71 lines
2.1 KiB
Python
71 lines
2.1 KiB
Python
import os
|
|
|
|
import pytest
|
|
from cryptography.exceptions import InvalidTag
|
|
|
|
from app import audit
|
|
from app.constants import CHECKMK_SECRET, OLLAMA_URL
|
|
from app.crypto import SecretBox
|
|
from app.db import Database
|
|
from app.settings import SettingsStore
|
|
|
|
|
|
@pytest.fixture
|
|
def box():
|
|
return SecretBox(os.urandom(32))
|
|
|
|
|
|
@pytest.fixture
|
|
def store(box):
|
|
return SettingsStore(Database(":memory:"), box)
|
|
|
|
|
|
def test_roundtrip(box):
|
|
token = box.encrypt("geheim", "ctx")
|
|
assert "geheim" not in token
|
|
assert box.decrypt(token, "ctx") == "geheim"
|
|
|
|
|
|
def test_context_mismatch_fails(box):
|
|
token = box.encrypt("geheim", "a")
|
|
with pytest.raises(InvalidTag):
|
|
box.decrypt(token, "b")
|
|
|
|
|
|
def test_tampered_token_fails(box):
|
|
token = box.encrypt("geheim", "ctx")
|
|
other = SecretBox(os.urandom(32))
|
|
with pytest.raises(InvalidTag):
|
|
other.decrypt(token, "ctx")
|
|
|
|
|
|
def test_plain_setting_roundtrip(store):
|
|
store.set(OLLAMA_URL, "http://x:11434", user="admin")
|
|
assert store.get(OLLAMA_URL) == "http://x:11434"
|
|
assert store.get("missing", "dflt") == "dflt"
|
|
|
|
|
|
def test_secret_encrypted_at_rest(store):
|
|
store.set(CHECKMK_SECRET, "topsecret", user="admin", secret=True)
|
|
raw = store._db.query("SELECT value, is_secret FROM settings WHERE key=?", (CHECKMK_SECRET,))[0]
|
|
assert raw["is_secret"] == 1
|
|
assert "topsecret" not in raw["value"]
|
|
assert store.get(CHECKMK_SECRET) == "topsecret"
|
|
|
|
|
|
def test_audit_masks_secrets(store):
|
|
store.set(CHECKMK_SECRET, "one", user="admin", secret=True)
|
|
store.set(CHECKMK_SECRET, "two", user="admin", secret=True)
|
|
entries = audit.recent(store._db)
|
|
dumped = str(entries)
|
|
assert "one" not in dumped and "two" not in dumped
|
|
assert entries[0]["old_value"] == "***" and entries[0]["new_value"] == "***"
|
|
assert entries[1]["old_value"] is None and entries[1]["new_value"] == "***"
|
|
|
|
|
|
def test_audit_records_plain_change(store):
|
|
store.set(OLLAMA_URL, "http://a", user="admin")
|
|
store.set(OLLAMA_URL, "http://b", user="admin")
|
|
latest = audit.recent(store._db)[0]
|
|
assert (latest["old_value"], latest["new_value"], latest["user"]) == ("http://a", "http://b", "admin")
|