Initial SQL-only 1C adapter baseline

tests/1c/test_adapter_sql_admin.py

@@ -0,0 +1,78 @@
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+
+ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(ROOT / "plugins" / "1c" / "connector"))
+
+import adapter_1c_server as adapter  # noqa: E402
+
+
+def test_sql_admin_save_load_and_redact_password(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    path = tmp_path / "bases.json"
+    monkeypatch.delenv("ONEC_SQL_BASES_JSON", raising=False)
+    monkeypatch.setenv("ONEC_SQL_BASES_JSON_FILE", str(path))
+    config = {"upo_test": {"server": "10.0.0.2", "database": "upo", "user": "reader", "password": "secret"}}
+
+    adapter.sql_admin_save(config)
+
+    assert adapter.sql_admin_load() == config
+    public = adapter.sql_admin_public(config)[0]
+    assert public["has_password"] is True
+    assert "password" not in public
+    assert "secret" not in json.dumps(public)
+
+
+def test_sql_admin_rejects_inline_environment_config(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("ONEC_SQL_BASES_JSON", '{"base": {}}')
+    with pytest.raises(ValueError, match="ONEC_SQL_BASES_JSON_FILE"):
+        adapter.sql_admin_load()
+
+
+@pytest.mark.parametrize("base_id", ["", "кириллица", "space id", "../escape"])
+def test_sql_admin_rejects_unsafe_base_id(base_id: str) -> None:
+    with pytest.raises(ValueError, match="base_id"):
+        adapter.sql_admin_validate({"base_id": base_id, "server": "s", "database": "d", "user": "u"})
+
+
+def test_sql_admin_accepts_password_environment_reference() -> None:
+    base_id, item = adapter.sql_admin_validate({
+        "base_id": "accounting-prod",
+        "server": "sql.internal",
+        "database": "Accounting",
+        "user": "reader",
+        "password": "ignored",
+        "password_env": "ONEC_SQL_PASSWORD_ACCOUNTING",
+    })
+    assert base_id == "accounting-prod"
+    assert item["password_env"] == "ONEC_SQL_PASSWORD_ACCOUNTING"
+    assert "password" not in item
+
+
+def test_sql_admin_preserves_repository_user_from_settings() -> None:
+    _, item = adapter.sql_admin_validate({
+        "base_id": "upo_test",
+        "server": "sql.internal",
+        "database": "upo_test",
+        "user": "reader",
+        "repository": {
+            "backend": "karman_bridge",
+            "lock_mode": "manual",
+            "runner_url": "http://runner:8121",
+            "repository_user": "adm",
+            "repository_password_env": "REPO_PASSWORD",
+            "infobase_user": "designer-user",
+            "infobase_password_env": "IB_PASSWORD",
+        },
+    })
+
+    assert item["repository"]["repository_user"] == "adm"
+    assert item["repository"]["lock_mode"] == "manual"
+    assert item["repository"]["repository_password_env"] == "REPO_PASSWORD"
+    assert item["repository"]["infobase_user"] == "designer-user"
+    assert item["repository"]["infobase_password_env"] == "IB_PASSWORD"