eea.stringinterp 1.2__tar.gz → 1.3__tar.gz

{eea_stringinterp-1.2/eea.stringinterp.egg-info → eea_stringinterp-1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: eea.stringinterp
-Version: 1.2
+Version: 1.3
 Summary: Extended plone.stringinterp functionality
 Home-page: https://github.com/eea/eea.stringinterp
 Author: European Environment Agency: IDM2 A-Team
@@ -166,9 +166,64 @@ EEA_ - European Environment Agency (EU)
 .. _EEA: https://www.eea.europa.eu/
 .. _`EEA Web Systems Training`: http://www.youtube.com/user/eeacms/videos?view=1
 
+Secret Scanning
+===============
+
+This repository uses the Betterleaks GitHub Action to scan the current
+repository content on every push and pull request. The scan uses the rules in
+``.gitleaks.toml`` and uploads a ``betterleaks-report`` artifact when a finding
+is detected.
+
+If the optional SMTP secrets are configured, failed scans also send an email to
+the last commit committer. The workflow expects these repository or
+organization secrets:
+
+- ``SMTP_URL``
+- ``SMTP_PORT`` (optional, defaults to ``25``)
+- ``SMTP_EMAIL``
+- ``SMTP_PASSWORD`` (optional if the SMTP server does not require authentication)
+
+Port ``465`` is sent with direct TLS; other ports use the default SMTP
+handshake. The email includes a short finding summary from the redacted
+Betterleaks report, including the redacted matched line from each finding.
+
+There are three common outcomes:
+
+1. Everything is OK. The ``Betterleaks / Scan for secrets`` check is green and
+   no action is needed. Regular references to runtime values are OK, for example::
+
+     token_from_cookie = request.cookies.get("auth_token")
+
+2. A real secret was found. The check is red and the workflow log asks you to
+   download the ``betterleaks-report`` artifact. Open the artifact from the
+   GitHub Actions run and check the reported file, line and rule. Remove the
+   committed value, move it to the proper secret store, and rotate it if it was
+   exposed. A report entry looks like this::
+
+     {
+       "RuleID": "secret-literal-assignment",
+       "File": "src/config.py",
+       "StartLine": 12,
+       "Secret": "[REDACTED]"
+     }
+
+3. The finding is a false positive. Keep the value only if it is clearly not
+   sensitive, such as a test fixture, placeholder, or public example. Add
+   ``betterleaks:allow`` on the same line and include a short explanation in the
+   pull request::
+
+     test_password = "admin"  #betterleaks:allow
+
+Do not add ``betterleaks:allow`` to real credentials.
+
 Changelog
 =========
 
+1.3 - (2026-07-13)
+---------------------------
+* Change: fix: SonarQube report - refs #305404
+  [avoinea]
+
 1.2 - (2025-11-18)
 ---------------------------
 * Change: Replace Python linting to ruff

{eea_stringinterp-1.2 → eea_stringinterp-1.3}/README.rst

@@ -128,3 +128,53 @@ EEA_ - European Environment Agency (EU)
 
 .. _EEA: https://www.eea.europa.eu/
 .. _`EEA Web Systems Training`: http://www.youtube.com/user/eeacms/videos?view=1
+
+Secret Scanning
+===============
+
+This repository uses the Betterleaks GitHub Action to scan the current
+repository content on every push and pull request. The scan uses the rules in
+``.gitleaks.toml`` and uploads a ``betterleaks-report`` artifact when a finding
+is detected.
+
+If the optional SMTP secrets are configured, failed scans also send an email to
+the last commit committer. The workflow expects these repository or
+organization secrets:
+
+- ``SMTP_URL``
+- ``SMTP_PORT`` (optional, defaults to ``25``)
+- ``SMTP_EMAIL``
+- ``SMTP_PASSWORD`` (optional if the SMTP server does not require authentication)
+
+Port ``465`` is sent with direct TLS; other ports use the default SMTP
+handshake. The email includes a short finding summary from the redacted
+Betterleaks report, including the redacted matched line from each finding.
+
+There are three common outcomes:
+
+1. Everything is OK. The ``Betterleaks / Scan for secrets`` check is green and
+   no action is needed. Regular references to runtime values are OK, for example::
+
+     token_from_cookie = request.cookies.get("auth_token")
+
+2. A real secret was found. The check is red and the workflow log asks you to
+   download the ``betterleaks-report`` artifact. Open the artifact from the
+   GitHub Actions run and check the reported file, line and rule. Remove the
+   committed value, move it to the proper secret store, and rotate it if it was
+   exposed. A report entry looks like this::
+
+     {
+       "RuleID": "secret-literal-assignment",
+       "File": "src/config.py",
+       "StartLine": 12,
+       "Secret": "[REDACTED]"
+     }
+
+3. The finding is a false positive. Keep the value only if it is clearly not
+   sensitive, such as a test fixture, placeholder, or public example. Add
+   ``betterleaks:allow`` on the same line and include a short explanation in the
+   pull request::
+
+     test_password = "admin"  #betterleaks:allow
+
+Do not add ``betterleaks:allow`` to real credentials.

{eea_stringinterp-1.2 → eea_stringinterp-1.3}/docs/HISTORY.txt

@@ -1,6 +1,11 @@
 Changelog
 =========
 
+1.3 - (2026-07-13)
+---------------------------
+* Change: fix: SonarQube report - refs #305404
+  [avoinea]
+
 1.2 - (2025-11-18)
 ---------------------------
 * Change: Replace Python linting to ruff

eea_stringinterp-1.3/eea/stringinterp/tests/test_adapters.py

@@ -0,0 +1,166 @@
+"""Tests for LazyDict adapter."""
+
+import unittest
+
+from zope.interface import Interface, implementer
+from zope.component import getGlobalSiteManager
+
+from plone.stringinterp.interfaces import IStringSubstitution
+from eea.stringinterp.adapters.dollarReplace import LazyDict
+
+
+@implementer(IStringSubstitution)
+class SuccessAdapter:
+    """Test adapter that returns a value."""
+
+    def __init__(self, context):
+        self.context = context
+
+    def __call__(self, key=None):
+        return f"value_for_{key}"
+
+
+@implementer(IStringSubstitution)
+class UnauthorizedAdapter:
+    """Test adapter that raises Unauthorized."""
+
+    def __init__(self, context):
+        self.context = context
+
+    def __call__(self, key=None):
+        from AccessControl import Unauthorized
+
+        raise Unauthorized("Not allowed")
+
+
+class DummyContext:
+    """Simple context for testing."""
+
+    pass
+
+
+class TestLazyDictKeyFiltering(unittest.TestCase):
+    """Test LazyDict key filtering — no adapters needed."""
+
+    def setUp(self):
+        self.ldict = LazyDict(DummyContext())
+
+    def test_underscore_key_raises_keyerror(self):
+        """Test that keys starting with _ raise KeyError."""
+        with self.assertRaises(KeyError):
+            self.ldict["_test"]
+
+    def test_dot_key_raises_keyerror(self):
+        """Test that keys starting with . raise KeyError."""
+        with self.assertRaises(KeyError):
+            self.ldict[".test"]
+
+    def test_empty_key_raises_keyerror(self):
+        """Test that empty key raises KeyError."""
+        with self.assertRaises(KeyError):
+            self.ldict[""]
+
+    def test_none_key_raises_keyerror(self):
+        """Test that None key raises KeyError."""
+        with self.assertRaises(KeyError):
+            self.ldict[None]
+
+
+class TestLazyDictNoAdapter(unittest.TestCase):
+    """Test LazyDict with no adapters registered — both paths fail."""
+
+    def setUp(self):
+        self.ldict = LazyDict(DummyContext())
+
+    def test_unregistered_key_raises_keyerror(self):
+        """Test that unregistered key raises KeyError."""
+        with self.assertRaises(KeyError):
+            self.ldict["nonexistent_key"]
+
+
+class TestLazyDictNamedAdapter(unittest.TestCase):
+    """Test LazyDict with named adapter — parent path succeeds."""
+
+    def setUp(self):
+        self.sm = getGlobalSiteManager()
+        self.sm.registerAdapter(
+            SuccessAdapter, (Interface,), IStringSubstitution, name="named_key"
+        )
+        self.ldict = LazyDict(DummyContext())
+
+    def tearDown(self):
+        self.sm.unregisterAdapter(
+            SuccessAdapter, (Interface,), IStringSubstitution, name="named_key"
+        )
+
+    def test_named_adapter_returns_value(self):
+        """Test that named adapter returns value via parent path."""
+        result = self.ldict["named_key"]
+        self.assertEqual(result, "value_for_None")
+
+
+class TestLazyDictUnnamedAdapter(unittest.TestCase):
+    """Test LazyDict with unnamed adapter — fallback path succeeds."""
+
+    def setUp(self):
+        self.sm = getGlobalSiteManager()
+        self.sm.registerAdapter(SuccessAdapter, (Interface,), IStringSubstitution)
+        self.ldict = LazyDict(DummyContext())
+
+    def tearDown(self):
+        self.sm.unregisterAdapter(SuccessAdapter, (Interface,), IStringSubstitution)
+
+    def test_unnamed_adapter_fallback(self):
+        """Test that fallback path with unnamed adapter returns value."""
+        result = self.ldict["fallback_key"]
+        self.assertEqual(result, "value_for_fallback_key")
+
+
+class TestLazyDictUnauthorized(unittest.TestCase):
+    """Test LazyDict with Unauthorized adapter."""
+
+    def setUp(self):
+        self.sm = getGlobalSiteManager()
+        self.sm.registerAdapter(UnauthorizedAdapter, (Interface,), IStringSubstitution)
+        self.ldict = LazyDict(DummyContext())
+
+    def tearDown(self):
+        self.sm.unregisterAdapter(
+            UnauthorizedAdapter, (Interface,), IStringSubstitution
+        )
+
+    def test_unauthorized_returns_unauthorized_string(self):
+        """Test that Unauthorized exception returns 'Unauthorized' string."""
+        result = self.ldict["protected_key"]
+        self.assertEqual(result, "Unauthorized")
+
+
+class TestLazyDictCaching(unittest.TestCase):
+    """Test LazyDict caching behavior."""
+
+    def setUp(self):
+        self.sm = getGlobalSiteManager()
+        self.sm.registerAdapter(SuccessAdapter, (Interface,), IStringSubstitution)
+        self.ldict = LazyDict(DummyContext())
+
+    def tearDown(self):
+        self.sm.unregisterAdapter(SuccessAdapter, (Interface,), IStringSubstitution)
+
+    def test_result_is_cached(self):
+        """Test that result is cached in _cache."""
+        result1 = self.ldict["cache_key"]
+        self.assertEqual(result1, "value_for_cache_key")
+        self.assertIn("cache_key", self.ldict._cache)
+
+    def test_cached_value_used_on_second_call(self):
+        """Test that second call uses cached value."""
+        result1 = self.ldict["cache_key"]
+        # Manually change cache to verify it's used
+        self.ldict._cache["cache_key"] = "cached_value"
+        result2 = self.ldict["cache_key"]
+        self.assertEqual(result2, "cached_value")
+
+
+def test_suite():
+    """Test suite."""
+    return unittest.defaultTestLoader.loadTestsFromName(__name__)

eea_stringinterp-1.3/eea/stringinterp/version.txt

@@ -0,0 +1 @@
+1.3

{eea_stringinterp-1.2 → eea_stringinterp-1.3/eea.stringinterp.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: eea.stringinterp
-Version: 1.2
+Version: 1.3
 Summary: Extended plone.stringinterp functionality
 Home-page: https://github.com/eea/eea.stringinterp
 Author: European Environment Agency: IDM2 A-Team
@@ -166,9 +166,64 @@ EEA_ - European Environment Agency (EU)
 .. _EEA: https://www.eea.europa.eu/
 .. _`EEA Web Systems Training`: http://www.youtube.com/user/eeacms/videos?view=1
 
+Secret Scanning
+===============
+
+This repository uses the Betterleaks GitHub Action to scan the current
+repository content on every push and pull request. The scan uses the rules in
+``.gitleaks.toml`` and uploads a ``betterleaks-report`` artifact when a finding
+is detected.
+
+If the optional SMTP secrets are configured, failed scans also send an email to
+the last commit committer. The workflow expects these repository or
+organization secrets:
+
+- ``SMTP_URL``
+- ``SMTP_PORT`` (optional, defaults to ``25``)
+- ``SMTP_EMAIL``
+- ``SMTP_PASSWORD`` (optional if the SMTP server does not require authentication)
+
+Port ``465`` is sent with direct TLS; other ports use the default SMTP
+handshake. The email includes a short finding summary from the redacted
+Betterleaks report, including the redacted matched line from each finding.
+
+There are three common outcomes:
+
+1. Everything is OK. The ``Betterleaks / Scan for secrets`` check is green and
+   no action is needed. Regular references to runtime values are OK, for example::
+
+     token_from_cookie = request.cookies.get("auth_token")
+
+2. A real secret was found. The check is red and the workflow log asks you to
+   download the ``betterleaks-report`` artifact. Open the artifact from the
+   GitHub Actions run and check the reported file, line and rule. Remove the
+   committed value, move it to the proper secret store, and rotate it if it was
+   exposed. A report entry looks like this::
+
+     {
+       "RuleID": "secret-literal-assignment",
+       "File": "src/config.py",
+       "StartLine": 12,
+       "Secret": "[REDACTED]"
+     }
+
+3. The finding is a false positive. Keep the value only if it is clearly not
+   sensitive, such as a test fixture, placeholder, or public example. Add
+   ``betterleaks:allow`` on the same line and include a short explanation in the
+   pull request::
+
+     test_password = "admin"  #betterleaks:allow
+
+Do not add ``betterleaks:allow`` to real credentials.
+
 Changelog
 =========
 
+1.3 - (2026-07-13)
+---------------------------
+* Change: fix: SonarQube report - refs #305404
+  [avoinea]
+
 1.2 - (2025-11-18)
 ---------------------------
 * Change: Replace Python linting to ruff