|
| 1 | +#!/usr/bin/env python3 |
| 2 | +# Copyright 2024 Canonical Ltd. |
| 3 | +# See LICENSE file for licensing details. |
| 4 | +import asyncio |
| 5 | +import logging |
| 6 | + |
| 7 | +import psycopg2 as psycopg2 |
| 8 | +import pytest as pytest |
| 9 | +from pytest_operator.plugin import OpsTest |
| 10 | +from tenacity import Retrying, stop_after_delay, wait_fixed |
| 11 | + |
| 12 | +from .helpers import ( |
| 13 | + APPLICATION_NAME, |
| 14 | + DATABASE_APP_NAME, |
| 15 | + run_command_on_unit, |
| 16 | +) |
| 17 | +from .new_relations.helpers import build_connection_string |
| 18 | + |
| 19 | +logger = logging.getLogger(__name__) |
| 20 | + |
| 21 | +RELATION_ENDPOINT = "database" |
| 22 | + |
| 23 | + |
| 24 | +@pytest.mark.group(1) |
| 25 | +@pytest.mark.abort_on_fail |
| 26 | +async def test_audit_plugin(ops_test: OpsTest, charm) -> None: |
| 27 | + """Test the audit plugin.""" |
| 28 | + await asyncio.gather( |
| 29 | + ops_test.model.deploy(charm, config={"profile": "testing"}), |
| 30 | + ops_test.model.deploy(APPLICATION_NAME), |
| 31 | + ) |
| 32 | + await ops_test.model.relate(f"{APPLICATION_NAME}:{RELATION_ENDPOINT}", DATABASE_APP_NAME) |
| 33 | + async with ops_test.fast_forward(): |
| 34 | + await ops_test.model.wait_for_idle( |
| 35 | + apps=[APPLICATION_NAME, DATABASE_APP_NAME], status="active" |
| 36 | + ) |
| 37 | + |
| 38 | + logger.info("Checking that the audit plugin is enabled") |
| 39 | + connection_string = await build_connection_string( |
| 40 | + ops_test, APPLICATION_NAME, RELATION_ENDPOINT |
| 41 | + ) |
| 42 | + connection = None |
| 43 | + try: |
| 44 | + connection = psycopg2.connect(connection_string) |
| 45 | + with connection.cursor() as cursor: |
| 46 | + cursor.execute("CREATE TABLE test2(value TEXT);") |
| 47 | + cursor.execute("GRANT SELECT ON test2 TO PUBLIC;") |
| 48 | + cursor.execute("SET TIME ZONE 'Europe/Rome';") |
| 49 | + finally: |
| 50 | + if connection is not None: |
| 51 | + connection.close() |
| 52 | + unit_name = f"{DATABASE_APP_NAME}/0" |
| 53 | + for attempt in Retrying(stop=stop_after_delay(90), wait=wait_fixed(10), reraise=True): |
| 54 | + with attempt: |
| 55 | + try: |
| 56 | + logs = await run_command_on_unit( |
| 57 | + ops_test, |
| 58 | + unit_name, |
| 59 | + "sudo grep AUDIT /var/snap/charmed-postgresql/common/var/log/postgresql/postgresql-*.log", |
| 60 | + ) |
| 61 | + assert "MISC,BEGIN,,,BEGIN" in logs |
| 62 | + assert ( |
| 63 | + "DDL,CREATE TABLE,TABLE,public.test2,CREATE TABLE test2(value TEXT);" in logs |
| 64 | + ) |
| 65 | + assert "ROLE,GRANT,TABLE,,GRANT SELECT ON test2 TO PUBLIC;" in logs |
| 66 | + assert "MISC,SET,,,SET TIME ZONE 'Europe/Rome';" in logs |
| 67 | + except Exception: |
| 68 | + assert False, "Audit logs were not found when the plugin is enabled." |
| 69 | + |
| 70 | + logger.info("Disabling the audit plugin") |
| 71 | + await ops_test.model.applications[DATABASE_APP_NAME].set_config({ |
| 72 | + "plugin_audit_enable": "False" |
| 73 | + }) |
| 74 | + await ops_test.model.wait_for_idle(apps=[DATABASE_APP_NAME], status="active") |
| 75 | + |
| 76 | + logger.info("Removing the previous logs") |
| 77 | + await run_command_on_unit( |
| 78 | + ops_test, |
| 79 | + unit_name, |
| 80 | + "rm /var/snap/charmed-postgresql/common/var/log/postgresql/postgresql-*.log", |
| 81 | + ) |
| 82 | + |
| 83 | + logger.info("Checking that the audit plugin is disabled") |
| 84 | + try: |
| 85 | + connection = psycopg2.connect(connection_string) |
| 86 | + with connection.cursor() as cursor: |
| 87 | + cursor.execute("CREATE TABLE test1(value TEXT);") |
| 88 | + cursor.execute("GRANT SELECT ON test1 TO PUBLIC;") |
| 89 | + cursor.execute("SET TIME ZONE 'Europe/Rome';") |
| 90 | + finally: |
| 91 | + if connection is not None: |
| 92 | + connection.close() |
| 93 | + try: |
| 94 | + logs = await run_command_on_unit( |
| 95 | + ops_test, |
| 96 | + unit_name, |
| 97 | + "sudo grep AUDIT /var/snap/charmed-postgresql/common/var/log/postgresql/postgresql-*.log", |
| 98 | + ) |
| 99 | + except Exception: |
| 100 | + pass |
| 101 | + else: |
| 102 | + logger.info(f"Logs: {logs}") |
| 103 | + assert False, "Audit logs were found when the plugin is disabled." |
0 commit comments