gti
d21a9d1140
git-subtree-dir: fiscal git-subtree-mainline:d95165fc8fgit-subtree-split:102ba84500
430 lines
15 KiB
Python
430 lines
15 KiB
Python
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from gti_discovery.firebird_connection import (
|
|
AUTHORIZED_DATABASE_PATH,
|
|
_FirebirdAdapter,
|
|
connect_authorized_read_only,
|
|
get_database_identity,
|
|
validate_authorized_database_path,
|
|
_ADAPTER_CREATION_TOKEN,
|
|
_create_firebird_adapter,
|
|
)
|
|
from gti_discovery.catalog import FirebirdCatalog
|
|
from gti_discovery.firebird_queries import _ADAPTER_REGISTRATION_TOKEN, _register_approved_adapter
|
|
|
|
|
|
def test_authorized_path_is_the_project_target():
|
|
assert AUTHORIZED_DATABASE_PATH == Path(
|
|
r"D:\PROJETOS\GTISISTEMAS\Projeto\TESTESOFICIAIS.FDB"
|
|
)
|
|
|
|
|
|
def test_validation_normalizes_case_and_relative_segments(tmp_path):
|
|
target = tmp_path / "TESTESOFICIAIS.FDB"
|
|
target.write_bytes(b"database")
|
|
|
|
# The production target is fixed; this exercises the same normalization
|
|
# rules with a temporary target without opening a database.
|
|
from gti_discovery import firebird_connection
|
|
|
|
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
|
try:
|
|
assert validate_authorized_database_path(
|
|
tmp_path / "sub" / ".." / "testesoficiais.fdb"
|
|
) == target.resolve()
|
|
finally:
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
|
|
|
|
|
def test_validation_rejects_missing_directory_and_alternate_file(tmp_path):
|
|
from gti_discovery import firebird_connection
|
|
|
|
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
|
authorized = tmp_path / "TESTESOFICIAIS.FDB"
|
|
authorized.write_bytes(b"database")
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = authorized
|
|
try:
|
|
with pytest.raises(ValueError, match="authorized"):
|
|
validate_authorized_database_path(tmp_path / "missing.FDB")
|
|
alternate = tmp_path / "ERP.FDB"
|
|
alternate.write_bytes(b"database")
|
|
with pytest.raises(ValueError, match="authorized"):
|
|
validate_authorized_database_path(alternate)
|
|
authorized.unlink()
|
|
with pytest.raises(ValueError, match="regular file"):
|
|
validate_authorized_database_path(authorized)
|
|
finally:
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
|
|
|
|
|
def test_rejected_path_never_invokes_driver(tmp_path):
|
|
calls = []
|
|
|
|
class Driver:
|
|
def connect(self, **kwargs):
|
|
calls.append(kwargs)
|
|
raise AssertionError("driver must not be invoked")
|
|
|
|
with pytest.raises(ValueError):
|
|
connect_authorized_read_only(tmp_path / "ERP.FDB", Driver())
|
|
assert calls == []
|
|
|
|
|
|
def test_connection_requests_and_proves_read_only_mode(tmp_path):
|
|
target = tmp_path / "TESTESOFICIAIS.FDB"
|
|
target.write_bytes(b"database")
|
|
from gti_discovery import firebird_connection
|
|
|
|
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
|
calls = []
|
|
|
|
class DriverConnection:
|
|
default_tpb = b"\x03\x08\x06\x0f\x11"
|
|
read_only = True
|
|
read_only_evidence = {
|
|
"accepted": True,
|
|
"isolation_level": "fixture-read-committed-ro",
|
|
}
|
|
|
|
def execute(self, sql, params=()):
|
|
return [("TESTESOFICIAIS.FDB",)]
|
|
|
|
class Driver:
|
|
def connect(self, **kwargs):
|
|
calls.append(kwargs)
|
|
return _create_firebird_adapter(DriverConnection(), {
|
|
"accepted": True,
|
|
"driver_api": "fdb.Connection.default_tpb",
|
|
"configured_tpb": b"\x03\x08\x06\x0f\x11",
|
|
"observed_default_tpb": b"\x03\x08\x06\x0f\x11",
|
|
}, _ADAPTER_CREATION_TOKEN)
|
|
|
|
try:
|
|
connection = connect_authorized_read_only(target, Driver(), "fbclient.dll")
|
|
assert isinstance(connection, FirebirdCatalog)
|
|
assert connection.read_only is True
|
|
assert calls == [
|
|
{
|
|
"database": str(target.resolve()),
|
|
"read_only": True,
|
|
"client_library": "fbclient.dll",
|
|
}
|
|
]
|
|
finally:
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
|
|
|
|
|
def test_connection_fails_closed_without_proven_read_only_mode(tmp_path):
|
|
target = tmp_path / "TESTESOFICIAIS.FDB"
|
|
target.write_bytes(b"database")
|
|
from gti_discovery import firebird_connection
|
|
|
|
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
|
|
|
class Driver:
|
|
def connect(self, **kwargs):
|
|
return object()
|
|
|
|
try:
|
|
with pytest.raises(ValueError, match="read-only"):
|
|
connect_authorized_read_only(target, Driver())
|
|
finally:
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
|
|
|
|
|
def test_connection_rejects_driver_that_ignores_read_only_setting(tmp_path):
|
|
target = tmp_path / "TESTESOFICIAIS.FDB"
|
|
target.write_bytes(b"database")
|
|
from gti_discovery import firebird_connection
|
|
|
|
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
|
|
|
class IgnoringConnection:
|
|
read_only = True
|
|
|
|
def close(self):
|
|
self.closed = True
|
|
|
|
raw_connection = IgnoringConnection()
|
|
|
|
class Driver:
|
|
def connect(self, **kwargs):
|
|
return raw_connection
|
|
|
|
try:
|
|
with pytest.raises(ValueError, match="read-only"):
|
|
connect_authorized_read_only(target, Driver())
|
|
assert raw_connection.closed is True
|
|
finally:
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
|
|
|
|
|
def test_connection_rejects_lookalike_sealed_adapter_from_untrusted_driver(tmp_path):
|
|
target = tmp_path / "TESTESOFICIAIS.FDB"
|
|
target.write_bytes(b"database")
|
|
from gti_discovery import firebird_connection
|
|
|
|
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
|
|
|
class Driver:
|
|
def connect(self, **kwargs):
|
|
return _FirebirdAdapter(object(), {
|
|
"accepted": True,
|
|
"driver_api": "fdb.Connection.default_tpb",
|
|
"configured_tpb": b"\x03\x08\x06\x0f\x11",
|
|
"observed_default_tpb": b"\x03\x08\x06\x0f\x11",
|
|
})
|
|
|
|
try:
|
|
with pytest.raises((TypeError, ValueError)):
|
|
connect_authorized_read_only(target, Driver())
|
|
finally:
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
|
|
|
|
|
@pytest.mark.parametrize("read_only", [False, None])
|
|
def test_connection_closes_raw_connection_without_read_only_proof(tmp_path, read_only):
|
|
target = tmp_path / "TESTESOFICIAIS.FDB"
|
|
target.write_bytes(b"database")
|
|
from gti_discovery import firebird_connection
|
|
|
|
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
|
|
|
class DriverConnection:
|
|
def close(self):
|
|
self.closed = True
|
|
|
|
raw_connection = DriverConnection()
|
|
if read_only is not None:
|
|
raw_connection.read_only = read_only
|
|
raw_connection.closed = False
|
|
|
|
class Driver:
|
|
def connect(self, **kwargs):
|
|
return raw_connection
|
|
|
|
try:
|
|
with pytest.raises(ValueError, match="read-only"):
|
|
connect_authorized_read_only(target, Driver())
|
|
assert raw_connection.closed is True
|
|
finally:
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
|
|
|
|
|
def test_connection_closes_malformed_raw_connection(tmp_path):
|
|
target = tmp_path / "TESTESOFICIAIS.FDB"
|
|
target.write_bytes(b"database")
|
|
from gti_discovery import firebird_connection
|
|
|
|
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
|
|
|
class DriverConnection:
|
|
read_only = True
|
|
|
|
def close(self):
|
|
self.closed = True
|
|
|
|
raw_connection = DriverConnection()
|
|
raw_connection.closed = False
|
|
|
|
class Driver:
|
|
def connect(self, **kwargs):
|
|
return raw_connection
|
|
|
|
try:
|
|
with pytest.raises(ValueError, match="read-only"):
|
|
connect_authorized_read_only(target, Driver())
|
|
assert raw_connection.closed is True
|
|
finally:
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|
|
|
|
|
|
def test_identity_helper_uses_only_database_monitor_query():
|
|
from gti_discovery.collector import _CATALOG_QUERIES
|
|
|
|
calls = []
|
|
|
|
class Adapter:
|
|
read_only = True
|
|
|
|
def execute(self, sql, params=()):
|
|
calls.append((sql, params))
|
|
return [("TESTESOFICIAIS.FDB",)]
|
|
|
|
_register_approved_adapter(Adapter, _ADAPTER_REGISTRATION_TOKEN)
|
|
assert get_database_identity(FirebirdCatalog(Adapter())) == "TESTESOFICIAIS.FDB"
|
|
assert calls == [(_CATALOG_QUERIES["database"], ())]
|
|
|
|
|
|
def test_driver_fixture_uses_runtime_fdb_read_only_constant(monkeypatch):
|
|
import importlib.util
|
|
script = Path(__file__).parents[1] / "scripts" / "run_firebird_discovery.py"
|
|
spec = importlib.util.spec_from_file_location("run_firebird_discovery_fixture", script)
|
|
script_module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(script_module)
|
|
|
|
class FdbFixture:
|
|
ISOLATION_LEVEL_READ_COMMITED_RO = b"\x03\x08\x06\x0f\x11"
|
|
|
|
def connect(self, **kwargs):
|
|
self.kwargs = kwargs
|
|
return type("Connection", (), {
|
|
"default_tpb": kwargs["isolation_level"],
|
|
"read_only_evidence": {
|
|
"accepted": True,
|
|
"isolation_level": kwargs["isolation_level"],
|
|
}
|
|
})()
|
|
|
|
fdb = FdbFixture()
|
|
monkeypatch.setenv("FB_USER", "fixture-user")
|
|
monkeypatch.setenv("FB_PASSWORD", "fixture-password")
|
|
driver = script_module._FdbDriver(fdb)
|
|
driver.connect(database="target.fdb", read_only=True)
|
|
|
|
assert fdb.kwargs["isolation_level"] is fdb.ISOLATION_LEVEL_READ_COMMITED_RO
|
|
|
|
|
|
def test_driver_rejects_connection_that_ignores_fdb_read_only_tpb(monkeypatch):
|
|
import importlib.util
|
|
script = Path(__file__).parents[1] / "scripts" / "run_firebird_discovery.py"
|
|
spec = importlib.util.spec_from_file_location("run_firebird_discovery_ignored_tpb", script)
|
|
script_module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(script_module)
|
|
|
|
class FdbFixture:
|
|
ISOLATION_LEVEL_READ_COMMITED_RO = b"\x03\x08\x06\x0f\x11"
|
|
|
|
def connect(self, **kwargs):
|
|
self.kwargs = kwargs
|
|
return type("Connection", (), {
|
|
"default_tpb": b"ordinary-read-write-tpb",
|
|
"read_only": True,
|
|
"read_only_evidence": {
|
|
"accepted": True,
|
|
"isolation_level": kwargs["isolation_level"],
|
|
},
|
|
})()
|
|
|
|
monkeypatch.setenv("FB_USER", "fixture-user")
|
|
monkeypatch.setenv("FB_PASSWORD", "fixture-password")
|
|
with pytest.raises(RuntimeError, match="read-only"):
|
|
script_module._FdbDriver(FdbFixture()).connect(database="target.fdb", read_only=True)
|
|
|
|
|
|
def test_driver_uses_adapter_configuration_evidence_not_raw_claims(monkeypatch):
|
|
import importlib.util
|
|
script = Path(__file__).parents[1] / "scripts" / "run_firebird_discovery.py"
|
|
spec = importlib.util.spec_from_file_location("run_firebird_discovery_claim", script)
|
|
script_module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(script_module)
|
|
|
|
class FdbFixture:
|
|
ISOLATION_LEVEL_READ_COMMITED_RO = b"\x03\x08\x06\x0f\x11"
|
|
|
|
def connect(self, **kwargs):
|
|
return type("Connection", (), {
|
|
"default_tpb": kwargs["isolation_level"],
|
|
"read_only": False,
|
|
"read_only_evidence": {"accepted": True, "isolation_level": kwargs["isolation_level"]},
|
|
})()
|
|
|
|
monkeypatch.setenv("FB_USER", "fixture-user")
|
|
monkeypatch.setenv("FB_PASSWORD", "fixture-password")
|
|
adapter = script_module._FdbDriver(FdbFixture()).connect(database="target.fdb", read_only=True)
|
|
assert adapter.read_only_evidence["configured_tpb"] == b"\x03\x08\x06\x0f\x11"
|
|
assert adapter.read_only_evidence["observed_default_tpb"] == b"\x03\x08\x06\x0f\x11"
|
|
|
|
|
|
def test_installed_fdb_runtime_exposes_read_only_isolation_api_without_connecting():
|
|
import fdb
|
|
|
|
import importlib.util
|
|
script = Path(__file__).parents[1] / "scripts" / "run_firebird_discovery.py"
|
|
spec = importlib.util.spec_from_file_location("run_firebird_discovery_runtime", script)
|
|
script_module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(script_module)
|
|
|
|
assert script_module._read_only_isolation_level(fdb) is getattr(
|
|
fdb, "ISOLATION_LEVEL_READ_COMMITED_RO"
|
|
)
|
|
|
|
|
|
def test_identity_mismatch_is_rejected_after_connection(tmp_path, monkeypatch):
|
|
from gti_discovery import firebird_connection
|
|
|
|
target = tmp_path / "TESTESOFICIAIS.FDB"
|
|
target.write_bytes(b"database")
|
|
original = firebird_connection.AUTHORIZED_DATABASE_PATH
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = target
|
|
|
|
import importlib.util
|
|
script = Path(__file__).parents[1] / "scripts" / "run_firebird_discovery.py"
|
|
spec = importlib.util.spec_from_file_location("run_firebird_discovery_identity", script)
|
|
script_module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(script_module)
|
|
monkeypatch.setenv("FB_USER", "fixture-user")
|
|
monkeypatch.setenv("FB_PASSWORD", "fixture-password")
|
|
monkeypatch.setattr(script_module, "_client_metadata", lambda path: {
|
|
"path": str(path), "exists": True, "version": "2.5.9.27139"
|
|
})
|
|
monkeypatch.setattr(script_module, "_security_gate", lambda path, driver: {
|
|
"path": str(path), "exists": True, "version": "2.5.9.27139"
|
|
})
|
|
|
|
class RawConnection:
|
|
default_tpb = b"\x03\x08\x06\x0f\x11"
|
|
read_only = True
|
|
read_only_evidence = {
|
|
"accepted": True,
|
|
"isolation_level": "fixture-read-committed-ro",
|
|
}
|
|
|
|
def execute(self, sql, params=()):
|
|
return [("OTHER.FDB",)]
|
|
|
|
def close(self):
|
|
pass
|
|
|
|
_register_approved_adapter(RawConnection, _ADAPTER_REGISTRATION_TOKEN)
|
|
|
|
class Driver:
|
|
version = "test-driver"
|
|
|
|
def compatibility_evidence(self, client_version):
|
|
return {
|
|
"client_version": client_version,
|
|
"fdb_version": "2.0.4",
|
|
"firebird_version": "2.5.9",
|
|
"read_only_isolation": True,
|
|
"read_only_api": "fdb.Connection.default_tpb",
|
|
"read_only_tpb": b"\x03\x08\x06\x0f\x11",
|
|
}
|
|
|
|
def connect(self, **kwargs):
|
|
return _create_firebird_adapter(RawConnection(), {
|
|
"accepted": True,
|
|
"driver_api": "fdb.Connection.default_tpb",
|
|
"configured_tpb": b"\x03\x08\x06\x0f\x11",
|
|
"observed_default_tpb": b"\x03\x08\x06\x0f\x11",
|
|
}, _ADAPTER_CREATION_TOKEN)
|
|
|
|
try:
|
|
result = script_module.run_discovery(target, driver=Driver())
|
|
assert result["status"] == "MISSION_00_BLOCKED"
|
|
assert result["blocker"] == "identity_mismatch"
|
|
assert result["connection_attempts"] == 1
|
|
assert result["other_databases_accessed"] == "UNKNOWN"
|
|
assert result["application_writes"] == 0
|
|
finally:
|
|
firebird_connection.AUTHORIZED_DATABASE_PATH = original
|