From 90e0c5bd0c73370143d4eaa63118801e2f8a6f9f Mon Sep 17 00:00:00 2001 From: Dmitri Dolguikh Date: Thu, 6 Aug 2026 15:17:39 +0200 Subject: [PATCH] added GetPolicies test Signed-off-by: Dmitri Dolguikh --- .../network_map_db/pgsql/policy_test.go | 145 ++++++++++++++++++ .../internals/network_map_db/pgsql/policy.go | 4 +- 2 files changed, 147 insertions(+), 2 deletions(-) create mode 100644 integration_tests/management/network_map_db/pgsql/policy_test.go diff --git a/integration_tests/management/network_map_db/pgsql/policy_test.go b/integration_tests/management/network_map_db/pgsql/policy_test.go new file mode 100644 index 000000000..714977eef --- /dev/null +++ b/integration_tests/management/network_map_db/pgsql/policy_test.go @@ -0,0 +1,145 @@ +package networkmap_pgsql + +import ( + "context" + "testing" + + networkmap_pgsql "github.com/netbirdio/netbird/management/internals/network_map_db/pgsql" + "github.com/netbirdio/netbird/shared/management/networkmap/nmdata" + "github.com/stretchr/testify/assert" +) + +func TestGetPolicies(t *testing.T) { + ctx := context.TODO() + + execQuery(t, ctx, + `insert into policies (id, public_id, account_id, enabled, source_posture_checks) + values('policy-1','policy-1-public','account-1',true,'["posture-checks-1","posture-checks-2"]')`) + execQuery(t, ctx, + `insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations, + source_resource, destination_resource, ports, port_ranges, + authorized_groups, authorized_user) + values('policy-1-rule-1','policy-1',true,'accept','tcp',true,'["group-one-resource-id","group-two-resources-id"]','["group-one-resource-id","group-two-resources-id"]', + '{"ID":"host-id-1","Type":"host"}','{"ID":"domain-1","Type":"domain"}','["8080","8443"]', '[{"Start":8080,"End":8090}]', + '{"group-one-resource-id":["user-1", "user-2"]}','user-3')`) + execQuery(t, ctx, + `insert into policies (id, public_id, account_id, enabled, source_posture_checks) + values('policy-2','policy-2-public','account-1',true,'["posture-checks-3","posture-checks-4"]')`) + execQuery(t, ctx, + `insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations, + source_resource, destination_resource, ports, port_ranges, + authorized_groups, authorized_user) + values('policy-2-rule-1','policy-2',true,'accept','tcp',true,'["group-one-resource-id"]','["group-two-resources-id"]', + '{"ID":"host-id-3","Type":"host"}','{"ID":"domain-3","Type":"domain"}','["8080","8443"]', '[{"Start":8080,"End":8090}]', + '{"group-one-resource-id":["user-6", "user-7"]}','user-8')`) + // policy with a rule with null fields + execQuery(t, ctx, + `insert into policies (id, public_id, account_id, enabled, source_posture_checks) + values('policy-3','policy-3-public','account-1',true,null)`) + execQuery(t, ctx, + `insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations, + source_resource, destination_resource, ports, port_ranges, + authorized_groups, authorized_user) + values('policy-3-rule-1','policy-3',true,null,null,null,null,null,null,null,null,null,null,null)`) + // policy with a disabled rule, destination resource and groups should not be in indexes + execQuery(t, ctx, + `insert into policies (id, public_id, account_id, enabled, source_posture_checks) + values('policy-4','policy-4-public','account-1',true,null)`) + execQuery(t, ctx, + `insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations, + source_resource, destination_resource, ports, port_ranges, + authorized_groups, authorized_user) + values('policy-4-rule-1','policy-4',false,null,null,null,null,'["group-two-resources-id"]', + null,'{"ID":"domain-3","Type":"domain"}',null,null,null,null)`) + + policies, policyToDestinationResourceIdx, policyToDestinationGroupIdx, err := networkmap_pgsql.GetPoliciesViaPgxConnection(ctx, conn(t, ctx), "account-1") + assert.NoError(t, err) + + assert.Contains(t, policies, nmdata.Policy{ + ID: "policy-1", + PublicID: "policy-1-public", + Enabled: true, + SourcePostureChecks: []string{"posture-checks-1", "posture-checks-2"}, + Rules: []*nmdata.PolicyRule{ + { + ID: "policy-1", + PolicyID: "policy-1", + Enabled: true, + Action: "accept", + Protocol: "tcp", + Bidirectional: true, + Sources: []string{"group-one-resource-id", "group-two-resources-id"}, + Destinations: []string{"group-one-resource-id", "group-two-resources-id"}, + SourceResource: nmdata.Resource{ID: "host-id-1", Type: "host"}, + DestinationResource: nmdata.Resource{ID: "domain-1", Type: "domain"}, + Ports: []string{"8080", "8443"}, + PortRanges: []nmdata.RulePortRange{{Start: 8080, End: 8090}}, + AuthorizedGroups: map[string][]string{"group-one-resource-id": {"user-1", "user-2"}}, + AuthorizedUser: "user-3", + }, + }, + }) + + assert.Contains(t, policies, nmdata.Policy{ + ID: "policy-2", + PublicID: "policy-2-public", + Enabled: true, + SourcePostureChecks: []string{"posture-checks-3", "posture-checks-4"}, + Rules: []*nmdata.PolicyRule{ + { + ID: "policy-2", + PolicyID: "policy-2", + Enabled: true, + Action: "accept", + Protocol: "tcp", + Bidirectional: true, + Sources: []string{"group-one-resource-id"}, + Destinations: []string{"group-two-resources-id"}, + SourceResource: nmdata.Resource{ID: "host-id-3", Type: "host"}, + DestinationResource: nmdata.Resource{ID: "domain-3", Type: "domain"}, + Ports: []string{"8080", "8443"}, + PortRanges: []nmdata.RulePortRange{{Start: 8080, End: 8090}}, + AuthorizedGroups: map[string][]string{"group-one-resource-id": {"user-6", "user-7"}}, + AuthorizedUser: "user-8", + }, + }, + }) + + assert.Contains(t, policies, nmdata.Policy{ + ID: "policy-3", + PublicID: "policy-3-public", + Enabled: true, + SourcePostureChecks: []string{}, + Rules: []*nmdata.PolicyRule{ + { + ID: "policy-3", + PolicyID: "policy-3", + Enabled: true, + }, + }, + }) + assert.Contains(t, policies, nmdata.Policy{ + ID: "policy-4", + PublicID: "policy-4-public", + Enabled: true, + SourcePostureChecks: []string{}, + Rules: []*nmdata.PolicyRule{ + { + ID: "policy-4", + PolicyID: "policy-4", + Enabled: false, + Destinations: []string{"group-two-resources-id"}, + DestinationResource: nmdata.Resource{ID: "domain-3", Type: "domain"}, + }, + }, + }) + + assert.Equal(t, policyToDestinationGroupIdx, map[string]map[string]any{ + "policy-1": {"group-one-resource-id": struct{}{}, "group-two-resources-id": struct{}{}}, + "policy-2": {"group-two-resources-id": struct{}{}}, + }) + assert.Equal(t, policyToDestinationResourceIdx, map[string]map[string]any{ + "policy-1": {"domain-1": struct{}{}}, + "policy-2": {"domain-3": struct{}{}}, + }) +} diff --git a/management/internals/network_map_db/pgsql/policy.go b/management/internals/network_map_db/pgsql/policy.go index 72aecaed8..da8e1e545 100644 --- a/management/internals/network_map_db/pgsql/policy.go +++ b/management/internals/network_map_db/pgsql/policy.go @@ -13,7 +13,7 @@ import ( const ( GetPoliciesQuery = ` - select p.id, p.public_id, p.enabled, p.source_posture_checks, pr.enabled as rule_enabled, pr.action, pr.protocol, pr.bidirectional, + select p.id, p.public_id, p.enabled, array (select json_array_elements_text(p.source_posture_checks::json)) as source_posture_checks, pr.enabled as rule_enabled, pr.action, pr.protocol, pr.bidirectional, pr.sources, pr.destinations, pr.source_resource, pr.destination_resource, pr.ports, pr.port_ranges, pr.authorized_groups, pr.authorized_user from policies as p @@ -151,7 +151,7 @@ func GetPoliciesViaPgxConnection(ctx context.Context, con *pgx.Conn, accountId s type policy struct { ID string PublicID sql.NullString - SourcePostureChecks json.RawMessage + SourcePostureChecks []string Enabled sql.NullBool RuleEnabled sql.NullBool `nmap:"skip"` Bidirectional sql.NullBool `nmap:"skip"`