82 lines
3.2 KiB
JavaScript
82 lines
3.2 KiB
JavaScript
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
|
|
require('../src/common');
|
|
|
|
const { AUDIT_CATEGORY_KEYS, AUDIT_CATEGORY_LABELS, buildAuditChanges, recordRequestAuditEvent } = require('../src/data/audit-log');
|
|
const { getDefaultAppSettings } = require('../src/data/app-settings');
|
|
|
|
function createPool(settings) {
|
|
const inserts = [];
|
|
return {
|
|
inserts,
|
|
async query(sql, params) {
|
|
if (String(sql).includes('SELECT id, setting_key, setting_value FROM o_app_settings')) {
|
|
return [[
|
|
{ setting_key: 'audit.enabled', setting_value: JSON.stringify(settings.enabled) },
|
|
{ setting_key: 'audit.categories', setting_value: JSON.stringify(settings.categories) },
|
|
{ setting_key: 'audit.screen_control_commands', setting_value: JSON.stringify(settings.screenControlCommands || []) },
|
|
{ setting_key: 'audit.include_request_metadata', setting_value: JSON.stringify(settings.includeMetadata) }
|
|
]];
|
|
}
|
|
if (String(sql).includes('INSERT INTO o_audit_events')) {
|
|
inserts.push(params);
|
|
}
|
|
return [[]];
|
|
}
|
|
};
|
|
}
|
|
|
|
const request = {
|
|
ip: '192.0.2.10',
|
|
headers: {
|
|
'user-agent': 'audit-test'
|
|
}
|
|
};
|
|
|
|
test('audit categories include weather data sources', () => {
|
|
assert.ok(AUDIT_CATEGORY_KEYS.includes('weather'));
|
|
assert.equal(AUDIT_CATEGORY_LABELS.weather, 'Weather');
|
|
});
|
|
|
|
test('screen control auditing is disabled by default', () => {
|
|
assert.equal(getDefaultAppSettings()['audit.categories'].includes('screen-controls'), false);
|
|
assert.deepEqual(getDefaultAppSettings()['audit.screen_control_commands'], []);
|
|
});
|
|
|
|
test('screen control auditing filters commands and groups navigation', async () => {
|
|
const pool = createPool({ enabled: true, categories: ['screen-controls'], screenControlCommands: ['navigation'], includeMetadata: false });
|
|
await recordRequestAuditEvent(pool, request, { category: 'screen-controls', eventType: 'screen-control.previous' });
|
|
await recordRequestAuditEvent(pool, request, { category: 'screen-controls', eventType: 'screen-control.pause' });
|
|
assert.equal(pool.inserts.length, 1);
|
|
assert.equal(pool.inserts[0][1], 'screen-control.previous');
|
|
});
|
|
|
|
test('audit writer skips disabled categories', async () => {
|
|
const pool = createPool({ enabled: true, categories: ['security'], includeMetadata: true });
|
|
await recordRequestAuditEvent(pool, request, { category: 'authentication', eventType: 'login.success' });
|
|
assert.equal(pool.inserts.length, 0);
|
|
});
|
|
|
|
test('audit writer omits request metadata when disabled', async () => {
|
|
const pool = createPool({ enabled: true, categories: ['authentication'], includeMetadata: false });
|
|
await recordRequestAuditEvent(pool, request, { category: 'authentication', eventType: 'login.success' });
|
|
assert.equal(pool.inserts.length, 1);
|
|
assert.equal(pool.inserts[0][6], null);
|
|
assert.equal(pool.inserts[0][7], null);
|
|
});
|
|
|
|
test('audit changes include only fields with different from and to values', () => {
|
|
assert.deepEqual(buildAuditChanges({
|
|
name: 'Old name',
|
|
playlistId: 4,
|
|
roleIds: [1, 2]
|
|
}, {
|
|
name: 'New name',
|
|
playlistId: 4,
|
|
roleIds: [2, 3]
|
|
}), {
|
|
name: { from: 'Old name', to: 'New name' },
|
|
roleIds: { from: [1, 2], to: [2, 3] }
|
|
});
|
|
}); |