056753e8cb
Phase 1 (tenant isolation):
- g.org_id set on require_auth; assert_tenant()/current_org_id() choke-point helpers.
- Multi-org provisioning: POST /api/admin/users {new_org:true} (super_admin) creates a
new org + its first admin; GET /api/admin/orgs (super_admin sees all, admin own).
- Fixed latent create_org double-id bug (dict id != store key).
- test_saas_tenant.py: org2 admin blocked from org1 group (403), can't list org1
groups/users, sees only own org; super_admin sees all.
Phase 2 (hardening):
- Rate limit login (per-IP + per-username) + chat send (per-user) to protect LLM cost
and slow brute force; services/rate_limit.py (in-memory + disk, no external deps).
- Audit log data/audit/audit.jsonl on org.create, user.promote_super_admin, analytics.export.
- CSV export now org-scoped (admin exports only own org).
All 8 backend suites pass.
84 lines
3.2 KiB
Python
84 lines
3.2 KiB
Python
"""Test: SaaS multi-tenant isolation + hardening basics."""
|
|
import os, sys, tempfile, warnings
|
|
from pathlib import Path
|
|
|
|
warnings.filterwarnings("ignore")
|
|
BACKEND = str(Path(__file__).resolve().parents[1])
|
|
sys.path.insert(0, BACKEND)
|
|
|
|
from app.factory import create_app
|
|
from app.config import Config
|
|
|
|
td = tempfile.mkdtemp()
|
|
Config.DATA_DIR = Path(td)
|
|
sys.path.insert(0, BACKEND + "/scripts")
|
|
from mock_llm import MockLLM
|
|
|
|
app = create_app()
|
|
app.extensions["llm"] = MockLLM()
|
|
C = app.test_client()
|
|
|
|
def tok(u, p): return C.post("/api/auth/login", json={"username": u, "password": p}).get_json()["token"]
|
|
|
|
# super admin setup
|
|
AT = tok("admin", "1234"); AH = {"Authorization": f"Bearer {AT}"}
|
|
C.post("/api/auth/setup", headers=AH, json={"username": "admin", "email": "a@b.co", "password": "newpass"})
|
|
AT = tok("admin", "newpass"); AH = {"Authorization": f"Bearer {AT}"}
|
|
|
|
# create org1 data (a group)
|
|
gid = C.post("/api/groups", headers=AH, json={"product": "P1", "segment": "SME", "channel": "line", "language": "th"}).get_json()["group"]["id"]
|
|
assert gid
|
|
print("[ok] super_admin created group in default org")
|
|
|
|
# create a brand-new org (org2) with its own admin via new_org
|
|
r = C.post("/api/admin/users", headers=AH, json={
|
|
"username": "adm2", "name": "Org2 Admin", "password": "pppp", "role": "admin", "new_org": True
|
|
})
|
|
assert r.status_code == 201, r.get_json()
|
|
org2_id = r.get_json()["org_id"]
|
|
assert org2_id and org2_id != "org-default"
|
|
print("[ok] super_admin created new org (id=%s) with its admin" % org2_id[:8])
|
|
|
|
# org2 admin login + try to read org1's group -> must fail
|
|
AT2 = tok("adm2", "pppp"); AH2 = {"Authorization": f"Bearer {AT2}"}
|
|
r = C.get(f"/api/groups/{gid}", headers=AH2)
|
|
assert r.status_code == 403, ("org2 admin should NOT read org1 group", r.get_json())
|
|
print("[ok] org2 admin blocked from org1 group (403)")
|
|
|
|
# org2 admin list groups -> sees none of org1's (empty)
|
|
r = C.get("/api/groups", headers=AH2)
|
|
assert r.status_code == 200
|
|
groups = r.get_json()["groups"]
|
|
assert all(g.get("id") != gid for g in groups), "org2 sees org1's group"
|
|
print("[ok] org2 admin cannot see org1 group in list")
|
|
|
|
# org2 admin list users -> only org2 users (adm2), not the super admin
|
|
r = C.get("/api/admin/users", headers=AH2)
|
|
names = [u.get("username") for u in r.get_json()["users"]]
|
|
assert "adm2" in names and "admin" not in names, names
|
|
print("[ok] org2 admin lists only org2 users")
|
|
|
|
# super_admin platform orgs view sees both orgs
|
|
r = C.get("/api/admin/orgs", headers=AH)
|
|
orgs = r.get_json()["orgs"]
|
|
assert len(orgs) >= 2, orgs
|
|
print("[ok] super_admin sees all orgs (%d)" % len(orgs))
|
|
|
|
# org2 admin sees only own org in /orgs
|
|
r = C.get("/api/admin/orgs", headers=AH2)
|
|
orgs = r.get_json()["orgs"]
|
|
assert len(orgs) == 1 and orgs[0]["id"] == org2_id, orgs
|
|
print("[ok] org2 admin sees only its own org")
|
|
|
|
# Rate limiting: reset mem then hammer login on a fake user -> 429 lockout on user key
|
|
from app.services import rate_limit
|
|
rate_limit._mem.clear()
|
|
code = None
|
|
for _ in range(11):
|
|
code = C.post("/api/auth/login", json={"username": "nobody", "password": "x"}).status_code
|
|
assert code == 429, ("expected 429 after login hammering", code)
|
|
rate_limit._mem.clear()
|
|
print("[ok] login rate-limit returns 429 after abuse")
|
|
|
|
print("ALL SAAS MULTI-TENANT TESTS PASSED")
|