@ngocsangairvds/vsaf 4.0.6 → 4.0.8

package/skills/vds-skill/vds-scripts/elastic_orchestrator/tests/test_config.py

@@ -0,0 +1,268 @@
+"""Tests for Elasticsearch configuration module.
+
+Tests cover:
+- Settings loading from environment variables
+- Settings loading from .env files
+- SecretStr handling for passwords
+- Validation of required fields
+- Default values for optional fields
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+
+from vds_elastic_orchestrator.config import (
+    DEFAULT_ENV_PATHS,
+    ElasticSettings,
+    SettingsError,
+    load_settings,
+)
+
+
+class TestElasticSettings:
+    """Tests for ElasticSettings model."""
+
+    def test_required_fields_from_env(self):
+        """Test loading required fields from environment variables."""
+        env = {
+            "VDS_ELASTIC_KIBANA_URL": "log.digital.vn",
+            "VDS_ELASTIC_KIBANA_IP": "10.207.56.26",
+            "VDS_ELASTIC_USER": "testuser",
+            "VDS_ELASTIC_PASSWORD": "testpass",
+        }
+        with patch.dict(os.environ, env, clear=False):
+            settings = ElasticSettings()
+            assert settings.kibana_url == "log.digital.vn"
+            assert settings.kibana_ip == "10.207.56.26"
+            assert settings.user == "testuser"
+            assert settings.password == "testpass"
+
+    def test_password_secret_str(self):
+        """Test that password is stored as SecretStr."""
+        env = {
+            "VDS_ELASTIC_KIBANA_URL": "log.digital.vn",
+            "VDS_ELASTIC_KIBANA_IP": "10.207.56.26",
+            "VDS_ELASTIC_USER": "testuser",
+            "VDS_ELASTIC_PASSWORD": "secret123",
+        }
+        with patch.dict(os.environ, env, clear=False):
+            settings = ElasticSettings()
+            # SecretStr should not reveal value in str representation
+            assert "secret123" not in str(settings.password_secret)
+            assert "secret123" not in repr(settings.password_secret)
+            # But get_secret_value() should return actual value
+            assert settings.password_secret.get_secret_value() == "secret123"
+            # Property wrapper should also work
+            assert settings.password == "secret123"
+
+    def test_default_values(self):
+        """Test default values for optional fields."""
+        env = {
+            "VDS_ELASTIC_KIBANA_URL": "log.digital.vn",
+            "VDS_ELASTIC_KIBANA_IP": "10.207.56.26",
+            "VDS_ELASTIC_USER": "testuser",
+            "VDS_ELASTIC_PASSWORD": "testpass",
+        }
+        with patch.dict(os.environ, env, clear=False):
+            settings = ElasticSettings()
+            # Check defaults
+            assert settings.connect_timeout == 10.0
+            assert settings.request_timeout == 30.0
+            assert settings.max_retries == 3
+            assert settings.retry_backoff == 1.0
+            assert settings.verify_certs is False
+            assert settings.default_index == "*"
+            assert settings.default_time_field == "@timestamp"
+            assert settings.default_size == 10
+
+    def test_custom_timeout_values(self):
+        """Test overriding default timeout values via overrides dict."""
+        env = {
+            "VDS_ELASTIC_KIBANA_URL": "log.digital.vn",
+            "VDS_ELASTIC_KIBANA_IP": "10.207.56.26",
+            "VDS_ELASTIC_USER": "testuser",
+            "VDS_ELASTIC_PASSWORD": "testpass",
+        }
+        with patch.dict(os.environ, env, clear=False):
+            # Use overrides to set timeout values (avoids load_shared_env env-var clobbering)
+            overrides = {
+                "connect_timeout": 5.0,
+                "request_timeout": 60.0,
+                "max_retries": 5,
+                "retry_backoff": 2.0,
+            }
+            settings = load_settings(overrides=overrides)
+            assert settings.connect_timeout == 5.0
+            assert settings.request_timeout == 60.0
+            assert settings.max_retries == 5
+            assert settings.retry_backoff == 2.0
+
+    def test_base_url_property(self):
+        """Test base_url property generation."""
+        env = {
+            "VDS_ELASTIC_KIBANA_URL": "log.digital.vn",
+            "VDS_ELASTIC_KIBANA_IP": "10.207.56.26",
+            "VDS_ELASTIC_USER": "testuser",
+            "VDS_ELASTIC_PASSWORD": "testpass",
+        }
+        with patch.dict(os.environ, env, clear=False):
+            settings = ElasticSettings()
+            assert settings.base_url == "https://10.207.56.26"
+
+    def test_proxy_endpoint_property(self):
+        """Test proxy_endpoint property."""
+        env = {
+            "VDS_ELASTIC_KIBANA_URL": "log.digital.vn",
+            "VDS_ELASTIC_KIBANA_IP": "10.207.56.26",
+            "VDS_ELASTIC_USER": "testuser",
+            "VDS_ELASTIC_PASSWORD": "testpass",
+        }
+        with patch.dict(os.environ, env, clear=False):
+            settings = ElasticSettings()
+            assert settings.proxy_endpoint == "/api/console/proxy"
+
+    def test_require_credentials_success(self):
+        """Test require_credentials passes when credentials present."""
+        env = {
+            "VDS_ELASTIC_KIBANA_URL": "log.digital.vn",
+            "VDS_ELASTIC_KIBANA_IP": "10.207.56.26",
+            "VDS_ELASTIC_USER": "testuser",
+            "VDS_ELASTIC_PASSWORD": "testpass",
+        }
+        with patch.dict(os.environ, env, clear=False):
+            settings = ElasticSettings()
+            # Should not raise
+            settings.require_credentials()
+
+    def test_require_credentials_missing_user(self):
+        """Test require_credentials fails when user is missing."""
+        env = {
+            "VDS_ELASTIC_KIBANA_URL": "log.digital.vn",
+            "VDS_ELASTIC_KIBANA_IP": "10.207.56.26",
+            "VDS_ELASTIC_USER": "",
+            "VDS_ELASTIC_PASSWORD": "testpass",
+        }
+        with patch.dict(os.environ, env, clear=False):
+            settings = ElasticSettings()
+            with pytest.raises(ValueError, match="Missing VDS_ELASTIC_USER"):
+                settings.require_credentials()
+
+
+class TestLoadSettings:
+    """Tests for load_settings factory function."""
+
+    def test_load_from_env(self):
+        """Test loading settings from environment variables."""
+        env = {
+            "VDS_ELASTIC_KIBANA_URL": "log.digital.vn",
+            "VDS_ELASTIC_KIBANA_IP": "10.207.56.26",
+            "VDS_ELASTIC_USER": "testuser",
+            "VDS_ELASTIC_PASSWORD": "testpass",
+        }
+        with patch.dict(os.environ, env, clear=False):
+            settings = load_settings()
+            assert settings.kibana_url == "log.digital.vn"
+            assert settings.user == "testuser"
+
+    def test_load_from_env_file(self, tmp_path):
+        """Test loading settings from a custom .env file."""
+        env_file = tmp_path / ".env"
+        env_file.write_text(
+            """
+VDS_ELASTIC_KIBANA_URL=custom.host.com
+VDS_ELASTIC_KIBANA_IP=192.168.1.1
+VDS_ELASTIC_USER=fileuser
+VDS_ELASTIC_PASSWORD=filepass
+"""
+        )
+
+        # Clear env vars to ensure file is used
+        with patch.dict(os.environ, {}, clear=True):
+            settings = load_settings(env_path=env_file)
+            assert settings.kibana_url == "custom.host.com"
+            assert settings.kibana_ip == "192.168.1.1"
+            assert settings.user == "fileuser"
+            assert settings.password == "filepass"
+
+    def test_env_overrides_file(self, tmp_path):
+        """Test that env vars override .env file values."""
+        env_file = tmp_path / ".env"
+        env_file.write_text(
+            """
+VDS_ELASTIC_KIBANA_URL=file.host.com
+VDS_ELASTIC_KIBANA_IP=10.0.0.1
+VDS_ELASTIC_USER=fileuser
+VDS_ELASTIC_PASSWORD=filepass
+"""
+        )
+
+        env = {
+            "VDS_ELASTIC_USER": "envuser",
+        }
+        with patch.dict(os.environ, env, clear=True):
+            settings = load_settings(env_path=env_file)
+            # Env var should override
+            assert settings.user == "envuser"
+            # File values should be used for others
+            assert settings.kibana_url == "file.host.com"
+            assert settings.password == "filepass"
+
+    def test_load_with_overrides(self):
+        """Test loading settings with explicit overrides."""
+        env = {
+            "VDS_ELASTIC_KIBANA_URL": "log.digital.vn",
+            "VDS_ELASTIC_KIBANA_IP": "10.207.56.26",
+            "VDS_ELASTIC_USER": "testuser",
+            "VDS_ELASTIC_PASSWORD": "testpass",
+        }
+        with patch.dict(os.environ, env, clear=False):
+            settings = load_settings(overrides={"default_size": 100})
+            assert settings.default_size == 100
+
+    def test_strict_mode_success(self):
+        """Test strict mode with valid credentials."""
+        env = {
+            "VDS_ELASTIC_KIBANA_URL": "log.digital.vn",
+            "VDS_ELASTIC_KIBANA_IP": "10.207.56.26",
+            "VDS_ELASTIC_USER": "testuser",
+            "VDS_ELASTIC_PASSWORD": "testpass",
+        }
+        with patch.dict(os.environ, env, clear=False):
+            # Should not raise
+            settings = load_settings(strict=True)
+            assert settings.user == "testuser"
+
+    def test_strict_mode_missing_credentials(self):
+        """Test strict mode fails when credentials are missing."""
+        env = {
+            "VDS_ELASTIC_KIBANA_URL": "log.digital.vn",
+            "VDS_ELASTIC_KIBANA_IP": "10.207.56.26",
+            "VDS_ELASTIC_USER": "",
+            "VDS_ELASTIC_PASSWORD": "testpass",
+        }
+        with patch.dict(os.environ, env, clear=False), pytest.raises(SettingsError):
+            load_settings(strict=True)
+
+    def test_validation_error_handling(self, tmp_path):
+        """Test that validation errors are wrapped in SettingsError."""
+        # Missing required fields should raise SettingsError
+        # Use a non-existent env file to avoid reading from real ~/.vds/.env
+        fake_env = tmp_path / "nonexistent.env"
+        with patch.dict(os.environ, {}, clear=True), pytest.raises(SettingsError):
+            load_settings(env_path=fake_env)
+
+
+class TestDefaultEnvPaths:
+    """Tests for DEFAULT_ENV_PATHS constant."""
+
+    def test_default_paths_exist(self):
+        """Test that DEFAULT_ENV_PATHS is defined correctly."""
+        # platform_core.env defines a single-path tuple:
+        # DEFAULT_ENV_PATHS = (_vds_env_path(),)
+        assert len(DEFAULT_ENV_PATHS) == 1
+        assert DEFAULT_ENV_PATHS[0] == Path.home() / ".vds" / ".env"

package/skills/vds-skill/vds-scripts/elastic_orchestrator/tests/test_e2e_verification.py

@@ -0,0 +1,272 @@
+"""End-to-end verification tests for VDS Elastic Orchestrator.
+
+These tests require access to the VDS internal network and valid credentials.
+They are gated by the VDS_ELASTIC_E2E_TESTS environment variable.
+
+To run these tests:
+    VDS_ELASTIC_E2E_TESTS=1 uv run pytest tests/test_e2e_verification.py -v
+
+Required environment variables:
+    - VDS_ELASTIC_E2E_TESTS=1 (to enable these tests)
+    - VDS_ELASTIC_KIBANA_URL
+    - VDS_ELASTIC_KIBANA_IP
+    - VDS_ELASTIC_USER
+    - VDS_ELASTIC_PASSWORD
+"""
+
+from __future__ import annotations
+
+import os
+
+import pytest
+
+from vds_elastic_orchestrator.client import KibanaElasticsearchClient
+from vds_elastic_orchestrator.config import load_settings
+from vds_elastic_orchestrator.errors import ClientPermissionError
+
+# Skip all tests if VDS_ELASTIC_E2E_TESTS is not set
+pytestmark = pytest.mark.skipif(
+    not os.getenv("VDS_ELASTIC_E2E_TESTS"),
+    reason="E2E tests require VDS_ELASTIC_E2E_TESTS=1 and VDS network access",
+)
+
+
+@pytest.fixture(scope="module")
+def settings():
+    """Load settings from environment."""
+    return load_settings(strict=True)
+
+
+@pytest.fixture(scope="module")
+def client(settings):
+    """Create and yield a client instance."""
+    with KibanaElasticsearchClient(settings) as client:
+        yield client
+
+
+class TestConnectivity:
+    """Test basic connectivity to Elasticsearch via Kibana."""
+
+    def test_ping_succeeds(self, client: KibanaElasticsearchClient) -> None:
+        """Test that ping returns True when connected."""
+        result = client.ping()
+        assert result is True, "Ping should succeed when connected to VDS network"
+
+    def test_kibana_status_returns_status(self, client: KibanaElasticsearchClient) -> None:
+        """Test Kibana status endpoint returns valid response."""
+        result = client.kibana_status()
+
+        # Should not have error
+        assert "error" not in result or result.get("error") is None
+
+        # Should have status information
+        assert "name" in result or "version" in result or "status" in result
+
+    def test_user_info_returns_current_user(self, client: KibanaElasticsearchClient) -> None:
+        """Test user info returns authenticated user details."""
+        result = client.user_info()
+
+        # Should not have error
+        assert "error" not in result or result.get("error") is None
+
+        # Should have username
+        assert "username" in result, "user_info should return username"
+
+        # Should have roles
+        assert "roles" in result, "user_info should return roles"
+        assert isinstance(result["roles"], list), "roles should be a list"
+
+
+class TestSearchOperations:
+    """Test search and count operations."""
+
+    def test_search_returns_results(self, client: KibanaElasticsearchClient) -> None:
+        """Test basic search returns valid response structure."""
+        result = client.search(index="*", size=1)
+
+        # Should have hits structure
+        assert "hits" in result, "Search should return hits"
+        assert "total" in result["hits"], "Search should return total count"
+        assert "hits" in result["hits"], "Search should return hits array"
+
+    def test_search_with_match_all_query(self, client: KibanaElasticsearchClient) -> None:
+        """Test search with explicit match_all query."""
+        result = client.search(
+            index="*",
+            query={"match_all": {}},
+            size=5,
+        )
+
+        assert "hits" in result
+        hits = result["hits"]["hits"]
+        assert isinstance(hits, list)
+        # We expect some documents to exist
+        assert len(hits) <= 5
+
+    def test_search_with_size_zero(self, client: KibanaElasticsearchClient) -> None:
+        """Test search with size=0 returns only count."""
+        result = client.search(index="*", size=0)
+
+        assert "hits" in result
+        # Should have total count
+        total = result["hits"]["total"]
+        if isinstance(total, dict):
+            assert total.get("value", 0) >= 0
+        else:
+            assert total >= 0
+
+        # Should have empty hits array
+        assert result["hits"]["hits"] == []
+
+    def test_count_returns_count(self, client: KibanaElasticsearchClient) -> None:
+        """Test count returns document count."""
+        result = client.count(index="*")
+
+        assert "count" in result, "Count should return count field"
+        assert isinstance(result["count"], int), "Count should be an integer"
+        assert result["count"] >= 0, "Count should be non-negative"
+
+    def test_count_with_query(self, client: KibanaElasticsearchClient) -> None:
+        """Test count with a query returns filtered count."""
+        # Count all documents
+        total = client.count(index="*")
+
+        # Count with match_all (should be same)
+        with_query = client.count(index="*", query={"match_all": {}})
+
+        assert with_query["count"] == total["count"]
+
+
+class TestAdminOperations:
+    """Test admin operations that may fail with permission errors."""
+
+    def test_info_or_permission_denied(self, client: KibanaElasticsearchClient) -> None:
+        """Test cluster info returns data or permission error."""
+        try:
+            result = client.info()
+            # If we get here, user has monitor privilege
+            assert "cluster_name" in result or "version" in result
+        except ClientPermissionError as exc:
+            # Expected for viewer role
+            assert "Permission denied" in str(exc)
+            assert exc.required_roles is not None
+
+    def test_health_or_permission_denied(self, client: KibanaElasticsearchClient) -> None:
+        """Test cluster health returns data or permission error."""
+        try:
+            result = client.health()
+            # If we get here, user has monitor privilege
+            assert "status" in result  # green, yellow, red
+            assert "cluster_name" in result
+        except ClientPermissionError as exc:
+            # Expected for viewer role
+            assert "Permission denied" in str(exc)
+
+    def test_cat_indices_or_permission_denied(self, client: KibanaElasticsearchClient) -> None:
+        """Test cat indices returns data or permission error."""
+        try:
+            result = client.cat_indices(pattern="*")
+            # If we get here, user has monitor privilege
+            assert isinstance(result, list)
+        except ClientPermissionError as exc:
+            # Expected for viewer role
+            assert "Permission denied" in str(exc)
+
+
+class TestRetryBehavior:
+    """Test retry behavior with real network conditions."""
+
+    def test_retry_on_success(self, client: KibanaElasticsearchClient) -> None:
+        """Test that successful requests don't trigger retries."""
+        # A simple successful request should complete without issues
+        result = client.ping()
+        assert result is True
+
+    def test_timeout_configuration(self, settings) -> None:
+        """Test that timeout settings are properly configured."""
+        assert settings.connect_timeout > 0
+        assert settings.request_timeout > 0
+        assert settings.max_retries >= 1
+
+
+class TestSettingsLoading:
+    """Test settings load correctly from environment."""
+
+    def test_settings_have_required_fields(self, settings) -> None:
+        """Test all required settings are loaded."""
+        assert settings.kibana_url is not None
+        assert settings.kibana_ip is not None
+        assert settings.user is not None
+        assert settings.password is not None
+
+    def test_proxy_endpoint_is_valid(self, settings) -> None:
+        """Test proxy endpoint is constructed correctly."""
+        expected = "/api/console/proxy"
+        assert settings.proxy_endpoint == expected
+
+
+class TestClientContextManager:
+    """Test client context manager behavior."""
+
+    def test_context_manager_opens_and_closes(self, settings) -> None:
+        """Test context manager properly manages client lifecycle."""
+        with KibanaElasticsearchClient(settings) as client:
+            # Client should be usable
+            assert client.ping() is True
+
+        # After exit, client should be closed
+        assert client._client is None
+
+    def test_multiple_requests_reuse_connection(self, settings) -> None:
+        """Test connection pooling is working."""
+        with KibanaElasticsearchClient(settings) as client:
+            # Make multiple requests
+            client.ping()
+            client.kibana_status()
+            client.user_info()
+
+            # Should still have the same client instance
+            assert client._client is not None
+
+
+# Smoke test for manual verification
+def test_smoke_test_manual_verification(client: KibanaElasticsearchClient) -> None:
+    """Manual smoke test that prints results for verification.
+
+    This test is useful for manual debugging and verification.
+    Run with: VDS_ELASTIC_E2E_TESTS=1 uv run pytest tests/test_e2e_verification.py::test_smoke_test_manual_verification -v -s
+    """
+    print("\n" + "=" * 60)
+    print("VDS Elastic Orchestrator - E2E Smoke Test")
+    print("=" * 60)
+
+    # Ping
+    ping_result = client.ping()
+    print(f"\n✓ Ping: {'SUCCESS' if ping_result else 'FAILED'}")
+
+    # User info
+    user_info = client.user_info()
+    if "username" in user_info:
+        print(f"✓ User: {user_info['username']}")
+        print(f"  Roles: {', '.join(user_info.get('roles', []))}")
+
+    # Count
+    count_result = client.count(index="*")
+    if "count" in count_result:
+        print(f"✓ Total documents: {count_result['count']:,}")
+
+    # Search
+    search_result = client.search(index="*", size=1)
+    if "hits" in search_result:
+        total = search_result["hits"]["total"]
+        total_value = total.get("value", total) if isinstance(total, dict) else total
+        print(f"✓ Search (size=1): {total_value:,} total hits")
+
+    # Kibana status
+    kibana_status = client.kibana_status()
+    if "name" in kibana_status:
+        print(f"✓ Kibana: {kibana_status.get('name', 'OK')}")
+
+    print("\n" + "=" * 60)
+    print("All smoke tests passed!")
+    print("=" * 60 + "\n")

package/skills/vds-skill/vds-scripts/elastic_orchestrator/tests/test_errors.py

@@ -0,0 +1,78 @@
+"""Tests for vds_elastic_orchestrator error re-exports from vds_platform_core."""
+
+from __future__ import annotations
+
+from vds_platform_core.errors import (
+    AuthError as PlatformAuthError,
+)
+from vds_platform_core.errors import (
+    ClientPermissionError as PlatformPermissionError,
+)
+from vds_platform_core.errors import (
+    ClientTimeoutError as PlatformTimeoutError,
+)
+from vds_platform_core.errors import (
+    NotFoundError as PlatformNotFoundError,
+)
+from vds_platform_core.errors import (
+    RateLimitError as PlatformRateLimitError,
+)
+from vds_platform_core.errors import (
+    ResponseError as PlatformResponseError,
+)
+from vds_platform_core.errors import (
+    RetryError as PlatformRetryError,
+)
+from vds_platform_core.errors import (
+    TransportError as PlatformTransportError,
+)
+from vds_platform_core.errors import (
+    VDSClientError as PlatformVDSClientError,
+)
+
+from vds_elastic_orchestrator.errors import (
+    SERVICE_NAME,
+    AuthError,
+    ClientPermissionError,
+    ClientTimeoutError,
+    NotFoundError,
+    RateLimitError,
+    ResponseError,
+    RetryError,
+    TransportError,
+    VDSClientError,
+)
+
+
+def test_service_name() -> None:
+    assert SERVICE_NAME == "elastic"
+
+
+def test_re_exports_are_platform_core_classes() -> None:
+    assert AuthError is PlatformAuthError
+    assert VDSClientError is PlatformVDSClientError
+    assert RateLimitError is PlatformRateLimitError
+    assert NotFoundError is PlatformNotFoundError
+    assert ResponseError is PlatformResponseError
+    assert RetryError is PlatformRetryError
+    assert TransportError is PlatformTransportError
+    assert ClientPermissionError is PlatformPermissionError
+    assert ClientTimeoutError is PlatformTimeoutError
+
+
+def test_errors_are_catchable_as_vds_client_error() -> None:
+    errors = [AuthError("auth"), RateLimitError("rate"), NotFoundError("nf")]
+    for error in errors:
+        assert isinstance(error, VDSClientError)
+        assert isinstance(error, RuntimeError)
+
+
+def test_timeout_inherits_transport() -> None:
+    assert issubclass(ClientTimeoutError, TransportError)
+    assert issubclass(TransportError, VDSClientError)
+
+
+def test_error_instantiation_with_context() -> None:
+    error = VDSClientError("test", context={"service": "elastic"})
+    assert error.context == {"service": "elastic"}
+    assert "test" in str(error)