Function TestDatabaseConfigAuditAPI

rest/adminapitest/admin_api_test.go:3956–4104

(t *testing.T)

}

func TestDatabaseConfigAuditAPI(t *testing.T) {
	if !base.IsEnterpriseEdition() {
		t.Skip("Audit logging is an EE-only feature")
	}

	rt := rest.NewRestTesterPersistentConfig(t)
	defer rt.Close()

	// check default audit config - verbose to read event names, etc.
	resp := rt.SendAdminRequest(http.MethodGet, "/db/_config/audit?verbose=true", "")
	rest.RequireStatus(t, resp, http.StatusOK)
	resp.DumpBody()
	var responseBody map[string]interface{}
	require.NoError(t, json.Unmarshal(resp.Body.Bytes(), &responseBody))
	assert.Equal(t, false, responseBody["enabled"].(bool))
	// check we got the verbose output
	assert.NotEmpty(t, responseBody["events"].(map[string]interface{})[base.AuditIDPublicUserAuthenticated.String()].(map[string]interface{})["description"].(string), "expected verbose output (event description, etc.)")
	// check that global event IDs were not present
	assert.Nil(t, responseBody["events"].(map[string]interface{})[base.AuditIDSyncGatewayCollectInfoStart.String()], "expected global event ID to not be present")

	// enable auditing on the database (upsert)
	resp = rt.SendAdminRequest(http.MethodPost, "/db/_config/audit", `{"enabled":true}`)
	rest.RequireStatus(t, resp, http.StatusOK)

	// check audit config
	resp = rt.SendAdminRequest(http.MethodGet, "/db/_config/audit", "")
	rest.RequireStatus(t, resp, http.StatusOK)
	resp.DumpBody()
	responseBody = nil
	require.NoError(t, json.Unmarshal(resp.Body.Bytes(), &responseBody))
	assert.Equal(t, true, responseBody["enabled"].(bool))
	eventsMap, ok := responseBody["events"].(map[string]interface{})
	require.True(t, ok)
	assert.False(t, eventsMap[base.AuditIDISGRStatus.String()].(bool), "audit enabled event should be disabled by default")
	assert.True(t, eventsMap[base.AuditIDPublicUserAuthenticated.String()].(bool), "public user authenticated event should be enabled by default")

	// use event IDs returned from GET response to disable all of them
	for id := range eventsMap {
		eventsMap[id] = false
	}
	eventsJSON, err := json.Marshal(eventsMap)
	require.NoError(t, err)

	// CBG-4111: Try to disable events on top of the default (nil) set... either PUT or POST where *all* of the given IDs are set to false. Bug results in a no-op.
	// CBG-4157: Ensure ALL specified events were actually disabled. Bug results in some events remaining 'true', and sometimes panicking by going out-of-bounds in a slice.
	resp = rt.SendAdminRequest(http.MethodPost, "/db/_config/audit", fmt.Sprintf(`{"enabled":true,"events":%s}`, eventsJSON))
	rest.RequireStatus(t, resp, http.StatusOK)
	// check all events were actually disabled
	resp = rt.SendAdminRequest(http.MethodGet, "/db/_config/audit", "")
	rest.RequireStatus(t, resp, http.StatusOK)
	resp.DumpBody()
	responseBody = nil
	require.NoError(t, json.Unmarshal(resp.Body.Bytes(), &responseBody))
	eventsMap, ok = responseBody["events"].(map[string]interface{})
	require.True(t, ok)
	for id, val := range eventsMap {
		assert.False(t, val.(bool), "event %s should be disabled", id)
	}