163 lines
5.1 KiB
Python
163 lines
5.1 KiB
Python
from __future__ import annotations
|
|
|
|
from types import SimpleNamespace
|
|
import unittest
|
|
|
|
from sqlalchemy import create_engine
|
|
from sqlalchemy.orm import Session
|
|
|
|
from govoplan_core.auth import ApiPrincipal
|
|
from govoplan_core.core.access import PrincipalRef
|
|
from govoplan_core.core.search import (
|
|
SearchAuthorizationRequest,
|
|
SearchBackfillRequest,
|
|
SearchResourceReference,
|
|
)
|
|
from govoplan_core.db.base import Base
|
|
from govoplan_datasources.backend.db.models import DatasourceRecord
|
|
from govoplan_datasources.backend.manifest import get_manifest
|
|
from govoplan_datasources.backend.search_source import (
|
|
DatasourcesSearchSource,
|
|
PROVIDER_ID,
|
|
RESOURCE_TYPE,
|
|
)
|
|
from govoplan_datasources.backend.service import ADMIN_SCOPE, CATALOGUE_READ_SCOPE
|
|
|
|
|
|
class DatasourcesSearchSourceTests(unittest.TestCase):
|
|
def setUp(self) -> None:
|
|
self.engine = create_engine("sqlite://")
|
|
Base.metadata.create_all(
|
|
self.engine,
|
|
tables=(DatasourceRecord.__table__,),
|
|
)
|
|
self.session = Session(self.engine)
|
|
self.session.add_all(
|
|
(
|
|
_datasource("source-1", "tenant-1", "Monthly source"),
|
|
_datasource("source-other", "tenant-2", "Other tenant"),
|
|
)
|
|
)
|
|
self.session.commit()
|
|
self.source = DatasourcesSearchSource()
|
|
|
|
def tearDown(self) -> None:
|
|
self.session.close()
|
|
self.engine.dispose()
|
|
|
|
def test_manifest_registers_optional_search_source(self) -> None:
|
|
manifest = get_manifest()
|
|
|
|
self.assertIn("search", manifest.optional_dependencies)
|
|
self.assertIn(
|
|
PROVIDER_ID,
|
|
{registration.id for registration in manifest.search_sources},
|
|
)
|
|
|
|
def test_backfill_is_tenant_bound_and_excludes_protected_payloads(self) -> None:
|
|
page = self.source.backfill(
|
|
self.session,
|
|
request=SearchBackfillRequest(
|
|
tenant_id="tenant-1",
|
|
provider_id=PROVIDER_ID,
|
|
resource_type=RESOURCE_TYPE,
|
|
rebuild_id="rebuild-1",
|
|
),
|
|
)
|
|
|
|
self.assertEqual(("source-1",), tuple(doc.resource_id for doc in page.documents))
|
|
document = page.documents[0]
|
|
serialized = repr(document)
|
|
self.assertNotIn("must-not-be-indexed", serialized)
|
|
self.assertNotIn("secret_field", serialized)
|
|
self.assertNotIn("credential-1", serialized)
|
|
self.assertTrue(document.requires_authorization_recheck)
|
|
self.assertEqual(
|
|
"/datasources?datasource=datasource%3Asource-1",
|
|
document.url,
|
|
)
|
|
|
|
def test_authorization_rechecks_scope_tenant_and_current_existence(self) -> None:
|
|
reference = SearchResourceReference(
|
|
tenant_id="tenant-1",
|
|
module_id="datasources",
|
|
resource_type=RESOURCE_TYPE,
|
|
resource_id="source-1",
|
|
)
|
|
request = SearchAuthorizationRequest(reference=reference, source_revision="1")
|
|
|
|
self.assertTrue(
|
|
self.source.authorize(
|
|
self.session,
|
|
_principal({CATALOGUE_READ_SCOPE}),
|
|
requests=(request,),
|
|
)[reference.key]
|
|
)
|
|
self.assertTrue(
|
|
self.source.authorize(
|
|
self.session,
|
|
_principal({ADMIN_SCOPE}),
|
|
requests=(request,),
|
|
)[reference.key]
|
|
)
|
|
self.assertFalse(
|
|
self.source.authorize(
|
|
self.session,
|
|
_principal(set()),
|
|
requests=(request,),
|
|
)[reference.key]
|
|
)
|
|
other_reference = SearchResourceReference(
|
|
tenant_id="tenant-2",
|
|
module_id="datasources",
|
|
resource_type=RESOURCE_TYPE,
|
|
resource_id="source-other",
|
|
)
|
|
other_request = SearchAuthorizationRequest(
|
|
reference=other_reference,
|
|
source_revision="1",
|
|
)
|
|
self.assertFalse(
|
|
self.source.authorize(
|
|
self.session,
|
|
_principal({CATALOGUE_READ_SCOPE}),
|
|
requests=(other_request,),
|
|
)[other_reference.key]
|
|
)
|
|
|
|
|
|
def _datasource(identifier: str, tenant_id: str, name: str) -> DatasourceRecord:
|
|
return DatasourceRecord(
|
|
id=identifier,
|
|
tenant_id=tenant_id,
|
|
source_name=identifier.replace("-", "_"),
|
|
name=name,
|
|
description="Safe catalogue description",
|
|
kind="database",
|
|
mode="cached",
|
|
shape="tabular",
|
|
status="active",
|
|
provider="connectors.sql",
|
|
provider_ref="credential-1",
|
|
schema_=[{"name": "secret_field", "type": "string"}],
|
|
provenance_={"query": "must-not-be-indexed"},
|
|
metadata_={"password": "must-not-be-indexed"},
|
|
)
|
|
|
|
|
|
def _principal(scopes: set[str]) -> ApiPrincipal:
|
|
return ApiPrincipal(
|
|
principal=PrincipalRef(
|
|
account_id="account-1",
|
|
membership_id="user-1",
|
|
tenant_id="tenant-1",
|
|
scopes=frozenset(scopes),
|
|
),
|
|
account=SimpleNamespace(id="account-1"),
|
|
user=SimpleNamespace(id="user-1"),
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|