215 lines
8.5 KiB
Go
215 lines
8.5 KiB
Go
package bell_rule_alert_test
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"os"
|
|
"testing"
|
|
"time"
|
|
|
|
"gorm.io/driver/postgres"
|
|
"gorm.io/gorm"
|
|
|
|
adminmodels "go-admin/app/admin/models"
|
|
"go-admin/app/bell/alert"
|
|
"go-admin/app/bell/evaluation"
|
|
"go-admin/app/bell/event"
|
|
"go-admin/app/bell/receipt"
|
|
"go-admin/app/bell/rule"
|
|
)
|
|
|
|
func TestPostgresRuleEvaluationAndAlertProjection(t *testing.T) {
|
|
dsn := os.Getenv("BELL_RULE_ALERT_TEST_DATABASE_URL")
|
|
if dsn == "" {
|
|
t.Skip("set BELL_RULE_ALERT_TEST_DATABASE_URL to run the isolated PostgreSQL test")
|
|
}
|
|
db, err := gorm.Open(postgres.Open(dsn), &gorm.Config{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
ctx := context.Background()
|
|
rules := rule.NewService(db)
|
|
events := event.NewService(db)
|
|
evaluations := evaluation.NewService(db)
|
|
alerts := alert.NewService(db)
|
|
assertOperatorAccess(t, db)
|
|
createOperatorUser(t, db)
|
|
|
|
eventType := "danger_area_entered"
|
|
location := "东门"
|
|
first, err := rules.Create(ctx, rule.WriteInput{Code: "area-high", Name: "高风险区域", EventType: &eventType, MinimumSeverity: "high", LocationContains: &location}, 1)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
second, err := rules.Create(ctx, rule.WriteInput{Code: "all-high", Name: "全局高风险", MinimumSeverity: "high"}, 1)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
otherEventType := "fire_detected"
|
|
_, err = rules.Create(ctx, rule.WriteInput{Code: "critical-fire", Name: "仅严重火情", EventType: &otherEventType, MinimumSeverity: "critical"}, 1)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
created := ingest(t, events, "event-001", "东门 A 区", "high")
|
|
result, err := evaluations.ForEvent(ctx, created.Event.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(result.Evaluations) != 3 || len(result.Alerts) != 2 {
|
|
t.Fatalf("expected 3 evaluations and 2 alerts, got %d and %d", len(result.Evaluations), len(result.Alerts))
|
|
}
|
|
matched, unmatched := 0, 0
|
|
for _, item := range result.Evaluations {
|
|
if item.Matched {
|
|
matched++
|
|
} else if item.Explanation != "" {
|
|
unmatched++
|
|
}
|
|
}
|
|
if matched != 2 || unmatched != 1 {
|
|
t.Fatalf("unexpected match explanations: matched=%d unmatched=%d", matched, unmatched)
|
|
}
|
|
|
|
replay := ingest(t, events, "event-001", "东门 A 区", "high")
|
|
if !replay.Duplicate || replay.Event.ID != created.Event.ID {
|
|
t.Fatalf("idempotent replay created another fact: %#v", replay)
|
|
}
|
|
assertCount(t, db, "bell_rule_evaluations", 3)
|
|
assertCount(t, db, "bell_alerts", 2)
|
|
|
|
secondEvent := ingest(t, events, "event-002", "东门 A 区", "critical")
|
|
assertCount(t, db, "bell_alerts", 2)
|
|
items, total, err := alerts.List(ctx, alert.PageQuery{PageIndex: 1, PageSize: 20, Status: "open"})
|
|
if err != nil || total != 2 || len(items) != 2 {
|
|
t.Fatalf("unexpected alert list: total=%d len=%d err=%v", total, len(items), err)
|
|
}
|
|
for _, item := range items {
|
|
if item.EventCount != 2 || item.Status != "open" || item.Severity != "critical" {
|
|
t.Fatalf("open alert did not aggregate and escalate: %#v", item)
|
|
}
|
|
detail, detailErr := alerts.Get(ctx, item.ID)
|
|
if detailErr != nil || len(detail.Events) != 2 || len(detail.Matches) != 2 {
|
|
t.Fatalf("event-alert navigation is incomplete: events=%d matches=%d err=%v", len(detail.Events), len(detail.Matches), detailErr)
|
|
}
|
|
}
|
|
|
|
updated, err := rules.Update(ctx, first.ID, rule.WriteInput{Name: "高风险区域（更新）", EventType: &eventType, MinimumSeverity: "medium", LocationContains: &location}, 1)
|
|
if err != nil || updated.Version != 2 {
|
|
t.Fatalf("rule version was not incremented: version=%d err=%v", updated.Version, err)
|
|
}
|
|
if _, err = rules.SetEnabled(ctx, second.ID, false, 1); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
thirdEvent := ingest(t, events, "event-003", "东门 B 区", "medium")
|
|
thirdResults, err := evaluations.ForEvent(ctx, thirdEvent.Event.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(thirdResults.Evaluations) != 2 || len(thirdResults.Alerts) != 1 {
|
|
t.Fatalf("disabled rule was evaluated: evaluations=%d alerts=%d", len(thirdResults.Evaluations), len(thirdResults.Alerts))
|
|
}
|
|
var snapshot struct {
|
|
Version int `json:"version"`
|
|
}
|
|
for _, item := range thirdResults.Evaluations {
|
|
if item.RuleID == first.ID {
|
|
if err = json.Unmarshal(item.RuleSnapshot, &snapshot); err != nil || item.RuleVersion != 2 || snapshot.Version != 2 {
|
|
t.Fatalf("versioned rule snapshot missing: item=%#v snapshot=%#v err=%v", item, snapshot, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
if err = db.Model(&evaluation.Evaluation{}).Where("event_id = ? AND rule_id = ?", created.Event.ID, first.ID).Update("explanation", "tampered").Error; err == nil {
|
|
t.Fatal("immutable evaluation update unexpectedly succeeded")
|
|
}
|
|
|
|
if err = db.Exec(`CREATE FUNCTION bell_test_reject_alert() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'forced alert failure'; END $$`).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err = db.Exec(`CREATE TRIGGER bell_test_reject_alert BEFORE INSERT ON bell_alerts FOR EACH ROW EXECUTE FUNCTION bell_test_reject_alert()`).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
failedID := "event-rollback"
|
|
_, ingestErr := events.Ingest(ctx, eventCommand(failedID, "东门 C 区", "high"), 1)
|
|
if ingestErr == nil {
|
|
t.Fatal("forced alert failure did not roll back Event ingest")
|
|
}
|
|
var eventCount, receiptCount int64
|
|
db.Model(&event.Event{}).Where("source_event_id = ?", failedID).Count(&eventCount)
|
|
db.Model(&receipt.Receipt{}).Where("source_event_id = ?", failedID).Count(&receiptCount)
|
|
if eventCount != 0 || receiptCount != 0 {
|
|
t.Fatalf("transaction failure left partial facts: events=%d receipts=%d", eventCount, receiptCount)
|
|
}
|
|
if err = db.Exec(`DROP TRIGGER bell_test_reject_alert ON bell_alerts; DROP FUNCTION bell_test_reject_alert()`).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
if secondEvent.Event.ID == thirdEvent.Event.ID {
|
|
t.Fatal("independent Events unexpectedly share an id")
|
|
}
|
|
}
|
|
|
|
func ingest(t *testing.T, service event.Service, sourceID, location, severity string) event.Result {
|
|
t.Helper()
|
|
result, err := service.Ingest(context.Background(), eventCommand(sourceID, location, severity), 1)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return result
|
|
}
|
|
|
|
func eventCommand(sourceID, location, severity string) event.Command {
|
|
return event.Command{ProducerID: "bell.rule-test", SourceEventID: sourceID, EventType: "danger_area_entered", OccurredAt: time.Date(2026, 8, 29, 0, 0, 0, 0, time.UTC), Location: location, Severity: severity, Attributes: map[string]any{"test": true}}
|
|
}
|
|
|
|
func assertCount(t *testing.T, db *gorm.DB, table string, want int64) {
|
|
t.Helper()
|
|
var got int64
|
|
if err := db.Table(table).Count(&got).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got != want {
|
|
t.Fatal(fmt.Sprintf("%s count: got %d want %d", table, got, want))
|
|
}
|
|
}
|
|
|
|
func assertOperatorAccess(t *testing.T, db *gorm.DB) {
|
|
t.Helper()
|
|
var menuCount, readPolicyCount, ruleWritePolicyCount, lifecycleWritePolicyCount int64
|
|
if err := db.Table("sys_role_menu rm").Joins("JOIN sys_role r ON r.role_id = rm.role_id").
|
|
Joins("JOIN sys_menu m ON m.menu_id = rm.menu_id").
|
|
Where("r.role_key = ? AND m.path IN ?", "operator", []string{"/bell", "alerts", "events", "rules"}).Count(&menuCount).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := db.Table("casbin_rule").Where("v0 = ? AND v2 = ?", "operator", "GET").Count(&readPolicyCount).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := db.Table("casbin_rule").Where("v0 = ? AND v2 <> ? AND v1 LIKE ?", "operator", "GET", "/api/v1/bell/rules%").Count(&ruleWritePolicyCount).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := db.Table("casbin_rule").Where("v0 = ? AND v2 = ? AND v1 IN ?", "operator", "POST", []string{"/api/v1/bell/alerts/:id/ack", "/api/v1/bell/alerts/:id/close"}).Count(&lifecycleWritePolicyCount).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if menuCount != 4 || readPolicyCount < 6 || ruleWritePolicyCount != 0 || lifecycleWritePolicyCount > 2 {
|
|
t.Fatalf("operator access escaped Bell scope: menus=%d reads=%d rule_writes=%d lifecycle_writes=%d", menuCount, readPolicyCount, ruleWritePolicyCount, lifecycleWritePolicyCount)
|
|
}
|
|
}
|
|
|
|
func createOperatorUser(t *testing.T, db *gorm.DB) {
|
|
t.Helper()
|
|
password := os.Getenv("BELL_RULE_ALERT_OPERATOR_PASSWORD")
|
|
if password == "" {
|
|
t.Skip("set BELL_RULE_ALERT_OPERATOR_PASSWORD for the HTTP RBAC continuation")
|
|
}
|
|
var roleID int
|
|
if err := db.Table("sys_role").Select("role_id").Where("role_key = ?", "operator").Scan(&roleID).Error; err != nil || roleID == 0 {
|
|
t.Fatalf("load operator role: id=%d err=%v", roleID, err)
|
|
}
|
|
user := adminmodels.SysUser{Username: "bell_132_operator", Password: password, NickName: "Bell 处置员", RoleId: roleID, DeptId: 1, PostId: 1, Status: "2"}
|
|
if err := db.Create(&user).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|