edf2475413
* fix: harden API token handling against rate-limit tampering and plaintext logging - Make `allowed_rate_limit` read-only on APITokenSerializer so users can no longer raise their own API token rate limit via PATCH (GHSA-xfgr-2x3f-g2cf). - Stop persisting API keys in plaintext in APITokenLogMiddleware: store a SHA-256 hash as the token identifier and redact sensitive request headers (X-Api-Key, Authorization, Cookie) before logging (GHSA-r5p8-cj3q-38cc). * refactor: remove MongoDB log sink and add per-log-type retention Logs are now written to and cleared from PostgreSQL only; MongoDB is no longer used as a log sink or archive. - Drop the MongoDB write/archival paths from the API request logger, the webhook log writer, and the cleanup tasks; Postgres is the sole sink. - Cleanup tasks now hard-delete expired rows in batches via `all_objects` (rows are removed immediately, not soft-deleted). - Add env-backed, per-log-type retention settings: API activity logs (API_ACTIVITY_LOG_RETENTION_DAYS, default 14), webhook logs (WEBHOOK_LOG_RETENTION_DAYS, default 14), email logs (EMAIL_LOG_RETENTION_DAYS, default 7). HARD_DELETE_AFTER_DAYS no longer drives any log cleanup. - Delete settings/mongo.py, remove MONGO_DB_* settings and the plane.mongo loggers, and drop the pymongo dependency. * chore: gitignore local advisories.md notes file * fix: use keyed HMAC-SHA256 for API token log identifier Address CodeQL "weak hashing of sensitive data" by hashing the API key with a SECRET_KEY-keyed HMAC instead of a bare SHA-256. The identifier is a non-reversible tokenization of a high-entropy key (not password storage); keying it also prevents precomputing the digest from a known key value. * chore: address review feedback on log cleanup and request logging - process_logs accepts extra kwargs so jobs enqueued by an older release (with a mongo_log arg) don't fail during a rolling deploy. - Log-cleanup batch delete failures are logged and skipped rather than aborting the run, so a single bad batch can't block the rest. - Extend logger middleware test to assert Authorization and Cookie headers are redacted; add a test that a failing cleanup batch is swallowed. * fix: fall back to default when a log retention env value is invalid Negative (or unparseable) retention values would compute a future cutoff and delete every log row. The retention settings now fall back to their defaults in that case via a shared `_retention_days` helper.
64 lines
2.1 KiB
Python
64 lines
2.1 KiB
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
import pytest
|
|
from unittest.mock import MagicMock, patch
|
|
|
|
|
|
@pytest.fixture
|
|
def mock_redis():
|
|
"""
|
|
Mock Redis for testing without actual Redis connection.
|
|
|
|
This fixture patches the redis_instance function to return a MagicMock
|
|
that behaves like a Redis client.
|
|
"""
|
|
mock_redis_client = MagicMock()
|
|
|
|
# Configure the mock to handle common Redis operations
|
|
mock_redis_client.get.return_value = None
|
|
mock_redis_client.set.return_value = True
|
|
mock_redis_client.delete.return_value = True
|
|
mock_redis_client.exists.return_value = 0
|
|
mock_redis_client.ttl.return_value = -1
|
|
|
|
# Start the patch
|
|
with patch("plane.settings.redis.redis_instance", return_value=mock_redis_client):
|
|
yield mock_redis_client
|
|
|
|
|
|
@pytest.fixture
|
|
def mock_elasticsearch():
|
|
"""
|
|
Mock Elasticsearch for testing without actual ES connection.
|
|
|
|
This fixture patches Elasticsearch to return a MagicMock
|
|
that behaves like an Elasticsearch client.
|
|
"""
|
|
mock_es_client = MagicMock()
|
|
|
|
# Configure the mock to handle common ES operations
|
|
mock_es_client.indices.exists.return_value = True
|
|
mock_es_client.indices.create.return_value = {"acknowledged": True}
|
|
mock_es_client.search.return_value = {"hits": {"total": {"value": 0}, "hits": []}}
|
|
mock_es_client.index.return_value = {"_id": "test_id", "result": "created"}
|
|
mock_es_client.update.return_value = {"_id": "test_id", "result": "updated"}
|
|
mock_es_client.delete.return_value = {"_id": "test_id", "result": "deleted"}
|
|
|
|
# Start the patch
|
|
with patch("elasticsearch.Elasticsearch", return_value=mock_es_client):
|
|
yield mock_es_client
|
|
|
|
|
|
@pytest.fixture
|
|
def mock_celery():
|
|
"""
|
|
Mock Celery for testing without actual task execution.
|
|
|
|
This fixture patches Celery's task.delay() to prevent actual task execution.
|
|
"""
|
|
# Start the patch
|
|
with patch("celery.app.task.Task.delay") as mock_delay:
|
|
mock_delay.return_value = MagicMock(id="mock-task-id")
|
|
yield mock_delay
|