eea.api.controlpanel 1.3__tar.gz → 1.4__tar.gz

{eea_api_controlpanel-1.3/eea.api.controlpanel.egg-info → eea_api_controlpanel-1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: eea.api.controlpanel
-Version: 1.3
+Version: 1.4
 Summary: Controlpanel RestAPI additional endpoints to be used with Volto @eeacms/volto-controlpanel
 Home-page: https://github.com/eea/eea.api.controlpanel
 Author: European Environment Agency: IDM2 A-Team
@@ -146,9 +146,64 @@ EEA_ - European Environment Agency (EU)
 .. _EEA: https://www.eea.europa.eu/
 .. _`EEA Web Systems Training`: http://www.youtube.com/user/eeacms/videos?view=1
 
+Secret Scanning
+===============
+
+This repository uses the Betterleaks GitHub Action to scan the current
+repository content on every push and pull request. The scan uses the rules in
+``.gitleaks.toml`` and uploads a ``betterleaks-report`` artifact when a finding
+is detected.
+
+If the optional SMTP secrets are configured, failed scans also send an email to
+the last commit committer. The workflow expects these repository or
+organization secrets:
+
+- ``SMTP_URL``
+- ``SMTP_PORT`` (optional, defaults to ``25``)
+- ``SMTP_EMAIL``
+- ``SMTP_PASSWORD`` (optional if the SMTP server does not require authentication)
+
+Port ``465`` is sent with direct TLS; other ports use the default SMTP
+handshake. The email includes a short finding summary from the redacted
+Betterleaks report, including the redacted matched line from each finding.
+
+There are three common outcomes:
+
+1. Everything is OK. The ``Betterleaks / Scan for secrets`` check is green and
+   no action is needed. Regular references to runtime values are OK, for example::
+
+     token_from_cookie = request.cookies.get("auth_token")
+
+2. A real secret was found. The check is red and the workflow log asks you to
+   download the ``betterleaks-report`` artifact. Open the artifact from the
+   GitHub Actions run and check the reported file, line and rule. Remove the
+   committed value, move it to the proper secret store, and rotate it if it was
+   exposed. A report entry looks like this::
+
+     {
+       "RuleID": "secret-literal-assignment",
+       "File": "src/config.py",
+       "StartLine": 12,
+       "Secret": "[REDACTED]"
+     }
+
+3. The finding is a false positive. Keep the value only if it is clearly not
+   sensitive, such as a test fixture, placeholder, or public example. Add
+   ``betterleaks:allow`` on the same line and include a short explanation in the
+   pull request::
+
+     test_password = "admin"  #betterleaks:allow
+
+Do not add ``betterleaks:allow`` to real credentials.
+
 Changelog
 =========
 
+1.4 - (2026-07-13)
+---------------------------
+* Change: fix: SonarQube report - refs #305404
+  [avoinea]
+
 1.3 - (2025-11-18)
 ---------------------------
 * Change: Release

{eea_api_controlpanel-1.3 → eea_api_controlpanel-1.4}/README.rst

@@ -108,3 +108,53 @@ EEA_ - European Environment Agency (EU)
 
 .. _EEA: https://www.eea.europa.eu/
 .. _`EEA Web Systems Training`: http://www.youtube.com/user/eeacms/videos?view=1
+
+Secret Scanning
+===============
+
+This repository uses the Betterleaks GitHub Action to scan the current
+repository content on every push and pull request. The scan uses the rules in
+``.gitleaks.toml`` and uploads a ``betterleaks-report`` artifact when a finding
+is detected.
+
+If the optional SMTP secrets are configured, failed scans also send an email to
+the last commit committer. The workflow expects these repository or
+organization secrets:
+
+- ``SMTP_URL``
+- ``SMTP_PORT`` (optional, defaults to ``25``)
+- ``SMTP_EMAIL``
+- ``SMTP_PASSWORD`` (optional if the SMTP server does not require authentication)
+
+Port ``465`` is sent with direct TLS; other ports use the default SMTP
+handshake. The email includes a short finding summary from the redacted
+Betterleaks report, including the redacted matched line from each finding.
+
+There are three common outcomes:
+
+1. Everything is OK. The ``Betterleaks / Scan for secrets`` check is green and
+   no action is needed. Regular references to runtime values are OK, for example::
+
+     token_from_cookie = request.cookies.get("auth_token")
+
+2. A real secret was found. The check is red and the workflow log asks you to
+   download the ``betterleaks-report`` artifact. Open the artifact from the
+   GitHub Actions run and check the reported file, line and rule. Remove the
+   committed value, move it to the proper secret store, and rotate it if it was
+   exposed. A report entry looks like this::
+
+     {
+       "RuleID": "secret-literal-assignment",
+       "File": "src/config.py",
+       "StartLine": 12,
+       "Secret": "[REDACTED]"
+     }
+
+3. The finding is a false positive. Keep the value only if it is clearly not
+   sensitive, such as a test fixture, placeholder, or public example. Add
+   ``betterleaks:allow`` on the same line and include a short explanation in the
+   pull request::
+
+     test_password = "admin"  #betterleaks:allow
+
+Do not add ``betterleaks:allow`` to real credentials.

{eea_api_controlpanel-1.3 → eea_api_controlpanel-1.4}/docs/HISTORY.txt

@@ -1,6 +1,11 @@
 Changelog
 =========
 
+1.4 - (2026-07-13)
+---------------------------
+* Change: fix: SonarQube report - refs #305404
+  [avoinea]
+
 1.3 - (2025-11-18)
 ---------------------------
 * Change: Release

eea_api_controlpanel-1.4/eea/api/controlpanel/tests/test_interfaces.py

@@ -0,0 +1,98 @@
+"""Tests for IEEAVersionsBackend and IEEAVersionsFrontend interfaces."""
+
+import unittest
+
+from zope import schema
+
+from eea.api.controlpanel.interfaces import IEEAVersionsBackend, IEEAVersionsFrontend
+
+
+class TestIEEAVersionsBackend(unittest.TestCase):
+    """Test IEEAVersionsBackend interface."""
+
+    def test_has_date_field(self):
+        """Test that date field exists."""
+        self.assertIn("date", list(IEEAVersionsBackend.names()))
+
+    def test_has_version_field(self):
+        """Test that version field exists."""
+        self.assertIn("version", list(IEEAVersionsBackend.names()))
+
+    def test_has_old_version_field(self):
+        """Test that old_version field exists."""
+        self.assertIn("old_version", list(IEEAVersionsBackend.names()))
+
+    def test_date_is_datetime(self):
+        """Test that date field is Datetime."""
+        self.assertIsInstance(IEEAVersionsBackend["date"], schema.Datetime)
+
+    def test_version_is_text(self):
+        """Test that version field is Text."""
+        self.assertIsInstance(IEEAVersionsBackend["version"], schema.Text)
+
+    def test_old_version_is_text(self):
+        """Test that old_version field is Text."""
+        self.assertIsInstance(IEEAVersionsBackend["old_version"], schema.Text)
+
+    def test_date_required(self):
+        """Test that date field is required."""
+        self.assertTrue(IEEAVersionsBackend["date"].required)
+
+    def test_version_required(self):
+        """Test that version field is required."""
+        self.assertTrue(IEEAVersionsBackend["version"].required)
+
+    def test_old_version_not_required(self):
+        """Test that old_version field is optional."""
+        self.assertFalse(IEEAVersionsBackend["old_version"].required)
+
+
+class TestIEEAVersionsFrontend(unittest.TestCase):
+    """Test IEEAVersionsFrontend interface."""
+
+    def test_has_date_field(self):
+        """Test that date field exists."""
+        self.assertIn("date", list(IEEAVersionsFrontend.names()))
+
+    def test_has_version_field(self):
+        """Test that version field exists."""
+        self.assertIn("version", list(IEEAVersionsFrontend.names()))
+
+    def test_has_old_version_field(self):
+        """Test that old_version field exists."""
+        self.assertIn("old_version", list(IEEAVersionsFrontend.names()))
+
+    def test_date_is_datetime(self):
+        """Test that date field is Datetime."""
+        self.assertIsInstance(IEEAVersionsFrontend["date"], schema.Datetime)
+
+    def test_version_is_text(self):
+        """Test that version field is Text."""
+        self.assertIsInstance(IEEAVersionsFrontend["version"], schema.Text)
+
+    def test_old_version_is_text(self):
+        """Test that old_version field is Text."""
+        self.assertIsInstance(IEEAVersionsFrontend["old_version"], schema.Text)
+
+    def test_date_required(self):
+        """Test that date field is required."""
+        self.assertTrue(IEEAVersionsFrontend["date"].required)
+
+    def test_version_required(self):
+        """Test that version field is required."""
+        self.assertTrue(IEEAVersionsFrontend["version"].required)
+
+    def test_old_version_not_required(self):
+        """Test that old_version field is optional."""
+        self.assertFalse(IEEAVersionsFrontend["old_version"].required)
+
+    def test_same_fields_as_backend(self):
+        """Test that frontend has same field names as backend."""
+        backend_fields = set(IEEAVersionsBackend.names())
+        frontend_fields = set(IEEAVersionsFrontend.names())
+        self.assertEqual(backend_fields, frontend_fields)
+
+
+def test_suite():
+    """Test suite."""
+    return unittest.defaultTestLoader.loadTestsFromName(__name__)

eea_api_controlpanel-1.4/eea/api/controlpanel/tests/test_setup.py

@@ -0,0 +1,33 @@
+"""Tests for setup handlers."""
+
+import unittest
+
+from eea.api.controlpanel.setuphandlers import HiddenProfiles
+
+
+class TestHiddenProfiles(unittest.TestCase):
+    """Test HiddenProfiles."""
+
+    def setUp(self):
+        self.hidden = HiddenProfiles()
+
+    def test_get_non_installable_profiles(self):
+        """Test that uninstall profile is hidden."""
+        profiles = self.hidden.getNonInstallableProfiles()
+        self.assertIsInstance(profiles, list)
+        self.assertIn("eea.api.controlpanel:uninstall", profiles)
+
+    def test_profiles_are_strings(self):
+        """Test that all profile entries are strings."""
+        for profile in self.hidden.getNonInstallableProfiles():
+            self.assertIsInstance(profile, str)
+
+    def test_no_installable_profile_leaked(self):
+        """Test that the default profile is NOT hidden."""
+        profiles = self.hidden.getNonInstallableProfiles()
+        self.assertNotIn("eea.api.controlpanel:default", profiles)
+
+
+def test_suite():
+    """Test suite."""
+    return unittest.defaultTestLoader.loadTestsFromName(__name__)

eea_api_controlpanel-1.4/eea/api/controlpanel/tests/test_system.py

@@ -0,0 +1,132 @@
+"""Tests for SystemGet REST API endpoint."""
+
+import unittest
+from unittest.mock import patch, MagicMock
+
+
+from eea.api.controlpanel.restapi.get import SystemGet
+from eea.api.controlpanel.interfaces import IEEAVersionsBackend, IEEAVersionsFrontend
+
+
+class TestSystemGetEggs(unittest.TestCase):
+    """Test SystemGet.eggs()."""
+
+    def setUp(self):
+        """Create SystemGet instance without full Plone init."""
+        self.service = SystemGet.__new__(SystemGet)
+        self.service.context = MagicMock()
+        self.service.request = MagicMock()
+        self.service.request._rest_cors_preflight = False
+
+    def test_eggs_returns_generator(self):
+        """Test that eggs() returns a generator."""
+        result = self.service.eggs()
+        self.assertTrue(hasattr(result, "__iter__"))
+
+    def test_eggs_yields_tuples(self):
+        """Test that eggs() yields (key, version) tuples."""
+        result = list(self.service.eggs())
+        self.assertGreater(len(result), 0)
+        for item in result:
+            self.assertIsInstance(item, tuple)
+            self.assertEqual(len(item), 2)
+
+    def test_eggs_contains_setuptools(self):
+        """Test that eggs() includes setuptools package."""
+        result = dict(self.service.eggs())
+        self.assertIn("setuptools", result)
+
+    def test_eggs_values_are_strings(self):
+        """Test that egg versions are strings."""
+        result = list(self.service.eggs())
+        for key, version in result:
+            self.assertIsInstance(key, str)
+            self.assertIsInstance(version, str)
+
+    def test_eggs_dict_has_multiple_packages(self):
+        """Test that eggs() returns multiple packages."""
+        result = dict(self.service.eggs())
+        self.assertGreater(len(result), 1)
+
+
+class TestSystemGetFrontend(unittest.TestCase):
+    """Test SystemGet.frontend()."""
+
+    def setUp(self):
+        self.service = SystemGet.__new__(SystemGet)
+        self.service.context = MagicMock()
+        self.service.request = MagicMock()
+        self.service.request._rest_cors_preflight = False
+
+    @patch("eea.api.controlpanel.restapi.get.get_registry_record")
+    def test_frontend_returns_dict_with_keys(self, mock_registry):
+        """Test that frontend() returns dict with version, old_version, date."""
+        mock_registry.side_effect = lambda name, interface=None: f"test_{name}"
+        result = self.service.frontend()
+        self.assertIsInstance(result, dict)
+        self.assertIn("version", result)
+        self.assertIn("old_version", result)
+        self.assertIn("date", result)
+
+    @patch("eea.api.controlpanel.restapi.get.get_registry_record")
+    def test_frontend_uses_frontend_interface(self, mock_registry):
+        """Test that frontend() queries with IEEAVersionsFrontend."""
+        mock_registry.side_effect = lambda name, interface=None: f"test_{name}"
+        self.service.frontend()
+        for call in mock_registry.call_args_list:
+            args, kwargs = call
+            iface = kwargs.get("interface") or (args[1] if len(args) > 1 else None)
+            self.assertEqual(iface, IEEAVersionsFrontend)
+
+    @patch("eea.api.controlpanel.restapi.get.get_registry_record")
+    def test_frontend_values_from_registry(self, mock_registry):
+        """Test that frontend() returns values from registry."""
+        mock_registry.side_effect = lambda name, interface=None: f"val_{name}"
+        result = self.service.frontend()
+        self.assertEqual(result["version"], "val_version")
+        self.assertEqual(result["old_version"], "val_old_version")
+        self.assertEqual(result["date"], "val_date")
+
+
+class TestSystemGetBackend(unittest.TestCase):
+    """Test SystemGet.backend()."""
+
+    def setUp(self):
+        self.service = SystemGet.__new__(SystemGet)
+        self.service.context = MagicMock()
+        self.service.request = MagicMock()
+        self.service.request._rest_cors_preflight = False
+
+    @patch("eea.api.controlpanel.restapi.get.get_registry_record")
+    def test_backend_returns_dict_with_keys(self, mock_registry):
+        """Test that backend() returns dict with version, old_version, date."""
+        mock_registry.side_effect = lambda name, interface=None: f"test_{name}"
+        result = self.service.backend()
+        self.assertIsInstance(result, dict)
+        self.assertIn("version", result)
+        self.assertIn("old_version", result)
+        self.assertIn("date", result)
+
+    @patch("eea.api.controlpanel.restapi.get.get_registry_record")
+    def test_backend_uses_backend_interface(self, mock_registry):
+        """Test that backend() queries with IEEAVersionsBackend."""
+        mock_registry.side_effect = lambda name, interface=None: f"test_{name}"
+        self.service.backend()
+        for call in mock_registry.call_args_list:
+            args, kwargs = call
+            iface = kwargs.get("interface") or (args[1] if len(args) > 1 else None)
+            self.assertEqual(iface, IEEAVersionsBackend)
+
+    @patch("eea.api.controlpanel.restapi.get.get_registry_record")
+    def test_backend_values_from_registry(self, mock_registry):
+        """Test that backend() returns values from registry."""
+        mock_registry.side_effect = lambda name, interface=None: f"val_{name}"
+        result = self.service.backend()
+        self.assertEqual(result["version"], "val_version")
+        self.assertEqual(result["old_version"], "val_old_version")
+        self.assertEqual(result["date"], "val_date")
+
+
+def test_suite():
+    """Test suite."""
+    return unittest.defaultTestLoader.loadTestsFromName(__name__)

eea_api_controlpanel-1.4/eea/api/controlpanel/version.txt

@@ -0,0 +1 @@
+1.4

{eea_api_controlpanel-1.3 → eea_api_controlpanel-1.4/eea.api.controlpanel.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: eea.api.controlpanel
-Version: 1.3
+Version: 1.4
 Summary: Controlpanel RestAPI additional endpoints to be used with Volto @eeacms/volto-controlpanel
 Home-page: https://github.com/eea/eea.api.controlpanel
 Author: European Environment Agency: IDM2 A-Team
@@ -146,9 +146,64 @@ EEA_ - European Environment Agency (EU)
 .. _EEA: https://www.eea.europa.eu/
 .. _`EEA Web Systems Training`: http://www.youtube.com/user/eeacms/videos?view=1
 
+Secret Scanning
+===============
+
+This repository uses the Betterleaks GitHub Action to scan the current
+repository content on every push and pull request. The scan uses the rules in
+``.gitleaks.toml`` and uploads a ``betterleaks-report`` artifact when a finding
+is detected.
+
+If the optional SMTP secrets are configured, failed scans also send an email to
+the last commit committer. The workflow expects these repository or
+organization secrets:
+
+- ``SMTP_URL``
+- ``SMTP_PORT`` (optional, defaults to ``25``)
+- ``SMTP_EMAIL``
+- ``SMTP_PASSWORD`` (optional if the SMTP server does not require authentication)
+
+Port ``465`` is sent with direct TLS; other ports use the default SMTP
+handshake. The email includes a short finding summary from the redacted
+Betterleaks report, including the redacted matched line from each finding.
+
+There are three common outcomes:
+
+1. Everything is OK. The ``Betterleaks / Scan for secrets`` check is green and
+   no action is needed. Regular references to runtime values are OK, for example::
+
+     token_from_cookie = request.cookies.get("auth_token")
+
+2. A real secret was found. The check is red and the workflow log asks you to
+   download the ``betterleaks-report`` artifact. Open the artifact from the
+   GitHub Actions run and check the reported file, line and rule. Remove the
+   committed value, move it to the proper secret store, and rotate it if it was
+   exposed. A report entry looks like this::
+
+     {
+       "RuleID": "secret-literal-assignment",
+       "File": "src/config.py",
+       "StartLine": 12,
+       "Secret": "[REDACTED]"
+     }
+
+3. The finding is a false positive. Keep the value only if it is clearly not
+   sensitive, such as a test fixture, placeholder, or public example. Add
+   ``betterleaks:allow`` on the same line and include a short explanation in the
+   pull request::
+
+     test_password = "admin"  #betterleaks:allow
+
+Do not add ``betterleaks:allow`` to real credentials.
+
 Changelog
 =========
 
+1.4 - (2026-07-13)
+---------------------------
+* Change: fix: SonarQube report - refs #305404
+  [avoinea]
+
 1.3 - (2025-11-18)
 ---------------------------
 * Change: Release