fluidattacks_core_models 14.2.0__tar.gz → 14.3.0__tar.gz

fluidattacks_core_models-14.3.0/.envrc

@@ -0,0 +1 @@
+use flake ../../..#fluidattacks-core-models

fluidattacks_core_models-14.3.0/.gitignore

@@ -0,0 +1,11 @@
+dist/
+dist-*/
+/.cargo-cache
+target/
+.direnv/
+.venv/
+.vscode/settings.json
+.zed/settings.json
+# each package's shell writes its own, beside the package rather than here
+**/.vscode/settings.json
+*.so

{fluidattacks_core_models-14.2.0 → fluidattacks_core_models-14.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fluidattacks_core_models
-Version: 14.2.0
+Version: 14.3.0
 Summary: Fluid Attacks Core Models Library
 Author-email: Development <development@fluidattacks.com>
 License: MPL-2.0

{fluidattacks_core_models-14.2.0 → fluidattacks_core_models-14.3.0}/fluidattacks_core/models/scanners/cspm_config.py

@@ -6,15 +6,20 @@ from fluidattacks_core.models.scanners.loader import LoaderValidationInfo, resol
 class AwsCredentials(BaseModel):
     model_config = {"extra": "forbid"}
     access_key_id: str
-    secret_access_key: str
-    session_token: str | None = None
+    secret_access_key: str = Field(repr=False)
+    session_token: str | None = Field(default=None, repr=False)
     environment_id: str | None = None
 
-    @field_validator("access_key_id", "secret_access_key", "session_token", mode="before")
+    @field_validator("access_key_id", "secret_access_key", mode="before")
     @classmethod
     def _resolve_credentials(cls, v: object, info: LoaderValidationInfo) -> object:
         return resolve_env_var(v, info)
 
+    @field_validator("session_token", mode="before")
+    @classmethod
+    def _resolve_optional_credentials(cls, v: object, info: LoaderValidationInfo) -> object:
+        return resolve_env_var(v, info, required=False)
+
     @model_validator(mode="after")
     def _validate_key_session_token_pairing(self) -> "AwsCredentials":
         is_temporary = self.access_key_id.startswith("ASIA")
@@ -33,11 +38,16 @@ class AwsRole(BaseModel):
     external_id: str | None = Field(default=None, repr=False)
     environment_id: str | None = None
 
-    @field_validator("role", "external_id", mode="before")
+    @field_validator("role", mode="before")
     @classmethod
     def _resolve_credentials(cls, v: object, info: LoaderValidationInfo) -> object:
         return resolve_env_var(v, info)
 
+    @field_validator("external_id", mode="before")
+    @classmethod
+    def _resolve_optional_credentials(cls, v: object, info: LoaderValidationInfo) -> object:
+        return resolve_env_var(v, info, required=False)
+
 
 class CspmConfig(BaseModel):
     model_config = {"extra": "forbid"}

{fluidattacks_core_models-14.2.0 → fluidattacks_core_models-14.3.0}/fluidattacks_core/models/scanners/loader.py

@@ -28,7 +28,7 @@ def _sub_env_var(m: re.Match[str]) -> str:
     return value
 
 
-def resolve_env_var(v: object, info: LoaderValidationInfo) -> object:
+def resolve_env_var(v: object, info: LoaderValidationInfo, *, required: bool = True) -> object:
     if not isinstance(v, str) or not (info.context or {}).get("resolve_env"):
         return v
     matches = list(_ENV_PLACEHOLDER.finditer(v))
@@ -39,6 +39,9 @@ def resolve_env_var(v: object, info: LoaderValidationInfo) -> object:
         var_name = matches[0].group(1)
         value = os.environ.get(var_name)
         if value is None:
+            if required:
+                msg = f"environment variable '{var_name}' referenced in the scan config is not set"
+                raise ValueError(msg)
             LOGGER.warning("env var '%s' not set; field will be None", var_name)
             return None
         LOGGER.info("env var '%s' set", var_name)

{fluidattacks_core_models-14.2.0 → fluidattacks_core_models-14.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fluidattacks_core_models"
-version = "14.2.0"
+version = "14.3.0"
 description = "Fluid Attacks Core Models Library"
 authors = [{ name = "Development", email = "development@fluidattacks.com" }]
 license = { text = "MPL-2.0" }

{fluidattacks_core_models-14.2.0 → fluidattacks_core_models-14.3.0}/tests/test_loader_env.py

@@ -1,8 +1,9 @@
 from pathlib import Path
 
 import pytest
-from pydantic import BaseModel, field_validator
+from pydantic import BaseModel, ValidationError, field_validator
 
+from fluidattacks_core.models.scanners import AwsCredentials, AwsRole, CspmConfig
 from fluidattacks_core.models.scanners.loader import (
     LoaderValidationInfo,
     build_config,
@@ -22,6 +23,16 @@ class _SecretFixture(BaseModel):
     value: str | None = None
     namespace: str = ""
 
+    @field_validator("value", mode="before")
+    @classmethod
+    def _resolve_value(cls, v: object, info: LoaderValidationInfo) -> object:
+        return resolve_env_var(v, info, required=False)
+
+
+class _RequiredSecretFixture(BaseModel):
+    model_config = {"extra": "forbid"}
+    value: str
+
     @field_validator("value", mode="before")
     @classmethod
     def _resolve_value(cls, v: object, info: LoaderValidationInfo) -> object:
@@ -45,7 +56,7 @@ def test_build_config_resolves_sensitive_field(
     assert cfg.value == "resolved-value"
 
 
-def test_build_config_missing_var_resolves_to_none(
+def test_build_config_missing_var_on_optional_field_resolves_to_none(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
     monkeypatch.delenv("TOKEN", raising=False)
@@ -54,6 +65,58 @@ def test_build_config_missing_var_resolves_to_none(
     assert cfg.value is None
 
 
+def test_build_config_set_var_on_required_field_resolves(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("TOKEN", "resolved-value")
+    path = _write(tmp_path, "value: ${TOKEN}\n")
+    cfg = build_config(path, _RequiredSecretFixture)
+    assert cfg.value == "resolved-value"
+
+
+def test_build_config_missing_var_on_required_field_names_the_variable(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.delenv("TOKEN", raising=False)
+    path = _write(tmp_path, "value: ${TOKEN}\n")
+    with pytest.raises(ValidationError) as exc_info:
+        build_config(path, _RequiredSecretFixture)
+    assert "environment variable 'TOKEN' referenced in the scan config is not set" in str(
+        exc_info.value
+    )
+
+
+def test_build_config_missing_var_on_cspm_external_id_resolves_to_none(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.delenv("CSPM_AWS_EXTERNAL_ID", raising=False)
+    path = _write(
+        tmp_path,
+        "aws_credentials:\n"
+        "  - role: arn:aws:iam::123456789012:role/MyRole\n"
+        "    external_id: ${CSPM_AWS_EXTERNAL_ID}\n",
+    )
+    role = build_config(path, CspmConfig).aws_credentials[0]
+    assert isinstance(role, AwsRole)
+    assert role.external_id is None
+
+
+def test_build_config_missing_var_on_cspm_session_token_resolves_to_none(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.delenv("CSPM_AWS_SESSION_TOKEN", raising=False)
+    path = _write(
+        tmp_path,
+        "aws_credentials:\n"
+        "  - access_key_id: AKIA-fake-key\n"
+        "    secret_access_key: secret\n"
+        "    session_token: ${CSPM_AWS_SESSION_TOKEN}\n",
+    )
+    cred = build_config(path, CspmConfig).aws_credentials[0]
+    assert isinstance(cred, AwsCredentials)
+    assert cred.session_token is None
+
+
 def test_build_config_non_sensitive_field_stays_literal(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
@@ -87,6 +150,15 @@ def test_partial_missing_var_substitutes_empty_string(
     assert cfg.value == "https:///api"
 
 
+def test_partial_missing_var_on_required_field_substitutes_empty_string(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.delenv("HOST", raising=False)
+    path = _write(tmp_path, "value: https://${HOST}/api\n")
+    cfg = build_config(path, _RequiredSecretFixture)
+    assert cfg.value == "https:///api"
+
+
 def test_multi_var_resolved(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("A", "foo")
     monkeypatch.setenv("B", "bar")

fluidattacks_core_models-14.2.0/.envrc

@@ -1 +0,0 @@
-use_flake ".#python311.devShell"

fluidattacks_core_models-14.2.0/.gitignore

@@ -1,9 +0,0 @@
-dist/
-dist-*/
-/.cargo-cache
-target/
-.direnv/
-.venv/
-.vscode/settings.json
-.zed/settings.json
-*.so