ocmo-api 0.8.19__py3-none-any.whl

core/tests/test_audit_event_id.py

@@ -0,0 +1,90 @@
+"""Tests for audit event id prefix resolution."""
+
+from __future__ import annotations
+
+import uuid
+
+from django.test import TestCase
+
+from core.exceptions import NotFound
+from core.managers.audit import AuditManager
+from core.managers.auth import AuthManager
+from core.models import AuditEvent
+from core.tests.namespace_helpers import create_test_namespace
+
+
+def _admin_auth() -> AuthManager:
+    return AuthManager(
+        {"_type": "user", "sub": "admin-1", "email": "admin@example.com", "groups": "ocmo-global-admins"}
+    )
+
+
+class TestAuditEventIdResolution(TestCase):
+    def setUp(self) -> None:
+        AuditManager.unbind()
+        self.ns = create_test_namespace("audit-id-prefix")
+        self.event = AuditEvent.objects.create(
+            namespace_name=self.ns.name,
+            auth_id="user-1",
+            auth_type=AuditEvent.AUTH_TYPE_USER,
+            http_method="GET",
+            api_endpoint="/api/v1/test",
+            event_kind=AuditEvent.EVENT_KIND_OPERATION,
+            object_type="config",
+            object_id="app/cfg",
+            operation="Read config",
+        )
+
+    def tearDown(self) -> None:
+        AuditManager.unbind()
+
+    def test_resolve_event_id_accepts_full_uuid(self) -> None:
+        mgr = AuditManager(auth=_admin_auth(), namespace=self.ns)
+        resolved = mgr.resolve_event_id(str(self.event.id))
+        self.assertEqual(resolved, self.event.id)
+
+    def test_resolve_event_id_accepts_unique_prefix(self) -> None:
+        mgr = AuditManager(auth=_admin_auth(), namespace=self.ns)
+        prefix = str(self.event.id).replace("-", "")[:8]
+        resolved = mgr.resolve_event_id(prefix)
+        self.assertEqual(resolved, self.event.id)
+
+    def test_resolve_event_id_rejects_ambiguous_prefix(self) -> None:
+        AuditEvent.objects.create(
+            id=uuid.UUID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"),
+            namespace_name=self.ns.name,
+            auth_id="user-1",
+            auth_type=AuditEvent.AUTH_TYPE_USER,
+            http_method="GET",
+            api_endpoint="/api/v1/test",
+            event_kind=AuditEvent.EVENT_KIND_OPERATION,
+            object_type="config",
+            object_id="app/other",
+            operation="Read config",
+        )
+        AuditEvent.objects.create(
+            id=uuid.UUID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaab"),
+            namespace_name=self.ns.name,
+            auth_id="user-1",
+            auth_type=AuditEvent.AUTH_TYPE_USER,
+            http_method="GET",
+            api_endpoint="/api/v1/test",
+            event_kind=AuditEvent.EVENT_KIND_OPERATION,
+            object_type="config",
+            object_id="app/other2",
+            operation="Read config",
+        )
+
+        mgr = AuditManager(auth=_admin_auth(), namespace=self.ns)
+        with self.assertRaises(ValueError, msg="Ambiguous"):
+            mgr.resolve_event_id("aaaaaaaa")
+
+    def test_resolve_event_id_not_found(self) -> None:
+        mgr = AuditManager(auth=_admin_auth(), namespace=self.ns)
+        with self.assertRaises(NotFound):
+            mgr.resolve_event_id("deadbeef")
+
+    def test_resolve_event_id_rejects_short_prefix(self) -> None:
+        mgr = AuditManager(auth=_admin_auth(), namespace=self.ns)
+        with self.assertRaises(ValueError, msg="too short"):
+            mgr.resolve_event_id("abc")

core/tests/test_audit_operations.py

@@ -0,0 +1,222 @@
+"""Unit tests for audit operation label helpers."""
+
+from django.test import SimpleTestCase
+
+from core.constants.audit_operations import OP_PROPAGATE_CONFIG
+from core.managers.audit import AuditEventDraft
+from core.managers.audit.timeline import format_timeline_note, infer_operation
+from core.managers.tree import TreeManager
+from core.models import AuditEvent
+from core.shortcuts import is_version_number_ref, tag_subresource_from_ref
+
+
+class TestAuditOperations(SimpleTestCase):
+    def test_is_version_number_ref(self):
+        self.assertTrue(is_version_number_ref("11"))
+        self.assertFalse(is_version_number_ref("latest"))
+        self.assertFalse(is_version_number_ref("v11"))
+
+    def test_tag_subresource_from_ref(self):
+        self.assertEqual(tag_subresource_from_ref("latest"), ("tag", "latest"))
+        self.assertIsNone(tag_subresource_from_ref("3"))
+
+    def test_format_subresource_rejects_version(self):
+        with self.assertRaises(ValueError):
+            TreeManager.format_subresource(["version"], ["11"])
+
+    def test_infer_resolve_kinds(self):
+        draft = AuditEventDraft(event_kind=AuditEvent.EVENT_KIND_RESOLVE_REQUEST)
+        self.assertEqual(infer_operation(draft), "Resolve")
+        draft = AuditEventDraft(event_kind=AuditEvent.EVENT_KIND_RESOLVE_PARTICIPANT)
+        self.assertEqual(infer_operation(draft), "Referenced in resolve")
+
+    def test_infer_read_typed(self):
+        draft = AuditEventDraft(
+            event_kind=AuditEvent.EVENT_KIND_OPERATION,
+            http_method="GET",
+            api_endpoint="/api/v1/ns/qa/~get/app/cfg",
+            object_type="config",
+        )
+        self.assertEqual(infer_operation(draft), "Read config")
+
+    def test_infer_uses_explicit_operation(self):
+        draft = AuditEventDraft(operation="Set tag")
+        self.assertEqual(infer_operation(draft), "Set tag")
+
+    def test_format_timeline_note_resolve(self):
+        event = AuditEvent(
+            auth_id="user-1",
+            auth_email="bob@example.com",
+            auth_type=AuditEvent.AUTH_TYPE_USER,
+            http_method="POST",
+            api_endpoint="/api/v1/ns/qa/~resolve/app/cfg",
+            event_kind=AuditEvent.EVENT_KIND_RESOLVE_REQUEST,
+            object_type="config",
+            object_id="app/cfg",
+            operation="Resolve",
+        )
+        self.assertEqual(
+            format_timeline_note(event),
+            "User bob@example.com resolved this config",
+        )
+
+    def test_format_timeline_note_set_tag(self):
+        event = AuditEvent(
+            auth_id="user-1",
+            auth_email="admin@example.com",
+            auth_type=AuditEvent.AUTH_TYPE_USER,
+            http_method="POST",
+            api_endpoint="/api/v1/ns/qa/~tag/app/cfg",
+            event_kind=AuditEvent.EVENT_KIND_OPERATION,
+            object_type="config",
+            object_id="app/cfg",
+            operation="Set tag",
+            object_version=2,
+            subresource_type="tag",
+            subresource="tagme",
+        )
+        self.assertEqual(
+            format_timeline_note(event),
+            "User admin@example.com set tag `tagme` to version 2",
+        )
+
+    def test_format_timeline_note_update_item(self):
+        event = AuditEvent(
+            auth_id="user-1",
+            auth_email="admin@example.com",
+            auth_type=AuditEvent.AUTH_TYPE_USER,
+            http_method="PUT",
+            api_endpoint="/api/v1/ns/qa/~config/~update/app/cfg",
+            event_kind=AuditEvent.EVENT_KIND_OPERATION,
+            object_type="config",
+            object_id="app/cfg",
+            operation="Update item",
+            object_version=3,
+        )
+        self.assertEqual(
+            format_timeline_note(event),
+            "User admin@example.com created new version of config (3)",
+        )
+
+    def test_format_timeline_note_with_tag_and_error(self):
+        event = AuditEvent(
+            auth_id="user-1",
+            auth_email="alice@example.com",
+            auth_type=AuditEvent.AUTH_TYPE_USER,
+            http_method="POST",
+            api_endpoint="/api/v1/ns/qa/~tag/app/cfg",
+            event_kind=AuditEvent.EVENT_KIND_OPERATION,
+            object_type="config",
+            object_id="app/cfg",
+            operation="Set tag",
+            object_version=3,
+            subresource_type="tag",
+            subresource="stable",
+            error="tag already exists",
+        )
+        self.assertEqual(
+            format_timeline_note(event),
+            "User alice@example.com set tag `stable` to version 3 — tag already exists",
+        )
+
+    def test_format_timeline_note_resolver_actor(self):
+        event = AuditEvent(
+            auth_id="resolver/app/cfg",
+            auth_email=None,
+            auth_type=AuditEvent.AUTH_TYPE_RESOLVER,
+            http_method="PUT",
+            api_endpoint="/api/v1/ns/qa/~config/~update/app/cfg",
+            event_kind=AuditEvent.EVENT_KIND_OPERATION,
+            object_type="config",
+            object_id="app/cfg",
+            operation="Update item",
+            object_version=4,
+        )
+        self.assertEqual(
+            format_timeline_note(event),
+            "Resolver resolver/app/cfg created new version of config (4)",
+        )
+
+    def test_format_timeline_note_manual_propagation(self):
+        payload = '{"trigger":"manual","targets":[{"path":"env/dev","version":3},{"path":"env/staging","version":2}]}'
+        event = AuditEvent(
+            auth_id="user-1",
+            auth_email="admin@example.com",
+            auth_type=AuditEvent.AUTH_TYPE_USER,
+            http_method="POST",
+            api_endpoint="/api/v1/ns/qa/~propagate/proj/source",
+            event_kind=AuditEvent.EVENT_KIND_OPERATION,
+            object_type="config",
+            object_id="proj/source",
+            operation=OP_PROPAGATE_CONFIG,
+            object_version=5,
+            subresource_type="trigger",
+            subresource=payload,
+        )
+        self.assertEqual(
+            format_timeline_note(event),
+            "User admin@example.com manually propagated version 5 to `env/dev`@v3, `env/staging`@v2",
+        )
+
+    def test_format_timeline_note_tag_propagation(self):
+        payload = '{"trigger":"tag","trigger_tag":"stable","targets":[{"path":"env/dev","version":3}]}'
+        event = AuditEvent(
+            auth_id="user-1",
+            auth_email="admin@example.com",
+            auth_type=AuditEvent.AUTH_TYPE_USER,
+            http_method="POST",
+            api_endpoint="/api/v1/ns/qa/~tag/proj/source",
+            event_kind=AuditEvent.EVENT_KIND_OPERATION,
+            object_type="config",
+            object_id="proj/source",
+            operation=OP_PROPAGATE_CONFIG,
+            object_version=5,
+            subresource_type="trigger",
+            subresource=payload,
+        )
+        self.assertEqual(
+            format_timeline_note(event),
+            "User admin@example.com propagated by setting tag `stable` to version 5, creating `env/dev`@v3",
+        )
+
+    def test_format_timeline_note_legacy_propagation_trigger(self):
+        event = AuditEvent(
+            auth_id="user-1",
+            auth_email="admin@example.com",
+            auth_type=AuditEvent.AUTH_TYPE_USER,
+            http_method="POST",
+            api_endpoint="/api/v1/ns/qa/~propagate/proj/source",
+            event_kind=AuditEvent.EVENT_KIND_OPERATION,
+            object_type="config",
+            object_id="proj/source",
+            operation=OP_PROPAGATE_CONFIG,
+            object_version=5,
+            subresource_type="trigger",
+            subresource="manual",
+        )
+        self.assertEqual(
+            format_timeline_note(event),
+            "User admin@example.com manually propagated version 5",
+        )
+
+    def test_format_timeline_note_manual_propagation_all_unchanged(self):
+        payload = '{"trigger":"manual","unchanged":["env/dev","env/staging"]}'
+        event = AuditEvent(
+            auth_id="user-1",
+            auth_email="admin@example.com",
+            auth_type=AuditEvent.AUTH_TYPE_USER,
+            http_method="POST",
+            api_endpoint="/api/v1/ns/qa/~propagate/proj/source",
+            event_kind=AuditEvent.EVENT_KIND_OPERATION,
+            object_type="config",
+            object_id="proj/source",
+            operation=OP_PROPAGATE_CONFIG,
+            object_version=9,
+            subresource_type="trigger",
+            subresource=payload,
+        )
+        self.assertEqual(
+            format_timeline_note(event),
+            "User admin@example.com manually propagated version 9; "
+            "all targets already matched (`env/dev`, `env/staging`)",
+        )

core/tests/test_builtin_config_schemas.py

@@ -0,0 +1,174 @@
+"""Tests for builtin namespace config JSON Schemas."""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+import yaml
+from django.test import Client, TestCase, override_settings
+
+from core.constants.permission_actions import (
+    PERMISSION_ACTION_PATTERN,
+    PERMISSION_ACTIONS,
+)
+from core.constants.webhook_events import WEBHOOK_EVENTS, WEBHOOK_PAYLOAD_PRESETS
+from core.managers.tree import TreeManager
+from core.models import Namespace
+from core.utils.namespace_special_configs import (
+    init_namespace_special_configs,
+    sync_permissions_webhooks_schema_configs,
+)
+from core.utils.permissions_schema_document import build_permissions_schema_document
+
+_TEST_MASTER_KEY = "ZDPuvW6Hx/1UxDK7K/CydLouVKtJl24nbHyb2EkvTzs="
+
+_BUILTIN_SCHEMA_DIR = Path(__file__).resolve().parent.parent / "data" / "builtin_schemas"
+
+
+def _load_builtin_schema(name: str) -> dict:
+    if name == "_permissions.schema":
+        return build_permissions_schema_document()
+    return yaml.safe_load((_BUILTIN_SCHEMA_DIR / f"{name}.yaml").read_text(encoding="utf-8"))
+
+
+class BuiltinPermissionsSchemaTests(TestCase):
+    def test_actions_enum_matches_pattern_constant(self):
+        schema = _load_builtin_schema("_permissions.schema")
+        action_items = schema["properties"]["policies"]["items"]["properties"]["actions"]["items"]
+        enum_values = action_items["enum"]
+        pattern = re.compile(action_items["pattern"])
+
+        self.assertEqual(tuple(enum_values), PERMISSION_ACTIONS)
+        self.assertEqual(action_items["pattern"], PERMISSION_ACTION_PATTERN)
+        for value in enum_values:
+            self.assertRegex(value, pattern)
+
+    def test_actions_enum_excludes_invalid_resource_verb_pairs(self):
+        schema = _load_builtin_schema("_permissions.schema")
+        enum_values = set(schema["properties"]["policies"]["items"]["properties"]["actions"]["items"]["enum"])
+        for invalid in (
+            "resolver:tag",
+            "resolver:resolve",
+            "resolver:describe",
+            "lock:audit",
+            "lock:tag",
+            "lock:resolve",
+            "lock:describe",
+            "folder:read",
+            "template:resolve",
+        ):
+            self.assertNotIn(invalid, enum_values)
+        self.assertIn("template:read", enum_values)
+        self.assertIn("folder:audit", enum_values)
+
+    def test_uri_reference_markers(self):
+        schema = _load_builtin_schema("_permissions.schema")
+        policy_props = schema["properties"]["policies"]["items"]["properties"]
+
+        resolver_actor = policy_props["actors"]["items"]["oneOf"][1]["properties"]["path"]
+        self.assertEqual(resolver_actor["format"], "uri-reference")
+        self.assertEqual(resolver_actor["x-ocmo-uri-reference"], "resolver")
+
+        resource_items = policy_props["resources"]["items"]
+        self.assertEqual(resource_items["format"], "uri-reference")
+        self.assertEqual(resource_items["x-ocmo-uri-reference"], "resource")
+
+
+class BuiltinWebhooksSchemaTests(TestCase):
+    def test_events_enum_matches_runtime_events(self):
+        schema = _load_builtin_schema("_webhooks.schema")
+        event_items = schema["properties"]["webhooks"]["items"]["properties"]["events"]["items"]
+        self.assertEqual(tuple(event_items["enum"]), WEBHOOK_EVENTS)
+
+    def test_payload_presets_enum(self):
+        schema = _load_builtin_schema("_webhooks.schema")
+        preset = schema["properties"]["webhooks"]["items"]["properties"]["payload"]["properties"]["preset"]
+        self.assertEqual(tuple(preset["enum"]), WEBHOOK_PAYLOAD_PRESETS)
+
+
+@override_settings(OCMO_MASTER_KEY=_TEST_MASTER_KEY)
+class BuiltinSchemaApiTests(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        cls.ns = Namespace.objects.create(name="builtin-schema-api", description="test")
+        init_namespace_special_configs(cls.ns)
+        cls.client = Client()
+
+    def test_permissions_schema_endpoint_includes_action_enum(self):
+        response = self.client.get(f"/api/v1/ns/{self.ns.name}/~config-schema/_permissions")
+        self.assertEqual(response.status_code, 200, response.content)
+        data = response.json()
+        actions = data["properties"]["policies"]["items"]["properties"]["actions"]["items"]
+        self.assertIn("config:read", actions["enum"])
+        self.assertIn("lock:read", actions["enum"])
+        self.assertIn("lock:write", actions["enum"])
+        self.assertIn("lock:delete", actions["enum"])
+        self.assertIn("*:audit", actions["enum"])
+        self.assertIn("*:*", actions["enum"])
+        self.assertNotIn("lock:tag", actions["enum"])
+        self.assertNotIn("resolver:tag", actions["enum"])
+        self.assertEqual(
+            data["properties"]["policies"]["items"]["properties"]["resources"]["items"]["format"],
+            "uri-reference",
+        )
+
+    def test_permissions_schema_endpoint_patches_stale_db_enum(self):
+        stale_schema = build_permissions_schema_document()
+        stale_actions = stale_schema["properties"]["policies"]["items"]["properties"]["actions"]["items"]
+        stale_actions["enum"] = list(stale_actions["enum"]) + ["lock:tag", "resolver:tag"]
+        TreeManager(self.ns, "_permissions.schema", auth=None).update_item(
+            yaml.safe_dump(stale_schema, sort_keys=False)
+        )
+
+        response = self.client.get(f"/api/v1/ns/{self.ns.name}/~config-schema/_permissions")
+        self.assertEqual(response.status_code, 200, response.content)
+        enum_values = response.json()["properties"]["policies"]["items"]["properties"]["actions"]["items"]["enum"]
+        self.assertEqual(tuple(enum_values), PERMISSION_ACTIONS)
+
+    def test_webhooks_schema_endpoint_includes_event_enum(self):
+        response = self.client.get(f"/api/v1/ns/{self.ns.name}/~config-schema/_webhooks")
+        self.assertEqual(response.status_code, 200, response.content)
+        data = response.json()
+        events = data["properties"]["webhooks"]["items"]["properties"]["events"]["items"]
+        self.assertIn("config.created", events["enum"])
+        self.assertIn("propagation.triggered", events["enum"])
+
+    def test_fresh_namespace_has_updated_builtin_schemas(self):
+        ns = Namespace.objects.create(name="schema-fresh-ns", description="schema test")
+        init_namespace_special_configs(ns)
+        schema_mgr = TreeManager(ns, "_permissions.schema", auth=None)
+        _, body = schema_mgr.load_config_version_document("latest")
+        actions = body["properties"]["policies"]["items"]["properties"]["actions"]["items"]
+        self.assertGreaterEqual(len(actions["enum"]), 35)
+        self.assertIn("lock:read", actions["enum"])
+        self.assertIn("lock:write", actions["enum"])
+        self.assertIn("lock:delete", actions["enum"])
+
+    def test_sync_updates_stale_permissions_and_webhooks_schemas(self):
+        ns = Namespace.objects.create(name="schema-sync-ns", description="sync test")
+        init_namespace_special_configs(ns)
+
+        stale_permissions_schema = """\
+_ocmo:
+  is_json_schema: true
+type: object
+properties:
+  policies:
+    type: array
+"""
+        TreeManager(ns, "_permissions.schema", auth=None).update_item(stale_permissions_schema)
+
+        updated = sync_permissions_webhooks_schema_configs(ns)
+        self.assertEqual(updated, ["_permissions.schema"])
+
+        response = self.client.get(f"/api/v1/ns/{ns.name}/~config-schema/_permissions")
+        self.assertEqual(response.status_code, 200, response.content)
+        actions = response.json()["properties"]["policies"]["items"]["properties"]["actions"]["items"]
+        self.assertIn("lock:read", actions["enum"])
+        self.assertIn("lock:write", actions["enum"])
+        self.assertIn("lock:delete", actions["enum"])
+        self.assertIn("*:*", actions["enum"])
+
+        # Idempotent: packaged content already applied.
+        self.assertEqual(sync_permissions_webhooks_schema_configs(ns), [])