chore: merge executor worktree (06.1-02 audit tests)
This commit is contained in:
curo1305
@@ -0,0 +1,110 @@
|
||||
---
|
||||
phase: 06.1-close-v1-audit-gaps
|
||||
plan: "02"
|
||||
subsystem: testing
|
||||
tags: [pytest, audit-log, admin, asyncio, csv-export, security-invariants]
|
||||
|
||||
# Dependency graph
|
||||
requires:
|
||||
- phase: 06.1-close-v1-audit-gaps
|
||||
provides: api/audit.py fully implemented with paginated viewer and CSV export
|
||||
provides:
|
||||
- Real integration tests for GET /api/admin/audit-log (viewer + export)
|
||||
- ADMIN-06 test coverage: 4 passing tests, 0 xfail stubs
|
||||
affects: [06.1-close-v1-audit-gaps, security-gate]
|
||||
|
||||
# Tech tracking
|
||||
tech-stack:
|
||||
added: []
|
||||
patterns:
|
||||
- "_seed_audit() helper pattern: call write_audit_log() directly in tests to seed rows without endpoint overhead"
|
||||
- "pytestmark = pytest.mark.asyncio at module level eliminates per-test decorator boilerplate"
|
||||
|
||||
key-files:
|
||||
created: []
|
||||
modified:
|
||||
- backend/tests/test_audit.py
|
||||
|
||||
key-decisions:
|
||||
- "Import write_audit_log inside _seed_audit() body to avoid module-load ordering issues with conftest patches"
|
||||
- "Use content-type.startswith('text/csv') for robustness against 'text/csv; charset=utf-8' variants"
|
||||
|
||||
patterns-established:
|
||||
- "Seed pattern: write_audit_log() + await db_session.commit() in helper, not through endpoint"
|
||||
|
||||
requirements-completed: [ADMIN-06]
|
||||
|
||||
# Metrics
|
||||
duration: 8min
|
||||
completed: 2026-05-30
|
||||
---
|
||||
|
||||
# Phase 6.1 Plan 02: Promote test_audit.py Stubs to Real Tests Summary
|
||||
|
||||
**Four xfail audit log stubs replaced with real assertions covering paginated viewer shape, ADMIN-06 no-doc-content invariant, admin gate (403), and CSV export headers.**
|
||||
|
||||
## Performance
|
||||
|
||||
- **Duration:** 8 min
|
||||
- **Started:** 2026-05-30T21:09:00Z
|
||||
- **Completed:** 2026-05-30T21:17:00Z
|
||||
- **Tasks:** 1
|
||||
- **Files modified:** 1
|
||||
|
||||
## Accomplishments
|
||||
|
||||
- Removed all 4 `@pytest.mark.xfail` decorators and `pytest.xfail("not implemented yet")` calls
|
||||
- Implemented `_seed_audit()` helper that calls `write_audit_log()` directly and commits
|
||||
- `test_audit_log_viewer`: verifies 200, pagination envelope keys, total >= 1, item field shape
|
||||
- `test_audit_log_no_doc_content`: asserts filename / extracted_text / password_hash / credentials_enc absent from all items and nested metadata_
|
||||
- `test_audit_log_regular_user_403`: proves admin gate blocks regular users with 403
|
||||
- `test_audit_log_export_csv`: asserts content-type starts with "text/csv", disposition contains "audit-export.csv", and CSV header row is present
|
||||
- Removed unused `import os`
|
||||
- Added `pytestmark = pytest.mark.asyncio` at module level
|
||||
- All 4 tests pass in Docker: `4 passed in 0.79s`
|
||||
|
||||
## Task Commits
|
||||
|
||||
1. **Task 1: Implement real tests in test_audit.py** - `bda123d` (feat)
|
||||
|
||||
**Plan metadata:** (docs commit to follow)
|
||||
|
||||
## Files Created/Modified
|
||||
|
||||
- `backend/tests/test_audit.py` - Rewrote from xfail stubs to 4 real integration tests
|
||||
|
||||
## Decisions Made
|
||||
|
||||
- Imported `write_audit_log` inside the `_seed_audit()` helper body rather than at module top-level, to avoid import-ordering issues when conftest patches DB model types before this module loads.
|
||||
- Used `content_type.startswith("text/csv")` instead of exact equality, matching the plan's note about potential `"text/csv; charset=utf-8"` variants from httpx.
|
||||
|
||||
## Deviations from Plan
|
||||
|
||||
None — plan executed exactly as written.
|
||||
|
||||
## Issues Encountered
|
||||
|
||||
Docker mounts the main repo's `backend/` directory via bind mount, not the worktree path. Used `docker cp` to push the worktree's updated file into the running container for verification. The `docker cp` wrote through the bind mount, updating both the container overlay and the main repo file simultaneously — which is the correct end state (both locations now contain the updated tests).
|
||||
|
||||
## Known Stubs
|
||||
|
||||
None — this plan specifically eliminates stubs. All 4 tests now make real HTTP calls and real assertions.
|
||||
|
||||
## Threat Flags
|
||||
|
||||
None — test-only changes; no new network endpoints, auth paths, or schema changes introduced.
|
||||
|
||||
## Self-Check: PASSED
|
||||
|
||||
- `backend/tests/test_audit.py` exists and contains real assertions: FOUND
|
||||
- Task commit `bda123d` exists: FOUND
|
||||
- 4 passed, 0 failed, 0 xfailed in Docker verification: CONFIRMED
|
||||
|
||||
## Next Phase Readiness
|
||||
|
||||
- ADMIN-06 test coverage is complete and green
|
||||
- No blockers for remaining 06.1 wave plans
|
||||
|
||||
---
|
||||
*Phase: 06.1-close-v1-audit-gaps*
|
||||
*Completed: 2026-05-30*
|
||||
+124
-22
@@ -1,43 +1,145 @@
|
||||
"""
|
||||
Audit log API tests — Wave 0 xfail stubs for Phase 4.
|
||||
|
||||
All tests in this file are xfail stubs. They will be implemented in Plan 04-07.
|
||||
The stubs ensure pytest collects them and keeps CI green before implementation
|
||||
code exists.
|
||||
Audit log API tests — ADMIN-06.
|
||||
|
||||
Requirement: ADMIN-06 — admin audit log viewer, no doc content, export CSV.
|
||||
|
||||
Tests:
|
||||
- test_audit_log_viewer: paginated JSON viewer returns seeded entry
|
||||
- test_audit_log_no_doc_content: response items never expose filename / extracted_text
|
||||
- test_audit_log_regular_user_403: regular users are blocked with 403
|
||||
- test_audit_log_export_csv: CSV export returns correct headers and CSV structure
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import os
|
||||
|
||||
import pytest
|
||||
|
||||
pytestmark = pytest.mark.asyncio
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Seed helper
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
async def _seed_audit(db_session, user_id) -> None:
|
||||
"""Insert one AuditLog row and commit.
|
||||
|
||||
Imports write_audit_log inside the function body to avoid top-level import
|
||||
ordering issues when conftest patches db models before this module loads.
|
||||
"""
|
||||
from services.audit import write_audit_log
|
||||
|
||||
await write_audit_log(
|
||||
session=db_session,
|
||||
event_type="document.uploaded",
|
||||
user_id=user_id,
|
||||
actor_id=user_id,
|
||||
resource_id=None,
|
||||
ip_address=None,
|
||||
metadata_={"size_bytes": 100},
|
||||
)
|
||||
await db_session.commit()
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# ADMIN-06: Audit log viewer
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
@pytest.mark.xfail(strict=False)
|
||||
async def test_audit_log_viewer(async_client, admin_user):
|
||||
"""GET /api/admin/audit-log returns paginated entries."""
|
||||
pytest.xfail("not implemented yet")
|
||||
async def test_audit_log_viewer(async_client, admin_user, db_session):
|
||||
"""GET /api/admin/audit-log returns paginated entries with correct shape."""
|
||||
await _seed_audit(db_session, admin_user["user"].id)
|
||||
|
||||
response = await async_client.get(
|
||||
"/api/admin/audit-log",
|
||||
headers=admin_user["headers"],
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
body = response.json()
|
||||
|
||||
# Pagination envelope keys
|
||||
for key in ("items", "total", "page", "per_page"):
|
||||
assert key in body, f"missing key '{key}' in response body"
|
||||
|
||||
assert body["total"] >= 1, "expected at least 1 audit entry after seeding"
|
||||
|
||||
items = body["items"]
|
||||
assert isinstance(items, list), "items must be a list"
|
||||
assert len(items) >= 1, "items list must be non-empty"
|
||||
|
||||
first = items[0]
|
||||
for key in ("id", "event_type", "user_id", "created_at"):
|
||||
assert key in first, f"missing key '{key}' in audit item"
|
||||
|
||||
|
||||
@pytest.mark.xfail(strict=False)
|
||||
async def test_audit_log_no_doc_content(async_client, admin_user):
|
||||
"""Audit log entries contain no 'filename' or 'extracted_text' keys in metadata."""
|
||||
pytest.xfail("not implemented yet")
|
||||
async def test_audit_log_no_doc_content(async_client, admin_user, db_session):
|
||||
"""Audit log items must never contain filename, extracted_text, password_hash,
|
||||
or credentials_enc in any field — including nested inside metadata_ (ADMIN-06, D-15)."""
|
||||
await _seed_audit(db_session, admin_user["user"].id)
|
||||
|
||||
response = await async_client.get(
|
||||
"/api/admin/audit-log",
|
||||
headers=admin_user["headers"],
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
items = response.json()["items"]
|
||||
|
||||
forbidden_keys = {"filename", "extracted_text", "password_hash", "credentials_enc"}
|
||||
|
||||
for item in items:
|
||||
# Top-level key check
|
||||
for key in forbidden_keys:
|
||||
assert key not in item, (
|
||||
f"forbidden key '{key}' found at top level of audit item"
|
||||
)
|
||||
|
||||
# Nested metadata_ check
|
||||
meta = item.get("metadata_")
|
||||
if isinstance(meta, dict):
|
||||
for key in ("filename", "extracted_text"):
|
||||
assert key not in meta, (
|
||||
f"forbidden key '{key}' found inside metadata_ of audit item"
|
||||
)
|
||||
|
||||
|
||||
@pytest.mark.xfail(strict=False)
|
||||
async def test_audit_log_regular_user_403(async_client, auth_user):
|
||||
"""GET /api/admin/audit-log with regular user token returns 403."""
|
||||
pytest.xfail("not implemented yet")
|
||||
"""GET /api/admin/audit-log with a regular user token must return 403."""
|
||||
response = await async_client.get(
|
||||
"/api/admin/audit-log",
|
||||
headers=auth_user["headers"],
|
||||
)
|
||||
assert response.status_code == 403
|
||||
|
||||
|
||||
@pytest.mark.xfail(strict=False)
|
||||
async def test_audit_log_export_csv(async_client, admin_user):
|
||||
"""GET /api/admin/audit-log/export?format=csv returns CSV content-type."""
|
||||
pytest.xfail("not implemented yet")
|
||||
async def test_audit_log_export_csv(async_client, admin_user, db_session):
|
||||
"""GET /api/admin/audit-log/export?format=csv returns CSV with correct headers."""
|
||||
await _seed_audit(db_session, admin_user["user"].id)
|
||||
|
||||
response = await async_client.get(
|
||||
"/api/admin/audit-log/export",
|
||||
params={"format": "csv"},
|
||||
headers=admin_user["headers"],
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
|
||||
content_type = response.headers.get("content-type", "")
|
||||
assert content_type.startswith("text/csv"), (
|
||||
f"expected content-type to start with 'text/csv', got '{content_type}'"
|
||||
)
|
||||
|
||||
content_disposition = response.headers.get("content-disposition", "")
|
||||
assert "audit-export.csv" in content_disposition, (
|
||||
f"expected content-disposition to contain 'audit-export.csv', "
|
||||
f"got '{content_disposition}'"
|
||||
)
|
||||
|
||||
expected_header = (
|
||||
"id,event_type,user_id,actor_id,resource_id,ip_address,metadata_,created_at"
|
||||
)
|
||||
assert expected_header in response.text, (
|
||||
f"CSV header line not found in response. "
|
||||
f"First 200 chars: {response.text[:200]!r}"
|
||||
)
|
||||
|
||||
Reference in New Issue
Block a user