eea.api.redirector 0.2__tar.gz → 0.4__tar.gz

{eea_api_redirector-0.2/eea.api.redirector.egg-info → eea_api_redirector-0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: eea.api.redirector
-Version: 0.2
+Version: 0.4
 Summary: Plone Redirector extension to get redirect URLs also from Redis
 Home-page: https://github.com/eea/eea.api.redirector
 Author: European Environment Agency: IDM2 A-Team
@@ -247,7 +247,7 @@ Request:
 
 Example::
 
-    curl -u admin:admin -F "file=@redirects.csv" http://localhost:8080/Plone/@redirects-import
+    curl -u admin:admin -F "file=@redirects.csv" http://localhost:8080/Plone/@redirects-import #betterleaks:allow
 
 Response::
 
@@ -340,9 +340,68 @@ EEA_ - European Environment Agency (EU)
 .. _EEA: https://www.eea.europa.eu/
 .. _`EEA Web Systems Training`: http://www.youtube.com/user/eeacms/videos?view=1
 
+Secret Scanning
+===============
+
+This repository uses the Betterleaks GitHub Action to scan the current
+repository content on every push and pull request. The scan uses the rules in
+``.gitleaks.toml`` and uploads a ``betterleaks-report`` artifact when a finding
+is detected.
+
+If the optional SMTP secrets are configured, failed scans also send an email to
+the last commit committer. The workflow expects these repository or
+organization secrets:
+
+- ``SMTP_URL``
+- ``SMTP_PORT`` (optional, defaults to ``25``)
+- ``SMTP_EMAIL``
+- ``SMTP_PASSWORD`` (optional if the SMTP server does not require authentication)
+
+Port ``465`` is sent with direct TLS; other ports use the default SMTP
+handshake. The email includes a short finding summary from the redacted
+Betterleaks report, including the redacted matched line from each finding.
+
+There are three common outcomes:
+
+1. Everything is OK. The ``Betterleaks / Scan for secrets`` check is green and
+   no action is needed. Regular references to runtime values are OK, for example::
+
+     token_from_cookie = request.cookies.get("auth_token")
+
+2. A real secret was found. The check is red and the workflow log asks you to
+   download the ``betterleaks-report`` artifact. Open the artifact from the
+   GitHub Actions run and check the reported file, line and rule. Remove the
+   committed value, move it to the proper secret store, and rotate it if it was
+   exposed. A report entry looks like this::
+
+     {
+       "RuleID": "secret-literal-assignment",
+       "File": "src/config.py",
+       "StartLine": 12,
+       "Secret": "[REDACTED]"
+     }
+
+3. The finding is a false positive. Keep the value only if it is clearly not
+   sensitive, such as a test fixture, placeholder, or public example. Add
+   ``betterleaks:allow`` on the same line and include a short explanation in the
+   pull request::
+
+     test_password = "admin"  #betterleaks:allow
+
+Do not add ``betterleaks:allow`` to real credentials.
+
 Changelog
 =========
 
+0.4 - (2026-07-13)
+---------------------------
+* Change: fix: SonarQube report - refs #305404
+  [avoinea]
+
+0.3 - (2026-04-14)
+---------------------------
+* Change: Add unit tests for add_redirects validation logic [avoinea]
+
 0.2 - (2025-12-20)
 ------------------------
 * Feature: CSV import endpoint (@redirects-import) for server-side processing

{eea_api_redirector-0.2 → eea_api_redirector-0.4}/README.rst

@@ -213,7 +213,7 @@ Request:
 
 Example::
 
-    curl -u admin:admin -F "file=@redirects.csv" http://localhost:8080/Plone/@redirects-import
+    curl -u admin:admin -F "file=@redirects.csv" http://localhost:8080/Plone/@redirects-import #betterleaks:allow
 
 Response::
 
@@ -305,3 +305,53 @@ EEA_ - European Environment Agency (EU)
 
 .. _EEA: https://www.eea.europa.eu/
 .. _`EEA Web Systems Training`: http://www.youtube.com/user/eeacms/videos?view=1
+
+Secret Scanning
+===============
+
+This repository uses the Betterleaks GitHub Action to scan the current
+repository content on every push and pull request. The scan uses the rules in
+``.gitleaks.toml`` and uploads a ``betterleaks-report`` artifact when a finding
+is detected.
+
+If the optional SMTP secrets are configured, failed scans also send an email to
+the last commit committer. The workflow expects these repository or
+organization secrets:
+
+- ``SMTP_URL``
+- ``SMTP_PORT`` (optional, defaults to ``25``)
+- ``SMTP_EMAIL``
+- ``SMTP_PASSWORD`` (optional if the SMTP server does not require authentication)
+
+Port ``465`` is sent with direct TLS; other ports use the default SMTP
+handshake. The email includes a short finding summary from the redacted
+Betterleaks report, including the redacted matched line from each finding.
+
+There are three common outcomes:
+
+1. Everything is OK. The ``Betterleaks / Scan for secrets`` check is green and
+   no action is needed. Regular references to runtime values are OK, for example::
+
+     token_from_cookie = request.cookies.get("auth_token")
+
+2. A real secret was found. The check is red and the workflow log asks you to
+   download the ``betterleaks-report`` artifact. Open the artifact from the
+   GitHub Actions run and check the reported file, line and rule. Remove the
+   committed value, move it to the proper secret store, and rotate it if it was
+   exposed. A report entry looks like this::
+
+     {
+       "RuleID": "secret-literal-assignment",
+       "File": "src/config.py",
+       "StartLine": 12,
+       "Secret": "[REDACTED]"
+     }
+
+3. The finding is a false positive. Keep the value only if it is clearly not
+   sensitive, such as a test fixture, placeholder, or public example. Add
+   ``betterleaks:allow`` on the same line and include a short explanation in the
+   pull request::
+
+     test_password = "admin"  #betterleaks:allow
+
+Do not add ``betterleaks:allow`` to real credentials.

{eea_api_redirector-0.2 → eea_api_redirector-0.4}/docs/HISTORY.txt

@@ -1,6 +1,15 @@
 Changelog
 =========
 
+0.4 - (2026-07-13)
+---------------------------
+* Change: fix: SonarQube report - refs #305404
+  [avoinea]
+
+0.3 - (2026-04-14)
+---------------------------
+* Change: Add unit tests for add_redirects validation logic [avoinea]
+
 0.2 - (2025-12-20)
 ------------------------
 * Feature: CSV import endpoint (@redirects-import) for server-side processing

eea_api_redirector-0.4/eea/api/redirector/tests/test_add_redirects.py

@@ -0,0 +1,120 @@
+"""Unit tests for eea.api.redirector.restapi.add module
+
+These tests cover add_redirects validation logic with a mock storage:
+- Validation of redirect items (missing path, target, self-redirect)
+"""
+
+import unittest
+from eea.api.redirector.restapi.add import add_redirects
+
+
+class FakeStorage:
+    """Mock storage that always succeeds"""
+
+    def set(self, path, target):
+        return True
+
+
+class FakeStorageFail:
+    """Mock storage that always fails"""
+
+    def set(self, path, target):
+        return None
+
+
+class TestAddRedirects(unittest.TestCase):
+    """Tests for add_redirects function"""
+
+    def test_add_valid_redirect(self):
+        storage = FakeStorage()
+        redirects = [{"path": "/old", "redirect-to": "/new"}]
+        success, failed = add_redirects(storage, redirects)
+        self.assertEqual(success, 1)
+        self.assertEqual(len(failed), 0)
+
+    def test_add_multiple_valid_redirects(self):
+        storage = FakeStorage()
+        redirects = [
+            {"path": "/old1", "redirect-to": "/new1"},
+            {"path": "/old2", "redirect-to": "/new2"},
+        ]
+        success, failed = add_redirects(storage, redirects)
+        self.assertEqual(success, 2)
+        self.assertEqual(len(failed), 0)
+
+    def test_non_dict_item(self):
+        storage = FakeStorage()
+        redirects = ["not a dict"]
+        success, failed = add_redirects(storage, redirects)
+        self.assertEqual(success, 0)
+        self.assertEqual(len(failed), 1)
+        self.assertIn("must be a dictionary", failed[0]["error"])
+
+    def test_missing_path(self):
+        storage = FakeStorage()
+        redirects = [{"redirect-to": "/new"}]
+        success, failed = add_redirects(storage, redirects)
+        self.assertEqual(success, 0)
+        self.assertEqual(len(failed), 1)
+        self.assertIn("Missing 'path'", failed[0]["error"])
+
+    def test_missing_target(self):
+        storage = FakeStorage()
+        redirects = [{"path": "/old"}]
+        success, failed = add_redirects(storage, redirects)
+        self.assertEqual(success, 0)
+        self.assertEqual(len(failed), 1)
+        self.assertIn("Missing 'redirect-to'", failed[0]["error"])
+
+    def test_path_without_leading_slash(self):
+        storage = FakeStorage()
+        redirects = [{"path": "old", "redirect-to": "/new"}]
+        success, failed = add_redirects(storage, redirects)
+        self.assertEqual(success, 0)
+        self.assertEqual(len(failed), 1)
+        self.assertIn("must start with", failed[0]["error"])
+
+    def test_self_redirect(self):
+        storage = FakeStorage()
+        redirects = [{"path": "/same", "redirect-to": "/same"}]
+        success, failed = add_redirects(storage, redirects)
+        self.assertEqual(success, 0)
+        self.assertEqual(len(failed), 1)
+        self.assertIn("cannot be the same", failed[0]["error"])
+
+    def test_empty_target_allowed_for_gone(self):
+        storage = FakeStorage()
+        redirects = [{"path": "/old", "redirect-to": ""}]
+        success, failed = add_redirects(storage, redirects)
+        self.assertEqual(success, 1)
+        self.assertEqual(len(failed), 0)
+
+    def test_none_target_not_allowed(self):
+        storage = FakeStorage()
+        redirects = [{"path": "/old", "redirect-to": None}]
+        success, failed = add_redirects(storage, redirects)
+        self.assertEqual(success, 0)
+        self.assertIn("Missing 'redirect-to'", failed[0]["error"])
+
+    def test_storage_failure(self):
+        storage = FakeStorageFail()
+        redirects = [{"path": "/old", "redirect-to": "/new"}]
+        success, failed = add_redirects(storage, redirects)
+        self.assertEqual(success, 0)
+        self.assertEqual(len(failed), 1)
+        self.assertIn("Failed to set", failed[0]["error"])
+
+    def test_mixed_valid_and_invalid(self):
+        storage = FakeStorage()
+        redirects = [
+            {"path": "/old1", "redirect-to": "/new1"},
+            "not a dict",
+            {"path": "/old2", "redirect-to": "/new2"},
+        ]
+        success, failed = add_redirects(storage, redirects)
+        self.assertEqual(success, 2)
+        self.assertEqual(len(failed), 1)
+
+
+if __name__ == "__main__":
+    unittest.main()

eea_api_redirector-0.4/eea/api/redirector/version.txt

@@ -0,0 +1 @@
+0.4

{eea_api_redirector-0.2 → eea_api_redirector-0.4/eea.api.redirector.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: eea.api.redirector
-Version: 0.2
+Version: 0.4
 Summary: Plone Redirector extension to get redirect URLs also from Redis
 Home-page: https://github.com/eea/eea.api.redirector
 Author: European Environment Agency: IDM2 A-Team
@@ -247,7 +247,7 @@ Request:
 
 Example::
 
-    curl -u admin:admin -F "file=@redirects.csv" http://localhost:8080/Plone/@redirects-import
+    curl -u admin:admin -F "file=@redirects.csv" http://localhost:8080/Plone/@redirects-import #betterleaks:allow
 
 Response::
 
@@ -340,9 +340,68 @@ EEA_ - European Environment Agency (EU)
 .. _EEA: https://www.eea.europa.eu/
 .. _`EEA Web Systems Training`: http://www.youtube.com/user/eeacms/videos?view=1
 
+Secret Scanning
+===============
+
+This repository uses the Betterleaks GitHub Action to scan the current
+repository content on every push and pull request. The scan uses the rules in
+``.gitleaks.toml`` and uploads a ``betterleaks-report`` artifact when a finding
+is detected.
+
+If the optional SMTP secrets are configured, failed scans also send an email to
+the last commit committer. The workflow expects these repository or
+organization secrets:
+
+- ``SMTP_URL``
+- ``SMTP_PORT`` (optional, defaults to ``25``)
+- ``SMTP_EMAIL``
+- ``SMTP_PASSWORD`` (optional if the SMTP server does not require authentication)
+
+Port ``465`` is sent with direct TLS; other ports use the default SMTP
+handshake. The email includes a short finding summary from the redacted
+Betterleaks report, including the redacted matched line from each finding.
+
+There are three common outcomes:
+
+1. Everything is OK. The ``Betterleaks / Scan for secrets`` check is green and
+   no action is needed. Regular references to runtime values are OK, for example::
+
+     token_from_cookie = request.cookies.get("auth_token")
+
+2. A real secret was found. The check is red and the workflow log asks you to
+   download the ``betterleaks-report`` artifact. Open the artifact from the
+   GitHub Actions run and check the reported file, line and rule. Remove the
+   committed value, move it to the proper secret store, and rotate it if it was
+   exposed. A report entry looks like this::
+
+     {
+       "RuleID": "secret-literal-assignment",
+       "File": "src/config.py",
+       "StartLine": 12,
+       "Secret": "[REDACTED]"
+     }
+
+3. The finding is a false positive. Keep the value only if it is clearly not
+   sensitive, such as a test fixture, placeholder, or public example. Add
+   ``betterleaks:allow`` on the same line and include a short explanation in the
+   pull request::
+
+     test_password = "admin"  #betterleaks:allow
+
+Do not add ``betterleaks:allow`` to real credentials.
+
 Changelog
 =========
 
+0.4 - (2026-07-13)
+---------------------------
+* Change: fix: SonarQube report - refs #305404
+  [avoinea]
+
+0.3 - (2026-04-14)
+---------------------------
+* Change: Add unit tests for add_redirects validation logic [avoinea]
+
 0.2 - (2025-12-20)
 ------------------------
 * Feature: CSV import endpoint (@redirects-import) for server-side processing

{eea_api_redirector-0.2 → eea_api_redirector-0.4}/eea.api.redirector.egg-info/SOURCES.txt

@@ -167,8 +167,7 @@ eea/api/redirector/restapi/get.py
 eea/api/redirector/restapi/import_csv.py
 eea/api/redirector/restapi/statistics.py
 eea/api/redirector/tests/__init__.py
-eea/api/redirector/tests/base.py
-eea/api/redirector/tests/test_doctests.py
+eea/api/redirector/tests/test_add_redirects.py
 eea/api/redirector/upgrades/__init__.py
 eea/api/redirector/upgrades/configure.zcml
 eea/api/redirector/utilities/__init__.py

eea_api_redirector-0.2/eea/api/redirector/tests/base.py

@@ -1,51 +0,0 @@
-"""Base test cases"""
-
-from Products.CMFPlone import setuphandlers
-from plone.testing import z2
-from plone.app.testing import TEST_USER_ID
-from plone.app.testing import PloneSandboxLayer
-from plone.app.testing import applyProfile
-from plone.app.testing import FunctionalTesting
-from plone.app.testing import setRoles
-
-
-class EEAFixture(PloneSandboxLayer):
-    """EEA Testing Policy"""
-
-    def setUpZope(self, app, configurationContext):
-        """Setup Zope"""
-        import eea.api.redirector
-
-        self.loadZCML(package=eea.api.redirector)
-        z2.installProduct(app, "eea.api.redirector")
-
-    def setUpPloneSite(self, portal):
-        """Setup Plone"""
-        applyProfile(portal, "eea.api.redirector:default")
-
-        # Default workflow
-        wftool = portal["portal_workflow"]
-        wftool.setDefaultChain("simple_publication_workflow")
-
-        # Login as manager
-        setRoles(portal, TEST_USER_ID, ["Manager"])
-
-        # Add default Plone content
-        try:
-            applyProfile(portal, "plone.app.contenttypes:plone-content")
-        except KeyError:
-            # BBB Plone 4
-            setuphandlers.setupPortalContent(portal)
-
-        # Create testing environment
-        portal.invokeFactory("Folder", "sandbox", title="Sandbox")
-
-    def tearDownZope(self, app):
-        """Uninstall Zope"""
-        z2.uninstallProduct(app, "eea.api.redirector")
-
-
-EEAFIXTURE = EEAFixture()
-FUNCTIONAL_TESTING = FunctionalTesting(
-    bases=(EEAFIXTURE,), name="EEAredirector:Functional"
-)

eea_api_redirector-0.2/eea/api/redirector/tests/test_doctests.py

@@ -1,31 +0,0 @@
-"""Doc tests"""
-
-import doctest
-import unittest
-from eea.api.redirector.tests.base import FUNCTIONAL_TESTING
-from plone.testing import layered
-
-OPTIONFLAGS = (
-    doctest.REPORT_ONLY_FIRST_FAILURE | doctest.ELLIPSIS | doctest.NORMALIZE_WHITESPACE
-)
-
-
-def test_suite():
-    """Suite"""
-    suite = unittest.TestSuite()
-    suite.addTests(
-        [
-            layered(
-                doctest.DocFileSuite(
-                    "README.txt", optionflags=OPTIONFLAGS, package="eea.api.redirector"
-                ),
-                layer=FUNCTIONAL_TESTING,
-            ),
-        ]
-    )
-
-    return suite
-
-
-if __name__ == "__main__":
-    unittest.main(defaultTest="test_suite")

eea_api_redirector-0.2/eea/api/redirector/version.txt

@@ -1 +0,0 @@
-0.2