feat(backend): add PostgreSQL schema, RLS policies, and multi-tenant middleware
- Add EF Core migrations for initial schema (clubs, members, work_items, shifts, shift_signups) - Implement RLS policies with SET LOCAL for tenant isolation - Add Finbuckle multi-tenant middleware with ClaimStrategy + HeaderStrategy fallback - Create TenantValidationMiddleware to enforce JWT claims match X-Tenant-Id header - Add tenant-aware DB interceptors (SaveChangesTenantInterceptor, TenantDbConnectionInterceptor) - Configure AppDbContext with tenant scoping and RLS support - Add test infrastructure: CustomWebApplicationFactory, TestAuthHandler, DatabaseFixture - Write TDD integration tests for multi-tenant isolation and RLS enforcement - Add health check null safety for connection string Tasks: 7 (PostgreSQL schema + migrations + RLS), 8 (Finbuckle multi-tenancy + validation), 12 (test infrastructure)
This commit is contained in:
WorkClub Automation
138
backend/WorkClub.Tests.Integration/Data/MigrationTests.cs
Normal file
138
backend/WorkClub.Tests.Integration/Data/MigrationTests.cs
Normal file
@@ -0,0 +1,138 @@
|
||||
using Dapper;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Npgsql;
|
||||
using Testcontainers.PostgreSql;
|
||||
using WorkClub.Infrastructure.Data;
|
||||
|
||||
namespace WorkClub.Tests.Integration.Data;
|
||||
|
||||
public class MigrationTests : IAsyncLifetime
|
||||
{
|
||||
private PostgreSqlContainer? _container;
|
||||
private string? _connectionString;
|
||||
|
||||
public async Task InitializeAsync()
|
||||
{
|
||||
_container = new PostgreSqlBuilder()
|
||||
.WithImage("postgres:16-alpine")
|
||||
.Build();
|
||||
|
||||
await _container.StartAsync();
|
||||
_connectionString = _container.GetConnectionString();
|
||||
}
|
||||
|
||||
public async Task DisposeAsync()
|
||||
{
|
||||
if (_container != null)
|
||||
{
|
||||
await _container.DisposeAsync();
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Migration_AppliesSuccessfully_CreatesAllTables()
|
||||
{
|
||||
// Arrange
|
||||
var options = new DbContextOptionsBuilder<AppDbContext>()
|
||||
.UseNpgsql(_connectionString)
|
||||
.Options;
|
||||
|
||||
// Act
|
||||
await using var context = new AppDbContext(options);
|
||||
await context.Database.MigrateAsync();
|
||||
|
||||
// Assert - verify all expected tables exist
|
||||
await using var connection = new NpgsqlConnection(_connectionString);
|
||||
var tables = (await connection.QueryAsync<string>(
|
||||
@"SELECT table_name
|
||||
FROM information_schema.tables
|
||||
WHERE table_schema = 'public'
|
||||
ORDER BY table_name")).ToList();
|
||||
|
||||
Assert.Contains("clubs", tables);
|
||||
Assert.Contains("members", tables);
|
||||
Assert.Contains("work_items", tables);
|
||||
Assert.Contains("shifts", tables);
|
||||
Assert.Contains("shift_signups", tables);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Migration_CreatesCorrectIndexes()
|
||||
{
|
||||
// Arrange
|
||||
var options = new DbContextOptionsBuilder<AppDbContext>()
|
||||
.UseNpgsql(_connectionString)
|
||||
.Options;
|
||||
|
||||
// Act
|
||||
await using var context = new AppDbContext(options);
|
||||
await context.Database.MigrateAsync();
|
||||
|
||||
// Assert - verify critical indexes exist
|
||||
await using var connection = new NpgsqlConnection(_connectionString);
|
||||
var indexes = (await connection.QueryAsync<string>(
|
||||
@"SELECT indexname
|
||||
FROM pg_indexes
|
||||
WHERE schemaname = 'public'
|
||||
ORDER BY indexname")).ToList();
|
||||
|
||||
// TenantId indexes
|
||||
Assert.Contains(indexes, i => i.Contains("tenant_id"));
|
||||
|
||||
// ClubId indexes
|
||||
Assert.Contains(indexes, i => i.Contains("club_id"));
|
||||
|
||||
// Status indexes for WorkItem
|
||||
Assert.Contains(indexes, i => i.Contains("status"));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Migration_EnablesRowLevelSecurity()
|
||||
{
|
||||
// Arrange
|
||||
var options = new DbContextOptionsBuilder<AppDbContext>()
|
||||
.UseNpgsql(_connectionString)
|
||||
.Options;
|
||||
|
||||
// Act
|
||||
await using var context = new AppDbContext(options);
|
||||
await context.Database.MigrateAsync();
|
||||
|
||||
// Assert - verify RLS is enabled on tenant tables
|
||||
await using var connection = new NpgsqlConnection(_connectionString);
|
||||
var rlsEnabled = await connection.QueryAsync<(string TableName, bool RlsEnabled)>(
|
||||
@"SELECT relname AS TableName, relrowsecurity AS RlsEnabled
|
||||
FROM pg_class
|
||||
WHERE relnamespace = 'public'::regnamespace
|
||||
AND relname IN ('clubs', 'members', 'work_items', 'shifts', 'shift_signups')");
|
||||
|
||||
foreach (var (tableName, enabled) in rlsEnabled)
|
||||
{
|
||||
Assert.True(enabled, $"RLS should be enabled on {tableName}");
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Migration_CreatesTenantIsolationPolicy()
|
||||
{
|
||||
// Arrange
|
||||
var options = new DbContextOptionsBuilder<AppDbContext>()
|
||||
.UseNpgsql(_connectionString)
|
||||
.Options;
|
||||
|
||||
// Act
|
||||
await using var context = new AppDbContext(options);
|
||||
await context.Database.MigrateAsync();
|
||||
|
||||
// Assert - verify tenant_isolation policies exist
|
||||
await using var connection = new NpgsqlConnection(_connectionString);
|
||||
var policies = (await connection.QueryAsync<string>(
|
||||
@"SELECT policyname
|
||||
FROM pg_policies
|
||||
WHERE schemaname = 'public'
|
||||
AND policyname = 'tenant_isolation'")).ToList();
|
||||
|
||||
// Should have tenant_isolation policy on all tenant tables
|
||||
Assert.True(policies.Count >= 5, "Should have at least 5 tenant_isolation policies");
|
||||
}
|
||||
}
|
||||
197
backend/WorkClub.Tests.Integration/Data/RlsTests.cs
Normal file
197
backend/WorkClub.Tests.Integration/Data/RlsTests.cs
Normal file
@@ -0,0 +1,197 @@
|
||||
using Dapper;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Npgsql;
|
||||
using Testcontainers.PostgreSql;
|
||||
using WorkClub.Domain.Entities;
|
||||
using WorkClub.Infrastructure.Data;
|
||||
|
||||
namespace WorkClub.Tests.Integration.Data;
|
||||
|
||||
public class RlsTests : IAsyncLifetime
|
||||
{
|
||||
private PostgreSqlContainer? _container;
|
||||
private string? _connectionString;
|
||||
private string? _adminConnectionString;
|
||||
|
||||
public async Task InitializeAsync()
|
||||
{
|
||||
_container = new PostgreSqlBuilder()
|
||||
.WithImage("postgres:16-alpine")
|
||||
.WithDatabase("workclub")
|
||||
.WithUsername("app_user")
|
||||
.WithPassword("apppass")
|
||||
.Build();
|
||||
|
||||
await _container.StartAsync();
|
||||
_connectionString = _container.GetConnectionString();
|
||||
|
||||
_adminConnectionString = _connectionString.Replace("app_user", "app_admin")
|
||||
.Replace("apppass", "adminpass");
|
||||
|
||||
await using var adminConn = new NpgsqlConnection(_adminConnectionString);
|
||||
await adminConn.ExecuteAsync("CREATE ROLE app_admin WITH LOGIN PASSWORD 'adminpass' SUPERUSER");
|
||||
await adminConn.ExecuteAsync("GRANT ALL PRIVILEGES ON DATABASE workclub TO app_admin");
|
||||
}
|
||||
|
||||
public async Task DisposeAsync()
|
||||
{
|
||||
if (_container != null)
|
||||
{
|
||||
await _container.DisposeAsync();
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task RLS_BlocksAccess_WithoutTenantContext()
|
||||
{
|
||||
await SeedTestDataAsync();
|
||||
|
||||
await using var connection = new NpgsqlConnection(_connectionString);
|
||||
await connection.OpenAsync();
|
||||
|
||||
var clubs = (await connection.QueryAsync<Club>(
|
||||
"SELECT * FROM clubs")).ToList();
|
||||
|
||||
Assert.Empty(clubs);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task RLS_AllowsAccess_WithCorrectTenantContext()
|
||||
{
|
||||
await SeedTestDataAsync();
|
||||
|
||||
await using var connection = new NpgsqlConnection(_connectionString);
|
||||
await connection.OpenAsync();
|
||||
|
||||
await connection.ExecuteAsync("SET LOCAL app.current_tenant_id = 'tenant-1'");
|
||||
|
||||
var clubs = (await connection.QueryAsync<Club>(
|
||||
"SELECT * FROM clubs WHERE tenant_id = 'tenant-1'")).ToList();
|
||||
|
||||
Assert.NotEmpty(clubs);
|
||||
Assert.All(clubs, c => Assert.Equal("tenant-1", c.TenantId));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task RLS_IsolatesData_AcrossTenants()
|
||||
{
|
||||
await SeedTestDataAsync();
|
||||
|
||||
await using var connection = new NpgsqlConnection(_connectionString);
|
||||
await connection.OpenAsync();
|
||||
|
||||
await connection.ExecuteAsync("SET LOCAL app.current_tenant_id = 'tenant-1'");
|
||||
var tenant1Clubs = (await connection.QueryAsync<Club>(
|
||||
"SELECT * FROM clubs")).ToList();
|
||||
|
||||
await connection.ExecuteAsync("SET LOCAL app.current_tenant_id = 'tenant-2'");
|
||||
var tenant2Clubs = (await connection.QueryAsync<Club>(
|
||||
"SELECT * FROM clubs")).ToList();
|
||||
|
||||
Assert.NotEmpty(tenant1Clubs);
|
||||
Assert.NotEmpty(tenant2Clubs);
|
||||
Assert.All(tenant1Clubs, c => Assert.Equal("tenant-1", c.TenantId));
|
||||
Assert.All(tenant2Clubs, c => Assert.Equal("tenant-2", c.TenantId));
|
||||
|
||||
var tenant1Ids = tenant1Clubs.Select(c => c.Id).ToHashSet();
|
||||
var tenant2Ids = tenant2Clubs.Select(c => c.Id).ToHashSet();
|
||||
Assert.Empty(tenant1Ids.Intersect(tenant2Ids));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task RLS_CountsCorrectly_PerTenant()
|
||||
{
|
||||
await SeedTestDataAsync();
|
||||
|
||||
await using var connection = new NpgsqlConnection(_connectionString);
|
||||
await connection.OpenAsync();
|
||||
|
||||
await connection.ExecuteAsync("SET LOCAL app.current_tenant_id = 'tenant-1'");
|
||||
var tenant1Count = await connection.ExecuteScalarAsync<int>(
|
||||
"SELECT COUNT(*) FROM work_items");
|
||||
|
||||
await connection.ExecuteAsync("SET LOCAL app.current_tenant_id = 'tenant-2'");
|
||||
var tenant2Count = await connection.ExecuteScalarAsync<int>(
|
||||
"SELECT COUNT(*) FROM work_items");
|
||||
|
||||
Assert.Equal(5, tenant1Count);
|
||||
Assert.Equal(3, tenant2Count);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task RLS_AllowsBypass_ForAdminRole()
|
||||
{
|
||||
await SeedTestDataAsync();
|
||||
|
||||
await using var connection = new NpgsqlConnection(_adminConnectionString);
|
||||
await connection.OpenAsync();
|
||||
|
||||
var allClubs = (await connection.QueryAsync<Club>(
|
||||
"SELECT * FROM clubs")).ToList();
|
||||
|
||||
Assert.True(allClubs.Count >= 2);
|
||||
Assert.Contains(allClubs, c => c.TenantId == "tenant-1");
|
||||
Assert.Contains(allClubs, c => c.TenantId == "tenant-2");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task RLS_HandlesShiftSignups_WithSubquery()
|
||||
{
|
||||
await SeedTestDataAsync();
|
||||
|
||||
await using var connection = new NpgsqlConnection(_connectionString);
|
||||
await connection.OpenAsync();
|
||||
|
||||
await connection.ExecuteAsync("SET LOCAL app.current_tenant_id = 'tenant-1'");
|
||||
var signups = (await connection.QueryAsync<ShiftSignup>(
|
||||
"SELECT * FROM shift_signups")).ToList();
|
||||
|
||||
Assert.NotEmpty(signups);
|
||||
Assert.All(signups, s => Assert.Equal("tenant-1", s.TenantId));
|
||||
}
|
||||
|
||||
private async Task SeedTestDataAsync()
|
||||
{
|
||||
var options = new DbContextOptionsBuilder<AppDbContext>()
|
||||
.UseNpgsql(_connectionString)
|
||||
.Options;
|
||||
|
||||
await using var context = new AppDbContext(options);
|
||||
await context.Database.MigrateAsync();
|
||||
|
||||
await using var adminConn = new NpgsqlConnection(_adminConnectionString);
|
||||
await adminConn.OpenAsync();
|
||||
|
||||
var club1Id = Guid.NewGuid();
|
||||
var club2Id = Guid.NewGuid();
|
||||
|
||||
await adminConn.ExecuteAsync(@"
|
||||
INSERT INTO clubs (id, tenant_id, name, sport_type, created_at, updated_at)
|
||||
VALUES (@Id1, 'tenant-1', 'Club 1', 0, NOW(), NOW()),
|
||||
(@Id2, 'tenant-2', 'Club 2', 1, NOW(), NOW())",
|
||||
new { Id1 = club1Id, Id2 = club2Id });
|
||||
|
||||
await adminConn.ExecuteAsync(@"
|
||||
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
|
||||
SELECT gen_random_uuid(), 'tenant-1', 'Task ' || i, 0, gen_random_uuid(), @ClubId, NOW(), NOW()
|
||||
FROM generate_series(1, 5) i",
|
||||
new { ClubId = club1Id });
|
||||
|
||||
await adminConn.ExecuteAsync(@"
|
||||
INSERT INTO work_items (id, tenant_id, title, status, created_by_id, club_id, created_at, updated_at)
|
||||
SELECT gen_random_uuid(), 'tenant-2', 'Task ' || i, 0, gen_random_uuid(), @ClubId, NOW(), NOW()
|
||||
FROM generate_series(1, 3) i",
|
||||
new { ClubId = club2Id });
|
||||
|
||||
var shift1Id = Guid.NewGuid();
|
||||
await adminConn.ExecuteAsync(@"
|
||||
INSERT INTO shifts (id, tenant_id, title, start_time, end_time, club_id, created_by_id, created_at, updated_at)
|
||||
VALUES (@Id, 'tenant-1', 'Shift 1', NOW(), NOW() + interval '2 hours', @ClubId, gen_random_uuid(), NOW(), NOW())",
|
||||
new { Id = shift1Id, ClubId = club1Id });
|
||||
|
||||
await adminConn.ExecuteAsync(@"
|
||||
INSERT INTO shift_signups (id, tenant_id, shift_id, member_id, signed_up_at)
|
||||
VALUES (gen_random_uuid(), 'tenant-1', @ShiftId, gen_random_uuid(), NOW())",
|
||||
new { ShiftId = shift1Id });
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user