194 lines
7.4 KiB
Python
194 lines
7.4 KiB
Python
"""Tests for SQL Audit Engine (Phase 3.2)."""
|
|
import pytest
|
|
from app.services.audit_engine import SQLAuditEngine, Severity
|
|
|
|
|
|
class TestSQLAuditEngine:
|
|
def setup_method(self):
|
|
self.engine = SQLAuditEngine(env="development")
|
|
|
|
# --- DDL Rules ---
|
|
|
|
def test_drop_table_without_if_exists(self):
|
|
report = self.engine.audit("DROP TABLE users;")
|
|
assert not report.passed or report.has_warnings
|
|
rules = [f.rule for f in report.findings]
|
|
assert "DROP_TABLE_DANGER" in rules
|
|
|
|
def test_drop_table_production_blocked(self):
|
|
engine = SQLAuditEngine(env="production")
|
|
report = engine.audit("DROP TABLE users;")
|
|
assert report.has_warnings or not report.passed
|
|
warnings = [f for f in report.findings if f.rule == "DROP_TABLE_DANGER"]
|
|
assert len(warnings) > 0
|
|
|
|
def test_truncate_warning(self):
|
|
report = self.engine.audit("TRUNCATE TABLE logs;")
|
|
rules = [f.rule for f in report.findings]
|
|
assert "TRUNCATE_DANGER" in rules
|
|
|
|
def test_truncate_production_error(self):
|
|
engine = SQLAuditEngine(env="production")
|
|
report = engine.audit("TRUNCATE TABLE logs;")
|
|
errors = [f for f in report.findings if f.level == Severity.ERROR]
|
|
assert any(f.rule == "TRUNCATE_DANGER" for f in errors)
|
|
|
|
# --- Missing WHERE ---
|
|
|
|
def test_update_no_where_error(self):
|
|
report = self.engine.audit("UPDATE users SET status = 1;")
|
|
assert not report.passed
|
|
errors = [f.rule for f in report.findings if f.level == Severity.ERROR]
|
|
assert "UPDATE_NO_WHERE" in errors
|
|
|
|
def test_delete_no_where_error(self):
|
|
report = self.engine.audit("DELETE FROM users;")
|
|
assert not report.passed
|
|
errors = [f.rule for f in report.findings if f.level == Severity.ERROR]
|
|
assert "DELETE_NO_WHERE" in errors
|
|
|
|
def test_update_with_where_passes(self):
|
|
report = self.engine.audit("UPDATE users SET name = 'test' WHERE id = 1;")
|
|
error_rules = [f.rule for f in report.findings if f.level == Severity.ERROR]
|
|
assert "UPDATE_NO_WHERE" not in error_rules
|
|
|
|
def test_delete_with_where_passes(self):
|
|
report = self.engine.audit("DELETE FROM users WHERE id = 1;")
|
|
error_rules = [f.rule for f in report.findings if f.level == Severity.ERROR]
|
|
assert "DELETE_NO_WHERE" not in error_rules
|
|
|
|
# --- SELECT * ---
|
|
|
|
def test_select_star_info(self):
|
|
report = self.engine.audit("SELECT * FROM users WHERE id = 1;")
|
|
rules = [f.rule for f in report.findings]
|
|
assert "SELECT_STAR" in rules
|
|
star_finding = next(f for f in report.findings if f.rule == "SELECT_STAR")
|
|
assert star_finding.level == Severity.INFO
|
|
|
|
def test_select_columns_clean(self):
|
|
report = self.engine.audit("SELECT id, name FROM users WHERE id = 1;")
|
|
rules = [f.rule for f in report.findings]
|
|
assert "SELECT_STAR" not in rules
|
|
|
|
# --- Multiple statements ---
|
|
|
|
def test_multi_statement_error(self):
|
|
report = self.engine.audit("UPDATE users SET name = 'a'; DELETE FROM logs;")
|
|
assert not report.passed
|
|
rules = [f.rule for f in report.findings if f.level == Severity.ERROR]
|
|
assert "MULTI_STATEMENT" in rules
|
|
|
|
def test_single_statement_ok(self):
|
|
report = self.engine.audit("SELECT id FROM users LIMIT 10;")
|
|
rules = [f.rule for f in report.findings]
|
|
assert "MULTI_STATEMENT" not in rules
|
|
|
|
# --- Large IN clause ---
|
|
|
|
def test_large_in_warning(self):
|
|
values = ", ".join([str(i) for i in range(150)])
|
|
sql = f"SELECT * FROM users WHERE id IN ({values});"
|
|
report = self.engine.audit(sql)
|
|
rules = [f.rule for f in report.findings]
|
|
assert "LARGE_IN_CLAUSE" in rules
|
|
|
|
def test_small_in_ok(self):
|
|
report = self.engine.audit("SELECT * FROM users WHERE id IN (1, 2, 3);")
|
|
rules = [f.rule for f in report.findings]
|
|
assert "LARGE_IN_CLAUSE" not in rules
|
|
|
|
# --- Production extra rules ---
|
|
|
|
def test_alter_table_production_error(self):
|
|
engine = SQLAuditEngine(env="production")
|
|
report = engine.audit("ALTER TABLE users ADD COLUMN age INT;")
|
|
assert not report.passed
|
|
errors = [f.rule for f in report.findings if f.level == Severity.ERROR]
|
|
assert "ALTER_TABLE_PRODUCTION" in errors
|
|
|
|
def test_alter_table_dev_ok(self):
|
|
report = self.engine.audit("ALTER TABLE users ADD COLUMN age INT;")
|
|
error_rules = [f.rule for f in report.findings if f.level == Severity.ERROR]
|
|
assert "ALTER_TABLE_PRODUCTION" not in error_rules
|
|
|
|
# --- JOIN without ON ---
|
|
|
|
def test_join_no_on_warning(self):
|
|
report = self.engine.audit("SELECT * FROM users JOIN orders;")
|
|
rules = [f.rule for f in report.findings]
|
|
assert "JOIN_NO_ON" in rules
|
|
|
|
def test_join_with_on_ok(self):
|
|
report = self.engine.audit("SELECT * FROM users JOIN orders ON users.id = orders.user_id;")
|
|
rules = [f.rule for f in report.findings]
|
|
assert "JOIN_NO_ON" not in rules
|
|
|
|
# --- Score ---
|
|
|
|
def test_clean_sql_score_100(self):
|
|
report = self.engine.audit("SELECT id, name FROM users WHERE id = 1 LIMIT 10;")
|
|
assert report.score == 100
|
|
assert report.passed
|
|
|
|
def test_error_reduces_score(self):
|
|
report = self.engine.audit("UPDATE users SET name = 'test';")
|
|
assert report.score < 100
|
|
assert not report.passed
|
|
|
|
def test_report_to_dict(self):
|
|
report = self.engine.audit("SELECT * FROM users;")
|
|
d = report.to_dict()
|
|
assert "passed" in d
|
|
assert "score" in d
|
|
assert "findings" in d
|
|
assert isinstance(d["findings"], list)
|
|
|
|
|
|
class TestAuditEngineIntegration:
|
|
"""Test audit engine integration with ticket creation via API."""
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_ticket_creation_returns_audit_report(self, client, db, admin_token, test_instance):
|
|
from tests.conftest import auth_header
|
|
resp = await client.post(
|
|
"/api/v1/tickets",
|
|
json={
|
|
"title": "SQL审核测试工单",
|
|
"db_type": "mysql",
|
|
"instance_id": test_instance.id,
|
|
"target_database": "test_db",
|
|
"sql_content": "SELECT * FROM users WHERE id = 1;",
|
|
"reason": "测试审核引擎",
|
|
"priority": "medium",
|
|
},
|
|
headers=auth_header(admin_token),
|
|
)
|
|
assert resp.status_code == 201
|
|
data = resp.json()
|
|
assert "audit_report" in data
|
|
assert "score" in data["audit_report"]
|
|
assert "findings" in data["audit_report"]
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_ticket_with_dangerous_sql_has_low_score(self, client, db, admin_token, test_instance):
|
|
from tests.conftest import auth_header
|
|
resp = await client.post(
|
|
"/api/v1/tickets",
|
|
json={
|
|
"title": "危险SQL工单",
|
|
"db_type": "mysql",
|
|
"instance_id": test_instance.id,
|
|
"target_database": "test_db",
|
|
"sql_content": "UPDATE users SET status = 1;",
|
|
"reason": "全表更新测试",
|
|
"priority": "high",
|
|
},
|
|
headers=auth_header(admin_token),
|
|
)
|
|
assert resp.status_code == 201
|
|
data = resp.json()
|
|
report = data["audit_report"]
|
|
assert report["passed"] is False
|
|
assert report["score"] < 100
|