feat(db): complete SQL management UI, cache modes, PostgreSQL params, and OpenPGP data encryption at rest

2026-09-30 17:17:57 +02:00
parent 6cb9631958
commit fa662da476
2 changed files with 580 additions and 103 deletions
@@ -682,6 +682,67 @@ class TestServerComponent(unittest.TestCase):
            # Starlette TestClient may raise RuntimeError when httpx/httpx2 is missing in lightweight runner environments
            pass

+    def test_db_encryption_at_rest_and_full_config_api(self):
+        """Tests OpenPGP data-at-rest encryption/decryption and full DB/Cache configuration API."""
+        Server.init_db(self.test_db)
+        priv_armored, pub_armored, fp = Server.generate_server_keypair("test-db-node")
+        priv_key, _ = pgpy.PGPKey.from_blob(priv_armored)
+        pub_key, _ = pgpy.PGPKey.from_blob(pub_armored)
+
+        Server.SERVER_STATE["config"] = {
+            "db_path": self.test_db,
+            "storage_engine": "sqlite",
+            "cache_mode": "direct",
+            "encrypt_at_rest": False,
+            "private_key": priv_armored,
+            "public_key": pub_armored,
+            "server_fingerprint": fp
+        }
+        Server.SERVER_STATE["private_key_obj"] = priv_key
+        Server.SERVER_STATE["public_key_obj"] = pub_key
+
+        # 1. Test OpenPGP encryption & decryption roundtrip
+        raw_msg = "Critical database corruption: segment 0x89FA damaged"
+        encrypted_msg = Server.encrypt_field_for_storage(raw_msg, force=True)
+        self.assertTrue(encrypted_msg.startswith("-----BEGIN PGP MESSAGE-----"))
+        self.assertNotIn("Critical database corruption", encrypted_msg)
+
+        decrypted_msg = Server.decrypt_field_from_storage(encrypted_msg)
+        self.assertEqual(decrypted_msg, raw_msg)
+
+        # 2. Test updating config via api_db_update_config (direct -> buffered, encrypt_at_rest = True)
+        cfg_req = Server.DbFullConfigRequest(
+            storage_engine="sqlite",
+            cache_mode="buffered",
+            flush_interval=4.0,
+            batch_size=200,
+            max_queue=25000,
+            encrypt_at_rest=True
+        )
+        res = Server.api_db_update_config(cfg_req)
+        self.assertEqual(res["status"], "success")
+        self.assertEqual(Server.SERVER_STATE["config"]["cache_mode"], "buffered")
+        self.assertTrue(Server.SERVER_STATE["config"]["encrypt_at_rest"])
+        self.assertEqual(Server.INGEST_QUEUE.flush_interval, 4.0)
+        self.assertEqual(Server.INGEST_QUEUE.batch_size, 200)
+
+        # 3. Test that switching to external PostgreSQL requires enterprise_db license
+        pg_req = Server.DbFullConfigRequest(
+            storage_engine="postgres",
+            cache_mode="direct",
+            pg_config=Server.DbConnectionTestRequest(host="db.corp.internal", port=5432, database="logar", user="postgres", password="")
+        )
+        with self.assertRaises(Server.HTTPException) as cm:
+            Server.api_db_update_config(pg_req)
+        self.assertEqual(cm.exception.status_code, 403)
+        self.assertIn("enterprise_db", cm.exception.detail)
+
+        # 4. Verify storage engine info output
+        info = Server.get_storage_engine_info(db_path=self.test_db)
+        self.assertEqual(info["cache_mode"], "buffered")
+        self.assertTrue(info["encrypt_at_rest"])
+        self.assertEqual(info["flush_interval"], 4.0)
+

 if __name__ == "__main__":
    unittest.main()