mirror of
https://github.com/valitydev/redash.git
synced 2024-11-07 01:25:16 +00:00
246eca1121
* Make core app compatible with Python 3 No backward compatibility with Python 2.7 is kept. This commit mostly contains changes made with 2to3 and manual tweaking when necessary. * Use Python 3.7 as base docker image Since it is not possible to change redash/base:debian to Python 3 without breaking future relases, its Dockerfile is temporarly copied here. * Upgrade some requirements to newest versions Some of the older versions were not compatible with Python 3. * Migrate tests to Python 3 * Build frontend on Python 3 * Make the HMAC sign function compatible with Python 3 In Python 3, HMAC only works with bytes so the strings and the float used in the sign function need to be encoded. Hopefully this is still backward compatible with already generated signatures. * Use assertCountEqual instead of assertItemsEqual The latter is not available in Python 3. See https://bugs.python.org/issue17866 * Remove redundant encoding header for Python 3 modules * Remove redundant string encoding in CLI * Rename list() functions in CLI These functions shadow the builtin list function which is problematic since 2to3 adds a fair amount of calls to the builtin list when it finds dict.keys() and dict.values(). Only the Python function is renamed, from the perspective of the CLI nothing changes. * Replace usage of Exception.message in CLI `message` is not available anymore, instead use the string representation of the exception. * Adapt test handlers to Python 3 * Fix test that relied on dict ordering * Make sure test results are always uploaded (#4215) * Support encoding memoryview to JSON psycopg2 returns `buffer` objects in Python 2.7 and `memoryview` in Python 3. See #3156 * Fix test relying on object address ordering * Decode bytes returned from Redis * Stop using e.message for most exceptions Exception.message is not available in Python 3 anymore, except for some exceptions defined by third-party libraries. * Fix writing XLSX files in Python 3 The buffer for the file should be made of bytes and the actual content written to it strings. Note: I do not know why the diff is so large as it's only a two lines change. Probably a white space or file encoding issue. * Fix test by comparing strings to strings * Fix another exception message unavailable in Python 3 * Fix export to CSV in Python 3 The UnicodeWriter is not used anymore. In Python 3, the interface provided by the CSV module only deals with strings, in and out. The encoding of the output is left to the user, in our case it is given to Flask via `make_response`. * (Python 3) Use Redis' decode_responses=True option (#4232) * Fix test_outdated_queries_works_scheduled_queries_tracker (use utcnow) * Make sure Redis connection uses decoded_responses option * Remove unused imports. * Use Redis' decode_responses option * Remove cases of explicit Redis decoding * Rename helper function and make sure it doesn't apply twice. * Don't add decode_responses to Celery Redis connection URL * Fix displaying error while connecting to SQLite The exception message is always a string in Python 3, so no need to try to decode things. * Fix another missing exception message * Handle JSON encoding for datasources returning bytes SimpleJSON assumes the bytes it receives contain text data, so it tries to UTF-8 encode them. It is sometimes not true, for instance the SQLite datasource returns bytes for BLOB types, which typically do not contain text but truly binary data. This commit disables SimpleJSON auto encoding of bytes to str and instead uses the same method as for memoryviews: generating a hex representation of the data. * Fix Python 3 compatibility with RQ * Revert some changes 2to3 tends to do (#4261) - Revert some changes 2to3 tends to do when it errs on the side of caution regarding dict view objects. - Also fixed some naming issues with one character variables in list comprehensions. - Fix Flask warning. * Upgrade dependencies * Remove useless `iter` added by 2to3 * Fix get_next_path tests (#4280) * Removed setting SERVER_NAME in tests setup to avoid a warning. * Change get_next_path to not return empty string in case of a domain only value. * Fix redirect tests: Since version 0.15 of Werkzeug it uses full path for fixing the location header instead of the root path. * Remove explicit dependency for Werkzeug * Switched pytz and certifi to unbinded versions. * Switch to new library for getting country from IP `python-geoip-geolite2` is not compatible with Python 3, instead use `maxminddb-geolite2` which is very similar as it includes the geolite2 database in the package . * Python 3 RQ modifications (#4281) * show current worker job (alongside with minor cosmetic column tweaks) * avoid loading entire job data for queued jobs * track general RQ queues (default, periodic and schemas) * get all active RQ queues * call get_celery_queues in another place * merge dicts the Python 3 way * extend the result_ttl of refresh_queries to 600 seconds to allow it to continue running periodically even after longer executions * Remove legacy Python flake8 tests
331 lines
14 KiB
Python
331 lines
14 KiB
Python
from tests import BaseTestCase
|
|
|
|
from redash.models import db
|
|
from redash.utils import json_dumps
|
|
from redash.handlers.query_results import error_messages
|
|
|
|
|
|
class TestQueryResultsCacheHeaders(BaseTestCase):
|
|
def test_uses_cache_headers_for_specific_result(self):
|
|
query_result = self.factory.create_query_result()
|
|
query = self.factory.create_query(latest_query_data=query_result)
|
|
|
|
rv = self.make_request('get', '/api/queries/{}/results/{}.json'.format(query.id, query_result.id))
|
|
self.assertIn('Cache-Control', rv.headers)
|
|
|
|
def test_doesnt_use_cache_headers_for_non_specific_result(self):
|
|
query_result = self.factory.create_query_result()
|
|
query = self.factory.create_query(latest_query_data=query_result)
|
|
|
|
rv = self.make_request('get', '/api/queries/{}/results.json'.format(query.id))
|
|
self.assertNotIn('Cache-Control', rv.headers)
|
|
|
|
def test_returns_404_if_no_cached_result_found(self):
|
|
query = self.factory.create_query(latest_query_data=None)
|
|
|
|
rv = self.make_request('get', '/api/queries/{}/results.json'.format(query.id))
|
|
self.assertEqual(404, rv.status_code)
|
|
|
|
|
|
class TestQueryResultListAPI(BaseTestCase):
|
|
def test_get_existing_result(self):
|
|
query_result = self.factory.create_query_result()
|
|
query = self.factory.create_query()
|
|
|
|
rv = self.make_request('post', '/api/query_results',
|
|
data={'data_source_id': self.factory.data_source.id,
|
|
'query': query.query_text})
|
|
self.assertEqual(rv.status_code, 200)
|
|
self.assertEqual(query_result.id, rv.json['query_result']['id'])
|
|
|
|
def test_execute_new_query(self):
|
|
query_result = self.factory.create_query_result()
|
|
query = self.factory.create_query()
|
|
|
|
rv = self.make_request('post', '/api/query_results',
|
|
data={'data_source_id': self.factory.data_source.id,
|
|
'query': query.query_text,
|
|
'max_age': 0})
|
|
|
|
self.assertEqual(rv.status_code, 200)
|
|
self.assertNotIn('query_result', rv.json)
|
|
self.assertIn('job', rv.json)
|
|
|
|
def test_execute_query_without_access(self):
|
|
group = self.factory.create_group()
|
|
db.session.commit()
|
|
user = self.factory.create_user(group_ids=[group.id])
|
|
query = self.factory.create_query()
|
|
|
|
rv = self.make_request('post', '/api/query_results',
|
|
data={'data_source_id': self.factory.data_source.id,
|
|
'query': query.query_text,
|
|
'max_age': 0},
|
|
user=user)
|
|
|
|
self.assertEqual(rv.status_code, 403)
|
|
self.assertIn('job', rv.json)
|
|
|
|
def test_execute_query_with_params(self):
|
|
query = "SELECT {{param}}"
|
|
|
|
rv = self.make_request('post', '/api/query_results',
|
|
data={'data_source_id': self.factory.data_source.id,
|
|
'query': query,
|
|
'max_age': 0})
|
|
|
|
self.assertEqual(rv.status_code, 400)
|
|
self.assertIn('job', rv.json)
|
|
|
|
rv = self.make_request('post', '/api/query_results',
|
|
data={'data_source_id': self.factory.data_source.id,
|
|
'query': query,
|
|
'parameters': {'param': 1},
|
|
'max_age': 0})
|
|
|
|
self.assertEqual(rv.status_code, 200)
|
|
self.assertIn('job', rv.json)
|
|
|
|
rv = self.make_request('post', '/api/query_results?p_param=1',
|
|
data={'data_source_id': self.factory.data_source.id,
|
|
'query': query,
|
|
'max_age': 0})
|
|
|
|
self.assertEqual(rv.status_code, 200)
|
|
self.assertIn('job', rv.json)
|
|
|
|
def test_execute_on_paused_data_source(self):
|
|
self.factory.data_source.pause()
|
|
|
|
rv = self.make_request('post', '/api/query_results',
|
|
data={'data_source_id': self.factory.data_source.id,
|
|
'query': 'SELECT 1',
|
|
'max_age': 0})
|
|
|
|
self.assertEqual(rv.status_code, 400)
|
|
self.assertNotIn('query_result', rv.json)
|
|
self.assertIn('job', rv.json)
|
|
|
|
def test_execute_without_data_source(self):
|
|
rv = self.make_request('post', '/api/query_results',
|
|
data={'query': 'SELECT 1',
|
|
'max_age': 0})
|
|
|
|
self.assertEqual(rv.status_code, 401)
|
|
self.assertDictEqual(rv.json, error_messages['select_data_source'][0])
|
|
|
|
|
|
class TestQueryResultAPI(BaseTestCase):
|
|
def test_has_no_access_to_data_source(self):
|
|
ds = self.factory.create_data_source(group=self.factory.create_group())
|
|
query_result = self.factory.create_query_result(data_source=ds)
|
|
|
|
rv = self.make_request('get', '/api/query_results/{}'.format(query_result.id))
|
|
self.assertEqual(rv.status_code, 403)
|
|
|
|
def test_has_view_only_access_to_data_source(self):
|
|
ds = self.factory.create_data_source(group=self.factory.org.default_group, view_only=True)
|
|
query_result = self.factory.create_query_result(data_source=ds)
|
|
|
|
rv = self.make_request('get', '/api/query_results/{}'.format(query_result.id))
|
|
self.assertEqual(rv.status_code, 200)
|
|
|
|
def test_has_full_access_to_data_source(self):
|
|
ds = self.factory.create_data_source(group=self.factory.org.default_group, view_only=False)
|
|
query_result = self.factory.create_query_result(data_source=ds)
|
|
|
|
rv = self.make_request('get', '/api/query_results/{}'.format(query_result.id))
|
|
self.assertEqual(rv.status_code, 200)
|
|
|
|
def test_execute_new_query(self):
|
|
query = self.factory.create_query()
|
|
|
|
rv = self.make_request('post', '/api/queries/{}/results'.format(query.id), data={'parameters': {}})
|
|
|
|
self.assertEqual(rv.status_code, 200)
|
|
self.assertIn('job', rv.json)
|
|
|
|
def test_execute_but_has_no_access_to_data_source(self):
|
|
ds = self.factory.create_data_source(group=self.factory.create_group())
|
|
query = self.factory.create_query(data_source=ds)
|
|
|
|
rv = self.make_request('post', '/api/queries/{}/results'.format(query.id))
|
|
self.assertEqual(rv.status_code, 403)
|
|
self.assertDictEqual(rv.json, error_messages['no_permission'][0])
|
|
|
|
def test_execute_with_no_parameter_values(self):
|
|
query = self.factory.create_query()
|
|
|
|
rv = self.make_request('post', '/api/queries/{}/results'.format(query.id))
|
|
|
|
self.assertEqual(rv.status_code, 200)
|
|
self.assertIn('job', rv.json)
|
|
|
|
def test_prevents_execution_of_unsafe_queries_on_view_only_data_sources(self):
|
|
ds = self.factory.create_data_source(group=self.factory.org.default_group, view_only=True)
|
|
query = self.factory.create_query(data_source=ds, options={"parameters": [{"name": "foo", "type": "text"}]})
|
|
|
|
rv = self.make_request('post', '/api/queries/{}/results'.format(query.id), data={"parameters": {}})
|
|
self.assertEqual(rv.status_code, 403)
|
|
self.assertDictEqual(rv.json, error_messages['unsafe_on_view_only'][0])
|
|
|
|
def test_allows_execution_of_safe_queries_on_view_only_data_sources(self):
|
|
ds = self.factory.create_data_source(group=self.factory.org.default_group, view_only=True)
|
|
query = self.factory.create_query(data_source=ds, options={"parameters": [{"name": "foo", "type": "number"}]})
|
|
|
|
rv = self.make_request('post', '/api/queries/{}/results'.format(query.id), data={"parameters": {}})
|
|
self.assertEqual(rv.status_code, 200)
|
|
|
|
def test_prevents_execution_of_unsafe_queries_using_api_key(self):
|
|
ds = self.factory.create_data_source(group=self.factory.org.default_group, view_only=True)
|
|
query = self.factory.create_query(data_source=ds, options={"parameters": [{"name": "foo", "type": "text"}]})
|
|
|
|
data = {'parameters': {'foo': 'bar'}}
|
|
rv = self.make_request('post', '/api/queries/{}/results?api_key={}'.format(query.id, query.api_key), data=data)
|
|
self.assertEqual(rv.status_code, 403)
|
|
self.assertDictEqual(rv.json, error_messages['unsafe_when_shared'][0])
|
|
|
|
def test_access_with_query_api_key(self):
|
|
ds = self.factory.create_data_source(group=self.factory.org.default_group, view_only=False)
|
|
query = self.factory.create_query()
|
|
query_result = self.factory.create_query_result(data_source=ds, query_text=query.query_text)
|
|
|
|
rv = self.make_request('get', '/api/queries/{}/results/{}.json?api_key={}'.format(query.id, query_result.id, query.api_key), user=False)
|
|
self.assertEqual(rv.status_code, 200)
|
|
|
|
def test_access_with_query_api_key_without_query_result_id(self):
|
|
ds = self.factory.create_data_source(group=self.factory.org.default_group, view_only=False)
|
|
query = self.factory.create_query()
|
|
query_result = self.factory.create_query_result(data_source=ds, query_text=query.query_text, query_hash=query.query_hash)
|
|
query.latest_query_data = query_result
|
|
|
|
rv = self.make_request('get', '/api/queries/{}/results.json?api_key={}'.format(query.id, query.api_key), user=False)
|
|
self.assertEqual(rv.status_code, 200)
|
|
|
|
def test_query_api_key_and_different_query_result(self):
|
|
ds = self.factory.create_data_source(group=self.factory.org.default_group, view_only=False)
|
|
query = self.factory.create_query(query_text="SELECT 8")
|
|
query_result2 = self.factory.create_query_result(data_source=ds, query_hash='something-different')
|
|
|
|
rv = self.make_request('get', '/api/queries/{}/results/{}.json?api_key={}'.format(query.id, query_result2.id, query.api_key), user=False)
|
|
self.assertEqual(rv.status_code, 404)
|
|
|
|
def test_signed_in_user_and_different_query_result(self):
|
|
ds2 = self.factory.create_data_source(group=self.factory.org.admin_group, view_only=False)
|
|
query = self.factory.create_query(query_text="SELECT 8")
|
|
query_result2 = self.factory.create_query_result(data_source=ds2, query_hash='something-different')
|
|
|
|
rv = self.make_request('get', '/api/queries/{}/results/{}.json'.format(query.id, query_result2.id))
|
|
self.assertEqual(rv.status_code, 403)
|
|
|
|
|
|
class TestQueryResultDropdownResource(BaseTestCase):
|
|
def test_checks_for_access_to_the_query(self):
|
|
ds2 = self.factory.create_data_source(group=self.factory.org.admin_group, view_only=False)
|
|
query = self.factory.create_query(data_source=ds2)
|
|
|
|
rv = self.make_request('get', '/api/queries/{}/dropdown'.format(query.id))
|
|
|
|
self.assertEqual(rv.status_code, 403)
|
|
|
|
|
|
class TestQueryDropdownsResource(BaseTestCase):
|
|
def test_prevents_access_if_unassociated_and_doesnt_have_access(self):
|
|
query = self.factory.create_query()
|
|
ds2 = self.factory.create_data_source(group=self.factory.org.admin_group, view_only=False)
|
|
unrelated_dropdown_query = self.factory.create_query(data_source=ds2)
|
|
|
|
# unrelated_dropdown_query has not been associated with query
|
|
# user does not have direct access to unrelated_dropdown_query
|
|
|
|
rv = self.make_request('get', '/api/queries/{}/dropdowns/{}'.format(query.id, unrelated_dropdown_query.id))
|
|
|
|
self.assertEqual(rv.status_code, 403)
|
|
|
|
def test_allows_access_if_unassociated_but_user_has_access(self):
|
|
query = self.factory.create_query()
|
|
|
|
query_result = self.factory.create_query_result()
|
|
data = {
|
|
'rows': [],
|
|
'columns': [{'name': 'whatever'}]
|
|
}
|
|
query_result = self.factory.create_query_result(data=json_dumps(data))
|
|
unrelated_dropdown_query = self.factory.create_query(latest_query_data=query_result)
|
|
|
|
# unrelated_dropdown_query has not been associated with query
|
|
# user has direct access to unrelated_dropdown_query
|
|
|
|
rv = self.make_request('get', '/api/queries/{}/dropdowns/{}'.format(query.id, unrelated_dropdown_query.id))
|
|
|
|
self.assertEqual(rv.status_code, 200)
|
|
|
|
def test_allows_access_if_associated_and_has_access_to_parent(self):
|
|
query_result = self.factory.create_query_result()
|
|
data = {
|
|
'rows': [],
|
|
'columns': [{'name': 'whatever'}]
|
|
}
|
|
query_result = self.factory.create_query_result(data=json_dumps(data))
|
|
dropdown_query = self.factory.create_query(latest_query_data=query_result)
|
|
|
|
options = {
|
|
'parameters': [{
|
|
'type': 'query',
|
|
'queryId': dropdown_query.id
|
|
}]
|
|
}
|
|
query = self.factory.create_query(options=options)
|
|
|
|
# dropdown_query has been associated with query
|
|
# user has access to query
|
|
|
|
rv = self.make_request('get', '/api/queries/{}/dropdowns/{}'.format(query.id, dropdown_query.id))
|
|
|
|
self.assertEqual(rv.status_code, 200)
|
|
|
|
def test_prevents_access_if_associated_and_doesnt_have_access_to_parent(self):
|
|
ds2 = self.factory.create_data_source(group=self.factory.org.admin_group, view_only=False)
|
|
dropdown_query = self.factory.create_query(data_source=ds2)
|
|
options = {
|
|
'parameters': [{
|
|
'type': 'query',
|
|
'queryId': dropdown_query.id
|
|
}]
|
|
}
|
|
query = self.factory.create_query(data_source=ds2, options=options)
|
|
|
|
# dropdown_query has been associated with query
|
|
# user doesnt have access to either query
|
|
|
|
rv = self.make_request('get', '/api/queries/{}/dropdowns/{}'.format(query.id, dropdown_query.id))
|
|
|
|
self.assertEqual(rv.status_code, 403)
|
|
|
|
|
|
class TestQueryResultExcelResponse(BaseTestCase):
|
|
def test_renders_excel_file(self):
|
|
query = self.factory.create_query()
|
|
query_result = self.factory.create_query_result()
|
|
|
|
rv = self.make_request('get', '/api/queries/{}/results/{}.xlsx'.format(query.id, query_result.id), is_json=False)
|
|
self.assertEqual(rv.status_code, 200)
|
|
|
|
def test_renders_excel_file_when_rows_have_missing_columns(self):
|
|
query = self.factory.create_query()
|
|
data = {
|
|
'rows': [
|
|
{'test': 1},
|
|
{'test': 2, 'test2': 3},
|
|
],
|
|
'columns': [
|
|
{'name': 'test'},
|
|
{'name': 'test2'},
|
|
],
|
|
}
|
|
query_result = self.factory.create_query_result(data=json_dumps(data))
|
|
|
|
rv = self.make_request('get', '/api/queries/{}/results/{}.xlsx'.format(query.id, query_result.id), is_json=False)
|
|
self.assertEqual(rv.status_code, 200)
|
|
|