test(store): репозиторий (аудит по всем сущностям) и персистентность после рестарта (#20)

2026-10-21 23:45:30 +03:00
parent 89e5a5a883
commit 7e10ffaf8a
2 changed files with 496 additions and 0 deletions
@@ -0,0 +1,312 @@
+"""Тесты репозитория: CRUD-мутации с аудитом «old→new» (issue #20)."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from awg_api.store import (
+    ConfigMeta,
+    Database,
+    Device,
+    Entity,
+    GeoIpSchedule,
+    Mode,
+    Rule,
+    RuleException,
+    StorageError,
+    Store,
+    ValidationError,
+)
+from awg_api.store import audit
+from awg_api.store.validation import validate_priority
+
+
+def make_store(tmp_path: Path) -> tuple[Database, Store]:
+    db = Database(tmp_path / "data" / "awg-dash.db")
+    return db, Store(db)
+
+
+# -- правила -----------------------------------------------------------------
+def test_upsert_rule_creates_with_audit(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        saved = store.upsert_rule(
+            Rule(name="yt", kind="domain", match="youtube.com", target="tun0", priority=10),
+            actor="ui:admin",
+        )
+        assert saved.id is not None and saved.created_at == saved.updated_at
+        assert store.get_rule(saved.id) == saved
+        assert store.get_rule_by_name("yt") == saved
+        entries = store.list_audit(entity=Entity.RULE.value)
+        assert len(entries) == 1
+        assert entries[0].action == "create"
+        assert entries[0].old_value is None
+        assert entries[0].new_value is not None
+        assert entries[0].new_value["name"] == "yt"
+
+
+def test_upsert_rule_updates_by_name_and_records_old_new(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        first = store.upsert_rule(Rule(name="yt", kind="domain", match="youtube.com", target="tun0"),
+                                  actor="ui:admin")
+        second = store.upsert_rule(Rule(name="yt", kind="domain", match="youtu.be", target="tun1"),
+                                   actor="ui:admin")
+        assert second.id == first.id
+        assert second.match == "youtu.be" and second.target == "tun1"
+        assert store.counts()["rules"] == 1
+        entries = store.list_audit(entity=Entity.RULE.value)
+        assert [entry.action for entry in entries] == ["update", "create"]
+        assert entries[0].old_value["match"] == "youtube.com"
+        assert entries[0].new_value["match"] == "youtu.be"
+        assert entries[0].old_value["target"] == "tun0"
+        assert entries[0].new_value["target"] == "tun1"
+
+
+def test_upsert_rule_by_id(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        saved = store.upsert_rule(Rule(name="a", kind="cidr", match="10.0.0.0/8", target="tun0"),
+                                  actor="system")
+        updated = store.upsert_rule(
+            Rule(id=saved.id, name="a", kind="cidr", match="10.1.0.0/16", target="tun0", enabled=False),
+            actor="system",
+        )
+        assert updated.id == saved.id
+        assert updated.match == "10.1.0.0/16"
+        assert updated.enabled is False
+        assert store.list_rules(enabled_only=True) == []
+
+
+def test_rule_validation_rejects_bad_input(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        cases = [
+            Rule(name="Bad Name", kind="domain", match="youtube.com", target="tun0"),
+            Rule(name="ok", kind="wrong", match="youtube.com", target="tun0"),
+            Rule(name="ok2", kind="domain", match="not a domain", target="tun0"),
+            Rule(name="ok3", kind="cidr", match="10.0.0.0/99", target="tun0"),
+            Rule(name="ok4", kind="domain", match="youtube.com", target="bad target!"),
+            Rule(name="ok5", kind="domain", match="youtube.com", target="tun0", priority=-1),
+        ]
+        for rule in cases:
+            with pytest.raises(ValidationError):
+                store.upsert_rule(rule, actor="system")
+        assert store.counts()["rules"] == 0
+        assert audit.count(db.connection) == 0
+
+
+def test_priority_must_be_int() -> None:
+    with pytest.raises(ValidationError, match="целое"):
+        validate_priority(True)  # bool не является допустимым приоритетом
+    with pytest.raises(ValidationError, match="диапазона"):
+        validate_priority(70000)
+
+
+def test_delete_rule(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        saved = store.upsert_rule(Rule(name="yt", kind="domain", match="youtube.com", target="tun0"),
+                                  actor="ui:admin")
+        assert saved.id is not None
+        assert store.delete_rule(saved.id, actor="ui:admin") is True
+        assert store.delete_rule(saved.id, actor="ui:admin") is False
+        assert store.get_rule(saved.id) is None
+        entries = store.list_audit(entity=Entity.RULE.value)
+        assert [entry.action for entry in entries] == ["delete", "create"]
+        assert entries[0].new_value is None
+        assert entries[0].old_value["name"] == "yt"
+
+
+def test_rules_sorted_by_priority(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        store.upsert_rule(Rule(name="b", kind="domain", match="b.example.com", target="tun0",
+                               priority=200), actor="system")
+        store.upsert_rule(Rule(name="a", kind="domain", match="a.example.com", target="tun0",
+                               priority=5), actor="system")
+        assert [rule.name for rule in store.list_rules()] == ["a", "b"]
+
+
+# -- исключения ---------------------------------------------------------------
+def test_exception_upsert_update_delete(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        created = store.upsert_exception(RuleException(match="bank.example.com", reason="банк"),
+                                        actor="ui:admin")
+        assert created.id is not None
+        assert store.get_exception("bank.example.com") == created
+
+        updated = store.upsert_exception(RuleException(match="bank.example.com", reason="банк2"),
+                                         actor="ui:admin")
+        assert updated.id == created.id and updated.reason == "банк2"
+        assert store.counts()["exceptions"] == 1
+
+        assert store.list_exceptions() == [updated]
+        assert store.delete_exception(updated.id or 0, actor="ui:admin") is True
+        assert store.delete_exception(updated.id or 0, actor="ui:admin") is False
+
+        actions = [entry.action for entry in store.list_audit(entity=Entity.EXCEPTION.value)]
+        assert actions == ["delete", "update", "create"]
+        update_entry = store.list_audit(entity=Entity.EXCEPTION.value)[1]
+        assert update_entry.old_value["reason"] == "банк"
+        assert update_entry.new_value["reason"] == "банк2"
+
+
+def test_exception_accepts_cidr_and_rejects_garbage(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        assert store.upsert_exception(RuleException(match="192.168.1.0/24"), actor="system").match == (
+            "192.168.1.0/24"
+        )
+        assert store.upsert_exception(RuleException(match="10.0.0.1"), actor="system").match == "10.0.0.1"
+        with pytest.raises(ValidationError, match="домен"):
+            store.upsert_exception(RuleException(match="!!!"), actor="system")
+        with pytest.raises(ValidationError, match="пустым"):
+            store.upsert_exception(RuleException(match="  "), actor="system")
+
+
+# -- режим и GeoIP -------------------------------------------------------------
+def test_set_mode_defaults_off_and_audits(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        assert store.get_mode() == Mode.OFF
+        assert store.set_mode("split", actor="ui:admin") == Mode.SPLIT
+        assert store.get_mode() == Mode.SPLIT
+        assert store.set_mode(Mode("full"), actor="ui:admin") == Mode.FULL
+        entries = store.list_audit(entity=Entity.MODE.value)
+        assert len(entries) == 2
+        assert entries[0].old_value == {"mode": "split"}
+        assert entries[0].new_value == {"mode": "full"}
+        assert entries[0].actor == "ui:admin"
+
+
+def test_set_mode_rejects_unknown(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        with pytest.raises(ValidationError, match="mode"):
+            store.set_mode("turbo", actor="ui:admin")
+        assert store.get_mode() == Mode.OFF
+
+
+def test_geoip_schedule_defaults_and_partial_update(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        default = store.get_geoip_schedule()
+        assert default == GeoIpSchedule(enabled=True, cron="0 4 * * *", provider="ripe",
+                                        updated_at=default.updated_at)
+        updated = store.set_geoip_schedule(cron="*/30 * * * *", actor="ui:admin")
+        assert updated.cron == "*/30 * * * *"
+        assert updated.provider == "ripe" and updated.enabled is True
+
+        disabled = store.set_geoip_schedule(enabled=False, provider="MAXMIND", actor="ui:admin")
+        assert disabled.enabled is False and disabled.provider == "maxmind"
+        assert store.get_geoip_schedule() == disabled
+
+        with pytest.raises(ValidationError, match="cron"):
+            store.set_geoip_schedule(cron="ежечасно", actor="ui:admin")
+        with pytest.raises(ValidationError, match="provider"):
+            store.set_geoip_schedule(provider="!", actor="ui:admin")
+
+        entries = store.list_audit(entity=Entity.GEOIP_SCHEDULE.value)
+        assert [entry.action for entry in entries] == ["set_geoip_schedule"] * 2
+        assert entries[0].old_value["provider"] == "ripe"
+        assert entries[0].new_value["provider"] == "maxmind"
+
+
+# -- конфиги ------------------------------------------------------------------
+def test_config_upsert_and_mark_applied(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        created = store.upsert_config(
+            ConfigMeta(name="client-peer1", path="/config/peer1.conf", version=1, checksum="abc",
+                       size_bytes=512), actor="ui:admin",
+        )
+        assert created.id is not None
+        assert store.get_config("client-peer1") == created
+
+        updated = store.upsert_config(
+            ConfigMeta(name="client-peer1", path="/config/peer1.conf", version=2, checksum="def",
+                       size_bytes=640, applied=True), actor="ui:admin",
+        )
+        assert updated.version == 2 and updated.applied is True
+        assert store.counts()["configs"] == 1
+
+        marked = store.mark_config_applied("client-peer1", applied=False, actor="ui:admin")
+        assert marked.applied is False
+
+        entries = store.list_audit(entity=Entity.CONFIG.value)
+        assert [entry.action for entry in entries] == ["set_applied", "update", "create"]
+        assert entries[0].old_value["applied"] is True
+        assert entries[0].new_value["applied"] is False
+        assert entries[1].old_value["version"] == 1
+        assert entries[1].new_value["version"] == 2
+
+
+def test_config_validation_and_missing(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        with pytest.raises(ValidationError, match="path"):
+            store.upsert_config(ConfigMeta(name="x", path="relative.conf"), actor="system")
+        with pytest.raises(ValidationError, match="path"):
+            store.upsert_config(ConfigMeta(name="x", path="/config/../etc/passwd"), actor="system")
+        with pytest.raises(ValidationError, match="name"):
+            store.upsert_config(ConfigMeta(name="Bad Name", path="/config/x.conf"), actor="system")
+        with pytest.raises(StorageError, match="не найден"):
+            store.mark_config_applied("ghost", applied=True, actor="system")
+
+
+# -- устройства -----------------------------------------------------------------
+def test_device_register_normalizes_mac_and_audits(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        created = store.register_device(
+            Device(mac="AA-BB-CC-DD-EE-FF", name="notebook", address="192.168.1.50"),
+            actor="ui:admin",
+        )
+        assert created.mac == "aa:bb:cc:dd:ee:ff"
+        assert store.get_device("AA:BB:CC:DD:EE:FF") == created
+
+        updated = store.register_device(
+            Device(mac="aabbccddeeff", name="notebook", policy="direct", last_seen="2026-01-01T00:00:00.000Z"),
+            actor="ui:admin",
+        )
+        assert updated.id == created.id and updated.policy == "direct"
+        assert store.counts()["devices"] == 1
+
+        assert store.delete_device("aa:bb:cc:dd:ee:ff", actor="ui:admin") is True
+        assert store.delete_device("aa:bb:cc:dd:ee:ff", actor="ui:admin") is False
+        assert store.list_devices() == []
+
+        actions = [entry.action for entry in store.list_audit(entity=Entity.DEVICE.value)]
+        assert actions == ["delete", "update", "create"]
+        update_entry = store.list_audit(entity=Entity.DEVICE.value)[1]
+        assert update_entry.old_value["policy"] == "default"
+        assert update_entry.new_value["policy"] == "direct"
+
+
+def test_device_validation(tmp_path: Path) -> None:
+    db, store = make_store(tmp_path)
+    with db:
+        with pytest.raises(ValidationError, match="MAC"):
+            store.register_device(Device(mac="zz:zz", name="x"), actor="system")
+        with pytest.raises(ValidationError, match="policy"):
+            store.register_device(Device(mac="aa:bb:cc:dd:ee:ff", name="x", policy="кибератака"),
+                                  actor="system")
+        with pytest.raises(ValidationError, match="name"):
+            store.register_device(Device(mac="aa:bb:cc:dd:ee:ff", name="Not A Name"), actor="system")
+
+
+def test_audit_actor_recorded_per_mutation(tmp_path: Path) -> None:
+    """GIVEN изменение через сервисный слой, THEN в audit_log есть actor и old/new."""
+    db, store = make_store(tmp_path)
+    with db:
+        store.set_mode(Mode.SPLIT, actor="api:token-42")
+        entry = store.list_audit(entity=Entity.MODE.value)[0]
+        assert entry.actor == "api:token-42"
+        assert entry.ts.endswith("Z")
+        assert entry.old_value == {"mode": "off"}
+        assert entry.new_value == {"mode": "split"}
+        assert entry.status == "ok"