anti
ce4be68501
Lays the storage and bus substrate for the "credential reuse patterns"
task in DEVELOPMENT.md and scaffolds decnet/vectorstore/ as the future
substrate for statistical attacker re-identification over behavioral
fingerprints. No correlator, profiler, API, or dashboard wiring in
this commit — see TODO.md for the handoff.
Schema:
- Credential.attacker_uuid (nullable FK to attackers.uuid),
backfilled by the profiler post-write to avoid coupling the
capture path to the profiler's ordering.
- CredentialReuse table — UUID PK, JSON list columns for the
accumulating attacker_uuids/ips/deckies/services, target_count
(the discriminative scalar), confidence reserved for a future
fuzzy-credential pass.
Repo:
- upsert_credential_reuse / list_credential_reuses /
get_credential_reuse_by_id / update_credential_attacker_uuid.
- Renamed pre-existing get_credential_reuse(secret_sha256) to
get_credential_attempts_for_secret(secret_sha256) — the new
findings table needs the cleaner name.
Bus topics:
- credential.captured (one per Credential upsert)
- credential.reuse.detected (correlator-emitted on insert/grow)
Vectorstore subpackage (decnet/vectorstore/, flat layout mirroring
decnet/bus/):
- BaseVectorStore ABC keyed by (kind, id) — kind discriminator
means new feature families are additive, no schema migration.
- FakeVectorStore (in-memory L2 KNN), NullVectorStore (no-op for
DECNET_VECTORSTORE_ENABLED=false), SqliteVecVectorStore (lazy
sqlite_vec extension load, one vec0 virtual table per kind).
- get_vectorstore() env-driven dispatch with graceful fallback
to FakeVectorStore when the sqlite-vec extension isn't on the
host, so workers don't crash on a missing optional dep.
Tests: 26 new (11 cred-reuse repo, 15 vectorstore). Existing
credentials and base-repo tests updated for the rename. Total: 34
passing on the touched files.
67 lines
2.5 KiB
Python
67 lines
2.5 KiB
Python
"""Tests for :func:`decnet.vectorstore.factory.get_vectorstore` dispatch."""
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
|
|
import pytest
|
|
|
|
from decnet.vectorstore.factory import _default_db_path, get_vectorstore
|
|
from decnet.vectorstore.fake import FakeVectorStore, NullVectorStore
|
|
|
|
|
|
def test_disabled_returns_null(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
monkeypatch.setenv("DECNET_VECTORSTORE_ENABLED", "false")
|
|
monkeypatch.setenv("DECNET_VECTORSTORE_TYPE", "sqlite_vec") # ignored when disabled
|
|
s = get_vectorstore()
|
|
assert isinstance(s, NullVectorStore)
|
|
|
|
|
|
def test_fake_dispatch(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
monkeypatch.setenv("DECNET_VECTORSTORE_ENABLED", "true")
|
|
monkeypatch.setenv("DECNET_VECTORSTORE_TYPE", "fake")
|
|
s = get_vectorstore()
|
|
assert isinstance(s, FakeVectorStore)
|
|
|
|
|
|
def test_sqlite_vec_falls_back_to_fake_when_extension_missing(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
"""The factory must degrade gracefully when sqlite_vec isn't installed:
|
|
log a warning, return FakeVectorStore. Workers stay alive instead of
|
|
crashing on a missing optional dep."""
|
|
monkeypatch.setenv("DECNET_VECTORSTORE_ENABLED", "true")
|
|
monkeypatch.setenv("DECNET_VECTORSTORE_TYPE", "sqlite_vec")
|
|
# Force the import to fail regardless of what's actually installed,
|
|
# so this test is deterministic on dev boxes that have the extension.
|
|
import builtins
|
|
real_import = builtins.__import__
|
|
|
|
def _fake_import(name, *a, **kw): # noqa: ANN001
|
|
if name == "sqlite_vec":
|
|
raise ImportError("forced")
|
|
return real_import(name, *a, **kw)
|
|
|
|
monkeypatch.setattr(builtins, "__import__", _fake_import)
|
|
s = get_vectorstore()
|
|
assert isinstance(s, FakeVectorStore)
|
|
|
|
|
|
def test_unknown_type_raises(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
monkeypatch.setenv("DECNET_VECTORSTORE_ENABLED", "true")
|
|
monkeypatch.setenv("DECNET_VECTORSTORE_TYPE", "qdrant")
|
|
with pytest.raises(ValueError, match="Unsupported vectorstore type"):
|
|
get_vectorstore()
|
|
|
|
|
|
def test_default_db_path_honors_env(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
monkeypatch.setenv("DECNET_VECTORSTORE_PATH", "/tmp/explicit.sqlite")
|
|
assert _default_db_path() == "/tmp/explicit.sqlite"
|
|
|
|
|
|
def test_default_db_path_falls_back_to_home(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
monkeypatch.delenv("DECNET_VECTORSTORE_PATH", raising=False)
|
|
monkeypatch.setattr("os.path.isdir", lambda p: False)
|
|
p = _default_db_path()
|
|
assert p.endswith(".decnet/vectors.sqlite")
|
|
assert p.startswith(os.path.expanduser("~"))
|