|
| 1 | +#!/usr/bin/env python3 |
| 2 | +# Copyright 2024 Canonical Ltd. |
| 3 | +# See LICENSE file for licensing details. |
| 4 | +import asyncio |
| 5 | +import logging |
| 6 | + |
| 7 | +import psycopg2 as psycopg2 |
| 8 | +import pytest as pytest |
| 9 | +from pytest_operator.plugin import OpsTest |
| 10 | +from tenacity import Retrying, stop_after_delay, wait_fixed |
| 11 | + |
| 12 | +from .helpers import ( |
| 13 | + APPLICATION_NAME, |
| 14 | + DATABASE_APP_NAME, |
| 15 | + build_and_deploy, |
| 16 | + run_command_on_unit, |
| 17 | +) |
| 18 | +from .new_relations.helpers import build_connection_string |
| 19 | + |
| 20 | +logger = logging.getLogger(__name__) |
| 21 | + |
| 22 | +RELATION_ENDPOINT = "database" |
| 23 | + |
| 24 | + |
| 25 | +@pytest.mark.group(1) |
| 26 | +@pytest.mark.abort_on_fail |
| 27 | +async def test_audit_plugin(ops_test: OpsTest) -> None: |
| 28 | + """Test the audit plugin.""" |
| 29 | + await asyncio.gather(build_and_deploy(ops_test, 1), ops_test.model.deploy(APPLICATION_NAME)) |
| 30 | + await ops_test.model.relate(f"{APPLICATION_NAME}:{RELATION_ENDPOINT}", DATABASE_APP_NAME) |
| 31 | + async with ops_test.fast_forward(): |
| 32 | + await ops_test.model.wait_for_idle( |
| 33 | + apps=[APPLICATION_NAME, DATABASE_APP_NAME], status="active" |
| 34 | + ) |
| 35 | + |
| 36 | + logger.info("Checking that the audit plugin is enabled") |
| 37 | + connection_string = await build_connection_string( |
| 38 | + ops_test, APPLICATION_NAME, RELATION_ENDPOINT |
| 39 | + ) |
| 40 | + connection = None |
| 41 | + try: |
| 42 | + connection = psycopg2.connect(connection_string) |
| 43 | + with connection.cursor() as cursor: |
| 44 | + cursor.execute("CREATE TABLE test2(value TEXT);") |
| 45 | + cursor.execute("GRANT SELECT ON test2 TO PUBLIC;") |
| 46 | + cursor.execute("SET TIME ZONE 'Europe/Rome';") |
| 47 | + finally: |
| 48 | + if connection is not None: |
| 49 | + connection.close() |
| 50 | + unit_name = f"{DATABASE_APP_NAME}/0" |
| 51 | + for attempt in Retrying(stop=stop_after_delay(90), wait=wait_fixed(10), reraise=True): |
| 52 | + with attempt: |
| 53 | + try: |
| 54 | + logs = await run_command_on_unit( |
| 55 | + ops_test, |
| 56 | + unit_name, |
| 57 | + "grep AUDIT /var/log/postgresql/postgresql-*.log", |
| 58 | + ) |
| 59 | + assert "MISC,BEGIN,,,BEGIN" in logs |
| 60 | + assert ( |
| 61 | + "DDL,CREATE TABLE,TABLE,public.test2,CREATE TABLE test2(value TEXT);" in logs |
| 62 | + ) |
| 63 | + assert "ROLE,GRANT,TABLE,,GRANT SELECT ON test2 TO PUBLIC;" in logs |
| 64 | + assert "MISC,SET,,,SET TIME ZONE 'Europe/Rome';" in logs |
| 65 | + except Exception: |
| 66 | + assert False, "Audit logs were not found when the plugin is enabled." |
| 67 | + |
| 68 | + logger.info("Disabling the audit plugin") |
| 69 | + await ops_test.model.applications[DATABASE_APP_NAME].set_config({ |
| 70 | + "plugin_audit_enable": "False" |
| 71 | + }) |
| 72 | + await ops_test.model.wait_for_idle(apps=[DATABASE_APP_NAME], status="active") |
| 73 | + |
| 74 | + logger.info("Removing the previous logs") |
| 75 | + await run_command_on_unit(ops_test, unit_name, "rm /var/log/postgresql/postgresql-*.log") |
| 76 | + |
| 77 | + logger.info("Checking that the audit plugin is disabled") |
| 78 | + try: |
| 79 | + connection = psycopg2.connect(connection_string) |
| 80 | + with connection.cursor() as cursor: |
| 81 | + cursor.execute("CREATE TABLE test1(value TEXT);") |
| 82 | + cursor.execute("GRANT SELECT ON test1 TO PUBLIC;") |
| 83 | + cursor.execute("SET TIME ZONE 'Europe/Rome';") |
| 84 | + finally: |
| 85 | + if connection is not None: |
| 86 | + connection.close() |
| 87 | + try: |
| 88 | + logs = await run_command_on_unit( |
| 89 | + ops_test, |
| 90 | + unit_name, |
| 91 | + "grep AUDIT /var/log/postgresql/postgresql-*.log", |
| 92 | + ) |
| 93 | + except Exception: |
| 94 | + pass |
| 95 | + else: |
| 96 | + logger.info(f"Logs: {logs}") |
| 97 | + assert False, "Audit logs were found when the plugin is disabled." |
0 commit comments