jcv-dev
551b42eab5
Close the gaps between the documented contract (API-STANDARD, TENANCY, ENTITLEMENTS) and the implementation, and remove committed build artifacts. Security: - verify + process inbound webhooks (HMAC/handler verify, size limit, timestamp tolerance, idempotency via InboundEvent.external_id) - real 2FA login flow (pre-auth challenge; tokens only after verify/recovery) - wire HybridPermission into security/audit views; add API-key rotate and users/<id>/permissions|roles endpoints - tenant-scoped throttling on by default; webhook replay protection - verify MercadoPago webhook signatures - login brute-force guard, configurable password policy, real ALTCHA PoW Correctness: - apply verified billing webhooks idempotently (subscription/entitlement/ invoice/PaymentTransaction); scheduled payment lifecycle jobs - capture audit update diffs automatically; add audit retention purge - working notification retries, per-channel rate limits, log retention - pluggable virus scanner, upload-size limit, pipeline toggle - feature rollout %/environment targeting; settings-driven registrations - workflow guards (instance cap, route depth, self-assignment, clone on re-entry) - wire every previously-dead INFRASYNTH_* setting; drop truly dead ones Delivery: - README + CHANGELOG; CI format check + coverage gate - keep test media out of the tree; untrack .coverage, __pycache__, egg-info, docs/ and invoice artifacts
130 lines
4.6 KiB
Python
130 lines
4.6 KiB
Python
import pytest
|
|
from django.conf import settings
|
|
from django.test import override_settings
|
|
|
|
from infrasynth.audit.models import ModelChangeLog, SecurityEvent
|
|
from infrasynth.audit.signals import security_event_occurred
|
|
from infrasynth.security.models import Role
|
|
|
|
|
|
def audit_config(**overrides):
|
|
return {**settings.INFRASYNTH_AUDIT, **overrides}
|
|
|
|
|
|
@pytest.fixture
|
|
def role(db):
|
|
return Role.objects.create(name="Test Role", slug="test-role", permissions=[])
|
|
|
|
|
|
class TestModelCreateTracking:
|
|
def test_create_logs_entry(self, role):
|
|
log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
|
|
assert log.object_id == str(role.pk)
|
|
assert log.action == "create"
|
|
assert "name" in log.changes
|
|
assert log.changes["name"] == [None, "Test Role"]
|
|
|
|
def test_create_changes_include_serialized_fields(self, role):
|
|
log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
|
|
assert log.changes["slug"] == [None, "test-role"]
|
|
assert log.changes["permissions"] == [None, "[]"]
|
|
|
|
def test_create_actor_none_without_actor_field(self, role):
|
|
log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
|
|
assert log.actor is None
|
|
|
|
|
|
class TestModelUpdateTracking:
|
|
def test_update_logs_field_changes(self, role):
|
|
role._previous_state = Role.objects.get(pk=role.pk)
|
|
role.name = "Renamed Role"
|
|
role.save()
|
|
|
|
logs = ModelChangeLog.objects.filter(
|
|
model_label="infrasynth_security.Role",
|
|
object_id=str(role.pk),
|
|
action="update",
|
|
)
|
|
assert logs.count() == 1
|
|
assert logs.first().changes["name"] == ["Test Role", "Renamed Role"]
|
|
|
|
def test_no_changes_does_not_log(self, role):
|
|
role._previous_state = Role.objects.get(pk=role.pk)
|
|
role.save()
|
|
|
|
assert not ModelChangeLog.objects.filter(
|
|
model_label="infrasynth_security.Role",
|
|
object_id=str(role.pk),
|
|
action="update",
|
|
).exists()
|
|
|
|
def test_update_logged_without_manual_snapshot(self, role):
|
|
role.name = "Changed Automatically"
|
|
role.save()
|
|
|
|
log = ModelChangeLog.objects.get(
|
|
model_label="infrasynth_security.Role",
|
|
object_id=str(role.pk),
|
|
action="update",
|
|
)
|
|
assert log.changes["name"] == ["Test Role", "Changed Automatically"]
|
|
|
|
|
|
class TestModelDeleteTracking:
|
|
def test_delete_logs_entry(self, role):
|
|
pk = role.pk
|
|
role.delete()
|
|
|
|
log = ModelChangeLog.objects.get(
|
|
model_label="infrasynth_security.Role",
|
|
object_id=str(pk),
|
|
action="delete",
|
|
)
|
|
assert log.action == "delete"
|
|
|
|
|
|
class TestConfiguration:
|
|
@override_settings(INFRASYNTH_AUDIT=audit_config(EXCLUDED_MODELS=["infrasynth_security.Role"]))
|
|
def test_excluded_model_not_logged(self, db):
|
|
Role.objects.create(name="Excluded", slug="excluded")
|
|
assert not ModelChangeLog.objects.filter(model_label="infrasynth_security.Role").exists()
|
|
|
|
@override_settings(INFRASYNTH_AUDIT=audit_config(EXCLUDED_FIELDS=["name", "slug"]))
|
|
def test_excluded_fields_not_in_changes(self, db):
|
|
Role.objects.create(name="Field", slug="field")
|
|
log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
|
|
assert "name" not in log.changes
|
|
assert "slug" not in log.changes
|
|
assert "is_system" in log.changes
|
|
|
|
@override_settings(INFRASYNTH_AUDIT=audit_config(ENABLE_MODEL_CHANGE_TRACKING=False))
|
|
def test_tracking_disabled(self, db):
|
|
Role.objects.create(name="No Track", slug="no-track")
|
|
assert not ModelChangeLog.objects.filter(model_label="infrasynth_security.Role").exists()
|
|
|
|
@override_settings(INFRASYNTH_AUDIT=audit_config(ENABLE_SECURITY_EVENTS=False))
|
|
def test_security_events_disabled(self, db):
|
|
security_event_occurred.send(
|
|
sender=Role,
|
|
event_type="test",
|
|
actor=None,
|
|
ip_address=None,
|
|
metadata={},
|
|
)
|
|
assert not SecurityEvent.objects.exists()
|
|
|
|
|
|
class TestSecurityEvents:
|
|
def test_security_event_creates_log(self, db, user):
|
|
security_event_occurred.send(
|
|
sender=Role,
|
|
event_type="login_failed",
|
|
actor=user,
|
|
ip_address="127.0.0.1",
|
|
metadata={"reason": "bad_password"},
|
|
)
|
|
event = SecurityEvent.objects.get(event_type="login_failed")
|
|
assert event.actor == user
|
|
assert event.ip_address == "127.0.0.1"
|
|
assert event.metadata == {"reason": "bad_password"}
|
|
assert event.request_id
|