/
githubmirror
/
salt
Обзор
Документация
Войти
/
githubmirror
/
salt
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
master
tests/pytests/unit/states/postgresql/test_user.py
751 строка
23 KB
Daniel A. Wozniak
Reformat files with black
25 мар 2026, 00:30
25 мар 2026, 00:30
9f0b176
Код
Авторство
О чём код?
import pytest from pytestskipmarkers.utils import platform import salt.modules.postgres as postgres import salt.states.postgres_user as postgres_user from tests.support.mock import create_autospec, patch class ScramHash: def __eq__(self, other): return other.startswith("SCRAM-SHA-256$4096:") @pytest.fixture(name="db_args") def fixture_db_args(): return { "runas": None, "host": None, "port": None, "maintenance_db": None, "user": None, "password": None, } @pytest.fixture(name="md5_pw") def fixture_md5_pw(): # 'md5' + md5('password' + 'username') if platform.is_fips_enabled(): pytest.skip("Test cannot run on a FIPS enabled platform") return "md55a231fcdb710d73268c4f44283487ba2" @pytest.fixture(name="scram_pw") def fixture_scram_pw(): # scram_sha_256('password') return ( "SCRAM-SHA-256$4096:wLr5nqC+3F+r7FdQPnB+nA==$" "0hn08ZdX8kirGaL4TM0j13digH9Wl365OOzCtAuF2pE=:" "LzAh/MGUdjYkdbDzcOKpfGwa3WwPUsyGcY+TEnSpcto=" ) @pytest.fixture(name="existing_user") def fixture_existing_user(md5_pw): return { "superuser": False, "inherits privileges": True, "can create roles": False, "can create databases": False, "can update system catalogs": None, "can login": True, "replication": False, "connections": None, "expiry time": None, "defaults variables": "", "password": md5_pw, "groups": [], } @pytest.fixture(name="test_mode") def fixture_test_mode(): with patch.dict(postgres_user.__opts__, {"test": True}): yield @pytest.fixture def mocks(): return { "postgres.role_get": create_autospec(postgres.role_get, return_value=None), "postgres.user_exists": create_autospec( postgres.user_exists, return_value=False ), "postgres.user_create": create_autospec( postgres.user_create, return_value=True ), "postgres.user_update": create_autospec( postgres.user_update, return_value=True ), "postgres.user_remove": create_autospec( postgres.user_remove, return_value=True ), } @pytest.fixture def configure_loader_modules(mocks): return { postgres_user: {"__opts__": {"test": False}, "__salt__": mocks}, postgres: {"__opts__": {"test": False}}, } # ========== # postgres_user.present # ========== def test_present_create_basic(mocks, db_args): assert postgres_user.present("username") == { "name": "username", "result": True, "changes": {"username": "Present"}, "comment": "The user username has been created", } mocks["postgres.role_get"].assert_called_once_with( "username", return_password=True, **db_args ) mocks["postgres.user_create"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted="md5", superuser=None, login=None, inherit=None, replication=None, rolepassword=None, valid_until=None, groups=None, **db_args, ) mocks["postgres.user_update"].assert_not_called() @pytest.mark.usefixtures("test_mode") def test_present_create_basic_test(mocks, db_args): assert postgres_user.present("username") == { "name": "username", "result": None, "changes": {}, "comment": "User username is set to be created", } mocks["postgres.role_get"].assert_called_once_with( "username", return_password=True, **db_args ) mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_not_called() def test_present_exists_basic(mocks, existing_user, db_args): mocks["postgres.role_get"].return_value = existing_user assert postgres_user.present("username") == { "name": "username", "result": True, "changes": {}, "comment": "User username is already present", } mocks["postgres.role_get"].assert_called_once_with( "username", return_password=True, **db_args ) mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_not_called() def test_present_create_basic_error(mocks, db_args): mocks["postgres.user_create"].return_value = False assert postgres_user.present("username") == { "name": "username", "result": False, "changes": {}, "comment": "Failed to create user username", } mocks["postgres.role_get"].assert_called_once_with( "username", return_password=True, **db_args ) mocks["postgres.user_create"].assert_called_once() mocks["postgres.user_update"].assert_not_called() def test_present_change_option(mocks, existing_user, db_args): mocks["postgres.role_get"].return_value = existing_user assert postgres_user.present("username", replication=True) == { "name": "username", "result": True, "changes": {"username": {"replication": True}}, "comment": "The user username has been updated", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted="md5", superuser=None, login=None, inherit=None, replication=True, rolepassword=None, valid_until=None, groups=None, **db_args, ) def test_present_create_md5_password(mocks, md5_pw, db_args): assert postgres_user.present("username", password="password", encrypted=True) == { "name": "username", "result": True, "changes": {"username": "Present"}, "comment": "The user username has been created", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted=True, superuser=None, login=None, inherit=None, replication=None, rolepassword=md5_pw, valid_until=None, groups=None, **db_args, ) mocks["postgres.user_update"].assert_not_called() def test_present_create_scram_password(mocks, db_args): assert postgres_user.present( "username", password="password", encrypted="scram-sha-256" ) == { "name": "username", "result": True, "changes": {"username": "Present"}, "comment": "The user username has been created", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted="scram-sha-256", superuser=None, login=None, inherit=None, replication=None, rolepassword=ScramHash(), valid_until=None, groups=None, **db_args, ) mocks["postgres.user_update"].assert_not_called() def test_present_create_plain_password(mocks, db_args): assert postgres_user.present("username", password="password", encrypted=False) == { "name": "username", "result": True, "changes": {"username": "Present"}, "comment": "The user username has been created", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted=False, superuser=None, login=None, inherit=None, replication=None, rolepassword="password", valid_until=None, groups=None, **db_args, ) mocks["postgres.user_update"].assert_not_called() def test_present_create_md5_password_default_plain(mocks, monkeypatch, md5_pw, db_args): monkeypatch.setattr(postgres, "_DEFAULT_PASSWORDS_ENCRYPTION", False) test_present_create_md5_password(mocks, md5_pw, db_args) def test_present_create_md5_password_default_encrypted( mocks, monkeypatch, md5_pw, db_args ): monkeypatch.setattr(postgres, "_DEFAULT_PASSWORDS_ENCRYPTION", True) assert postgres_user.present("username", password="password") == { "name": "username", "result": True, "changes": {"username": "Present"}, "comment": "The user username has been created", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted=True, superuser=None, login=None, inherit=None, replication=None, rolepassword=md5_pw, valid_until=None, groups=None, **db_args, ) mocks["postgres.user_update"].assert_not_called() def test_present_create_md5_prehashed(mocks, md5_pw, db_args): assert postgres_user.present("username", password=md5_pw, encrypted=True) == { "name": "username", "result": True, "changes": {"username": "Present"}, "comment": "The user username has been created", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted=True, superuser=None, login=None, inherit=None, replication=None, rolepassword=md5_pw, valid_until=None, groups=None, **db_args, ) mocks["postgres.user_update"].assert_not_called() def test_present_md5_matches(mocks, existing_user): mocks["postgres.role_get"].return_value = existing_user assert postgres_user.present("username", password="password", encrypted=True) == { "name": "username", "result": True, "changes": {}, "comment": "User username is already present", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_not_called() def test_present_md5_matches_prehashed(mocks, existing_user, md5_pw): mocks["postgres.role_get"].return_value = existing_user assert postgres_user.present("username", password=md5_pw, encrypted=True) == { "name": "username", "result": True, "changes": {}, "comment": "User username is already present", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_not_called() def test_present_scram_matches(mocks, existing_user, scram_pw): existing_user["password"] = scram_pw mocks["postgres.role_get"].return_value = existing_user assert postgres_user.present( "username", password="password", encrypted="scram-sha-256" ) == { "name": "username", "result": True, "changes": {}, "comment": "User username is already present", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_not_called() def test_present_scram_matches_prehashed(mocks, existing_user, scram_pw): existing_user["password"] = scram_pw mocks["postgres.role_get"].return_value = existing_user assert postgres_user.present( "username", password=scram_pw, encrypted="scram-sha-256" ) == { "name": "username", "result": True, "changes": {}, "comment": "User username is already present", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_not_called() def test_present_update_md5_password(mocks, existing_user, md5_pw, db_args): existing_user["password"] = "md500000000000000000000000000000000" mocks["postgres.role_get"].return_value = existing_user assert postgres_user.present("username", password="password", encrypted=True) == { "name": "username", "result": True, "changes": {"username": {"password": True}}, "comment": "The user username has been updated", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted=True, superuser=None, login=None, inherit=None, replication=None, rolepassword=md5_pw, valid_until=None, groups=None, **db_args, ) def test_present_refresh_scram_password(mocks, existing_user, scram_pw, db_args): existing_user["password"] = scram_pw mocks["postgres.role_get"].return_value = existing_user assert postgres_user.present( "username", password="password", encrypted="scram-sha-256", refresh_password=True, ) == { "name": "username", "result": True, "changes": {"username": {"password": True}}, "comment": "The user username has been updated", } mocks["postgres.role_get"].assert_called_once_with( "username", return_password=False, **db_args ) mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted="scram-sha-256", superuser=None, login=None, inherit=None, replication=None, rolepassword=ScramHash(), valid_until=None, groups=None, **db_args, ) def test_present_update_error(mocks, existing_user): existing_user["password"] = "md500000000000000000000000000000000" mocks["postgres.role_get"].return_value = existing_user mocks["postgres.user_update"].return_value = False assert postgres_user.present("username", password="password", encrypted=True) == { "name": "username", "result": False, "changes": {}, "comment": "Failed to update user username", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_called_once() def test_present_update_password_no_check(mocks, existing_user, md5_pw, db_args): del existing_user["password"] mocks["postgres.role_get"].return_value = existing_user assert postgres_user.present( "username", password="password", encrypted=True, refresh_password=True ) == { "name": "username", "result": True, "changes": {"username": {"password": True}}, "comment": "The user username has been updated", } mocks["postgres.role_get"].assert_called_once_with( "username", return_password=False, **db_args ) mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted=True, superuser=None, login=None, inherit=None, replication=None, rolepassword=md5_pw, valid_until=None, groups=None, **db_args, ) def test_present_create_default_password(mocks, md5_pw, db_args): assert postgres_user.present( "username", default_password="password", encrypted=True ) == { "name": "username", "result": True, "changes": {"username": "Present"}, "comment": "The user username has been created", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted=True, superuser=None, login=None, inherit=None, replication=None, rolepassword=md5_pw, valid_until=None, groups=None, **db_args, ) def test_present_create_unused_default_password(mocks, md5_pw, db_args): assert postgres_user.present( "username", password="password", default_password="changeme", encrypted=True ) == { "name": "username", "result": True, "changes": {"username": "Present"}, "comment": "The user username has been created", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted=True, superuser=None, login=None, inherit=None, replication=None, rolepassword=md5_pw, valid_until=None, groups=None, **db_args, ) mocks["postgres.user_update"].assert_not_called() def test_present_existing_default_password(mocks, existing_user): mocks["postgres.role_get"].return_value = existing_user assert postgres_user.present( "username", default_password="changeme", encrypted=True, refresh_password=True ) == { "name": "username", "result": True, "changes": {}, "comment": "User username is already present", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_not_called() def test_present_plain_to_scram(mocks, existing_user, db_args): existing_user["password"] = "password" mocks["postgres.role_get"].return_value = existing_user assert postgres_user.present( "username", password="password", encrypted="scram-sha-256" ) == { "name": "username", "result": True, "changes": {"username": {"password": True}}, "comment": "The user username has been updated", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted="scram-sha-256", superuser=None, login=None, inherit=None, replication=None, rolepassword=ScramHash(), valid_until=None, groups=None, **db_args, ) def test_present_plain_to_md5(mocks, existing_user, md5_pw, db_args): existing_user["password"] = "password" mocks["postgres.role_get"].return_value = existing_user assert postgres_user.present("username", password="password", encrypted="md5") == { "name": "username", "result": True, "changes": {"username": {"password": True}}, "comment": "The user username has been updated", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted="md5", superuser=None, login=None, inherit=None, replication=None, rolepassword=md5_pw, valid_until=None, groups=None, **db_args, ) def test_present_md5_to_scram(mocks, existing_user, db_args): mocks["postgres.role_get"].return_value = existing_user assert postgres_user.present( "username", password="password", encrypted="scram-sha-256" ) == { "name": "username", "result": True, "changes": {"username": {"password": True}}, "comment": "The user username has been updated", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted="scram-sha-256", superuser=None, login=None, inherit=None, replication=None, rolepassword=ScramHash(), valid_until=None, groups=None, **db_args, ) def test_present_scram_to_md5(mocks, existing_user, scram_pw, md5_pw, db_args): existing_user["password"] = scram_pw mocks["postgres.role_get"].return_value = existing_user assert postgres_user.present("username", password="password", encrypted="md5") == { "name": "username", "result": True, "changes": {"username": {"password": True}}, "comment": "The user username has been updated", } mocks["postgres.role_get"].assert_called_once() mocks["postgres.user_create"].assert_not_called() mocks["postgres.user_update"].assert_called_once_with( username="username", createdb=None, createroles=None, encrypted="md5", superuser=None, login=None, inherit=None, replication=None, rolepassword=md5_pw, valid_until=None, groups=None, **db_args, ) # ========== # postgres_user.absent # ========== def test_absent_delete(mocks, db_args): mocks["postgres.user_exists"].return_value = True assert postgres_user.absent("username") == { "name": "username", "result": True, "changes": {"username": "Absent"}, "comment": "User username has been removed", } mocks["postgres.user_exists"].assert_called_once_with("username", **db_args) mocks["postgres.user_remove"].assert_called_once_with("username", **db_args) @pytest.mark.usefixtures("test_mode") def test_absent_test(mocks, db_args): mocks["postgres.user_exists"].return_value = True assert postgres_user.absent("username") == { "name": "username", "result": None, "changes": {}, "comment": "User username is set to be removed", } mocks["postgres.user_exists"].assert_called_once_with("username", **db_args) mocks["postgres.user_remove"].assert_not_called() def test_absent_already(mocks, db_args): mocks["postgres.user_exists"].return_value = False assert postgres_user.absent("username") == { "name": "username", "result": True, "changes": {}, "comment": "User username is not present, so it cannot be removed", } mocks["postgres.user_exists"].assert_called_once_with("username", **db_args) mocks["postgres.user_remove"].assert_not_called() def test_absent_error(mocks): mocks["postgres.user_exists"].return_value = True mocks["postgres.user_remove"].return_value = False assert postgres_user.absent("username") == { "name": "username", "result": False, "changes": {}, "comment": "User username failed to be removed", } mocks["postgres.user_exists"].assert_called_once() mocks["postgres.user_remove"].assert_called_once()