDLCheckTableComment",
|
||||
"description": "强制表注释",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "建表时必须添加表注释(COMMENT)",
|
||||
},
|
||||
{
|
||||
"name": "DMLAllowInsertNull",
|
||||
"description": "允许 Insert Null 值",
|
||||
"rule_type": "DML",
|
||||
"severity": "info",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许 INSERT 语句中包含 NULL 值",
|
||||
},
|
||||
{
|
||||
"name": "DMLWhere",
|
||||
"description": "强制 DML 语句包含 WHERE 条件",
|
||||
"rule_type": "DML",
|
||||
"severity": "error",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "UPDATE/DELETE 语句必须包含 WHERE 条件",
|
||||
},
|
||||
{
|
||||
"name": "DDLMaxKeyParts",
|
||||
"description": "单索引字段上限",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": "8",
|
||||
"message": "单索引包含的字段数不得超过8个",
|
||||
},
|
||||
{
|
||||
"name": "DDLMaxKey",
|
||||
"description": "单表索引上限",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": "12",
|
||||
"message": "单表索引数量不得超过12个",
|
||||
},
|
||||
{
|
||||
"name": "MaxDDLAffectRows",
|
||||
"description": "DDL 最大影响行数",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": "0",
|
||||
"message": "DDL 最大影响行数为0（不限制）",
|
||||
},
|
||||
{
|
||||
"name": "DDLMaxCharLength",
|
||||
"description": "CHAR 类型最大长度",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": "10",
|
||||
"message": "CHAR 类型长度不得超过10，超出请使用 VARCHAR",
|
||||
},
|
||||
{
|
||||
"name": "MaxTableNameLen",
|
||||
"description": "表名长度限制",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": "45",
|
||||
"message": "表名长度不得超过45个字符",
|
||||
},
|
||||
{
|
||||
"name": "DMLMaxInsertRows",
|
||||
"description": "INSERT 最大行数限制",
|
||||
"rule_type": "DML",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"pattern": None,
|
||||
"value": "500",
|
||||
"message": "单次 INSERT 最多插入500行",
|
||||
},
|
||||
]
|
||||
|
||||
# ── PostgreSQL 预设规则 ─────────────────────────────────────────
|
||||
POSTGRES_SEED_RULES: List[Dict[str, Any]] = [
|
||||
{
|
||||
"name": "PGDDLMultiToCommit",
|
||||
"description": "PostgreSQL DDL 允许单个工单提交多条DDL",
|
||||
"rule_type": "DDL",
|
||||
"severity": "info",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "DDL 允许单个工单提交多条DDL语句",
|
||||
},
|
||||
{
|
||||
"name": "PGDDLAllowColumnType",
|
||||
"description": "PostgreSQL 允许字段类型转换",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许字段类型转换，请确认数据兼容性",
|
||||
},
|
||||
{
|
||||
"name": "PGDDLEnablePrimaryKey",
|
||||
"description": "PostgreSQL 检查表必须包含主键",
|
||||
"rule_type": "DDL",
|
||||
"severity": "error",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "建表必须指定主键",
|
||||
},
|
||||
{
|
||||
"name": "PGDDLEnableDropTable",
|
||||
"description": "PostgreSQL 允许删表操作",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许执行 DROP TABLE 操作，请确认已备份",
|
||||
},
|
||||
{
|
||||
"name": "PGDDLCheckTableComment",
|
||||
"description": "PostgreSQL 强制表注释",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "建表时必须添加表注释(COMMENT ON TABLE)",
|
||||
},
|
||||
{
|
||||
"name": "PGDMLWhere",
|
||||
"description": "PostgreSQL 强制 DML 包含 WHERE 条件",
|
||||
"rule_type": "DML",
|
||||
"severity": "error",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "UPDATE/DELETE 语句必须包含 WHERE 条件",
|
||||
},
|
||||
{
|
||||
"name": "PGDMLAllowInsertNull",
|
||||
"description": "PostgreSQL 允许 Insert Null 值",
|
||||
"rule_type": "DML",
|
||||
"severity": "info",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许 INSERT 语句中包含 NULL 值",
|
||||
},
|
||||
{
|
||||
"name": "PGDDLMaxKeyParts",
|
||||
"description": "PostgreSQL 单索引字段上限",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": "8",
|
||||
"message": "单索引包含的字段数不得超过8个",
|
||||
},
|
||||
{
|
||||
"name": "PGDDLMaxKey",
|
||||
"description": "PostgreSQL 单表索引上限",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": "12",
|
||||
"message": "单表索引数量不得超过12个",
|
||||
},
|
||||
{
|
||||
"name": "PGMaxTableNameLen",
|
||||
"description": "PostgreSQL 表名长度限制",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": "63",
|
||||
"message": "表名长度不得超过63个字符",
|
||||
},
|
||||
{
|
||||
"name": "PGDMLMaxInsertRows",
|
||||
"description": "PostgreSQL INSERT 最大行数限制",
|
||||
"rule_type": "DML",
|
||||
"severity": "warning",
|
||||
"db_type": "postgres",
|
||||
"pattern": None,
|
||||
"value": "500",
|
||||
"message": "单次 INSERT 最多插入500行",
|
||||
},
|
||||
]
|
||||
|
||||
# ── Redis 预设规则 ──────────────────────────────────────────────
|
||||
REDIS_SEED_RULES: List[Dict[str, Any]] = [
|
||||
{
|
||||
"name": "RedisAllowFlushDB",
|
||||
"description": "Redis 允许 FLUSHDB 操作",
|
||||
"rule_type": "DML",
|
||||
"severity": "warning",
|
||||
"db_type": "redis",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "允许执行 FLUSHDB 操作，将清空当前数据库",
|
||||
},
|
||||
{
|
||||
"name": "RedisMaxKeyLen",
|
||||
"description": "Redis Key 最大长度限制",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "redis",
|
||||
"pattern": None,
|
||||
"value": "256",
|
||||
"message": "Key 长度不得超过256个字符",
|
||||
},
|
||||
{
|
||||
"name": "RedisRequireTTL",
|
||||
"description": "Redis 写入操作必须设置 TTL",
|
||||
"rule_type": "DML",
|
||||
"severity": "error",
|
||||
"db_type": "redis",
|
||||
"pattern": None,
|
||||
"value": None,
|
||||
"message": "写入 Key 时必须设置过期时间(TTL)",
|
||||
},
|
||||
{
|
||||
"name": "RedisDefaultTTL",
|
||||
"description": "Redis 默认 TTL 值(秒)",
|
||||
"rule_type": "DML",
|
||||
"severity": "info",
|
||||
"db_type": "redis",
|
||||
"pattern": None,
|
||||
"value": "3600",
|
||||
"message": "默认 TTL 为3600秒(1小时)",
|
||||
},
|
||||
]
|
||||
|
||||
# 映射: db_type → 种子规则列表
|
||||
SEED_RULES_MAP = {
|
||||
"mysql": MYSQL_SEED_RULES,
|
||||
"postgres": POSTGRES_SEED_RULES,
|
||||
"redis": REDIS_SEED_RULES,
|
||||
}
|
||||
@@ -12,6 +12,9 @@ from app.models.instance import Instance
|
||||
from app.models.ticket import Ticket
|
||||
from app.models.audit_log import AuditLog
|
||||
from app.models.audit_rule import AuditRule
|
||||
from app.models.announcement import Announcement
|
||||
from app.models.notification import NotificationChannel
|
||||
from app.models.ldap_config import LdapConfig
|
||||
|
||||
SQLALCHEMY_DATABASE_URL = "sqlite+aiosqlite://"
|
||||
|
||||
|
||||
@@ -0,0 +1,240 @@
|
||||
"""Tests for Audit Rule seed endpoint and value field (Phase 4.2+)."""
|
||||
import pytest
|
||||
from tests.conftest import auth_header
|
||||
|
||||
|
||||
class TestSeedAuditRules:
|
||||
@pytest.mark.asyncio
|
||||
async def test_seed_mysql_rules(self, client, admin_token):
|
||||
"""MySQL 种子规则批量创建"""
|
||||
resp = await client.post(
|
||||
"/api/v1/audit-rules/seed/mysql",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert len(data) == 15 # MySQL 有 15 条预设规则
|
||||
names = {r["name"] for r in data}
|
||||
assert "DDLMultiToCommit" in names
|
||||
assert "DDLMaxKeyParts" in names
|
||||
assert "DMLMaxInsertRows" in names
|
||||
assert "DMLWhere" in names
|
||||
# 验证 value 字段
|
||||
key_parts = next(r for r in data if r["name"] == "DDLMaxKeyParts")
|
||||
assert key_parts["value"] == "8"
|
||||
max_key = next(r for r in data if r["name"] == "DDLMaxKey")
|
||||
assert max_key["value"] == "12"
|
||||
insert_rows = next(r for r in data if r["name"] == "DMLMaxInsertRows")
|
||||
assert insert_rows["value"] == "500"
|
||||
table_name = next(r for r in data if r["name"] == "MaxTableNameLen")
|
||||
assert table_name["value"] == "45"
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_seed_postgres_rules(self, client, admin_token):
|
||||
"""PostgreSQL 种子规则批量创建"""
|
||||
resp = await client.post(
|
||||
"/api/v1/audit-rules/seed/postgres",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert len(data) == 11
|
||||
names = {r["name"] for r in data}
|
||||
assert "PGDDLMultiToCommit" in names
|
||||
assert "PGDDLMaxKeyParts" in names
|
||||
assert "PGMaxTableNameLen" in names
|
||||
# 验证 value 字段
|
||||
key_parts = next(r for r in data if r["name"] == "PGDDLMaxKeyParts")
|
||||
assert key_parts["value"] == "8"
|
||||
table_len = next(r for r in data if r["name"] == "PGMaxTableNameLen")
|
||||
assert table_len["value"] == "63"
|
||||
insert_rows = next(r for r in data if r["name"] == "PGDMLMaxInsertRows")
|
||||
assert insert_rows["value"] == "500"
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_seed_redis_rules(self, client, admin_token):
|
||||
"""Redis 种子规则批量创建"""
|
||||
resp = await client.post(
|
||||
"/api/v1/audit-rules/seed/redis",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert len(data) == 4
|
||||
names = {r["name"] for r in data}
|
||||
assert "RedisAllowFlushDB" in names
|
||||
assert "RedisMaxKeyLen" in names
|
||||
assert "RedisRequireTTL" in names
|
||||
assert "RedisDefaultTTL" in names
|
||||
# 验证 value 字段
|
||||
key_len = next(r for r in data if r["name"] == "RedisMaxKeyLen")
|
||||
assert key_len["value"] == "256"
|
||||
ttl = next(r for r in data if r["name"] == "RedisDefaultTTL")
|
||||
assert ttl["value"] == "3600"
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_seed_unsupported_db_type(self, client, admin_token):
|
||||
"""不支持的数据库类型应返回 400"""
|
||||
resp = await client.post(
|
||||
"/api/v1/audit-rules/seed/oracle",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 400
|
||||
assert "不支持的数据库类型" in resp.json()["detail"]
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_seed_idempotent(self, client, admin_token):
|
||||
"""重复调用 seed 应幂等，不创建重复规则"""
|
||||
resp1 = await client.post(
|
||||
"/api/v1/audit-rules/seed/mysql",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp1.status_code == 200
|
||||
count1 = len(resp1.json())
|
||||
|
||||
resp2 = await client.post(
|
||||
"/api/v1/audit-rules/seed/mysql",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp2.status_code == 200
|
||||
count2 = len(resp2.json())
|
||||
assert count2 == 0 # 第二次调用不再创建
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_seed_forbidden_for_dba(self, client, dba_token):
|
||||
"""DBA 无权调用 seed 接口"""
|
||||
resp = await client.post(
|
||||
"/api/v1/audit-rules/seed/mysql",
|
||||
headers=auth_header(dba_token),
|
||||
)
|
||||
assert resp.status_code == 403
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_seed_forbidden_for_developer(self, client, developer_token):
|
||||
"""Developer 无权调用 seed 接口"""
|
||||
resp = await client.post(
|
||||
"/api/v1/audit-rules/seed/mysql",
|
||||
headers=auth_header(developer_token),
|
||||
)
|
||||
assert resp.status_code == 403
|
||||
|
||||
|
||||
class TestValueFieldAndDDLType:
|
||||
@pytest.mark.asyncio
|
||||
async def test_create_rule_with_value(self, client, admin_token):
|
||||
"""创建带 value 字段的规则"""
|
||||
resp = await client.post(
|
||||
"/api/v1/audit-rules",
|
||||
json={
|
||||
"name": "test_with_value",
|
||||
"description": "测试value字段",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"db_type": "mysql",
|
||||
"value": "100",
|
||||
"message": "测试规则带value",
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
data = resp.json()
|
||||
assert data["value"] == "100"
|
||||
assert data["rule_type"] == "DDL"
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_create_rule_with_dml_type(self, client, admin_token):
|
||||
"""创建 DML 类型规则"""
|
||||
resp = await client.post(
|
||||
"/api/v1/audit-rules",
|
||||
json={
|
||||
"name": "test_dml_rule",
|
||||
"rule_type": "DML",
|
||||
"severity": "error",
|
||||
"db_type": "mysql",
|
||||
"message": "DML测试规则",
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
assert resp.json()["rule_type"] == "DML"
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_create_rule_null_value(self, client, admin_token):
|
||||
"""value 可以为 null"""
|
||||
resp = await client.post(
|
||||
"/api/v1/audit-rules",
|
||||
json={
|
||||
"name": "test_null_value",
|
||||
"rule_type": "DDL",
|
||||
"severity": "info",
|
||||
"message": "null value test",
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
assert resp.json()["value"] is None
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_update_rule_value(self, client, admin_token):
|
||||
"""更新 value 字段"""
|
||||
create = await client.post(
|
||||
"/api/v1/audit-rules",
|
||||
json={
|
||||
"name": "update_value_test",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"value": "50",
|
||||
"message": "test",
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
rule_id = create.json()["id"]
|
||||
|
||||
resp = await client.put(
|
||||
f"/api/v1/audit-rules/{rule_id}",
|
||||
json={"value": "200"},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
assert resp.json()["value"] == "200"
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_list_rules_with_ddl_filter(self, client, admin_token):
|
||||
"""按 DDL 类型筛选规则"""
|
||||
# 先 seed MySQL
|
||||
await client.post(
|
||||
"/api/v1/audit-rules/seed/mysql",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
resp = await client.get(
|
||||
"/api/v1/audit-rules?rule_type=DDL",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert len(data) > 0
|
||||
assert all(r["rule_type"] == "DDL" for r in data)
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_response_includes_value_field(self, client, admin_token):
|
||||
"""响应中包含 value 字段"""
|
||||
create = await client.post(
|
||||
"/api/v1/audit-rules",
|
||||
json={
|
||||
"name": "response_value_test",
|
||||
"rule_type": "DDL",
|
||||
"severity": "warning",
|
||||
"value": "42",
|
||||
"message": "test",
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
rule_id = create.json()["id"]
|
||||
|
||||
resp = await client.get(
|
||||
f"/api/v1/audit-rules/{rule_id}",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
assert "value" in resp.json()
|
||||
assert resp.json()["value"] == "42"
|
||||
@@ -0,0 +1,379 @@
|
||||
"""Tests for Settings modules: Announcement, NotificationChannel, LDAP Config."""
|
||||
import json
|
||||
|
||||
import pytest
|
||||
from httpx import AsyncClient
|
||||
|
||||
from tests.conftest import auth_header
|
||||
|
||||
|
||||
# ─── Announcement Tests ────────────────────────────────────────────
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_create_announcement(client: AsyncClient, admin_token: str):
|
||||
resp = await client.post(
|
||||
"/api/v1/announcements",
|
||||
json={"title": "系统公告", "content": "# Hello\n这是公告内容"},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
data = resp.json()
|
||||
assert data["title"] == "系统公告"
|
||||
assert data["content"] == "# Hello\n这是公告内容"
|
||||
assert data["is_published"] is False
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_list_announcements(client: AsyncClient, admin_token: str, developer_token: str):
|
||||
# Create two announcements
|
||||
for i in range(2):
|
||||
await client.post(
|
||||
"/api/v1/announcements",
|
||||
json={"title": f"公告{i}", "content": f"内容{i}"},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
|
||||
# Admin can list
|
||||
resp = await client.get("/api/v1/announcements", headers=auth_header(admin_token))
|
||||
assert resp.status_code == 200
|
||||
assert len(resp.json()) == 2
|
||||
|
||||
# Developer can also list
|
||||
resp = await client.get("/api/v1/announcements", headers=auth_header(developer_token))
|
||||
assert resp.status_code == 200
|
||||
assert len(resp.json()) == 2
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_update_announcement(client: AsyncClient, admin_token: str):
|
||||
create = await client.post(
|
||||
"/api/v1/announcements",
|
||||
json={"title": "原始标题", "content": "原始内容"},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
aid = create.json()["id"]
|
||||
|
||||
resp = await client.put(
|
||||
f"/api/v1/announcements/{aid}",
|
||||
json={"title": "更新标题", "is_published": True},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert data["title"] == "更新标题"
|
||||
assert data["is_published"] is True
|
||||
assert data["published_at"] is not None
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_delete_announcement(client: AsyncClient, admin_token: str):
|
||||
create = await client.post(
|
||||
"/api/v1/announcements",
|
||||
json={"title": "待删除", "content": "内容"},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
aid = create.json()["id"]
|
||||
|
||||
resp = await client.delete(
|
||||
f"/api/v1/announcements/{aid}",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
|
||||
# Verify deleted
|
||||
resp = await client.get("/api/v1/announcements", headers=auth_header(admin_token))
|
||||
assert all(a["id"] != aid for a in resp.json())
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_announcement_non_admin_forbidden(client: AsyncClient, developer_token: str):
|
||||
# Create forbidden
|
||||
resp = await client.post(
|
||||
"/api/v1/announcements",
|
||||
json={"title": "test", "content": "test"},
|
||||
headers=auth_header(developer_token),
|
||||
)
|
||||
assert resp.status_code == 403
|
||||
|
||||
# Update forbidden
|
||||
resp = await client.put(
|
||||
"/api/v1/announcements/1",
|
||||
json={"title": "test"},
|
||||
headers=auth_header(developer_token),
|
||||
)
|
||||
assert resp.status_code == 403
|
||||
|
||||
# Delete forbidden
|
||||
resp = await client.delete(
|
||||
"/api/v1/announcements/1",
|
||||
headers=auth_header(developer_token),
|
||||
)
|
||||
assert resp.status_code == 403
|
||||
|
||||
|
||||
# ─── NotificationChannel Tests ─────────────────────────────────────
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_create_notification_channel(client: AsyncClient, admin_token: str):
|
||||
resp = await client.post(
|
||||
"/api/v1/notifications",
|
||||
json={
|
||||
"name": "钉钉告警",
|
||||
"channel_type": "dingtalk",
|
||||
"config": {"webhook_url": "https://oapi.dingtalk.com/robot/send?access_token=xxx", "secret": "mysecret"},
|
||||
"is_enabled": True,
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
data = resp.json()
|
||||
assert data["name"] == "钉钉告警"
|
||||
assert data["channel_type"] == "dingtalk"
|
||||
# Password/secret should be masked
|
||||
assert data["config"]["secret"] == "******"
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_list_notification_channels(client: AsyncClient, admin_token: str):
|
||||
resp = await client.get(
|
||||
"/api/v1/notifications",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
assert isinstance(resp.json(), list)
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_update_notification_channel(client: AsyncClient, admin_token: str):
|
||||
create = await client.post(
|
||||
"/api/v1/notifications",
|
||||
json={
|
||||
"name": "飞书通知",
|
||||
"channel_type": "webhook_feishu",
|
||||
"config": {"webhook_url": "https://open.feishu.cn/open-apis/bot/v2/hook/xxx"},
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
cid = create.json()["id"]
|
||||
|
||||
resp = await client.put(
|
||||
f"/api/v1/notifications/{cid}",
|
||||
json={"name": "飞书通知-更新", "is_enabled": False},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
assert resp.json()["name"] == "飞书通知-更新"
|
||||
assert resp.json()["is_enabled"] is False
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_delete_notification_channel(client: AsyncClient, admin_token: str):
|
||||
create = await client.post(
|
||||
"/api/v1/notifications",
|
||||
json={
|
||||
"name": "待删除",
|
||||
"channel_type": "email",
|
||||
"config": {
|
||||
"smtp_host": "smtp.example.com",
|
||||
"smtp_port": 465,
|
||||
"smtp_user": "user@example.com",
|
||||
"smtp_password": "pass123",
|
||||
"from_addr": "user@example.com",
|
||||
"use_tls": True,
|
||||
},
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
cid = create.json()["id"]
|
||||
|
||||
resp = await client.delete(
|
||||
f"/api/v1/notifications/{cid}",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_notification_test_endpoint(client: AsyncClient, admin_token: str):
|
||||
create = await client.post(
|
||||
"/api/v1/notifications",
|
||||
json={
|
||||
"name": "钉钉测试",
|
||||
"channel_type": "dingtalk",
|
||||
"config": {"webhook_url": "https://oapi.dingtalk.com/robot/send?access_token=test"},
|
||||
"is_enabled": True,
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
cid = create.json()["id"]
|
||||
|
||||
resp = await client.post(
|
||||
f"/api/v1/notifications/{cid}/test",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert data["success"] is True
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_notification_non_admin_forbidden(client: AsyncClient, developer_token: str):
|
||||
resp = await client.get(
|
||||
"/api/v1/notifications",
|
||||
headers=auth_header(developer_token),
|
||||
)
|
||||
assert resp.status_code == 403
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_email_config_mask_password(client: AsyncClient, admin_token: str):
|
||||
create = await client.post(
|
||||
"/api/v1/notifications",
|
||||
json={
|
||||
"name": "邮件通道",
|
||||
"channel_type": "email",
|
||||
"config": {
|
||||
"smtp_host": "smtp.example.com",
|
||||
"smtp_port": 587,
|
||||
"smtp_user": "admin@example.com",
|
||||
"smtp_password": "super_secret_pass",
|
||||
"from_addr": "admin@example.com",
|
||||
"use_tls": True,
|
||||
},
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
data = create.json()
|
||||
assert data["config"]["smtp_password"] == "******"
|
||||
|
||||
|
||||
# ─── LDAP Config Tests ─────────────────────────────────────────────
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_create_ldap_config(client: AsyncClient, admin_token: str):
|
||||
resp = await client.put(
|
||||
"/api/v1/ldap-config",
|
||||
json={
|
||||
"ldap_host": "ldap.example.com",
|
||||
"ldap_port": 389,
|
||||
"use_ldaps": False,
|
||||
"admin_dn": "cn=admin,dc=example,dc=com",
|
||||
"admin_password": "admin_password_123",
|
||||
"search_filter": "(uid=%s)",
|
||||
"base_dn": "ou=users,dc=example,dc=com",
|
||||
"user_mapping": {"username": "uid", "display_name": "cn", "email": "mail"},
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert data["ldap_host"] == "ldap.example.com"
|
||||
assert data["ldap_port"] == 389
|
||||
# Password should be masked
|
||||
assert data["admin_password"] == "******"
|
||||
assert data["user_mapping"]["username"] == "uid"
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_get_ldap_config(client: AsyncClient, admin_token: str):
|
||||
# First create
|
||||
await client.put(
|
||||
"/api/v1/ldap-config",
|
||||
json={
|
||||
"ldap_host": "ldap.test.com",
|
||||
"ldap_port": 636,
|
||||
"use_ldaps": True,
|
||||
"admin_dn": "cn=admin,dc=test,dc=com",
|
||||
"admin_password": "testpass",
|
||||
"base_dn": "dc=test,dc=com",
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
|
||||
resp = await client.get(
|
||||
"/api/v1/ldap-config",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert data["ldap_host"] == "ldap.test.com"
|
||||
assert data["use_ldaps"] is True
|
||||
assert data["admin_password"] == "******"
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_update_ldap_config(client: AsyncClient, admin_token: str):
|
||||
# Create
|
||||
await client.put(
|
||||
"/api/v1/ldap-config",
|
||||
json={
|
||||
"ldap_host": "ldap.old.com",
|
||||
"ldap_port": 389,
|
||||
"admin_dn": "cn=admin,dc=old,dc=com",
|
||||
"admin_password": "oldpass",
|
||||
"base_dn": "dc=old,dc=com",
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
|
||||
# Update
|
||||
resp = await client.put(
|
||||
"/api/v1/ldap-config",
|
||||
json={
|
||||
"ldap_host": "ldap.new.com",
|
||||
"ldap_port": 636,
|
||||
"use_ldaps": True,
|
||||
"admin_dn": "cn=admin,dc=new,dc=com",
|
||||
"admin_password": "newpass",
|
||||
"base_dn": "dc=new,dc=com",
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
assert resp.json()["ldap_host"] == "ldap.new.com"
|
||||
assert resp.json()["use_ldaps"] is True
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_ldap_config_not_found(client: AsyncClient, admin_token: str):
|
||||
resp = await client.get(
|
||||
"/api/v1/ldap-config",
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 404
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_ldap_test_connection(client: AsyncClient, admin_token: str):
|
||||
# Create config first
|
||||
await client.put(
|
||||
"/api/v1/ldap-config",
|
||||
json={
|
||||
"ldap_host": "ldap.example.com",
|
||||
"ldap_port": 389,
|
||||
"admin_dn": "cn=admin,dc=example,dc=com",
|
||||
"admin_password": "admin123",
|
||||
"base_dn": "dc=example,dc=com",
|
||||
},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
|
||||
resp = await client.post(
|
||||
"/api/v1/ldap-config/test",
|
||||
json={"test_user": "testuser", "test_password": "testpass"},
|
||||
headers=auth_header(admin_token),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
# Mock mode should return success
|
||||
assert data["success"] is True
|
||||
assert "Mock" in data["message"]
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_ldap_non_admin_forbidden(client: AsyncClient, developer_token: str):
|
||||
resp = await client.get(
|
||||
"/api/v1/ldap-config",
|
||||
headers=auth_header(developer_token),
|
||||
)
|
||||
assert resp.status_code == 403
|
||||
Reference in new issue
Block a user