mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
Alexey MilovidovandClaude Opus 4.8
295ced78d1
Follow-up to #105171, which added `ruff` with a deliberately narrow, bug-class-only rule set and left the unused-name and star-import rules off pending a dedicated cleanup pass. This enables that second batch in `pyproject.toml` and fixes every violation across the tree (the bulk in integration tests): - `F401` unused-import and `F841` unused-variable: removed, preserving any side-effecting right-hand side (e.g. `result = node.query(...)` becomes `node.query(...)`). Two `try: import ...` feature probes are kept with `# noqa: F401`. - `F541` f-string-missing-placeholders: dropped the redundant `f` prefix. - `F403`/`F405` star imports: every `from module import *` is expanded into explicit imports of the names actually used, taken from each name's real origin, so stdlib/third-party names import from their real source rather than through a test "convenience bundle". The now-empty `tests/integration/helpers/kafka/common_direct.py` bundle is removed and its three remaining consumers import `_VarintBytes`/`KafkaAdminClient` directly. Eliminating the star imports surfaced a real bug the wildcard had masked from `F821`: `generate_presets.py` in `test_prometheus_protocols` called an undefined `execute_instant_query_with_http_api`; fixed to the existing `execute_query_via_http_api`. No `black`/`isort` reformatting was applied (neither is enforced in the style check), so the diff is limited to the lint fixes themselves. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
175 lines
5.0 KiB
Python
Executable File
175 lines
5.0 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
|
|
import pytest
|
|
from kazoo.security import make_acl
|
|
from kazoo.exceptions import NoAuthError
|
|
|
|
from helpers.cluster import ClickHouseCluster
|
|
|
|
from helpers import keeper_utils as ku
|
|
|
|
cluster = ClickHouseCluster(__file__)
|
|
node = cluster.add_instance(
|
|
"node",
|
|
main_configs=["configs/keeper_config.xml"],
|
|
with_zookeeper=True,
|
|
stay_alive=True,
|
|
)
|
|
|
|
def get_fake_zk_with_auth(username, password):
|
|
zk = ku.get_fake_zk(cluster, "node")
|
|
zk.add_auth("digest", f"{username}:{password}")
|
|
return zk
|
|
|
|
@pytest.fixture(scope="module")
|
|
def started_cluster():
|
|
try:
|
|
cluster.start()
|
|
yield cluster
|
|
finally:
|
|
cluster.shutdown()
|
|
|
|
def wait_node():
|
|
ku.wait_nodes(cluster, [node])
|
|
|
|
def setup_node():
|
|
node.stop_clickhouse()
|
|
node.exec_in_container(["rm", "-rf", "/var/lib/clickhouse/coordination/log"])
|
|
node.exec_in_container(
|
|
["rm", "-rf", "/var/lib/clickhouse/coordination/snapshots"]
|
|
)
|
|
set_acl_blocking(0)
|
|
set_snapshot_on_exit(0)
|
|
node.start_clickhouse()
|
|
wait_node()
|
|
|
|
|
|
def set_acl_blocking(value):
|
|
node.replace_in_config(
|
|
"/etc/clickhouse-server/config.d/keeper_config.xml",
|
|
"<cleanup_old_and_ignore_new_acl>[01]</cleanup_old_and_ignore_new_acl>",
|
|
f"<cleanup_old_and_ignore_new_acl>{value}</cleanup_old_and_ignore_new_acl>",
|
|
)
|
|
|
|
|
|
def set_snapshot_on_exit(value):
|
|
node.replace_in_config(
|
|
"/etc/clickhouse-server/config.d/keeper_config.xml",
|
|
"<create_snapshot_on_exit>[01]</create_snapshot_on_exit>",
|
|
f"<create_snapshot_on_exit>{value}</create_snapshot_on_exit>",
|
|
)
|
|
|
|
|
|
def test_keeper_block_acl(started_cluster):
|
|
setup_node()
|
|
|
|
zk_no_auth = None
|
|
zk_with_auth = None
|
|
|
|
def close_zk(zk):
|
|
if zk is not None:
|
|
zk.stop()
|
|
zk.close()
|
|
zk = None
|
|
|
|
try:
|
|
zk_with_auth = get_fake_zk_with_auth("antonio", "isthebest")
|
|
|
|
acl = [make_acl("auth", "", all=True)]
|
|
zk_with_auth.create("/test_auth_node", b"test_data", acl=acl)
|
|
zk_with_auth.create("/test_auth_node/child", b"child_data", acl=acl)
|
|
|
|
close_zk(zk_with_auth)
|
|
|
|
def check_acl_enabled():
|
|
zk_with_auth = get_fake_zk_with_auth("antonio", "isthebest")
|
|
|
|
assert zk_with_auth.get("/test_auth_node")[0] == b"test_data"
|
|
assert zk_with_auth.get("/test_auth_node/child")[0] == b"child_data"
|
|
|
|
close_zk(zk_with_auth)
|
|
|
|
zk_no_auth = ku.get_fake_zk(cluster, "node")
|
|
zk_no_auth.start()
|
|
|
|
with pytest.raises(NoAuthError):
|
|
zk_no_auth.get("/test_auth_node")
|
|
|
|
with pytest.raises(NoAuthError):
|
|
zk_no_auth.get("/test_auth_node/child")
|
|
|
|
close_zk(zk_no_auth)
|
|
|
|
def check_acl_disabled():
|
|
zk_with_auth = get_fake_zk_with_auth("antonio", "isthebest")
|
|
|
|
assert zk_with_auth.get("/test_auth_node")[0] == b"test_data"
|
|
assert zk_with_auth.get("/test_auth_node/child")[0] == b"child_data"
|
|
|
|
close_zk(zk_with_auth)
|
|
|
|
zk_no_auth = ku.get_fake_zk(cluster, "node")
|
|
zk_no_auth.start()
|
|
|
|
assert zk_no_auth.get("/test_auth_node")[0] == b"test_data"
|
|
assert zk_no_auth.get("/test_auth_node/child")[0] == b"child_data"
|
|
|
|
close_zk(zk_no_auth)
|
|
|
|
check_acl_enabled()
|
|
|
|
|
|
# enable blocking, all requests are applied from changelog
|
|
# but ACL is ignored
|
|
node.stop_clickhouse()
|
|
set_acl_blocking(1)
|
|
node.start_clickhouse()
|
|
wait_node()
|
|
|
|
check_acl_disabled()
|
|
|
|
# we disable acl blocking again
|
|
# because nothing is stored in snapshot, logs are reapplied
|
|
# but this time with ACL
|
|
node.stop_clickhouse()
|
|
set_acl_blocking(0)
|
|
set_snapshot_on_exit(1)
|
|
node.start_clickhouse()
|
|
wait_node()
|
|
|
|
check_acl_enabled()
|
|
|
|
# we enable acl blocking again
|
|
# this time we load nodes from snapshot
|
|
node.stop_clickhouse()
|
|
set_acl_blocking(1)
|
|
node.start_clickhouse()
|
|
wait_node()
|
|
|
|
check_acl_disabled()
|
|
|
|
# blocking is enabled, we try to create a node and verifying
|
|
# that it will be written to snapshot without ACL
|
|
zk_with_auth = get_fake_zk_with_auth("antonio", "isthebest")
|
|
acl = [make_acl("auth", "", all=True)]
|
|
zk_with_auth.create("/test_auth_node_new", b"test_data", acl=acl)
|
|
close_zk(zk_with_auth)
|
|
|
|
zk_no_auth = ku.get_fake_zk(cluster, "node")
|
|
zk_no_auth.start()
|
|
assert zk_no_auth.get("/test_auth_node_new")[0] == b"test_data"
|
|
close_zk(zk_no_auth)
|
|
|
|
node.stop_clickhouse()
|
|
set_acl_blocking(0)
|
|
node.start_clickhouse()
|
|
wait_node()
|
|
|
|
zk_no_auth = ku.get_fake_zk(cluster, "node")
|
|
zk_no_auth.start()
|
|
assert zk_no_auth.get("/test_auth_node_new")[0] == b"test_data"
|
|
close_zk(zk_no_auth)
|
|
finally:
|
|
for zk in [zk_with_auth, zk_no_auth]:
|
|
close_zk(zk)
|