fixup

test_runner/fixtures/neon_fixtures.py

@@ -40,6 +40,7 @@ from _pytest.fixtures import FixtureRequest
 from psycopg2.extensions import connection as PgConnection
 from psycopg2.extensions import cursor as PgCursor
 from psycopg2.extensions import make_dsn, parse_dsn
+from pytest_httpserver import HTTPServer
 from urllib3.util.retry import Retry
 
 from fixtures import overlayfs

test_runner/regress/test_proxy_allowed_ips.py

@@ -11,9 +11,7 @@ from pytest_httpserver import HTTPServer
 TABLE_NAME = "neon_control_plane.endpoints"
 
 
-# Proxy uses the same logic for psql and websockets.
-@pytest.mark.asyncio
-async def test_proxy_psql_allowed_ips(
+def test_proxy_psql_not_allowed_ips(
     static_proxy: NeonProxy,
     vanilla_pg: VanillaPostgres,
     httpserver: HTTPServer,
@@ -23,9 +21,7 @@ async def test_proxy_psql_allowed_ips(
     )
 
     # Shouldn't be able to connect to this project
-    httpserver.expect_request(
-        "/cplane/proxy_get_role_secret", query_string="project=private-project"
-    ).respond_with_json(
+    httpserver.expect_request("/cplane/proxy_get_role_secret").respond_with_json(
         {
             "role_secret": rolpassword,
             "allowed_ips": ["8.8.8.8"],
@@ -33,24 +29,6 @@ async def test_proxy_psql_allowed_ips(
         }
     )
 
-    # Should be able to connect to this project
-    httpserver.expect_request(
-        "/cplane/proxy_get_role_secret", query_string="project=generic-project"
-    ).respond_with_json(
-        {
-            "role_secret": rolpassword,
-            "allowed_ips": ["::1", "127.0.0.1"],
-            "project_id": "foo-bar",
-        }
-    )
-
-    # vanilla_pg.safe_psql(
-    #     f"INSERT INTO {TABLE_NAME} (endpoint_id, allowed_ips) VALUES ('private-project', '8.8.8.8')"
-    # )
-    # vanilla_pg.safe_psql(
-    #     f"INSERT INTO {TABLE_NAME} (endpoint_id, allowed_ips) VALUES ('generic-project', '::1,127.0.0.1')"
-    # )
-
     def check_cannot_connect(**kwargs):
         with pytest.raises(psycopg2.Error) as exprinfo:
             static_proxy.safe_psql(**kwargs)
@@ -66,6 +44,25 @@ async def test_proxy_psql_allowed_ips(
     # with SNI
     check_cannot_connect(query="select 1", host="private-project.localtest.me")
 
+
+def test_proxy_psql_allowed_ips(
+    static_proxy: NeonProxy,
+    vanilla_pg: VanillaPostgres,
+    httpserver: HTTPServer,
+):
+    [(rolpassword,)] = vanilla_pg.safe_psql(
+        "select rolpassword from pg_catalog.pg_authid where rolname = 'proxy'"
+    )
+
+    # Should be able to connect to this project
+    httpserver.expect_request("/cplane/proxy_get_role_secret").respond_with_json(
+        {
+            "role_secret": rolpassword,
+            "allowed_ips": ["::1", "127.0.0.1"],
+            "project_id": "foo-bar",
+        }
+    )
+
     # no SNI, deprecated `options=project` syntax (before we had several endpoint in project)
     out = static_proxy.safe_psql(query="select 1", sslsni=0, options="project=generic-project")
     assert out[0][0] == 1
@@ -79,36 +76,18 @@ async def test_proxy_psql_allowed_ips(
     assert out[0][0] == 1
 
 
-@pytest.mark.asyncio
-async def test_proxy_http_allowed_ips(
+def test_proxy_http_not_allowed_ips(
     static_proxy: NeonProxy,
     vanilla_pg: VanillaPostgres,
     httpserver: HTTPServer,
 ):
     vanilla_pg.safe_psql("create user http_auth with password 'http' superuser")
 
-    # # Shouldn't be able to connect to this project
-    # vanilla_pg.safe_psql(
-    #     f"INSERT INTO {TABLE_NAME} (endpoint_id, allowed_ips) VALUES ('proxy', '8.8.8.8')"
-    # )
-
     [(rolpassword,)] = vanilla_pg.safe_psql(
-        "select rolpassword from pg_catalog.pg_authid where rolname = 'proxy'"
+        "select rolpassword from pg_catalog.pg_authid where rolname = 'http_auth'"
     )
 
-    def query(status: int, query: str, *args):
-        static_proxy.http_query(
-            query,
-            args,
-            user="http_auth",
-            password="http",
-            expected_code=status,
-        )
-
-    # Shouldn't be able to connect to this project
-    httpserver.expect_oneshot_request(
-        "/cplane/proxy_get_role_secret", query_string="project=proxy"
-    ).respond_with_json(
+    httpserver.expect_oneshot_request("/cplane/proxy_get_role_secret").respond_with_json(
         {
             "role_secret": rolpassword,
             "allowed_ips": ["8.8.8.8"],
@@ -117,13 +96,28 @@ async def test_proxy_http_allowed_ips(
     )
 
     with httpserver.wait() as waiting:
-        query(400, "select 1;")  # ip address is not allowed
+        static_proxy.http_query(
+            "select 1;",
+            [],
+            user="http_auth",
+            password="http",
+            expected_code=400,
+        )
     assert waiting.result
 
-    # Should be able to connect to this project
-    httpserver.expect_oneshot_request(
-        "/cplane/proxy_get_role_secret", query_string="project=proxy"
-    ).respond_with_json(
+
+def test_proxy_http_allowed_ips(
+    static_proxy: NeonProxy,
+    vanilla_pg: VanillaPostgres,
+    httpserver: HTTPServer,
+):
+    vanilla_pg.safe_psql("create user http_auth with password 'http' superuser")
+
+    [(rolpassword,)] = vanilla_pg.safe_psql(
+        "select rolpassword from pg_catalog.pg_authid where rolname = 'http_auth'"
+    )
+
+    httpserver.expect_oneshot_request("/cplane/proxy_get_role_secret").respond_with_json(
         {
             "role_secret": rolpassword,
             "allowed_ips": ["8.8.8.8", "127.0.0.1"],
@@ -132,5 +126,11 @@ async def test_proxy_http_allowed_ips(
     )
 
     with httpserver.wait() as waiting:
-        query(400, "select 1;")  # ip address is not allowed
+        static_proxy.http_query(
+            "select 1;",
+            [],
+            user="http_auth",
+            password="http",
+            expected_code=200,
+        )
     assert waiting.result