Guides image + draft gating, audit retention, ADR-015 gate, backup credential redaction

tests/test_plugins/test_backups.py

@@ -1416,3 +1416,112 @@ def test_the_card_omits_the_snapshot_row_when_no_path_is_passed(bk_app, bk_plugi
     from plugins.backups.services import partmarkerinfo
     card = partmarkerinfo.build(_markermanifest(['A.PAT']), 1)
     assert 'Snapshot' not in [f['label'] for f in card['fields']]
+
+
+def test_an_empty_source_hostname_still_dedups(bk_app, bk_plugin):
+    """A client posting sourcehostname='' must not defeat dedup forever.
+
+    samesource() maps '' to IS NULL for the QUERY, but the insert stored the raw
+    '' - so the rows a client wrote could never match its own next post. Every
+    post inserted, the table grew without bound, and the revision history filled
+    with identical entries nobody could read.
+    """
+    from plugins.backups.models import BackupRevision
+    with bk_app.app_context():
+        first = bk_plugin.apply_collector_payload(_payload(sourcehostname=''))
+        assert first['action'] == 'created'
+
+        second = bk_plugin.apply_collector_payload(_payload(sourcehostname=''))
+        assert second['action'] == 'noop', 'an identical re-post must dedup'
+
+        rows = BackupRevision.query.all()
+        assert len(rows) == 1
+        assert rows[0].sourcehostname is None, \
+            "'' is stored as NULL, matching how samesource() queries it"
+
+
+def test_a_padded_source_hostname_is_the_same_source(bk_app, bk_plugin):
+    """Whitespace must not fork a machine's history into two chains."""
+    with bk_app.app_context():
+        bk_plugin.apply_collector_payload(_payload(sourcehostname='GGBX0NH3ESF'))
+        second = bk_plugin.apply_collector_payload(
+            _payload(sourcehostname='  GGBX0NH3ESF  '))
+        assert second['action'] == 'noop'
+
+
+# ---------------------------------------------------------------------------
+# Credential redaction. The DNC registry carries an FTP password in cleartext;
+# stored verbatim it reached the database, the revision panel and the download
+# route, so anyone with backups.view could read the fleet's password off a page.
+# ---------------------------------------------------------------------------
+
+# A configured install that also carries the FTP credential, which is what a
+# real marker/DNC bay actually has in its registry.
+SECRETREG = CONFIGUREDREG.replace(
+    '"MachineNo"="3204"',
+    '"MachineNo"="3204"\r\n"FtpPasswd"="hunter2"\r\n"FtpUser"="dnc"')
+
+
+def test_a_credential_never_enters_the_projection():
+    """Redaction happens at parse, so the secret is never persisted.
+
+    Redacting on display instead would leave it at rest and one query away.
+    """
+    import json
+    from plugins.backups.services import ntlars
+
+    projection = ntlars.parse(_asbytes(SECRETREG))
+
+    assert 'hunter2' not in json.dumps(projection)
+    assert projection['redacted'] == ['General\\FtpPasswd']
+    values = dict(projection['keys'][0]['values'])
+    for key in projection['keys']:
+        values.update(key['values'])
+    assert values['FtpPasswd']['data'] == ntlars.REDACTEDMARKER
+    assert values['FtpUser']['data'] == 'dnc', 'only credentials are withheld'
+
+
+def test_a_redacted_value_is_commented_out_not_imported():
+    """Importing the marker as a password yields a machine that cannot log in.
+
+    It would LOOK restored, and the technician would go debugging the network.
+    A commented-out value fails at the one moment somebody is reading the file.
+    """
+    from plugins.backups.services import ntlars
+
+    text = ntlars.render(ntlars.parse(_asbytes(SECRETREG))).decode('utf-16-le')
+
+    assert 'hunter2' not in text
+    assert ntlars.REDACTEDMARKER not in text
+    assert 'FtpPasswd' in text, 'the omission must be named, not silent'
+    assert '"FtpPasswd"="' not in text, 'must not be an importable value line'
+    assert '"FtpUser"="dnc"' in text, 'everything else still restores'
+
+
+def test_the_download_route_cannot_hand_back_a_password(bk_app, bk_plugin):
+    """End to end: post a config with a password, download it back."""
+    with bk_app.app_context():
+        result = bk_plugin.apply_collector_payload(_payload(reg=SECRETREG))
+        assert result['action'] == 'created'
+
+        from plugins.backups.models import BackupRevision
+        revision = _db.session.get(BackupRevision, result['backuprevisionid'])
+        stored = json.dumps(revision.payload)
+        assert 'hunter2' not in stored
+
+        rendered = ntlars_render(revision.payload)
+        assert 'hunter2' not in rendered
+
+
+def ntlars_render(projection):
+    from plugins.backups.services import ntlars
+    return ntlars.render(projection).decode('utf-16-le')
+
+
+def test_secret_name_matching_covers_the_usual_spellings():
+    from plugins.backups.services.ntlars import issecretname
+    for name in ('FtpPasswd', 'Password', 'ftp_pwd', 'ApiKey', 'AuthToken',
+                 'ClientSecret'):
+        assert issecretname(name), name
+    for name in ('FtpUser', 'FMSHost', 'Retries', 'Passive'):
+        assert not issecretname(name), name