mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-27 05:57:27 +00:00
rcourtman
72eaab444f
Schema v6 shipped audit_logging_persistent and audit_events_30d as Pro adoption signals. Neither discriminated. pkg/server installs the SQLite audit logger on every install for defense in depth and gates only the read/export endpoints, so the boolean was true on all 8 installs that had taken rc.8 and 0 rows in the retained table have ever had it false. The event count measured that background write volume: three of those eight unlicensed community installs were pegged at the receiver's 100000 clamp ceiling, with the rest between 4863 and 67509. Schema v7 replaces both with audit_reads_30d, a count of requests that cleared the license gate on an audit read or export surface. A read requires a human action, so unlike store presence or write volume it cannot settle into a constant. The recorder is wrapped INSIDE RequireLicenseFeature so unentitled requests never count, and the persisted marker carries a timestamp and a coarse activity class from a fixed allowlist. Query filters, actors, ranges, and every audit row read stay on the install. The retired columns are left in the live database. They hold real rc.8 rows and migrations only add, so dropping them would be a pointless risk; nothing writes them once the receiver struct loses the fields. Adds the guard this class needed. LicensedFeatureAdoptionFields registers every field that exists to measure licensed-feature adoption, and TestLicensedFeatureAdoptionFieldsDiscriminate builds an unused install through the real production snapshot paths, installs a real SQLite audit logger exactly as pkg/server does, records a baseline audit event, and fails if any registered field is non-zero. Pinning a console logger there would have made the guard pass while the payload lied, so it deliberately does not. The guard was verified by reintroducing the v6 sourcing and confirming it fails with the field named. A companion test pins the three retired fields so they cannot return under their old names. This is the third instance of one bug class. v6 removed pulse_intelligence_patrol_autofixes_30d, hardcoded to zero with no increment site, and then introduced two fields that were constant in the other direction. Three occurrences is a guard, not a habit. Verified end to end on a running unlicensed install: the payload that reported audit_logging_persistent true under v6 now reports audit_reads_30d 0, and seeding two in-window reads, one outside the window, and one with an invalid activity class yields 2.
113 lines
3.8 KiB
Go
113 lines
3.8 KiB
Go
package api
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"reflect"
|
|
"testing"
|
|
|
|
"github.com/rcourtman/pulse-go-rewrite/internal/config"
|
|
)
|
|
|
|
func newAuditReadActivityRouter(t *testing.T) (*Router, *config.ConfigPersistence) {
|
|
t.Helper()
|
|
persistence := config.NewConfigPersistence(t.TempDir())
|
|
return &Router{persistence: persistence}, persistence
|
|
}
|
|
|
|
func countRecordedAuditReads(t *testing.T, persistence *config.ConfigPersistence) int {
|
|
t.Helper()
|
|
history, err := persistence.LoadAuditReadActivityHistory()
|
|
if err != nil {
|
|
t.Fatalf("LoadAuditReadActivityHistory: %v", err)
|
|
}
|
|
if history == nil {
|
|
return 0
|
|
}
|
|
return len(history.Events)
|
|
}
|
|
|
|
func TestWithAuditReadActivity_RecordsAndStillServes(t *testing.T) {
|
|
router, persistence := newAuditReadActivityRouter(t)
|
|
|
|
served := false
|
|
handler := router.withAuditReadActivity(config.AuditReadActivityExport, func(w http.ResponseWriter, req *http.Request) {
|
|
served = true
|
|
w.WriteHeader(http.StatusOK)
|
|
})
|
|
|
|
rec := httptest.NewRecorder()
|
|
handler(rec, httptest.NewRequest(http.MethodGet, "/api/audit/export", nil))
|
|
|
|
if !served {
|
|
t.Fatal("wrapped handler was not invoked")
|
|
}
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want 200", rec.Code)
|
|
}
|
|
if got := countRecordedAuditReads(t, persistence); got != 1 {
|
|
t.Fatalf("recorded audit reads = %d, want 1", got)
|
|
}
|
|
}
|
|
|
|
// The recorded marker must carry the activity class and nothing that could
|
|
// describe what was read.
|
|
func TestWithAuditReadActivity_RecordIsContentFree(t *testing.T) {
|
|
router, persistence := newAuditReadActivityRouter(t)
|
|
|
|
handler := router.withAuditReadActivity(config.AuditReadActivityList, func(w http.ResponseWriter, req *http.Request) {})
|
|
req := httptest.NewRequest(http.MethodGet, "/api/audit?user=alice&event=login&start=2026-01-01", nil)
|
|
handler(httptest.NewRecorder(), req)
|
|
|
|
history, err := persistence.LoadAuditReadActivityHistory()
|
|
if err != nil {
|
|
t.Fatalf("LoadAuditReadActivityHistory: %v", err)
|
|
}
|
|
if len(history.Events) != 1 {
|
|
t.Fatalf("events = %d, want 1", len(history.Events))
|
|
}
|
|
record := history.Events[0]
|
|
if record.Activity != config.AuditReadActivityList {
|
|
t.Fatalf("activity = %q, want %q", record.Activity, config.AuditReadActivityList)
|
|
}
|
|
if record.Timestamp.IsZero() {
|
|
t.Fatal("record must carry a timestamp")
|
|
}
|
|
// The record type has exactly two fields; a future field carrying query
|
|
// filters or actors would have to be added deliberately and would fail the
|
|
// privacy disclosure guard.
|
|
if got := recordFieldCount(record); got != 2 {
|
|
t.Fatalf("AuditReadActivityRecord has %d fields, want 2 (timestamp, activity)", got)
|
|
}
|
|
}
|
|
|
|
// Unknown activity classes are dropped rather than stored, so a future caller
|
|
// cannot widen what this history means by passing a new string.
|
|
func TestRecordAuditReadActivity_RejectsUnknownActivity(t *testing.T) {
|
|
router, persistence := newAuditReadActivityRouter(t)
|
|
|
|
handler := router.withAuditReadActivity("peeked-at-everything", func(w http.ResponseWriter, req *http.Request) {})
|
|
handler(httptest.NewRecorder(), httptest.NewRequest(http.MethodGet, "/api/audit", nil))
|
|
|
|
if got := countRecordedAuditReads(t, persistence); got != 0 {
|
|
t.Fatalf("recorded audit reads = %d for an unknown activity class, want 0", got)
|
|
}
|
|
}
|
|
|
|
// A router with no persistence must not panic: the audit routes are reachable
|
|
// before every dependency is guaranteed to be wired.
|
|
func TestWithAuditReadActivity_NilPersistenceIsSafe(t *testing.T) {
|
|
served := false
|
|
handler := (&Router{}).withAuditReadActivity(config.AuditReadActivityList, func(w http.ResponseWriter, req *http.Request) {
|
|
served = true
|
|
})
|
|
handler(httptest.NewRecorder(), httptest.NewRequest(http.MethodGet, "/api/audit", nil))
|
|
if !served {
|
|
t.Fatal("handler must still run when activity cannot be recorded")
|
|
}
|
|
}
|
|
|
|
func recordFieldCount(record config.AuditReadActivityRecord) int {
|
|
return reflect.TypeOf(record).NumField()
|
|
}
|