1package logexport
2
3import (
4 "context"
5 "errors"
6 "testing"
7 "time"
8
9 "github.com/stretchr/testify/assert"
10 "github.com/stretchr/testify/mock"
11 "github.com/stretchr/testify/require"
12
13 "github.com/bnema/gordon/internal/boundaries/out"
14 "github.com/bnema/gordon/internal/boundaries/out/mocks"
15 "github.com/bnema/gordon/internal/domain"
16)
17
18type fakeHosts map[string][2]string
19
20func (f fakeHosts) HostOwner(host string) (string, string, bool) {
21 owner, ok := f[host]
22 return owner[0], owner[1], ok
23}
24
25type fakeAccessWriter struct {
26 entries []out.AccessLogEntry
27 err error
28}
29
30func (f *fakeAccessWriter) Write(entry out.AccessLogEntry) error {
31 f.entries = append(f.entries, entry)
32 return f.err
33}
34
35func captureExport(t *testing.T) (*mocks.MockLogExporter, *[]domain.LogRecord) {
36 var records []domain.LogRecord
37 exporter := mocks.NewMockLogExporter(t)
38 exporter.EXPECT().Export(mock.Anything, mock.Anything).Run(func(_ context.Context, r domain.LogRecord) {
39 records = append(records, r)
40 }).Return()
41 return exporter, &records
42}
43
44func TestAccessLogExporter_AttributesOwnedHostToAppService(t *testing.T) {
45 exporter, records := captureExport(t)
46 next := &fakeAccessWriter{}
47 a := NewAccessLogExporter(fakeHosts{"blog.example.com": {"blog", "web"}}, exporter, next)
48 ts := time.Date(2026, 9, 10, 12, 0, 0, 0, time.UTC)
49
50 err := a.Write(out.AccessLogEntry{Time: ts, Method: "GET", Host: "Blog.Example.com:443", Path: "/x", Status: 502})
51
52 require.NoError(t, err)
53 require.Len(t, *records, 1)
54 record := (*records)[0]
55 assert.Equal(t, domain.LogSource{App: "blog", Service: "web"}, record.Source)
56 assert.Equal(t, domain.LogTypeAccess, record.Type)
57 assert.Equal(t, domain.LogSeverityError, record.Severity)
58 assert.Equal(t, ts, record.Time)
59 assert.Equal(t, "GET blog.example.com/x 502", record.Body)
60 assert.Equal(t, "502", record.Attributes["http.response.status_code"])
61 assert.Len(t, next.entries, 1, "local sink still receives the entry")
62}
63
64func TestAccessLogExporter_UnownedHostIsGordon(t *testing.T) {
65 exporter, records := captureExport(t)
66 a := NewAccessLogExporter(fakeHosts{}, exporter, nil)
67
68 require.NoError(t, a.Write(out.AccessLogEntry{Host: "registry.example.com", Status: 200}))
69
70 require.Len(t, *records, 1)
71 assert.True(t, (*records)[0].Source.IsGordon())
72 assert.Equal(t, domain.LogSeverityInfo, (*records)[0].Severity)
73}
74
75func TestAccessLogExporter_ReturnsLocalSinkError(t *testing.T) {
76 exporter, _ := captureExport(t)
77 sinkErr := errors.New("disk full")
78 a := NewAccessLogExporter(fakeHosts{}, exporter, &fakeAccessWriter{err: sinkErr})
79
80 assert.ErrorIs(t, a.Write(out.AccessLogEntry{Status: 404}), sinkErr)
81}
82
83func TestAccessLogExporter_DropsQueryAttribute(t *testing.T) {
84 exporter, records := captureExport(t)
85 a := NewAccessLogExporter(fakeHosts{}, exporter, nil)
86
87 require.NoError(t, a.Write(out.AccessLogEntry{Path: "/search", Query: "q=secret", Status: 200}))
88
89 require.Len(t, *records, 1)
90 _, ok := (*records)[0].Attributes["url.query"]
91 assert.False(t, ok, "query must not be exported over OTLP")
92 assert.Equal(t, "/search", (*records)[0].Attributes["url.path"])
93}
94
95func TestAccessLogExporter_SanitizesInvalidUTF8(t *testing.T) {
96 exporter, records := captureExport(t)
97 a := NewAccessLogExporter(fakeHosts{}, exporter, nil)
98
99 require.NoError(t, a.Write(out.AccessLogEntry{Path: "/bad\xff", UserAgent: "agent\xff", Status: 200}))
100
101 require.Len(t, *records, 1)
102 assert.Equal(t, "/bad\uFFFD", (*records)[0].Attributes["url.path"])
103 assert.Equal(t, "agent\uFFFD", (*records)[0].Attributes["user_agent.original"])
104}