15370 FIX oracle_instance: fix reporting of restricted logins

Previously logins were not correctly reported:

1. they were only shown if the openmode was `OPEN` but not if they were `READ
   ONLY` or `READ WRITE`
2. the logic whether a database is restricted was inverted

SUP-24195

Change-Id: Ia392defafa93e4fd35d65e78eb37b80c5a22193e

Author: BenediktSeidl

.werks/15370.md

@@ -0,0 +1,18 @@
+[//]: # (werk v2)
+# oracle_instance: fix reporting of restricted logins
+
+key        | value
+---------- | ---
+date       | 2025-07-24T08:18:36+00:00
+version    | 2.3.0p36
+class      | fix
+edition    | cre
+component  | checks
+level      | 1
+compatible | yes
+
+Previously logins were not correctly reported:
+
+1. they were only shown if the openmode was `OPEN` but not if they were `READ
+   ONLY` or `READ WRITE`
+2. the logic whether a database is restricted was inverted

cmk/base/plugins/agent_based/oracle_instance_check.py

@@ -60,6 +60,10 @@ class _Params(TypedDict, total=True):
 }
 
 
+def _is_open(openmode: str) -> bool:
+    return openmode in {"OPEN", "READ ONLY", "READ WRITE"}
+
+
 def discover_oracle_instance(section: Section) -> DiscoveryResult:
     yield from (Service(item=item) for item in section)
 
@@ -86,11 +90,7 @@ def check_oracle_instance(item: str, params: _Params, section: Section) -> Check
 
     status_state = State.OK
     # Check state for PRIMARY Database. Normaly there are always OPEN
-    if instance.database_role == "PRIMARY" and instance.openmode not in (
-        "OPEN",
-        "READ ONLY",
-        "READ WRITE",
-    ):
+    if instance.database_role == "PRIMARY" and not _is_open(instance.openmode):
         status_state = State(params["primarynotopen"])
         yield Result(
             state=status_state,
@@ -130,7 +130,7 @@ def _asses_property(
 
 def _check_archive_log(instance: Instance, params: _Params) -> Iterable[Result]:
     # logins are only possible when the database is open
-    if instance.openmode == "OPEN":
+    if _is_open(instance.openmode):
         yield _asses_property("Logins", instance.logins, params, _LOGINS_MAP)
 
     # the new internal database _MGMTDB from 12.1.0.2 is always in NOARCHIVELOG mode

cmk/base/plugins/agent_based/oracle_instance_section.py

@@ -150,7 +150,7 @@ def _parse_agent_line(line: Sequence[str]) -> InvalidData | GeneralError | Insta
 
     if instance.pdb:
         assert instance.popenmode is not None
-        instance.logins = "RESTRICTED" if str(instance.prestricted).lower() == "no" else "ALLOWED"
+        instance.logins = "RESTRICTED" if str(instance.prestricted).lower() == "yes" else "ALLOWED"
         instance.openmode = instance.popenmode
         instance.up_seconds = instance.pup_seconds
 

tests/unit/cmk/base/plugins/agent_based/test_oracle_instance.py

@@ -827,14 +827,15 @@ def test_login():
     assert isinstance(section["ORA7777.FANTASY"], Instance)
 
     assert section["ORA7777"].logins == "ALLOWED"
-    assert section["ORA7777.BBBBBBBBBBBBBBB"].logins == "ALLOWED"
-    assert section["ORA7777.PDB$SEED"].logins == "RESTRICTED"
+    assert section["ORA7777.BBBBBBBBBBBBBBB"].logins == "RESTRICTED"
+    assert section["ORA7777.PDB$SEED"].logins == "ALLOWED"
 
     assert list(
         oracle_instance_check.check_oracle_instance("ORA7777.PDB$SEED", params, section)
     ) == [
         Result(state=State.OK, summary="PDB Name ORA7777.PDB$SEED"),
         Result(state=State.OK, summary="Status READ ONLY"),
+        Result(state=State.OK, summary="Logins allowed"),
         Result(state=State.OK, summary="PDB size: 4.14 GiB"),
         Metric("oracle_pdb_total_size", 4444444444.0),
     ]
@@ -844,6 +845,7 @@ def test_login():
     ) == [
         Result(state=State.OK, summary="PDB Name ORA7777.BBBBBBBBBBBBBBB"),
         Result(state=State.OK, summary="Status READ WRITE"),
+        Result(state=State.CRIT, summary="Logins restricted"),
         Result(state=State.OK, summary="PDB size: 10.3 GiB"),
         Metric("oracle_pdb_total_size", 11111111111.0),
     ]
@@ -853,7 +855,7 @@ def test_login():
     ) == [
         Result(state=State.OK, summary="PDB Name ORA7777.FANTASY"),
         Result(state=State.OK, summary="Status OPEN"),
-        Result(state=State.OK, summary="Logins allowed"),
+        Result(state=State.CRIT, summary="Logins restricted"),
         Result(state=State.OK, summary="PDB size: 10.3 GiB"),
         Metric("oracle_pdb_total_size", 11111111111.0),
     ]