feat(storage): implement in-memory ingestion queue, PostgreSQL enterprise backend, and gated DB WebUI tab

tests/test_server.py

@@ -547,8 +547,118 @@ class TestServerComponent(unittest.TestCase):
         Server.reset_failed_ip_attempts(test_ip, scope="login", db_path=self.test_db)
         self.assertTrue(Server.check_ip_rate_limit(test_ip, max_attempts=3, window_seconds=60, scope="login", db_path=self.test_db))
 
+    def test_ingest_queue_manager_and_batch_flush(self):
+        """Tests IngestQueueManager buffering, capacity bounds, and atomic batch flushing."""
+        Server.init_db(self.test_db)
+        qm = Server.IngestQueueManager(flush_interval=1.0, batch_size=5, max_queue=50)
+        
+        # Initial stats
+        stats = qm.get_stats()
+        self.assertEqual(stats["queue_size"], 0)
+        self.assertEqual(stats["total_ingested"], 0)
+        self.assertEqual(stats["total_flushed"], 0)
+
+        # Push 3 payloads
+        for i in range(3):
+            payload = {
+                "server": f"node-{i}.corp.local",
+                "logs": [
+                    {"server": f"node-{i}", "signature": f"Sig_{i}", "severity": "WARNING", "message": f"Log msg {i}", "os_type": "linux"}
+                ]
+            }
+            pushed = qm.push(payload)
+            self.assertTrue(pushed)
+
+        stats = qm.get_stats()
+        self.assertEqual(stats["queue_size"], 3)
+        self.assertEqual(stats["total_ingested"], 3)
+
+        # Flush to database
+        res_flush = qm.flush(db_path=self.test_db, window_hours=12, min_runs=1)
+        self.assertEqual(res_flush["flushed_runs"], 3)
+        self.assertEqual(res_flush["processed_logs"], 3)
+
+        # Verify DB records
+        conn = sqlite3.connect(self.test_db)
+        c = conn.cursor()
+        c.execute("SELECT COUNT(*) FROM ingest_runs")
+        run_count = c.fetchone()[0]
+        c.execute("SELECT COUNT(*) FROM active_issues WHERE status = 'VERIFIED'")
+        issue_count = c.fetchone()[0]
+        conn.close()
+
+        self.assertEqual(run_count, 3)
+        self.assertEqual(issue_count, 3)
+
+        # Stats after flush
+        stats = qm.get_stats()
+        self.assertEqual(stats["queue_size"], 0)
+        self.assertEqual(stats["total_flushed"], 3)
+
+    def test_enterprise_db_feature_gating(self):
+        """Tests feature check helpers and DB storage info under standard and enterprise licensed states."""
+        Server.init_db(self.test_db)
+
+        # 1. Standard / Unlicensed state
+        self.assertFalse(Server.is_feature_licensed("enterprise_db", db_path=self.test_db))
+        info = Server.get_storage_engine_info(db_path=self.test_db)
+        self.assertEqual(info["engine"], "sqlite")
+        self.assertFalse(info["feature_unlocked"])
+        self.assertIn("SQLite 3 (WAL Mode)", info["backend_display"])
+
+        # 2. Unlock enterprise_db feature in DB
+        conn = sqlite3.connect(self.test_db)
+        conn.execute("UPDATE license_config SET features = ? WHERE id = 1", (json.dumps(["enterprise_db", "ai_heuristics"]),))
+        conn.commit()
+        conn.close()
+
+        self.assertTrue(Server.is_feature_licensed("enterprise_db", db_path=self.test_db))
+        self.assertTrue(Server.is_feature_licensed("ai_heuristics", db_path=self.test_db))
+        self.assertFalse(Server.is_feature_licensed("unknown_feat", db_path=self.test_db))
+
+        info_unlocked = Server.get_storage_engine_info(db_path=self.test_db)
+        self.assertTrue(info_unlocked["feature_unlocked"])
+        self.assertIn("enterprise_db", info_unlocked["licensed_features"])
+
+    def test_postgres_storage_endpoints_authorization(self):
+        """Tests REST API security gating on DB engine management endpoints."""
+        from fastapi.testclient import TestClient
+        Server.init_db(self.test_db)
+        Server.SERVER_STATE["config"] = {"db_path": self.test_db, "storage_engine": "sqlite"}
+        client = TestClient(Server.app)
+
+        # 1. Unauthenticated request to /api/db/stats -> 401
+        res = client.get("/api/db/stats")
+        self.assertEqual(res.status_code, 401)
+
+        # 2. Authenticated request with session cookie
+        token = Server.generate_session_token("admin", db_path=self.test_db)
+        client.cookies.set(Server.SESSION_COOKIE_NAME, token)
+
+        res_auth = client.get("/api/db/stats")
+        self.assertEqual(res_auth.status_code, 200)
+        data = res_auth.json()
+        self.assertIn("queue", data)
+        self.assertIn("storage", data)
+        self.assertFalse(data["enterprise_db_licensed"])
+
+        # 3. /api/db/test-connection without enterprise_db feature -> 403 Forbidden
+        pg_req = {"host": "localhost", "port": 5432, "database": "logar", "user": "postgres", "password": ""}
+        res_test = client.post("/api/db/test-connection", json=pg_req)
+        self.assertEqual(res_test.status_code, 403)
+        self.assertIn("enterprise_db", res_test.json()["detail"])
+
+        # 4. /api/db/switch-backend without enterprise_db feature -> 403 Forbidden
+        res_switch = client.post("/api/db/switch-backend", json={"engine": "postgres", "pg_config": pg_req})
+        self.assertEqual(res_switch.status_code, 403)
+
+        # 5. Flush buffer endpoint is accessible to authenticated admins
+        res_flush = client.post("/api/db/flush-buffer")
+        self.assertEqual(res_flush.status_code, 200)
+
 
 if __name__ == "__main__":
     unittest.main()
 
 
+