PTah
d3a337992c
Path traversal fix in SPA fallback, admin-only host delete, login rate limit with 3 attempts and Telegram alert, JWT validated against active users in DB, and DOMPurify for agent report HTML. Co-authored-by: Cursor <cursoragent@cursor.com>
107 lines
2.9 KiB
Python
107 lines
2.9 KiB
Python
"""Hosts list API."""
|
|
|
|
import uuid
|
|
from datetime import datetime, timezone
|
|
|
|
from app.models import Event, Host, Problem
|
|
|
|
|
|
def test_hosts_search_by_display_name(client, db_session, jwt_headers):
|
|
h = Host(
|
|
hostname="pc-01",
|
|
display_name="UNMS Kalina",
|
|
os_family="linux",
|
|
product="ssh-monitor",
|
|
last_seen_at=datetime.now(timezone.utc),
|
|
)
|
|
db_session.add(h)
|
|
db_session.commit()
|
|
|
|
r = client.get("/api/v1/hosts?hostname=UNMS", headers=jwt_headers)
|
|
assert r.status_code == 200
|
|
body = r.json()
|
|
assert body["total"] == 1
|
|
assert body["items"][0]["display_name"] == "UNMS Kalina"
|
|
|
|
r2 = client.get("/api/v1/hosts?hostname=nomatch", headers=jwt_headers)
|
|
assert r2.json()["total"] == 0
|
|
|
|
|
|
def test_delete_host_removes_events_and_problems(client, db_session, jwt_headers):
|
|
h = Host(
|
|
hostname="test-host",
|
|
os_family="linux",
|
|
product="ssh-monitor",
|
|
last_seen_at=datetime.now(timezone.utc),
|
|
)
|
|
db_session.add(h)
|
|
db_session.flush()
|
|
ev = Event(
|
|
event_id=str(uuid.uuid4()),
|
|
host_id=h.id,
|
|
occurred_at=datetime.now(timezone.utc),
|
|
category="agent",
|
|
type="agent.test",
|
|
severity="info",
|
|
title="t",
|
|
summary="s",
|
|
payload={},
|
|
)
|
|
db_session.add(ev)
|
|
db_session.add(
|
|
Problem(
|
|
host_id=h.id,
|
|
title="p",
|
|
summary="s",
|
|
severity="warning",
|
|
status="open",
|
|
rule_id="rule:test",
|
|
fingerprint="fp-del-host",
|
|
event_count=1,
|
|
last_seen_at=datetime.now(timezone.utc),
|
|
)
|
|
)
|
|
db_session.commit()
|
|
|
|
r = client.delete(f"/api/v1/hosts/{h.id}", headers=jwt_headers)
|
|
assert r.status_code == 200
|
|
body = r.json()
|
|
assert body["hostname"] == "test-host"
|
|
assert body["deleted_events"] == 1
|
|
assert body["deleted_problems"] == 1
|
|
assert db_session.get(Host, h.id) is None
|
|
|
|
|
|
def test_delete_host_404(client, jwt_headers):
|
|
r = client.delete("/api/v1/hosts/999999", headers=jwt_headers)
|
|
assert r.status_code == 404
|
|
|
|
|
|
def test_delete_host_forbidden_for_monitor(client, db_session, jwt_monitor_headers):
|
|
h = Host(
|
|
hostname="monitor-blocked",
|
|
os_family="linux",
|
|
product="ssh-monitor",
|
|
last_seen_at=datetime.now(timezone.utc),
|
|
)
|
|
db_session.add(h)
|
|
db_session.commit()
|
|
|
|
r = client.delete(f"/api/v1/hosts/{h.id}", headers=jwt_monitor_headers)
|
|
assert r.status_code == 403
|
|
assert db_session.get(Host, h.id) is not None
|
|
|
|
|
|
def test_delete_host_requires_jwt(client, db_session):
|
|
h = Host(
|
|
hostname="no-auth",
|
|
os_family="linux",
|
|
product="ssh-monitor",
|
|
last_seen_at=datetime.now(timezone.utc),
|
|
)
|
|
db_session.add(h)
|
|
db_session.commit()
|
|
r = client.delete(f"/api/v1/hosts/{h.id}")
|
|
assert r.status_code == 401
|
|
|