mirror of
https://github.com/Dvorinka/Containr.git
synced 2026-10-28 07:41:27 +00:00
refactor(db): port auth and security handlers to sqlc (#83)
- auth.sql: user lookups, counts, register/mirror inserts, profile update - security.sql: access EXISTS, vulnerability list/metrics/status, framework list, latest scan/report, project-id guards - NULL description/service_id rows stay filtered, matching the original scan-error-and-skip behavior - auth_users probe and filtered audit-log queries stay raw: one is a Better Auth table outside the schema, the other is dynamically built - TestSecurityLiveInvariants covers the access predicate, severity ordering, upsert conflict path, and latest-row lookups against live Postgres Authored By: TDvorak <[email protected]>
This commit is contained in:
Tomáš Dvořák authored and GitHub committed
1 parent
6bcbc1369e
commit
66301bb68a
10 files changed
+1169
-155
No files matched your search
@@ -0,0 +1,212 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"containr/internal/database"
|
||||
"containr/internal/database/sqlcdb"
|
||||
|
||||
"github.com/google/uuid"
|
||||
)
|
||||
|
||||
// Live invariant test against real Postgres — set METRICS_TEST_DSN (or
|
||||
// DATABASE_URL). Covers the generated auth/security queries: user upsert
|
||||
// conflict path, project-access EXISTS predicate, vulnerability ordering and
|
||||
// status update, latest-scan/report lookups, and the framework list.
|
||||
func TestSecurityLiveInvariants(t *testing.T) {
|
||||
dsn := testDSNString(t)
|
||||
db, err := database.NewConnection(dsn)
|
||||
if err != nil {
|
||||
t.Fatalf("connect: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
ctx := context.Background()
|
||||
q := sqlcdb.New(db.DB)
|
||||
|
||||
userID := uuid.New()
|
||||
otherID := uuid.New()
|
||||
projectID := uuid.New()
|
||||
envID := uuid.New()
|
||||
serviceID := uuid.New()
|
||||
scanID := uuid.New()
|
||||
reportID := uuid.New()
|
||||
frameworkID := uuid.New()
|
||||
vulnCrit := uuid.New()
|
||||
vulnLow := uuid.New()
|
||||
suffix := strings.ReplaceAll(userID.String()[:8], "-", "")
|
||||
must := func(err error) {
|
||||
t.Helper()
|
||||
if err != nil {
|
||||
t.Fatalf("setup: %v", err)
|
||||
}
|
||||
}
|
||||
_, err = db.Exec(`INSERT INTO users (id, email, password_hash, name) VALUES ($1, $2, 'x', 'test'), ($3, $4, 'x', 'other')`,
|
||||
userID, "sec-"+suffix+"@test.local", otherID, "sec-"+suffix+"[email protected]")
|
||||
must(err)
|
||||
_, err = db.Exec(`INSERT INTO projects (id, name, owner_id, is_approved) VALUES ($1, $2, $3, false)`,
|
||||
projectID, "sec-"+suffix, userID)
|
||||
must(err)
|
||||
_, err = db.Exec(`INSERT INTO environments (id, name, project_id) VALUES ($1, 'production', $2)`,
|
||||
envID, projectID)
|
||||
must(err)
|
||||
_, err = db.Exec(`INSERT INTO services (id, name, project_id, environment_id, service_type, source_type)
|
||||
VALUES ($1, $2, $3, $4, 'web', 'image')`,
|
||||
serviceID, "sec-"+suffix, projectID, envID)
|
||||
must(err)
|
||||
defer func() { _, _ = db.Exec(`DELETE FROM users WHERE id IN ($1, $2)`, userID, otherID) }()
|
||||
|
||||
// Auth queries: upsert conflicts update rather than error, counts see rows.
|
||||
_, err = q.InsertUserAdmin(ctx, sqlcdb.InsertUserAdminParams{
|
||||
Email: "ins-" + suffix + "@test.local", PasswordHash: "x", Name: "ins", IsAdmin: false,
|
||||
})
|
||||
must(err)
|
||||
defer func() { _, _ = db.Exec(`DELETE FROM users WHERE email = $1`, "ins-"+suffix+"@test.local") }()
|
||||
urow, err := q.UpsertLocalUser(ctx, sqlcdb.UpsertLocalUserParams{
|
||||
Email: "ins-" + suffix + "@test.local", PasswordHash: "y", Name: "renamed",
|
||||
Column4: "http://img", IsAdmin: false,
|
||||
})
|
||||
must(err)
|
||||
if urow.Name != "renamed" || urow.AvatarUrl != "http://img" {
|
||||
t.Fatalf("upsert: %+v", urow)
|
||||
}
|
||||
byEmail, err := q.GetUserByEmailForAuth(ctx, "ins-"+suffix+"@test.local")
|
||||
must(err)
|
||||
if byEmail.ID != urow.ID || byEmail.PasswordHash != "x" {
|
||||
t.Fatalf("by email: %+v", byEmail)
|
||||
}
|
||||
count, err := q.CountUsersByEmail(ctx, "ins-"+suffix+"@test.local")
|
||||
must(err)
|
||||
if count != 1 {
|
||||
t.Fatalf("count by email: %d", count)
|
||||
}
|
||||
byID, err := q.GetUserByID(ctx, urow.ID)
|
||||
must(err)
|
||||
if byID.Email != "ins-"+suffix+"@test.local" {
|
||||
t.Fatalf("by id: %+v", byID)
|
||||
}
|
||||
|
||||
// Access predicate: unapproved project is owner/admin/member only.
|
||||
ownerAccess, err := q.CheckSecurityProjectAccess(ctx, sqlcdb.CheckSecurityProjectAccessParams{
|
||||
ID: projectID, OwnerID: userID, Column3: false,
|
||||
})
|
||||
must(err)
|
||||
if !ownerAccess {
|
||||
t.Fatal("owner should have access")
|
||||
}
|
||||
strangerAccess, err := q.CheckSecurityProjectAccess(ctx, sqlcdb.CheckSecurityProjectAccessParams{
|
||||
ID: projectID, OwnerID: otherID, Column3: false,
|
||||
})
|
||||
must(err)
|
||||
if strangerAccess {
|
||||
t.Fatal("stranger should not have access")
|
||||
}
|
||||
adminAccess, err := q.CheckSecurityProjectAccess(ctx, sqlcdb.CheckSecurityProjectAccessParams{
|
||||
ID: projectID, OwnerID: otherID, Column3: true,
|
||||
})
|
||||
must(err)
|
||||
if !adminAccess {
|
||||
t.Fatal("admin should have access")
|
||||
}
|
||||
ownerText, err := q.GetProjectOwnerText(ctx, projectID)
|
||||
must(err)
|
||||
if ownerText != userID.String() {
|
||||
t.Fatalf("owner text: %q", ownerText)
|
||||
}
|
||||
exists, err := q.ServiceExistsInProject(ctx, sqlcdb.ServiceExistsInProjectParams{
|
||||
ID: serviceID, ProjectID: projectID,
|
||||
})
|
||||
must(err)
|
||||
if !exists {
|
||||
t.Fatal("service should exist in project")
|
||||
}
|
||||
|
||||
// Scan/report/vuln rows via raw inserts (fixtures), reads via sqlc.
|
||||
_, err = db.Exec(`INSERT INTO security_scans (id, project_id, service_id, scan_type, status, summary, started_at)
|
||||
VALUES ($1, $2, $3, 'dependency', 'completed', '{"score": 85}', NOW() - interval '1 hour')`,
|
||||
scanID, projectID, serviceID)
|
||||
must(err)
|
||||
_, err = db.Exec(`INSERT INTO compliance_frameworks (id, name, description, version, enabled)
|
||||
VALUES ($1, $2, 'desc', '1.0', true)`,
|
||||
frameworkID, "fw-"+suffix)
|
||||
must(err)
|
||||
defer func() { _, _ = db.Exec(`DELETE FROM compliance_frameworks WHERE id = $1`, frameworkID) }()
|
||||
_, err = db.Exec(`INSERT INTO compliance_reports (id, project_id, framework_id, overall_status, score, assessment_date)
|
||||
VALUES ($1, $2, $3, 'compliant', 92, NOW() - interval '30 minutes')`,
|
||||
reportID, projectID, frameworkID)
|
||||
must(err)
|
||||
defer func() { _, _ = db.Exec(`DELETE FROM compliance_reports WHERE id = $1`, reportID) }()
|
||||
_, err = db.Exec(`INSERT INTO vulnerabilities (id, type, severity, title, description, service_id, project_id, status, found_at)
|
||||
VALUES ($1, 'dependency', 'low', 'low-v', 'd', $3, $4, 'open', NOW() - interval '2 hours'),
|
||||
($2, 'dependency', 'critical', 'crit-v', 'd', $3, $4, 'open', NOW() - interval '1 hour')`,
|
||||
vulnLow, vulnCrit, serviceID, projectID)
|
||||
must(err)
|
||||
defer func() { _, _ = db.Exec(`DELETE FROM vulnerabilities WHERE project_id = $1`, projectID) }()
|
||||
defer func() { _, _ = db.Exec(`DELETE FROM security_scans WHERE id = $1`, scanID) }()
|
||||
|
||||
// Severity ordering: critical first.
|
||||
vulns, err := q.ListVulnerabilities(ctx, projectID)
|
||||
must(err)
|
||||
if len(vulns) != 2 || vulns[0].ID != vulnCrit {
|
||||
t.Fatalf("vuln ordering: %+v", vulns)
|
||||
}
|
||||
metrics, err := q.GetVulnerabilityMetrics(ctx, projectID)
|
||||
must(err)
|
||||
if metrics.Total != 2 || metrics.Critical != 1 || metrics.Low != 1 || metrics.Open != 2 {
|
||||
t.Fatalf("metrics: %+v", metrics)
|
||||
}
|
||||
must(q.UpdateVulnerabilityStatus(ctx, sqlcdb.UpdateVulnerabilityStatusParams{
|
||||
Status: "resolved",
|
||||
ResolvedAt: sql.NullTime{Time: time.Now(), Valid: true},
|
||||
ID: vulnCrit,
|
||||
}))
|
||||
metrics, err = q.GetVulnerabilityMetrics(ctx, projectID)
|
||||
must(err)
|
||||
if metrics.Open != 1 || metrics.Resolved != 1 {
|
||||
t.Fatalf("metrics after resolve: %+v", metrics)
|
||||
}
|
||||
|
||||
// Latest scan/report lookups.
|
||||
scan, err := q.GetLatestSecurityScan(ctx, projectID)
|
||||
must(err)
|
||||
if scan.ID != scanID || scan.Score != 85 || scan.Status != "completed" {
|
||||
t.Fatalf("latest scan: %+v", scan)
|
||||
}
|
||||
report, err := q.GetLatestComplianceReport(ctx, projectID)
|
||||
must(err)
|
||||
if report.OverallStatus != "compliant" || report.Score != 92 {
|
||||
t.Fatalf("latest report: %+v", report)
|
||||
}
|
||||
|
||||
// Project-ID lookups used by the access guards.
|
||||
scanPID, err := q.GetSecurityScanProjectID(ctx, scanID)
|
||||
must(err)
|
||||
reportPID, err := q.GetComplianceReportProjectID(ctx, reportID)
|
||||
must(err)
|
||||
vulnPID, err := q.GetVulnerabilityProjectID(ctx, vulnCrit)
|
||||
must(err)
|
||||
if scanPID != projectID || reportPID != projectID || vulnPID != projectID {
|
||||
t.Fatalf("project id lookups: %v %v %v", scanPID, reportPID, vulnPID)
|
||||
}
|
||||
|
||||
// Framework list only returns enabled rows.
|
||||
frameworks, err := q.ListComplianceFrameworks(ctx)
|
||||
must(err)
|
||||
found := false
|
||||
for _, f := range frameworks {
|
||||
if f.ID == frameworkID && f.Enabled {
|
||||
found = true
|
||||
}
|
||||
}
|
||||
if !found {
|
||||
t.Fatal("enabled framework missing from list")
|
||||
}
|
||||
frameworkExists, err := q.ComplianceFrameworkExists(ctx, frameworkID)
|
||||
must(err)
|
||||
if !frameworkExists {
|
||||
t.Fatal("framework should exist")
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user