|
| 1 | +// @spec api-reports |
| 2 | +// |
| 3 | +// Report faces (export). The pure render test needs no DB; the |
| 4 | +// export/caching path is OPENWATCH_TEST_DSN-gated: |
| 5 | +// |
| 6 | +// AC-12 TestRenderExecutivePDF (renderer emits a structurally valid PDF) |
| 7 | +// AC-13 TestExport_FacesAndCaching (json + pdf faces, report_faces cache, errors) |
| 8 | + |
| 9 | +package report |
| 10 | + |
| 11 | +import ( |
| 12 | + "bytes" |
| 13 | + "context" |
| 14 | + "errors" |
| 15 | + "testing" |
| 16 | + "time" |
| 17 | + |
| 18 | + "github.com/google/uuid" |
| 19 | +) |
| 20 | + |
| 21 | +// @ac AC-12 |
| 22 | +// The PDF renderer emits a structurally valid, non-trivial PDF document |
| 23 | +// (magic header + EOF trailer) from a report + its content. Pure: no DB. |
| 24 | +func TestRenderExecutivePDF(t *testing.T) { |
| 25 | + t.Run("api-reports/AC-12", func(t *testing.T) { |
| 26 | + pct := 65 |
| 27 | + rep := Report{ |
| 28 | + Title: executiveTitle, |
| 29 | + ScopeLabel: "RHEL hosts · CIS", |
| 30 | + DataAsOf: time.Date(2026, 6, 21, 14, 30, 0, 0, time.UTC), |
| 31 | + GeneratedBy: "alice@example.com", |
| 32 | + ContentSHA256: "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789", |
| 33 | + } |
| 34 | + c := ExecutiveContent{ |
| 35 | + CompliancePct: &pct, |
| 36 | + HostCount: 5, |
| 37 | + PassingRules: 1812, |
| 38 | + FailingRules: 821, |
| 39 | + CriticalIssues: 0, |
| 40 | + TopFailingRules: []TopFailingRule{ |
| 41 | + {RuleID: "audit-chmod-changes", FailingHostCount: 5}, |
| 42 | + {RuleID: "audit-chown-changes", FailingHostCount: 5}, |
| 43 | + }, |
| 44 | + Coverage: Coverage{HostsTotal: 5, HostsFresh: 4, HostsStale: 1, HostsUnreachable: 1}, |
| 45 | + } |
| 46 | + |
| 47 | + pdf, err := renderExecutivePDF(rep, c) |
| 48 | + if err != nil { |
| 49 | + t.Fatalf("renderExecutivePDF: %v", err) |
| 50 | + } |
| 51 | + if len(pdf) < 800 { |
| 52 | + t.Errorf("pdf is implausibly small: %d bytes", len(pdf)) |
| 53 | + } |
| 54 | + if !bytes.HasPrefix(pdf, []byte("%PDF-")) { |
| 55 | + t.Errorf("pdf does not start with the %%PDF- magic: %q", pdf[:min(8, len(pdf))]) |
| 56 | + } |
| 57 | + if !bytes.Contains(pdf, []byte("%%EOF")) { |
| 58 | + t.Errorf("pdf has no %%%%EOF trailer") |
| 59 | + } |
| 60 | + }) |
| 61 | +} |
| 62 | + |
| 63 | +// @ac AC-13 |
| 64 | +// Export serves the json face (canonical content) and the pdf face |
| 65 | +// (rendered + cached in report_faces). A second pdf export re-streams the |
| 66 | +// cached bytes; an unknown face is ErrInvalidFace; an unknown id is |
| 67 | +// ErrNotFound. |
| 68 | +func TestExport_FacesAndCaching(t *testing.T) { |
| 69 | + t.Run("api-reports/AC-13", func(t *testing.T) { |
| 70 | + pool := freshPool(t) |
| 71 | + ctx := context.Background() |
| 72 | + svc := NewService(pool) |
| 73 | + owner := seedUser(t, pool) |
| 74 | + h := seedHost(t, pool, owner, false) |
| 75 | + seedRuleState(t, pool, h, "r1", "fail", "high") |
| 76 | + |
| 77 | + rep, err := svc.Generate(ctx, "alice@example.com", GenerateRequest{}) |
| 78 | + if err != nil { |
| 79 | + t.Fatalf("Generate: %v", err) |
| 80 | + } |
| 81 | + |
| 82 | + // json face == the canonical stored content. |
| 83 | + jsonBody, jsonMedia, err := svc.Export(ctx, rep.ID, FaceJSON) |
| 84 | + if err != nil { |
| 85 | + t.Fatalf("Export json: %v", err) |
| 86 | + } |
| 87 | + if jsonMedia != "application/json" { |
| 88 | + t.Errorf("json media = %q", jsonMedia) |
| 89 | + } |
| 90 | + if !bytes.Equal(jsonBody, rep.Content) { |
| 91 | + t.Errorf("json face is not the canonical content") |
| 92 | + } |
| 93 | + |
| 94 | + // pdf face renders and caches. |
| 95 | + pdfBody, pdfMedia, err := svc.Export(ctx, rep.ID, FacePDF) |
| 96 | + if err != nil { |
| 97 | + t.Fatalf("Export pdf: %v", err) |
| 98 | + } |
| 99 | + if pdfMedia != "application/pdf" { |
| 100 | + t.Errorf("pdf media = %q", pdfMedia) |
| 101 | + } |
| 102 | + if !bytes.HasPrefix(pdfBody, []byte("%PDF-")) { |
| 103 | + t.Errorf("pdf face is not a PDF") |
| 104 | + } |
| 105 | + |
| 106 | + // A report_faces row was written with status ready + a content hash. |
| 107 | + var status, blob string |
| 108 | + var size int |
| 109 | + if err := pool.QueryRow(ctx, |
| 110 | + `SELECT status, blob_sha256, size_bytes FROM report_faces WHERE snapshot_id = $1 AND face = 'pdf'`, |
| 111 | + rep.ID).Scan(&status, &blob, &size); err != nil { |
| 112 | + t.Fatalf("face row lookup: %v", err) |
| 113 | + } |
| 114 | + if status != "ready" || len(blob) != 64 || size != len(pdfBody) { |
| 115 | + t.Errorf("face row = status %q, blob %q (len %d), size %d (want ready/64/%d)", |
| 116 | + status, blob, len(blob), size, len(pdfBody)) |
| 117 | + } |
| 118 | + |
| 119 | + // Second export re-streams the cached bytes (identical). |
| 120 | + pdfBody2, _, err := svc.Export(ctx, rep.ID, FacePDF) |
| 121 | + if err != nil { |
| 122 | + t.Fatalf("Export pdf #2: %v", err) |
| 123 | + } |
| 124 | + if !bytes.Equal(pdfBody, pdfBody2) { |
| 125 | + t.Errorf("cached pdf differs from first render") |
| 126 | + } |
| 127 | + |
| 128 | + // Unknown face -> ErrInvalidFace. |
| 129 | + if _, _, err := svc.Export(ctx, rep.ID, "oscal"); !errors.Is(err, ErrInvalidFace) { |
| 130 | + t.Errorf("Export bogus face err = %v, want ErrInvalidFace", err) |
| 131 | + } |
| 132 | + // Unknown id -> ErrNotFound. |
| 133 | + if _, _, err := svc.Export(ctx, uuid.New(), FacePDF); !errors.Is(err, ErrNotFound) { |
| 134 | + t.Errorf("Export unknown id err = %v, want ErrNotFound", err) |
| 135 | + } |
| 136 | + }) |
| 137 | +} |
| 138 | + |
| 139 | +func min(a, b int) int { |
| 140 | + if a < b { |
| 141 | + return a |
| 142 | + } |
| 143 | + return b |
| 144 | +} |
0 commit comments