chore: establish project baseline
This commit is contained in:
OpenCode
@@ -0,0 +1,429 @@
|
||||
from pathlib import Path
|
||||
|
||||
import pytest
|
||||
|
||||
from gti_discovery.firebird_connection import (
|
||||
AUTHORIZED_DATABASE_PATH,
|
||||
_FirebirdAdapter,
|
||||
connect_authorized_read_only,
|
||||
get_database_identity,
|
||||
validate_authorized_database_path,
|
||||
_ADAPTER_CREATION_TOKEN,
|
||||
_create_firebird_adapter,
|
||||
)
|
||||
from gti_discovery.catalog import FirebirdCatalog
|
||||
from gti_discovery.firebird_queries import _ADAPTER_REGISTRATION_TOKEN, _register_approved_adapter
|
||||
|
||||
|
||||
def test_authorized_path_is_the_project_target():
|
||||
assert AUTHORIZED_DATABASE_PATH == Path(
|
||||
r"D:\PROJETOS\GTISISTEMAS\Projeto\TESTESOFICIAIS.FDB"
|
||||
)
|
||||
|
||||
|
||||
def test_validation_normalizes_case_and_relative_segments(tmp_path):
|
||||
target = tmp_path / "TESTESOFICIAIS.FDB"
|
||||
target.write_bytes(b"database")
|
||||
|
||||
# The production target is fixed; this exercises the same normalization
|
||||
# rules with a temporary target without opening a database.
|
||||
from gti_discovery import firebird_connection
|
||||
|
||||
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
||||
try:
|
||||
assert validate_authorized_database_path(
|
||||
tmp_path / "sub" / ".." / "testesoficiais.fdb"
|
||||
) == target.resolve()
|
||||
finally:
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
||||
|
||||
|
||||
def test_validation_rejects_missing_directory_and_alternate_file(tmp_path):
|
||||
from gti_discovery import firebird_connection
|
||||
|
||||
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
||||
authorized = tmp_path / "TESTESOFICIAIS.FDB"
|
||||
authorized.write_bytes(b"database")
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = authorized
|
||||
try:
|
||||
with pytest.raises(ValueError, match="authorized"):
|
||||
validate_authorized_database_path(tmp_path / "missing.FDB")
|
||||
alternate = tmp_path / "ERP.FDB"
|
||||
alternate.write_bytes(b"database")
|
||||
with pytest.raises(ValueError, match="authorized"):
|
||||
validate_authorized_database_path(alternate)
|
||||
authorized.unlink()
|
||||
with pytest.raises(ValueError, match="regular file"):
|
||||
validate_authorized_database_path(authorized)
|
||||
finally:
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
||||
|
||||
|
||||
def test_rejected_path_never_invokes_driver(tmp_path):
|
||||
calls = []
|
||||
|
||||
class Driver:
|
||||
def connect(self, **kwargs):
|
||||
calls.append(kwargs)
|
||||
raise AssertionError("driver must not be invoked")
|
||||
|
||||
with pytest.raises(ValueError):
|
||||
connect_authorized_read_only(tmp_path / "ERP.FDB", Driver())
|
||||
assert calls == []
|
||||
|
||||
|
||||
def test_connection_requests_and_proves_read_only_mode(tmp_path):
|
||||
target = tmp_path / "TESTESOFICIAIS.FDB"
|
||||
target.write_bytes(b"database")
|
||||
from gti_discovery import firebird_connection
|
||||
|
||||
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
||||
calls = []
|
||||
|
||||
class DriverConnection:
|
||||
default_tpb = b"\x03\x08\x06\x0f\x11"
|
||||
read_only = True
|
||||
read_only_evidence = {
|
||||
"accepted": True,
|
||||
"isolation_level": "fixture-read-committed-ro",
|
||||
}
|
||||
|
||||
def execute(self, sql, params=()):
|
||||
return [("TESTESOFICIAIS.FDB",)]
|
||||
|
||||
class Driver:
|
||||
def connect(self, **kwargs):
|
||||
calls.append(kwargs)
|
||||
return _create_firebird_adapter(DriverConnection(), {
|
||||
"accepted": True,
|
||||
"driver_api": "fdb.Connection.default_tpb",
|
||||
"configured_tpb": b"\x03\x08\x06\x0f\x11",
|
||||
"observed_default_tpb": b"\x03\x08\x06\x0f\x11",
|
||||
}, _ADAPTER_CREATION_TOKEN)
|
||||
|
||||
try:
|
||||
connection = connect_authorized_read_only(target, Driver(), "fbclient.dll")
|
||||
assert isinstance(connection, FirebirdCatalog)
|
||||
assert connection.read_only is True
|
||||
assert calls == [
|
||||
{
|
||||
"database": str(target.resolve()),
|
||||
"read_only": True,
|
||||
"client_library": "fbclient.dll",
|
||||
}
|
||||
]
|
||||
finally:
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
||||
|
||||
|
||||
def test_connection_fails_closed_without_proven_read_only_mode(tmp_path):
|
||||
target = tmp_path / "TESTESOFICIAIS.FDB"
|
||||
target.write_bytes(b"database")
|
||||
from gti_discovery import firebird_connection
|
||||
|
||||
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
||||
|
||||
class Driver:
|
||||
def connect(self, **kwargs):
|
||||
return object()
|
||||
|
||||
try:
|
||||
with pytest.raises(ValueError, match="read-only"):
|
||||
connect_authorized_read_only(target, Driver())
|
||||
finally:
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
||||
|
||||
|
||||
def test_connection_rejects_driver_that_ignores_read_only_setting(tmp_path):
|
||||
target = tmp_path / "TESTESOFICIAIS.FDB"
|
||||
target.write_bytes(b"database")
|
||||
from gti_discovery import firebird_connection
|
||||
|
||||
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
||||
|
||||
class IgnoringConnection:
|
||||
read_only = True
|
||||
|
||||
def close(self):
|
||||
self.closed = True
|
||||
|
||||
raw_connection = IgnoringConnection()
|
||||
|
||||
class Driver:
|
||||
def connect(self, **kwargs):
|
||||
return raw_connection
|
||||
|
||||
try:
|
||||
with pytest.raises(ValueError, match="read-only"):
|
||||
connect_authorized_read_only(target, Driver())
|
||||
assert raw_connection.closed is True
|
||||
finally:
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
||||
|
||||
|
||||
def test_connection_rejects_lookalike_sealed_adapter_from_untrusted_driver(tmp_path):
|
||||
target = tmp_path / "TESTESOFICIAIS.FDB"
|
||||
target.write_bytes(b"database")
|
||||
from gti_discovery import firebird_connection
|
||||
|
||||
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
||||
|
||||
class Driver:
|
||||
def connect(self, **kwargs):
|
||||
return _FirebirdAdapter(object(), {
|
||||
"accepted": True,
|
||||
"driver_api": "fdb.Connection.default_tpb",
|
||||
"configured_tpb": b"\x03\x08\x06\x0f\x11",
|
||||
"observed_default_tpb": b"\x03\x08\x06\x0f\x11",
|
||||
})
|
||||
|
||||
try:
|
||||
with pytest.raises((TypeError, ValueError)):
|
||||
connect_authorized_read_only(target, Driver())
|
||||
finally:
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
||||
|
||||
|
||||
@pytest.mark.parametrize("read_only", [False, None])
|
||||
def test_connection_closes_raw_connection_without_read_only_proof(tmp_path, read_only):
|
||||
target = tmp_path / "TESTESOFICIAIS.FDB"
|
||||
target.write_bytes(b"database")
|
||||
from gti_discovery import firebird_connection
|
||||
|
||||
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
||||
|
||||
class DriverConnection:
|
||||
def close(self):
|
||||
self.closed = True
|
||||
|
||||
raw_connection = DriverConnection()
|
||||
if read_only is not None:
|
||||
raw_connection.read_only = read_only
|
||||
raw_connection.closed = False
|
||||
|
||||
class Driver:
|
||||
def connect(self, **kwargs):
|
||||
return raw_connection
|
||||
|
||||
try:
|
||||
with pytest.raises(ValueError, match="read-only"):
|
||||
connect_authorized_read_only(target, Driver())
|
||||
assert raw_connection.closed is True
|
||||
finally:
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
||||
|
||||
|
||||
def test_connection_closes_malformed_raw_connection(tmp_path):
|
||||
target = tmp_path / "TESTESOFICIAIS.FDB"
|
||||
target.write_bytes(b"database")
|
||||
from gti_discovery import firebird_connection
|
||||
|
||||
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
||||
|
||||
class DriverConnection:
|
||||
read_only = True
|
||||
|
||||
def close(self):
|
||||
self.closed = True
|
||||
|
||||
raw_connection = DriverConnection()
|
||||
raw_connection.closed = False
|
||||
|
||||
class Driver:
|
||||
def connect(self, **kwargs):
|
||||
return raw_connection
|
||||
|
||||
try:
|
||||
with pytest.raises(ValueError, match="read-only"):
|
||||
connect_authorized_read_only(target, Driver())
|
||||
assert raw_connection.closed is True
|
||||
finally:
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
||||
|
||||
|
||||
def test_identity_helper_uses_only_database_monitor_query():
|
||||
from gti_discovery.collector import _CATALOG_QUERIES
|
||||
|
||||
calls = []
|
||||
|
||||
class Adapter:
|
||||
read_only = True
|
||||
|
||||
def execute(self, sql, params=()):
|
||||
calls.append((sql, params))
|
||||
return [("TESTESOFICIAIS.FDB",)]
|
||||
|
||||
_register_approved_adapter(Adapter, _ADAPTER_REGISTRATION_TOKEN)
|
||||
assert get_database_identity(FirebirdCatalog(Adapter())) == "TESTESOFICIAIS.FDB"
|
||||
assert calls == [(_CATALOG_QUERIES["database"], ())]
|
||||
|
||||
|
||||
def test_driver_fixture_uses_runtime_fdb_read_only_constant(monkeypatch):
|
||||
import importlib.util
|
||||
script = Path(__file__).parents[1] / "scripts" / "run_firebird_discovery.py"
|
||||
spec = importlib.util.spec_from_file_location("run_firebird_discovery_fixture", script)
|
||||
script_module = importlib.util.module_from_spec(spec)
|
||||
spec.loader.exec_module(script_module)
|
||||
|
||||
class FdbFixture:
|
||||
ISOLATION_LEVEL_READ_COMMITED_RO = b"\x03\x08\x06\x0f\x11"
|
||||
|
||||
def connect(self, **kwargs):
|
||||
self.kwargs = kwargs
|
||||
return type("Connection", (), {
|
||||
"default_tpb": kwargs["isolation_level"],
|
||||
"read_only_evidence": {
|
||||
"accepted": True,
|
||||
"isolation_level": kwargs["isolation_level"],
|
||||
}
|
||||
})()
|
||||
|
||||
fdb = FdbFixture()
|
||||
monkeypatch.setenv("FB_USER", "fixture-user")
|
||||
monkeypatch.setenv("FB_PASSWORD", "fixture-password")
|
||||
driver = script_module._FdbDriver(fdb)
|
||||
driver.connect(database="target.fdb", read_only=True)
|
||||
|
||||
assert fdb.kwargs["isolation_level"] is fdb.ISOLATION_LEVEL_READ_COMMITED_RO
|
||||
|
||||
|
||||
def test_driver_rejects_connection_that_ignores_fdb_read_only_tpb(monkeypatch):
|
||||
import importlib.util
|
||||
script = Path(__file__).parents[1] / "scripts" / "run_firebird_discovery.py"
|
||||
spec = importlib.util.spec_from_file_location("run_firebird_discovery_ignored_tpb", script)
|
||||
script_module = importlib.util.module_from_spec(spec)
|
||||
spec.loader.exec_module(script_module)
|
||||
|
||||
class FdbFixture:
|
||||
ISOLATION_LEVEL_READ_COMMITED_RO = b"\x03\x08\x06\x0f\x11"
|
||||
|
||||
def connect(self, **kwargs):
|
||||
self.kwargs = kwargs
|
||||
return type("Connection", (), {
|
||||
"default_tpb": b"ordinary-read-write-tpb",
|
||||
"read_only": True,
|
||||
"read_only_evidence": {
|
||||
"accepted": True,
|
||||
"isolation_level": kwargs["isolation_level"],
|
||||
},
|
||||
})()
|
||||
|
||||
monkeypatch.setenv("FB_USER", "fixture-user")
|
||||
monkeypatch.setenv("FB_PASSWORD", "fixture-password")
|
||||
with pytest.raises(RuntimeError, match="read-only"):
|
||||
script_module._FdbDriver(FdbFixture()).connect(database="target.fdb", read_only=True)
|
||||
|
||||
|
||||
def test_driver_uses_adapter_configuration_evidence_not_raw_claims(monkeypatch):
|
||||
import importlib.util
|
||||
script = Path(__file__).parents[1] / "scripts" / "run_firebird_discovery.py"
|
||||
spec = importlib.util.spec_from_file_location("run_firebird_discovery_claim", script)
|
||||
script_module = importlib.util.module_from_spec(spec)
|
||||
spec.loader.exec_module(script_module)
|
||||
|
||||
class FdbFixture:
|
||||
ISOLATION_LEVEL_READ_COMMITED_RO = b"\x03\x08\x06\x0f\x11"
|
||||
|
||||
def connect(self, **kwargs):
|
||||
return type("Connection", (), {
|
||||
"default_tpb": kwargs["isolation_level"],
|
||||
"read_only": False,
|
||||
"read_only_evidence": {"accepted": True, "isolation_level": kwargs["isolation_level"]},
|
||||
})()
|
||||
|
||||
monkeypatch.setenv("FB_USER", "fixture-user")
|
||||
monkeypatch.setenv("FB_PASSWORD", "fixture-password")
|
||||
adapter = script_module._FdbDriver(FdbFixture()).connect(database="target.fdb", read_only=True)
|
||||
assert adapter.read_only_evidence["configured_tpb"] == b"\x03\x08\x06\x0f\x11"
|
||||
assert adapter.read_only_evidence["observed_default_tpb"] == b"\x03\x08\x06\x0f\x11"
|
||||
|
||||
|
||||
def test_installed_fdb_runtime_exposes_read_only_isolation_api_without_connecting():
|
||||
import fdb
|
||||
|
||||
import importlib.util
|
||||
script = Path(__file__).parents[1] / "scripts" / "run_firebird_discovery.py"
|
||||
spec = importlib.util.spec_from_file_location("run_firebird_discovery_runtime", script)
|
||||
script_module = importlib.util.module_from_spec(spec)
|
||||
spec.loader.exec_module(script_module)
|
||||
|
||||
assert script_module._read_only_isolation_level(fdb) is getattr(
|
||||
fdb, "ISOLATION_LEVEL_READ_COMMITED_RO"
|
||||
)
|
||||
|
||||
|
||||
def test_identity_mismatch_is_rejected_after_connection(tmp_path, monkeypatch):
|
||||
from gti_discovery import firebird_connection
|
||||
|
||||
target = tmp_path / "TESTESOFICIAIS.FDB"
|
||||
target.write_bytes(b"database")
|
||||
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
||||
|
||||
import importlib.util
|
||||
script = Path(__file__).parents[1] / "scripts" / "run_firebird_discovery.py"
|
||||
spec = importlib.util.spec_from_file_location("run_firebird_discovery_identity", script)
|
||||
script_module = importlib.util.module_from_spec(spec)
|
||||
spec.loader.exec_module(script_module)
|
||||
monkeypatch.setenv("FB_USER", "fixture-user")
|
||||
monkeypatch.setenv("FB_PASSWORD", "fixture-password")
|
||||
monkeypatch.setattr(script_module, "_client_metadata", lambda path: {
|
||||
"path": str(path), "exists": True, "version": "2.5.9.27139"
|
||||
})
|
||||
monkeypatch.setattr(script_module, "_security_gate", lambda path, driver: {
|
||||
"path": str(path), "exists": True, "version": "2.5.9.27139"
|
||||
})
|
||||
|
||||
class RawConnection:
|
||||
default_tpb = b"\x03\x08\x06\x0f\x11"
|
||||
read_only = True
|
||||
read_only_evidence = {
|
||||
"accepted": True,
|
||||
"isolation_level": "fixture-read-committed-ro",
|
||||
}
|
||||
|
||||
def execute(self, sql, params=()):
|
||||
return [("OTHER.FDB",)]
|
||||
|
||||
def close(self):
|
||||
pass
|
||||
|
||||
_register_approved_adapter(RawConnection, _ADAPTER_REGISTRATION_TOKEN)
|
||||
|
||||
class Driver:
|
||||
version = "test-driver"
|
||||
|
||||
def compatibility_evidence(self, client_version):
|
||||
return {
|
||||
"client_version": client_version,
|
||||
"fdb_version": "2.0.4",
|
||||
"firebird_version": "2.5.9",
|
||||
"read_only_isolation": True,
|
||||
"read_only_api": "fdb.Connection.default_tpb",
|
||||
"read_only_tpb": b"\x03\x08\x06\x0f\x11",
|
||||
}
|
||||
|
||||
def connect(self, **kwargs):
|
||||
return _create_firebird_adapter(RawConnection(), {
|
||||
"accepted": True,
|
||||
"driver_api": "fdb.Connection.default_tpb",
|
||||
"configured_tpb": b"\x03\x08\x06\x0f\x11",
|
||||
"observed_default_tpb": b"\x03\x08\x06\x0f\x11",
|
||||
}, _ADAPTER_CREATION_TOKEN)
|
||||
|
||||
try:
|
||||
result = script_module.run_discovery(target, driver=Driver())
|
||||
assert result["status"] == "MISSION_00_BLOCKED"
|
||||
assert result["blocker"] == "identity_mismatch"
|
||||
assert result["connection_attempts"] == 1
|
||||
assert result["other_databases_accessed"] == "UNKNOWN"
|
||||
assert result["application_writes"] == 0
|
||||
finally:
|
||||
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
||||
Reference in New Issue
Block a user