* feat(rbac): drop dataset_permissions + access_requests + users.role + is_public; v19 migration
BREAKING. Sjednocení datové RBAC vrstvy do per-group resource_grants modelu.
Před PR byla legacy data RBAC vrstva (dataset_permissions + is_public bypass)
de-facto neaktivní — is_public neměl API/UI/CLI surface, default true znamenal
že can_access_table vždycky bypassl. Dnes každý non-admin přístup vyžaduje
explicitní resource_grants(group, "table", id) řádek.
Schema v18 → v19 (src/db.py:_v18_to_v19_finalize):
- DROP TABLE dataset_permissions, access_requests
- DROP COLUMN users.role (NULL artifact since v13)
- DROP COLUMN table_registry.is_public
- Drops přes table-rebuild idiom (rename → create new → INSERT … SELECT
→ drop old) kvůli DuckDB ALTER DROP COLUMN limitacím na tabulkách
s historic FK constraints. INSERT picks intersection sloupců, takže
test fixtures s minimal pre-v19 schemou migrate cleanly.
Runtime:
- src/rbac.py:can_access_table → deleguje na app.auth.access.can_access
- DatasetPermissionRepository, AccessRequestRepository smazány
- AGNES_ENABLE_TABLE_GRANTS env-gate v app/resource_types.py odstraněn
(TABLE je unconditionally enabled)
API drop:
- app/api/permissions.py, app/api/access_requests.py celé soubory
- /admin/permissions web route + admin_permissions.html
- "Request Access" modal v catalog.html + locked-row UI
- ~10 if user.get("role") != "admin" checků nahrazeno (admin shortcut
je uvnitř can_access_table)
- /api/settings: drop permissions field z GET; PUT /api/settings/dataset
gate přepnut na can_access(user_id, "table", dataset, conn)
Auth:
- app/auth/jwt.py:create_access_token: drop role parametr (claim zmizí
z nově vydávaných JWT; staré tokeny zůstávají valid, claim ignored)
- app/api/users.py: drop role z CreateUserRequest / UpdateUserRequest
(admin promotion = explicit add to Admin group via memberships API)
- src/repositories/users.py: drop role z create() / update()
CLI:
- da admin set-role smazán → hard-fail s replacement command
- da admin add-user --role flag pryč
- da auth import-token --role flag pryč
- da auth whoami: drop "Role:" výpis
- cli/config.py:save_token: role parametr now optional, no longer written
(back-compat se starými token.json soubory zachována — pole se ignoruje)
Tests:
- DELETE: test_permissions.py, test_permissions_api.py, test_access_requests_api.py
- REWRITE: test_access_control.py (resource_grants flow), test_rbac.py
(can_access_table over resource_grants), test_journey_rbac.py
(drop access-request flow), test_resource_types.py (drop env-gate
tests, drop is_public from helpers), test_v2_*.py (drop role-based
user dicts in favor of id-based + Admin group membership),
test_settings_api.py (no permissions field, can_access gate)
- TRIVIAL: ~30 souborů — drop role="admin" arg z UserRepository.create
a 3rd positional role z create_access_token
- NEW: test_v18_to_v19 migration test (test_db.py),
test_can_access_table_no_implicit_public (test_rbac.py),
test_admin_set_role_returns_hardfail (test_cli_admin.py)
- OpenAPI snapshot regenerated
Docs:
- CHANGELOG: BREAKING entry pod [Unreleased]
- CLAUDE.md: schema v18 → v19
- docs/architecture.md: schema table + RBAC sekce přepsána
- docs/auth-google-oauth.md: admin promotion přes da admin break-glass
- cli/skills/security.md: kompletně přepsáno na group-based model
- docs/TODO-rbac-data-enforcement.md: smazáno (TODO splněn)
Test results: 2363 passed, 19 failed. Zbývající failures jsou pre-existing
Windows-specific issues (fcntl, charset) nesouvisející s tímto PR —
ověřeno git stash pop.
Plan: ~/.claude/plans/floofy-coalescing-parnas.md
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(release): cut 0.27.0
---------
Co-authored-by: Minas Arustamyan <arustamyan.minas@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: ZdenekSrotyr <zdenek.srotyr@keboola.com>
288 lines
11 KiB
Python
288 lines
11 KiB
Python
"""Tests for CLI commands."""
|
|
|
|
import json
|
|
import os
|
|
import pytest
|
|
from unittest.mock import patch, MagicMock
|
|
|
|
from typer.testing import CliRunner
|
|
from cli.main import app
|
|
|
|
runner = CliRunner()
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def tmp_config(tmp_path, monkeypatch):
|
|
monkeypatch.setenv("DA_CONFIG_DIR", str(tmp_path / "config"))
|
|
monkeypatch.setenv("DA_LOCAL_DIR", str(tmp_path / "local"))
|
|
monkeypatch.setenv("DATA_DIR", str(tmp_path / "data"))
|
|
monkeypatch.setenv("JWT_SECRET_KEY", "test-secret-for-cli-tests")
|
|
(tmp_path / "config").mkdir()
|
|
(tmp_path / "local").mkdir()
|
|
(tmp_path / "data").mkdir()
|
|
yield tmp_path
|
|
|
|
|
|
class TestCLIHelp:
|
|
def test_main_help(self):
|
|
result = runner.invoke(app, ["--help"])
|
|
assert result.exit_code == 0
|
|
assert "AI Data Analyst CLI" in result.output
|
|
|
|
def test_auth_help(self):
|
|
result = runner.invoke(app, ["auth", "--help"])
|
|
assert result.exit_code == 0
|
|
assert "login" in result.output
|
|
|
|
def test_sync_help(self):
|
|
result = runner.invoke(app, ["sync", "--help"])
|
|
assert result.exit_code == 0
|
|
|
|
def test_query_help(self):
|
|
result = runner.invoke(app, ["query", "--help"])
|
|
assert result.exit_code == 0
|
|
|
|
def test_admin_help(self):
|
|
result = runner.invoke(app, ["admin", "--help"])
|
|
assert result.exit_code == 0
|
|
|
|
def test_admin_metadata_help(self):
|
|
result = runner.invoke(app, ["admin", "metadata-show", "--help"])
|
|
assert result.exit_code == 0
|
|
|
|
def test_diagnose_help(self):
|
|
result = runner.invoke(app, ["diagnose", "--help"])
|
|
assert result.exit_code == 0
|
|
|
|
def test_skills_help(self):
|
|
result = runner.invoke(app, ["skills", "--help"])
|
|
assert result.exit_code == 0
|
|
|
|
|
|
class TestCLIVersion:
|
|
def test_version_long_flag(self):
|
|
result = runner.invoke(app, ["--version"])
|
|
assert result.exit_code == 0
|
|
assert result.output.startswith("da ")
|
|
# Version string must be non-empty after the `da ` prefix.
|
|
assert result.output.strip() != "da"
|
|
|
|
def test_version_short_flag(self):
|
|
result = runner.invoke(app, ["-V"])
|
|
assert result.exit_code == 0
|
|
assert result.output.startswith("da ")
|
|
|
|
def test_version_exits_before_subcommand_resolution(self):
|
|
"""Eager callback must run even when an unknown subcommand follows."""
|
|
result = runner.invoke(app, ["--version", "bogus-subcommand"])
|
|
assert result.exit_code == 0
|
|
assert "da " in result.output
|
|
|
|
|
|
class TestSkills:
|
|
def test_list_skills(self):
|
|
result = runner.invoke(app, ["skills", "list"])
|
|
assert result.exit_code == 0
|
|
assert "setup" in result.output
|
|
assert "troubleshoot" in result.output
|
|
|
|
def test_show_skill(self):
|
|
result = runner.invoke(app, ["skills", "show", "setup"])
|
|
assert result.exit_code == 0
|
|
assert "Prerequisites" in result.output
|
|
|
|
def test_show_nonexistent_skill(self):
|
|
result = runner.invoke(app, ["skills", "show", "nonexistent"])
|
|
assert result.exit_code == 1
|
|
|
|
|
|
class TestAuth:
|
|
def test_whoami_not_logged_in(self):
|
|
result = runner.invoke(app, ["auth", "whoami"])
|
|
assert result.exit_code == 1
|
|
assert "Not logged in" in result.output
|
|
|
|
def test_logout(self):
|
|
result = runner.invoke(app, ["auth", "logout"])
|
|
assert result.exit_code == 0
|
|
assert "Logged out" in result.output
|
|
|
|
def test_login_with_mock_server(self, tmp_config):
|
|
"""Test login against a real FastAPI test server."""
|
|
from src.db import get_system_db
|
|
from src.repositories.users import UserRepository
|
|
|
|
from argon2 import PasswordHasher
|
|
conn = get_system_db()
|
|
repo = UserRepository(conn)
|
|
repo.create(id="u1", email="test@acme.com", name="Test",
|
|
password_hash=PasswordHasher().hash("testpass"))
|
|
conn.close()
|
|
|
|
from fastapi.testclient import TestClient
|
|
from app.main import create_app
|
|
test_app = create_app()
|
|
|
|
with patch("cli.client.get_client") as mock_get_client:
|
|
client = TestClient(test_app)
|
|
mock_get_client.return_value.__enter__ = MagicMock(return_value=client)
|
|
mock_get_client.return_value.__exit__ = MagicMock(return_value=False)
|
|
|
|
# Simulate the API call
|
|
resp = client.post("/auth/token", json={"email": "test@acme.com", "password": "testpass"})
|
|
assert resp.status_code == 200
|
|
token = resp.json()["access_token"]
|
|
|
|
# Save token manually (since we can't easily mock typer prompts)
|
|
from cli.config import save_token
|
|
save_token(token, "test@acme.com", "analyst")
|
|
|
|
# Now whoami should work
|
|
result = runner.invoke(app, ["auth", "whoami"])
|
|
assert result.exit_code == 0
|
|
assert "test@acme.com" in result.output
|
|
|
|
|
|
class TestStatus:
|
|
def test_local_status_empty(self):
|
|
result = runner.invoke(app, ["status", "--local"])
|
|
assert result.exit_code == 0
|
|
assert "Tables synced: 0" in result.output
|
|
|
|
def test_local_status_json(self):
|
|
result = runner.invoke(app, ["status", "--local", "--json"])
|
|
assert result.exit_code == 0
|
|
data = json.loads(result.output)
|
|
assert data["mode"] == "local"
|
|
|
|
|
|
class TestQuery:
|
|
def test_query_no_db(self, tmp_config):
|
|
result = runner.invoke(app, ["query", "SELECT 1"])
|
|
assert result.exit_code == 1
|
|
assert "not found" in result.output
|
|
|
|
def test_query_with_db(self, tmp_config):
|
|
import duckdb
|
|
local_dir = tmp_config / "local"
|
|
db_dir = local_dir / "user" / "duckdb"
|
|
db_dir.mkdir(parents=True)
|
|
conn = duckdb.connect(str(db_dir / "analytics.duckdb"))
|
|
conn.execute("CREATE TABLE test_table (id INT, name VARCHAR)")
|
|
conn.execute("INSERT INTO test_table VALUES (1, 'hello'), (2, 'world')")
|
|
conn.close()
|
|
|
|
result = runner.invoke(app, ["query", "SELECT count(*) as cnt FROM test_table", "--format", "json"])
|
|
assert result.exit_code == 0
|
|
data = json.loads(result.output)
|
|
assert data[0]["cnt"] == 2
|
|
|
|
|
|
class TestAdminCommands:
|
|
def test_register_table(self, tmp_config):
|
|
"""Test da admin register-table calls the API and reports success."""
|
|
mock_resp = MagicMock()
|
|
mock_resp.status_code = 201
|
|
mock_resp.json.return_value = {"id": "tbl-1", "name": "orders"}
|
|
|
|
with patch("cli.commands.admin.api_post", return_value=mock_resp) as mock_post:
|
|
result = runner.invoke(app, [
|
|
"admin", "register-table", "orders",
|
|
"--source-type", "keboola",
|
|
"--bucket", "in.c-crm",
|
|
"--query-mode", "local",
|
|
])
|
|
assert result.exit_code == 0
|
|
assert "Registered: orders" in result.output
|
|
mock_post.assert_called_once()
|
|
call_args = mock_post.call_args
|
|
assert call_args[0][0] == "/api/admin/register-table"
|
|
assert call_args[1]["json"]["name"] == "orders"
|
|
|
|
def test_register_table_conflict(self, tmp_config):
|
|
"""Test da admin register-table when table already exists."""
|
|
mock_resp = MagicMock()
|
|
mock_resp.status_code = 409
|
|
mock_resp.json.return_value = {"detail": "Table already exists"}
|
|
|
|
with patch("cli.commands.admin.api_post", return_value=mock_resp):
|
|
result = runner.invoke(app, ["admin", "register-table", "orders"])
|
|
assert result.exit_code == 0
|
|
assert "Already exists: orders" in result.output
|
|
|
|
def test_list_tables(self, tmp_config):
|
|
"""Test da admin list-tables returns table listing."""
|
|
mock_resp = MagicMock()
|
|
mock_resp.status_code = 200
|
|
mock_resp.json.return_value = {
|
|
"count": 2,
|
|
"tables": [
|
|
{"name": "orders", "source_type": "keboola", "query_mode": "local", "bucket": "in.c-crm", "id": "t1"},
|
|
{"name": "customers", "source_type": "keboola", "query_mode": "local", "bucket": "in.c-crm", "id": "t2"},
|
|
],
|
|
}
|
|
|
|
with patch("cli.commands.admin.api_get", return_value=mock_resp):
|
|
result = runner.invoke(app, ["admin", "list-tables"])
|
|
assert result.exit_code == 0
|
|
assert "Registered tables: 2" in result.output
|
|
assert "orders" in result.output
|
|
assert "customers" in result.output
|
|
|
|
def test_list_tables_json(self, tmp_config):
|
|
"""Test da admin list-tables --json outputs valid JSON."""
|
|
mock_resp = MagicMock()
|
|
mock_resp.status_code = 200
|
|
mock_resp.json.return_value = {
|
|
"count": 1,
|
|
"tables": [
|
|
{"name": "orders", "source_type": "keboola", "query_mode": "local", "bucket": "in.c-crm", "id": "t1"},
|
|
],
|
|
}
|
|
|
|
with patch("cli.commands.admin.api_get", return_value=mock_resp):
|
|
result = runner.invoke(app, ["admin", "list-tables", "--json"])
|
|
assert result.exit_code == 0
|
|
data = json.loads(result.output)
|
|
assert data["count"] == 1
|
|
|
|
def test_list_tables_api_failure(self, tmp_config):
|
|
"""Test da admin list-tables handles API errors."""
|
|
mock_resp = MagicMock()
|
|
mock_resp.status_code = 500
|
|
mock_resp.text = "Internal Server Error"
|
|
mock_resp.json.return_value = {"detail": "Internal Server Error"}
|
|
|
|
with patch("cli.commands.admin.api_get", return_value=mock_resp):
|
|
result = runner.invoke(app, ["admin", "list-tables"])
|
|
assert result.exit_code == 1
|
|
|
|
|
|
class TestQueryHybrid:
|
|
def test_register_bq_flag_help(self):
|
|
result = runner.invoke(app, ["query", "--help"])
|
|
assert result.exit_code == 0
|
|
# Rich/Typer may insert ANSI escape codes within option names,
|
|
# so check for the parts separately
|
|
assert "register" in result.output
|
|
assert "bq" in result.output
|
|
assert "BigQuery" in result.output
|
|
|
|
|
|
class TestMetricsHelp:
|
|
def test_metrics_help(self):
|
|
result = runner.invoke(app, ["metrics", "--help"])
|
|
assert result.exit_code == 0
|
|
assert "list" in result.output
|
|
assert "show" in result.output
|
|
assert "import" in result.output
|
|
|
|
def test_analyst_help(self):
|
|
result = runner.invoke(app, ["analyst", "--help"])
|
|
assert result.exit_code == 0
|
|
assert "setup" in result.output
|
|
|
|
def test_analyst_status_help(self):
|
|
result = runner.invoke(app, ["analyst", "status", "--help"])
|
|
assert result.exit_code == 0
|
|
assert "freshness" in result.output.lower() or "workspace" in result.output.lower()
|