mirror of
https://github.com/neondatabase/neon.git
synced 2026-01-07 21:42:56 +00:00
1d90b1b205
* Add --id argument to safekeeper setting its unique u64 id. In preparation for storage node messaging. IDs are supposed to be monotonically assigned by the console. In tests it is issued by ZenithEnv; at the zenith cli level and fixtures, string name is completely replaced by integer id. Example TOML configs are adjusted accordingly. Sequential ids are chosen over Zid mainly because they are compact and easy to type/remember. * add node id to pageserver This adds node id parameter to pageserver configuration. Also I use a simple builder to construct pageserver config struct to avoid setting node id to some temporary invalid value. Some of the changes in test fixtures are needed to split init and start operations for envrionment. Co-authored-by: Arseny Sher <sher-ars@yandex.ru>
69 lines
2.8 KiB
Python
69 lines
2.8 KiB
Python
from contextlib import closing
|
|
from typing import Iterator
|
|
from uuid import UUID, uuid4
|
|
import psycopg2
|
|
from fixtures.zenith_fixtures import ZenithEnvBuilder, ZenithPageserverApiException
|
|
import pytest
|
|
|
|
|
|
def test_pageserver_auth(zenith_env_builder: ZenithEnvBuilder):
|
|
zenith_env_builder.pageserver_auth_enabled = True
|
|
env = zenith_env_builder.init_start()
|
|
|
|
ps = env.pageserver
|
|
|
|
tenant_token = env.auth_keys.generate_tenant_token(env.initial_tenant.hex)
|
|
tenant_http_client = env.pageserver.http_client(tenant_token)
|
|
invalid_tenant_token = env.auth_keys.generate_tenant_token(uuid4().hex)
|
|
invalid_tenant_http_client = env.pageserver.http_client(invalid_tenant_token)
|
|
|
|
management_token = env.auth_keys.generate_management_token()
|
|
management_http_client = env.pageserver.http_client(management_token)
|
|
|
|
# this does not invoke auth check and only decodes jwt and checks it for validity
|
|
# check both tokens
|
|
ps.safe_psql("set FOO", password=tenant_token)
|
|
ps.safe_psql("set FOO", password=management_token)
|
|
|
|
# tenant can create branches
|
|
tenant_http_client.branch_create(env.initial_tenant, 'new1', 'main')
|
|
# console can create branches for tenant
|
|
management_http_client.branch_create(env.initial_tenant, 'new2', 'main')
|
|
|
|
# fail to create branch using token with different tenant_id
|
|
with pytest.raises(ZenithPageserverApiException,
|
|
match='Forbidden: Tenant id mismatch. Permission denied'):
|
|
invalid_tenant_http_client.branch_create(env.initial_tenant, "new3", "main")
|
|
|
|
# create tenant using management token
|
|
management_http_client.tenant_create(uuid4())
|
|
|
|
# fail to create tenant using tenant token
|
|
with pytest.raises(
|
|
ZenithPageserverApiException,
|
|
match='Forbidden: Attempt to access management api with tenant scope. Permission denied'
|
|
):
|
|
tenant_http_client.tenant_create(uuid4())
|
|
|
|
|
|
@pytest.mark.parametrize('with_wal_acceptors', [False, True])
|
|
def test_compute_auth_to_pageserver(zenith_env_builder: ZenithEnvBuilder, with_wal_acceptors: bool):
|
|
zenith_env_builder.pageserver_auth_enabled = True
|
|
if with_wal_acceptors:
|
|
zenith_env_builder.num_safekeepers = 3
|
|
env = zenith_env_builder.init_start()
|
|
|
|
branch = f"test_compute_auth_to_pageserver{with_wal_acceptors}"
|
|
env.zenith_cli.create_branch(branch, "main")
|
|
|
|
pg = env.postgres.create_start(branch)
|
|
|
|
with closing(pg.connect()) as conn:
|
|
with conn.cursor() as cur:
|
|
# we rely upon autocommit after each statement
|
|
# as waiting for acceptors happens there
|
|
cur.execute('CREATE TABLE t(key int primary key, value text)')
|
|
cur.execute("INSERT INTO t SELECT generate_series(1,100000), 'payload'")
|
|
cur.execute('SELECT sum(key) FROM t')
|
|
assert cur.fetchone() == (5000050000, )
|