using SQLInsight.Collectors.Instance; using SQLInsight.Core.Data; namespace SQLInsight.IntegrationTests; /// Replication on a distributor, as the least-privilege agent: not readable without rights, readable with SELECT on the agent tables. [Collection(SqlServerTestGroup.Name)] [Trait("Category", "Integration")] public class ReplicationTests(SqlServerFixture sql) { [Fact] public async Task A_distributor_is_unreadable_without_rights_and_readable_with_select_on_the_agent_tables() { await using var session = await AgentSession.OpenAsync(sql); var before = await session.CollectAsync(new ReplicationCollector()); Assert.False(before.IsDistributor); await sql.ExecuteAsSaAsync("DECLARE @s sysname; SET @s = @@SERVERNAME; EXEC sp_adddistributor @distributor = @s, @password = N'Distr-Passw0rd!';"); await sql.ExecuteAsSaAsync("EXEC sp_adddistributiondb @database = N'distribution';"); try { var denied = await session.CollectAsync(new ReplicationCollector()); await sql.ExecuteAsSaAsync($"USE distribution; IF USER_ID(N'{SqlServerFixture.AgentLogin}') IS NULL CREATE USER [{SqlServerFixture.AgentLogin}] FOR LOGIN [{SqlServerFixture.AgentLogin}]; GRANT SELECT ON dbo.MSdistribution_agents TO [{SqlServerFixture.AgentLogin}]; GRANT SELECT ON dbo.MSdistribution_history TO [{SqlServerFixture.AgentLogin}]; GRANT SELECT ON dbo.MSrepl_errors TO [{SqlServerFixture.AgentLogin}];"); var readable = await session.CollectAsync(new ReplicationCollector()); Assert.True(denied.IsDistributor); Assert.Contains("GRANT SELECT ON dbo.MSdistribution_agents", denied.Unavailable, StringComparison.Ordinal); Assert.True(readable.Unavailable is null, readable.Unavailable); Assert.Empty(readable.Agents); Assert.Equal(0, readable.ErrorsLastDay); } finally { await sql.ExecuteAsSaAsync("EXEC sp_dropdistributiondb @database = N'distribution';"); await sql.ExecuteAsSaAsync("EXEC sp_dropdistributor @no_checks = 1, @ignore_distributor = 1;"); } } }