129 lines
4.5 KiB
Python
129 lines
4.5 KiB
Python
import pytest
|
|
from django.conf import settings
|
|
from django.test import override_settings
|
|
|
|
from infrasynth.audit.models import ModelChangeLog, SecurityEvent
|
|
from infrasynth.audit.signals import security_event_occurred
|
|
from infrasynth.security.models import Role
|
|
|
|
|
|
def audit_config(**overrides):
|
|
return {**settings.INFRASYNTH_AUDIT, **overrides}
|
|
|
|
|
|
@pytest.fixture
|
|
def role(db):
|
|
return Role.objects.create(name="Test Role", slug="test-role", permissions=[])
|
|
|
|
|
|
class TestModelCreateTracking:
|
|
def test_create_logs_entry(self, role):
|
|
log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
|
|
assert log.object_id == str(role.pk)
|
|
assert log.action == "create"
|
|
assert "name" in log.changes
|
|
assert log.changes["name"] == [None, "Test Role"]
|
|
|
|
def test_create_changes_include_serialized_fields(self, role):
|
|
log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
|
|
assert log.changes["slug"] == [None, "test-role"]
|
|
assert log.changes["permissions"] == [None, "[]"]
|
|
|
|
def test_create_actor_none_without_actor_field(self, role):
|
|
log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
|
|
assert log.actor is None
|
|
|
|
|
|
class TestModelUpdateTracking:
|
|
def test_update_logs_field_changes(self, role):
|
|
role._previous_state = Role.objects.get(pk=role.pk)
|
|
role.name = "Renamed Role"
|
|
role.save()
|
|
|
|
logs = ModelChangeLog.objects.filter(
|
|
model_label="infrasynth_security.Role",
|
|
object_id=str(role.pk),
|
|
action="update",
|
|
)
|
|
assert logs.count() == 1
|
|
assert logs.first().changes["name"] == ["Test Role", "Renamed Role"]
|
|
|
|
def test_no_changes_does_not_log(self, role):
|
|
role._previous_state = Role.objects.get(pk=role.pk)
|
|
role.save()
|
|
|
|
assert not ModelChangeLog.objects.filter(
|
|
model_label="infrasynth_security.Role",
|
|
object_id=str(role.pk),
|
|
action="update",
|
|
).exists()
|
|
|
|
def test_no_previous_state_does_not_log(self, role):
|
|
role.name = "Changed Without Snapshot"
|
|
role.save()
|
|
|
|
assert not ModelChangeLog.objects.filter(
|
|
model_label="infrasynth_security.Role",
|
|
object_id=str(role.pk),
|
|
action="update",
|
|
).exists()
|
|
|
|
|
|
class TestModelDeleteTracking:
|
|
def test_delete_logs_entry(self, role):
|
|
pk = role.pk
|
|
role.delete()
|
|
|
|
log = ModelChangeLog.objects.get(
|
|
model_label="infrasynth_security.Role",
|
|
object_id=str(pk),
|
|
action="delete",
|
|
)
|
|
assert log.action == "delete"
|
|
|
|
|
|
class TestConfiguration:
|
|
@override_settings(INFRASYNTH_AUDIT=audit_config(EXCLUDED_MODELS=["infrasynth_security.Role"]))
|
|
def test_excluded_model_not_logged(self, db):
|
|
Role.objects.create(name="Excluded", slug="excluded")
|
|
assert not ModelChangeLog.objects.filter(model_label="infrasynth_security.Role").exists()
|
|
|
|
@override_settings(INFRASYNTH_AUDIT=audit_config(EXCLUDED_FIELDS=["name", "slug"]))
|
|
def test_excluded_fields_not_in_changes(self, db):
|
|
Role.objects.create(name="Field", slug="field")
|
|
log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
|
|
assert "name" not in log.changes
|
|
assert "slug" not in log.changes
|
|
assert "is_system" in log.changes
|
|
|
|
@override_settings(INFRASYNTH_AUDIT=audit_config(ENABLE_MODEL_CHANGE_TRACKING=False))
|
|
def test_tracking_disabled(self, db):
|
|
Role.objects.create(name="No Track", slug="no-track")
|
|
assert not ModelChangeLog.objects.filter(model_label="infrasynth_security.Role").exists()
|
|
|
|
@override_settings(INFRASYNTH_AUDIT=audit_config(ENABLE_SECURITY_EVENTS=False))
|
|
def test_security_events_disabled(self, db):
|
|
security_event_occurred.send(
|
|
sender=Role,
|
|
event_type="test",
|
|
actor=None,
|
|
ip_address=None,
|
|
metadata={},
|
|
)
|
|
assert not SecurityEvent.objects.exists()
|
|
|
|
|
|
class TestSecurityEvents:
|
|
def test_security_event_creates_log(self, db, user):
|
|
security_event_occurred.send(
|
|
sender=Role,
|
|
event_type="login_failed",
|
|
actor=user,
|
|
ip_address="127.0.0.1",
|
|
metadata={"reason": "bad_password"},
|
|
)
|
|
event = SecurityEvent.objects.get(event_type="login_failed")
|
|
assert event.actor == user
|
|
assert event.ip_address == "127.0.0.1"
|
|
assert event.metadata == {"reason": "bad_password"}
|
|
assert event.request_id
|