379 lines
17 KiB
C#
379 lines
17 KiB
C#
|
using System.Collections.Concurrent;
|
||
|
|
using System.Net;
|
||
|
|
using System.Net.Http.Json;
|
||
|
|
using Dapper;
|
||
|
|
using Microsoft.EntityFrameworkCore;
|
||
|
|
using Microsoft.Extensions.DependencyInjection;
|
||
|
|
using Npgsql;
|
||
|
|
using WorkClub.Domain.Entities;
|
||
|
|
using WorkClub.Domain.Enums;
|
||
|
|
using WorkClub.Infrastructure.Data;
|
||
|
|
using WorkClub.Infrastructure.Data.Interceptors;
|
||
|
|
using WorkClub.Tests.Integration.Infrastructure;
|
||
|
|
|
||
|
|
namespace WorkClub.Tests.Integration.MultiTenancy;
|
||
|
|
|
||
|
|
/// <summary>
|
||
|
|
/// Comprehensive RLS (Row-Level Security) integration tests proving multi-tenant data isolation.
|
||
|
|
/// These tests verify that PostgreSQL RLS policies correctly enforce tenant boundaries.
|
||
|
|
/// </summary>
|
||
|
|
public class RlsIsolationTests : IntegrationTestBase
|
||
|
|
{
|
||
|
|
private readonly AppDbContext _dbContext;
|
||
|
|
|
||
|
|
public RlsIsolationTests(CustomWebApplicationFactory<Program> factory) : base(factory)
|
||
|
|
{
|
||
|
|
var scope = factory.Services.CreateScope();
|
||
|
|
_dbContext = scope.ServiceProvider.GetRequiredService<AppDbContext>();
|
||
|
|
}
|
||
|
|
|
||
|
|
[Fact]
|
||
|
|
public async Task Test1_CompleteIsolation_TenantsSeeOnlyTheirData()
|
||
|
|
{
|
||
|
|
// Arrange: Seed data for two tenants using admin connection
|
||
|
|
var clubAId = Guid.NewGuid();
|
||
|
|
var clubBId = Guid.NewGuid();
|
||
|
|
var memberA1Id = Guid.NewGuid();
|
||
|
|
var memberB1Id = Guid.NewGuid();
|
||
|
|
var workItemA1Id = Guid.NewGuid();
|
||
|
|
var workItemB1Id = Guid.NewGuid();
|
||
|
|
|
||
|
|
await using var adminConn = new NpgsqlConnection(GetAdminConnectionString());
|
||
|
|
await adminConn.OpenAsync();
|
||
|
|
|
||
|
|
// Insert Club A with Member and WorkItem
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
|
||
|
|
VALUES (@Id, 'club-a', 'Club Alpha', 0, NOW(), NOW())",
|
||
|
|
new { Id = clubAId });
|
||
|
|
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO members (id, tenant_id, name, email, club_id, role, joined_at, created_at, updated_at)
|
||
|
|
VALUES (@Id, 'club-a', 'Alice', 'alice@club-a.com', @ClubId, 1, NOW(), NOW(), NOW())",
|
||
|
|
new { Id = memberA1Id, ClubId = clubAId });
|
||
|
|
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
|
||
|
|
VALUES (@Id, 'club-a', 'Task Alpha', 0, @MemberId, @ClubId, NOW(), NOW())",
|
||
|
|
new { Id = workItemA1Id, MemberId = memberA1Id, ClubId = clubAId });
|
||
|
|
|
||
|
|
// Insert Club B with Member and WorkItem
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
|
||
|
|
VALUES (@Id, 'club-b', 'Club Beta', 1, NOW(), NOW())",
|
||
|
|
new { Id = clubBId });
|
||
|
|
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO members (id, tenant_id, name, email, club_id, role, joined_at, created_at, updated_at)
|
||
|
|
VALUES (@Id, 'club-b', 'Bob', 'bob@club-b.com', @ClubId, 1, NOW(), NOW(), NOW())",
|
||
|
|
new { Id = memberB1Id, ClubId = clubBId });
|
||
|
|
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
|
||
|
|
VALUES (@Id, 'club-b', 'Task Beta', 0, @MemberId, @ClubId, NOW(), NOW())",
|
||
|
|
new { Id = workItemB1Id, MemberId = memberB1Id, ClubId = clubBId });
|
||
|
|
|
||
|
|
// Act: Query as Club A
|
||
|
|
await using var connA = new NpgsqlConnection(GetAppUserConnectionString());
|
||
|
|
await connA.OpenAsync();
|
||
|
|
await connA.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-a'");
|
||
|
|
var workItemsA = (await connA.QueryAsync<WorkItem>("SELECT * FROM work_items")).ToList();
|
||
|
|
var clubsA = (await connA.QueryAsync<Club>("SELECT * FROM clubs")).ToList();
|
||
|
|
|
||
|
|
// Act: Query as Club B
|
||
|
|
await using var connB = new NpgsqlConnection(GetAppUserConnectionString());
|
||
|
|
await connB.OpenAsync();
|
||
|
|
await connB.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-b'");
|
||
|
|
var workItemsB = (await connB.QueryAsync<WorkItem>("SELECT * FROM work_items")).ToList();
|
||
|
|
var clubsB = (await connB.QueryAsync<Club>("SELECT * FROM clubs")).ToList();
|
||
|
|
|
||
|
|
// Assert: Club A sees only its data
|
||
|
|
Assert.Single(workItemsA);
|
||
|
|
Assert.Equal(workItemA1Id, workItemsA[0].Id);
|
||
|
|
Assert.Equal("club-a", workItemsA[0].TenantId);
|
||
|
|
Assert.Equal("Task Alpha", workItemsA[0].Title);
|
||
|
|
Assert.Single(clubsA);
|
||
|
|
Assert.Equal(clubAId, clubsA[0].Id);
|
||
|
|
|
||
|
|
// Assert: Club B sees only its data
|
||
|
|
Assert.Single(workItemsB);
|
||
|
|
Assert.Equal(workItemB1Id, workItemsB[0].Id);
|
||
|
|
Assert.Equal("club-b", workItemsB[0].TenantId);
|
||
|
|
Assert.Equal("Task Beta", workItemsB[0].Title);
|
||
|
|
Assert.Single(clubsB);
|
||
|
|
Assert.Equal(clubBId, clubsB[0].Id);
|
||
|
|
|
||
|
|
// Assert: Zero overlap - perfect isolation
|
||
|
|
Assert.DoesNotContain(workItemsA, w => w.Id == workItemB1Id);
|
||
|
|
Assert.DoesNotContain(workItemsB, w => w.Id == workItemA1Id);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Fact]
|
||
|
|
public async Task Test2_NoContext_NoData_RlsBlocksEverything()
|
||
|
|
{
|
||
|
|
// Arrange: Seed data for two tenants
|
||
|
|
var clubAId = Guid.NewGuid();
|
||
|
|
var clubBId = Guid.NewGuid();
|
||
|
|
|
||
|
|
await using var adminConn = new NpgsqlConnection(GetAdminConnectionString());
|
||
|
|
await adminConn.OpenAsync();
|
||
|
|
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
|
||
|
|
VALUES (@Id1, 'club-a', 'Club Alpha', 0, NOW(), NOW()),
|
||
|
|
(@Id2, 'club-b', 'Club Beta', 1, NOW(), NOW())",
|
||
|
|
new { Id1 = clubAId, Id2 = clubBId });
|
||
|
|
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
|
||
|
|
SELECT gen_random_uuid(), 'club-a', 'Task A' || i, 0, gen_random_uuid(), @ClubId, NOW(), NOW()
|
||
|
|
FROM generate_series(1, 3) i",
|
||
|
|
new { ClubId = clubAId });
|
||
|
|
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
|
||
|
|
SELECT gen_random_uuid(), 'club-b', 'Task B' || i, 0, gen_random_uuid(), @ClubId, NOW(), NOW()
|
||
|
|
FROM generate_series(1, 3) i",
|
||
|
|
new { ClubId = clubBId });
|
||
|
|
|
||
|
|
// Act: Query WITHOUT setting tenant context
|
||
|
|
await using var conn = new NpgsqlConnection(GetAppUserConnectionString());
|
||
|
|
await conn.OpenAsync();
|
||
|
|
// CRITICAL: Do NOT execute SET LOCAL - simulate missing tenant context
|
||
|
|
var clubs = (await conn.QueryAsync<Club>("SELECT * FROM clubs")).ToList();
|
||
|
|
var workItems = (await conn.QueryAsync<WorkItem>("SELECT * FROM work_items")).ToList();
|
||
|
|
|
||
|
|
// Assert: RLS blocks all access when no tenant context is set
|
||
|
|
Assert.Empty(clubs);
|
||
|
|
Assert.Empty(workItems);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Fact]
|
||
|
|
public async Task Test3_InsertProtection_CrossTenantInsertBlocked()
|
||
|
|
{
|
||
|
|
// Arrange: Seed Club A
|
||
|
|
var clubAId = Guid.NewGuid();
|
||
|
|
var memberAId = Guid.NewGuid();
|
||
|
|
|
||
|
|
await using var adminConn = new NpgsqlConnection(GetAdminConnectionString());
|
||
|
|
await adminConn.OpenAsync();
|
||
|
|
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
|
||
|
|
VALUES (@Id, 'club-a', 'Club Alpha', 0, NOW(), NOW())",
|
||
|
|
new { Id = clubAId });
|
||
|
|
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO members (id, tenant_id, name, email, club_id, role, joined_at, created_at, updated_at)
|
||
|
|
VALUES (@Id, 'club-a', 'Alice', 'alice@club-a.com', @ClubId, 1, NOW(), NOW(), NOW())",
|
||
|
|
new { Id = memberAId, ClubId = clubAId });
|
||
|
|
|
||
|
|
// Act: Try to insert WorkItem with Club B tenant_id while context is Club A
|
||
|
|
await using var conn = new NpgsqlConnection(GetAppUserConnectionString());
|
||
|
|
await conn.OpenAsync();
|
||
|
|
await conn.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-a'");
|
||
|
|
|
||
|
|
var workItemId = Guid.NewGuid();
|
||
|
|
var insertSql = @"
|
||
|
|
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
|
||
|
|
VALUES (@Id, 'club-b', 'Malicious Task', 0, @MemberId, @ClubId, NOW(), NOW())";
|
||
|
|
|
||
|
|
// Assert: RLS blocks the insert (PostgreSQL returns 0 rows affected for policy violation)
|
||
|
|
var rowsAffected = await conn.ExecuteAsync(insertSql, new { Id = workItemId, MemberId = memberAId, ClubId = clubAId });
|
||
|
|
Assert.Equal(0, rowsAffected);
|
||
|
|
|
||
|
|
// Verify: WorkItem was NOT inserted
|
||
|
|
await conn.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-b'");
|
||
|
|
var insertedItems = (await conn.QueryAsync<WorkItem>(
|
||
|
|
"SELECT * FROM work_items WHERE id = @Id", new { Id = workItemId })).ToList();
|
||
|
|
Assert.Empty(insertedItems);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Fact]
|
||
|
|
public async Task Test4_ConcurrentRequests_ConnectionPoolSafety()
|
||
|
|
{
|
||
|
|
// Arrange: Seed data for two tenants
|
||
|
|
var clubAId = Guid.NewGuid();
|
||
|
|
var clubBId = Guid.NewGuid();
|
||
|
|
|
||
|
|
await using var adminConn = new NpgsqlConnection(GetAdminConnectionString());
|
||
|
|
await adminConn.OpenAsync();
|
||
|
|
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
|
||
|
|
VALUES (@Id1, 'club-a', 'Club Alpha', 0, NOW(), NOW()),
|
||
|
|
(@Id2, 'club-b', 'Club Beta', 1, NOW(), NOW())",
|
||
|
|
new { Id1 = clubAId, Id2 = clubBId });
|
||
|
|
|
||
|
|
var memberAId = Guid.NewGuid();
|
||
|
|
var memberBId = Guid.NewGuid();
|
||
|
|
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO members (id, tenant_id, name, email, club_id, role, joined_at, created_at, updated_at)
|
||
|
|
VALUES (@IdA, 'club-a', 'Alice', 'alice@club-a.com', @ClubAId, 1, NOW(), NOW(), NOW()),
|
||
|
|
(@IdB, 'club-b', 'Bob', 'bob@club-b.com', @ClubBId, 1, NOW(), NOW(), NOW())",
|
||
|
|
new { IdA = memberAId, ClubAId = clubAId, IdB = memberBId, ClubBId = clubBId });
|
||
|
|
|
||
|
|
// Insert 25 work items for Club A
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
|
||
|
|
SELECT gen_random_uuid(), 'club-a', 'Task A' || i, 0, @MemberId, @ClubId, NOW(), NOW()
|
||
|
|
FROM generate_series(1, 25) i",
|
||
|
|
new { MemberId = memberAId, ClubId = clubAId });
|
||
|
|
|
||
|
|
// Insert 25 work items for Club B
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
|
||
|
|
SELECT gen_random_uuid(), 'club-b', 'Task B' || i, 0, @MemberId, @ClubId, NOW(), NOW()
|
||
|
|
FROM generate_series(1, 25) i",
|
||
|
|
new { MemberId = memberBId, ClubId = clubBId });
|
||
|
|
|
||
|
|
// Act: Fire 50 parallel requests (25 for Club A, 25 for Club B)
|
||
|
|
var results = new ConcurrentBag<(string TenantId, List<WorkItem> Items)>();
|
||
|
|
var tasks = new List<Task>();
|
||
|
|
|
||
|
|
for (int i = 0; i < 25; i++)
|
||
|
|
{
|
||
|
|
tasks.Add(Task.Run(async () =>
|
||
|
|
{
|
||
|
|
await using var conn = new NpgsqlConnection(GetAppUserConnectionString());
|
||
|
|
await conn.OpenAsync();
|
||
|
|
await conn.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-a'");
|
||
|
|
var items = (await conn.QueryAsync<WorkItem>("SELECT * FROM work_items")).ToList();
|
||
|
|
results.Add(("club-a", items));
|
||
|
|
}));
|
||
|
|
|
||
|
|
tasks.Add(Task.Run(async () =>
|
||
|
|
{
|
||
|
|
await using var conn = new NpgsqlConnection(GetAppUserConnectionString());
|
||
|
|
await conn.OpenAsync();
|
||
|
|
await conn.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-b'");
|
||
|
|
var items = (await conn.QueryAsync<WorkItem>("SELECT * FROM work_items")).ToList();
|
||
|
|
results.Add(("club-b", items));
|
||
|
|
}));
|
||
|
|
}
|
||
|
|
|
||
|
|
await Task.WhenAll(tasks);
|
||
|
|
|
||
|
|
// Assert: All 50 requests returned correct tenant-isolated data
|
||
|
|
Assert.Equal(50, results.Count);
|
||
|
|
|
||
|
|
var clubAResults = results.Where(r => r.TenantId == "club-a").ToList();
|
||
|
|
var clubBResults = results.Where(r => r.TenantId == "club-b").ToList();
|
||
|
|
|
||
|
|
Assert.Equal(25, clubAResults.Count);
|
||
|
|
Assert.Equal(25, clubBResults.Count);
|
||
|
|
|
||
|
|
// Verify: Every Club A request saw exactly 25 Club A items
|
||
|
|
foreach (var (_, items) in clubAResults)
|
||
|
|
{
|
||
|
|
Assert.Equal(25, items.Count);
|
||
|
|
Assert.All(items, item => Assert.Equal("club-a", item.TenantId));
|
||
|
|
Assert.All(items, item => Assert.StartsWith("Task A", item.Title));
|
||
|
|
}
|
||
|
|
|
||
|
|
// Verify: Every Club B request saw exactly 25 Club B items
|
||
|
|
foreach (var (_, items) in clubBResults)
|
||
|
|
{
|
||
|
|
Assert.Equal(25, items.Count);
|
||
|
|
Assert.All(items, item => Assert.Equal("club-b", item.TenantId));
|
||
|
|
Assert.All(items, item => Assert.StartsWith("Task B", item.Title));
|
||
|
|
}
|
||
|
|
|
||
|
|
// Assert: Zero cross-contamination events
|
||
|
|
var allClubAItems = clubAResults.SelectMany(r => r.Items).ToList();
|
||
|
|
var allClubBItems = clubBResults.SelectMany(r => r.Items).ToList();
|
||
|
|
Assert.DoesNotContain(allClubAItems, item => item.TenantId == "club-b");
|
||
|
|
Assert.DoesNotContain(allClubBItems, item => item.TenantId == "club-a");
|
||
|
|
}
|
||
|
|
|
||
|
|
[Fact]
|
||
|
|
public async Task Test5_CrossTenantHeaderSpoof_MiddlewareBlocks()
|
||
|
|
{
|
||
|
|
// Arrange: Seed Club A only
|
||
|
|
var clubAId = Guid.NewGuid();
|
||
|
|
|
||
|
|
await using var adminConn = new NpgsqlConnection(GetAdminConnectionString());
|
||
|
|
await adminConn.OpenAsync();
|
||
|
|
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
|
||
|
|
VALUES (@Id, 'club-a', 'Club Alpha', 0, NOW(), NOW())",
|
||
|
|
new { Id = clubAId });
|
||
|
|
|
||
|
|
// Act: Authenticate as user with only club-a membership
|
||
|
|
AuthenticateAs("alice@club-a.com", new Dictionary<string, string>
|
||
|
|
{
|
||
|
|
["club-a"] = "admin"
|
||
|
|
});
|
||
|
|
|
||
|
|
// Try to access club-b (user is NOT a member)
|
||
|
|
SetTenant("club-b");
|
||
|
|
|
||
|
|
// Make request to API endpoint - TenantValidationMiddleware should block
|
||
|
|
var response = await Client.GetAsync("/api/clubs");
|
||
|
|
|
||
|
|
// Assert: Middleware returns 403 Forbidden
|
||
|
|
Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Fact]
|
||
|
|
public async Task Test6_InterceptorVerification_SetLocalExecuted()
|
||
|
|
{
|
||
|
|
// Arrange: Seed data for Club A
|
||
|
|
var clubAId = Guid.NewGuid();
|
||
|
|
var memberAId = Guid.NewGuid();
|
||
|
|
|
||
|
|
await using var adminConn = new NpgsqlConnection(GetAdminConnectionString());
|
||
|
|
await adminConn.OpenAsync();
|
||
|
|
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
|
||
|
|
VALUES (@Id, 'club-a', 'Club Alpha', 0, NOW(), NOW())",
|
||
|
|
new { Id = clubAId });
|
||
|
|
|
||
|
|
await adminConn.ExecuteAsync(@"
|
||
|
|
INSERT INTO members (id, tenant_id, name, email, club_id, role, joined_at, created_at, updated_at)
|
||
|
|
VALUES (@Id, 'club-a', 'Alice', 'alice@club-a.com', @ClubId, 1, NOW(), NOW(), NOW())",
|
||
|
|
new { Id = memberAId, ClubId = clubAId });
|
||
|
|
|
||
|
|
// Act: Use EF Core with interceptor to query data
|
||
|
|
// The TenantDbConnectionInterceptor should automatically set app.current_tenant_id
|
||
|
|
await using var conn = new NpgsqlConnection(GetAppUserConnectionString());
|
||
|
|
await conn.OpenAsync();
|
||
|
|
|
||
|
|
// Simulate interceptor behavior: SET LOCAL is called by TenantDbConnectionInterceptor
|
||
|
|
await conn.ExecuteAsync("SET LOCAL app.current_tenant_id = 'club-a'");
|
||
|
|
|
||
|
|
// Verify: Check current_setting returns correct tenant
|
||
|
|
var currentTenant = await conn.ExecuteScalarAsync<string>(
|
||
|
|
"SELECT current_setting('app.current_tenant_id', true)");
|
||
|
|
|
||
|
|
Assert.Equal("club-a", currentTenant);
|
||
|
|
|
||
|
|
// Verify: Queries respect the tenant context
|
||
|
|
var members = (await conn.QueryAsync<Member>("SELECT * FROM members")).ToList();
|
||
|
|
Assert.Single(members);
|
||
|
|
Assert.Equal(memberAId, members[0].Id);
|
||
|
|
Assert.Equal("club-a", members[0].TenantId);
|
||
|
|
|
||
|
|
// Verify: Interceptor is registered in DI container
|
||
|
|
var scope = Factory.Services.CreateScope();
|
||
|
|
var interceptor = scope.ServiceProvider.GetService<TenantDbConnectionInterceptor>();
|
||
|
|
Assert.NotNull(interceptor);
|
||
|
|
}
|
||
|
|
|
||
|
|
private string GetAppUserConnectionString()
|
||
|
|
{
|
||
|
|
var config = Factory.Services.GetRequiredService<Microsoft.Extensions.Configuration.IConfiguration>();
|
||
|
|
var connectionString = config["ConnectionStrings:DefaultConnection"];
|
||
|
|
return connectionString!;
|
||
|
|
}
|
||
|
|
|
||
|
|
private string GetAdminConnectionString()
|
||
|
|
{
|
||
|
|
var connString = GetAppUserConnectionString();
|
||
|
|
return connString;
|
||
|
|
}
|
||
|
|
}
|