fix(i-b): Cross-Tenant-Suite 10/10 gruen — echte RLS-Verifikation statt Vakuum-Tests
Root-Causes und Fixes: (1) conftest.py: crm_api-Rolle (NOSUPERUSER NOBYPASSRLS) mit Grants, RLS auf 117 Tenant-Tabellen aktiviert, tenant_isolation-Policies erstellt — vorher liefen Tests als Superuser (RLS bypassed). (2) test_rls_blocks_cross_tenant_insert: asyncpg fuehrt eagerly aus, RLS-Violation kommt direkt bei execute() nicht erst bei flush() — Doppel-Exception-Erwartung durch Message-Assertion ersetzt. (3) test_rls_tenant_a_insert_own_succeeds: 6 NOT NULL numeric Spalten (discount_*) im Raw-INSERT ergaenzt (Model hat Python-Defaults, DB keine server_defaults). (4) seed_data: commit() fuer Cross-Connection-Sichtbarkeit (crm_api verbindet separat) + Teardown-Cleanup gegen Datenlecks. (5) admin_session: ohne conn.begin() — sonst conditional_savepoint und commit() wirkungslos. (6) sees_only_rows x2: UUID/String-Vergleich normalisiert (asyncpg liefert UUID-Objekte). Vorher: 9 von 10 Tests vakuum-trivial gruen (leere DB, Superuser). Nachher: echte RLS-Assertions mit Seed-Daten als unprivilegierte Rolle.
This commit is contained in:
Agent Zero
@@ -96,13 +96,18 @@ async def api_engine():
|
||||
|
||||
@pytest_asyncio.fixture
|
||||
async def admin_session(admin_engine):
|
||||
"""Admin session for data setup."""
|
||||
"""Admin session for data setup.
|
||||
|
||||
No externally begun transaction: the session must own its transactions so
|
||||
that seed_data's commit() really persists rows (visible to the separate
|
||||
crm_api connection used by api_session). With conn.begin() the Session
|
||||
would treat it as an external transaction (conditional_savepoint) and
|
||||
commit() would not release it.
|
||||
"""
|
||||
async with admin_engine.connect() as conn:
|
||||
await conn.begin()
|
||||
session = AsyncSession(bind=conn, expire_on_commit=False)
|
||||
yield session
|
||||
await session.rollback()
|
||||
await conn.rollback()
|
||||
await session.close()
|
||||
|
||||
|
||||
@pytest_asyncio.fixture
|
||||
@@ -173,7 +178,14 @@ async def seed_data(admin_session: AsyncSession):
|
||||
admin_session.add_all([contact_a, contact_b])
|
||||
await admin_session.flush()
|
||||
|
||||
return {
|
||||
# COMMIT is mandatory here: the api_session fixture connects as the
|
||||
# unprivileged crm_api role on a SEPARATE connection. Uncommitted rows
|
||||
# from the admin connection are invisible there, so FK checks
|
||||
# (contacts.updated_by -> users) and RLS visibility assertions would
|
||||
# operate on an empty database.
|
||||
await admin_session.commit()
|
||||
|
||||
yield {
|
||||
"tenant_a": tenant_a,
|
||||
"tenant_b": tenant_b,
|
||||
"user_a": user_a,
|
||||
@@ -182,6 +194,26 @@ async def seed_data(admin_session: AsyncSession):
|
||||
"contact_b": contact_b,
|
||||
}
|
||||
|
||||
# Teardown: remove seeded rows so the committed data does not leak into
|
||||
# other tests (order respects FK dependencies).
|
||||
await admin_session.execute(
|
||||
text("DELETE FROM contacts WHERE id IN (:a, :b)"),
|
||||
{"a": contact_a.id, "b": contact_b.id},
|
||||
)
|
||||
await admin_session.execute(
|
||||
text("DELETE FROM user_tenants WHERE user_id IN (:a, :b)"),
|
||||
{"a": user_a.id, "b": user_b.id},
|
||||
)
|
||||
await admin_session.execute(
|
||||
text("DELETE FROM users WHERE id IN (:a, :b)"),
|
||||
{"a": user_a.id, "b": user_b.id},
|
||||
)
|
||||
await admin_session.execute(
|
||||
text("DELETE FROM tenants WHERE id IN (:a, :b)"),
|
||||
{"a": tenant_a.id, "b": tenant_b.id},
|
||||
)
|
||||
await admin_session.commit()
|
||||
|
||||
|
||||
# ── RLS Enforcement Tests with Unprivileged Role ─────────────────────────────
|
||||
|
||||
@@ -210,10 +242,10 @@ async def test_rls_tenant_a_sees_only_own_rows(api_session: AsyncSession, seed_d
|
||||
)
|
||||
rows = result.fetchall()
|
||||
for row in rows:
|
||||
assert row[0] == str(tenant_a.id), \
|
||||
assert str(row[0]) == str(tenant_a.id), \
|
||||
f"RLS leak: tenant A context shows row from {row[0]}"
|
||||
# Tenant B's contact must not be visible
|
||||
tenant_b_ids = [r[0] for r in rows if r[0] == str(tenant_b.id)]
|
||||
tenant_b_ids = [r for r in rows if str(r[0]) == str(tenant_b.id)]
|
||||
assert len(tenant_b_ids) == 0, "RLS failed: Tenant B data visible in Tenant A context!"
|
||||
|
||||
|
||||
@@ -230,9 +262,9 @@ async def test_rls_tenant_b_sees_only_own_rows(api_session: AsyncSession, seed_d
|
||||
)
|
||||
rows = result.fetchall()
|
||||
for row in rows:
|
||||
assert row[0] == str(tenant_b.id), \
|
||||
assert str(row[0]) == str(tenant_b.id), \
|
||||
f"RLS leak: tenant B context shows row from {row[0]}"
|
||||
tenant_a_ids = [r[0] for r in rows if r[0] == str(tenant_a.id)]
|
||||
tenant_a_ids = [r for r in rows if str(r[0]) == str(tenant_a.id)]
|
||||
assert len(tenant_a_ids) == 0, "RLS failed: Tenant A data visible in Tenant B context!"
|
||||
|
||||
|
||||
@@ -246,33 +278,37 @@ async def test_rls_blocks_cross_tenant_insert(api_session: AsyncSession, seed_da
|
||||
|
||||
await set_tenant_context(api_session, tenant_a.id)
|
||||
|
||||
# Try to insert a contact with tenant B's ID while in tenant A context
|
||||
# Try to insert a contact with tenant B's ID while in tenant A context.
|
||||
# asyncpg executes eagerly: the RLS WITH CHECK violation surfaces directly
|
||||
# at execute() (asyncpg InsufficientPrivilege -> SQLAlchemy ProgrammingError,
|
||||
# both subclasses of DBAPIError).
|
||||
new_id = uuid.uuid4()
|
||||
await api_session.execute(
|
||||
text(
|
||||
"INSERT INTO contacts (id, tenant_id, firstname, surname, email_1, "
|
||||
"owner_id, created_by, updated_by, type, displayname) "
|
||||
"VALUES (:id, :tenant_id, :firstname, :surname, :email, :owner, :creator, :updater, :ctype, :dname)"
|
||||
),
|
||||
{
|
||||
"id": str(new_id),
|
||||
"tenant_id": str(tenant_b.id), # Wrong tenant!
|
||||
"firstname": "Cross",
|
||||
"surname": "Tenant",
|
||||
"email": f"cross-{uuid.uuid4().hex[:8]}@test.local",
|
||||
"owner": str(user_a.id),
|
||||
"creator": str(user_a.id),
|
||||
"updater": str(user_a.id),
|
||||
"ctype": "person",
|
||||
"dname": "Cross Tenant",
|
||||
},
|
||||
)
|
||||
|
||||
# The INSERT should fail due to RLS WITH CHECK
|
||||
with pytest.raises(Exception) as exc_info:
|
||||
await api_session.flush()
|
||||
assert "row level security" in str(exc_info.value).lower() or "rls" in str(exc_info.value).lower(), \
|
||||
f"Expected RLS error, got: {exc_info.value}"
|
||||
from sqlalchemy.exc import DBAPIError
|
||||
with pytest.raises(DBAPIError) as exc_info:
|
||||
await api_session.execute(
|
||||
text(
|
||||
"INSERT INTO contacts (id, tenant_id, firstname, surname, email_1, "
|
||||
"owner_id, created_by, updated_by, type, displayname, status) "
|
||||
"VALUES (:id, :tenant_id, :firstname, :surname, :email, :owner, :creator, :updater, :ctype, :dname, 'open')"
|
||||
),
|
||||
{
|
||||
"id": str(new_id),
|
||||
"tenant_id": str(tenant_b.id), # Wrong tenant!
|
||||
"firstname": "Cross",
|
||||
"surname": "Tenant",
|
||||
"email": f"cross-{uuid.uuid4().hex[:8]}@test.local",
|
||||
"owner": str(user_a.id),
|
||||
"creator": str(user_a.id),
|
||||
"updater": str(user_a.id),
|
||||
"ctype": "person",
|
||||
"dname": "Cross Tenant",
|
||||
},
|
||||
)
|
||||
# The INSERT must have failed due to RLS WITH CHECK — verify the message
|
||||
err_text = str(exc_info.value).lower()
|
||||
assert "row-level security" in err_text or "row level security" in err_text, \
|
||||
f"Expected RLS violation, got: {exc_info.value}"
|
||||
# Roll back the failed transaction so subsequent statements work
|
||||
await api_session.rollback()
|
||||
|
||||
|
||||
@@ -325,8 +361,10 @@ async def test_rls_tenant_a_insert_own_succeeds(api_session: AsyncSession, seed_
|
||||
await api_session.execute(
|
||||
text(
|
||||
"INSERT INTO contacts (id, tenant_id, firstname, surname, email_1, "
|
||||
"owner_id, created_by, updated_by, type, displayname) "
|
||||
"VALUES (:id, :tenant_id, :firstname, :surname, :email, :owner, :creator, :updater, :ctype, :dname)"
|
||||
"owner_id, created_by, updated_by, type, displayname, status, "
|
||||
"discount_crew, discount_transport, discount_rental, discount_sale, discount_subrent, discount_total) "
|
||||
"VALUES (:id, :tenant_id, :firstname, :surname, :email, :owner, :creator, :updater, :ctype, :dname, 'open', "
|
||||
"0, 0, 0, 0, 0, 0)"
|
||||
),
|
||||
{
|
||||
"id": str(new_id),
|
||||
|
||||
Reference in New Issue
Block a user