fluidattacks_core_models 14.2.0__tar.gz → 14.4.0__tar.gz

fluidattacks_core_models-14.4.0/.envrc

@@ -0,0 +1 @@
+use flake ../../..#fluidattacks-core-models

fluidattacks_core_models-14.4.0/.gitignore

@@ -0,0 +1,15 @@
+dist/
+dist-*/
+*.zip
+.tflint.d
+/.cargo-cache
+target/
+.direnv/
+.venv/
+.vscode/settings.json
+.zed/settings.json
+# each package's shell writes its own, beside the package rather than here
+**/.vscode/settings.json
+*.so
+# the publish check builds into its own tree per architecture
+target-*/

{fluidattacks_core_models-14.2.0 → fluidattacks_core_models-14.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fluidattacks_core_models
-Version: 14.2.0
+Version: 14.4.0
 Summary: Fluid Attacks Core Models Library
 Author-email: Development <development@fluidattacks.com>
 License: MPL-2.0

{fluidattacks_core_models-14.2.0 → fluidattacks_core_models-14.4.0}/fluidattacks_core/models/scanners/__init__.py

@@ -33,13 +33,19 @@ from fluidattacks_core.models.scanners.sbom_config import (
 from fluidattacks_core.models.scanners.sca_config import ScaConfig
 from fluidattacks_core.models.scanners.scan_config import ScanConfig
 from fluidattacks_core.models.scanners.sniffs_config import SniffsConfig
-from fluidattacks_core.models.scanners.sspm_config import GithubApp, GithubPat, SspmConfig
+from fluidattacks_core.models.scanners.sspm_config import (
+    AzureDevopsPat,
+    GithubApp,
+    GithubPat,
+    SspmConfig,
+)
 
 __all__ = [
     "ApkConfig",
     "ApkEnvironment",
     "AwsCredentials",
     "AwsRole",
+    "AzureDevopsPat",
     "ContainerImageConfig",
     "ContainerScaItem",
     "ContainersScaConfig",

{fluidattacks_core_models-14.2.0 → fluidattacks_core_models-14.4.0}/fluidattacks_core/models/scanners/cspm_config.py

@@ -6,15 +6,20 @@ from fluidattacks_core.models.scanners.loader import LoaderValidationInfo, resol
 class AwsCredentials(BaseModel):
     model_config = {"extra": "forbid"}
     access_key_id: str
-    secret_access_key: str
-    session_token: str | None = None
+    secret_access_key: str = Field(repr=False)
+    session_token: str | None = Field(default=None, repr=False)
     environment_id: str | None = None
 
-    @field_validator("access_key_id", "secret_access_key", "session_token", mode="before")
+    @field_validator("access_key_id", "secret_access_key", mode="before")
     @classmethod
     def _resolve_credentials(cls, v: object, info: LoaderValidationInfo) -> object:
         return resolve_env_var(v, info)
 
+    @field_validator("session_token", mode="before")
+    @classmethod
+    def _resolve_optional_credentials(cls, v: object, info: LoaderValidationInfo) -> object:
+        return resolve_env_var(v, info, required=False)
+
     @model_validator(mode="after")
     def _validate_key_session_token_pairing(self) -> "AwsCredentials":
         is_temporary = self.access_key_id.startswith("ASIA")
@@ -33,11 +38,16 @@ class AwsRole(BaseModel):
     external_id: str | None = Field(default=None, repr=False)
     environment_id: str | None = None
 
-    @field_validator("role", "external_id", mode="before")
+    @field_validator("role", mode="before")
     @classmethod
     def _resolve_credentials(cls, v: object, info: LoaderValidationInfo) -> object:
         return resolve_env_var(v, info)
 
+    @field_validator("external_id", mode="before")
+    @classmethod
+    def _resolve_optional_credentials(cls, v: object, info: LoaderValidationInfo) -> object:
+        return resolve_env_var(v, info, required=False)
+
 
 class CspmConfig(BaseModel):
     model_config = {"extra": "forbid"}

{fluidattacks_core_models-14.2.0 → fluidattacks_core_models-14.4.0}/fluidattacks_core/models/scanners/loader.py

@@ -28,7 +28,7 @@ def _sub_env_var(m: re.Match[str]) -> str:
     return value
 
 
-def resolve_env_var(v: object, info: LoaderValidationInfo) -> object:
+def resolve_env_var(v: object, info: LoaderValidationInfo, *, required: bool = True) -> object:
     if not isinstance(v, str) or not (info.context or {}).get("resolve_env"):
         return v
     matches = list(_ENV_PLACEHOLDER.finditer(v))
@@ -39,6 +39,9 @@ def resolve_env_var(v: object, info: LoaderValidationInfo) -> object:
         var_name = matches[0].group(1)
         value = os.environ.get(var_name)
         if value is None:
+            if required:
+                msg = f"environment variable '{var_name}' referenced in the scan config is not set"
+                raise ValueError(msg)
             LOGGER.warning("env var '%s' not set; field will be None", var_name)
             return None
         LOGGER.info("env var '%s' set", var_name)

{fluidattacks_core_models-14.2.0 → fluidattacks_core_models-14.4.0}/fluidattacks_core/models/scanners/sspm_config.py

@@ -29,6 +29,19 @@ class GithubApp(BaseModel):
         return resolve_env_var(v, info)
 
 
+class AzureDevopsPat(BaseModel):
+    model_config = {"extra": "forbid"}
+    organization: str
+    pat_token: str = Field(repr=False)
+    environment_id: str | None = None
+
+    @field_validator("pat_token", mode="before")
+    @classmethod
+    def _resolve_credentials(cls, v: object, info: LoaderValidationInfo) -> object:
+        return resolve_env_var(v, info)
+
+
 class SspmConfig(BaseModel):
     model_config = {"extra": "forbid"}
     github_credentials: list[GithubPat | GithubApp] = []
+    azure_devops_credentials: list[AzureDevopsPat] = []

{fluidattacks_core_models-14.2.0 → fluidattacks_core_models-14.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fluidattacks_core_models"
-version = "14.2.0"
+version = "14.4.0"
 description = "Fluid Attacks Core Models Library"
 authors = [{ name = "Development", email = "development@fluidattacks.com" }]
 license = { text = "MPL-2.0" }

{fluidattacks_core_models-14.2.0 → fluidattacks_core_models-14.4.0}/tests/test_loader_env.py

@@ -1,8 +1,9 @@
 from pathlib import Path
 
 import pytest
-from pydantic import BaseModel, field_validator
+from pydantic import BaseModel, ValidationError, field_validator
 
+from fluidattacks_core.models.scanners import AwsCredentials, AwsRole, CspmConfig
 from fluidattacks_core.models.scanners.loader import (
     LoaderValidationInfo,
     build_config,
@@ -22,6 +23,16 @@ class _SecretFixture(BaseModel):
     value: str | None = None
     namespace: str = ""
 
+    @field_validator("value", mode="before")
+    @classmethod
+    def _resolve_value(cls, v: object, info: LoaderValidationInfo) -> object:
+        return resolve_env_var(v, info, required=False)
+
+
+class _RequiredSecretFixture(BaseModel):
+    model_config = {"extra": "forbid"}
+    value: str
+
     @field_validator("value", mode="before")
     @classmethod
     def _resolve_value(cls, v: object, info: LoaderValidationInfo) -> object:
@@ -45,7 +56,7 @@ def test_build_config_resolves_sensitive_field(
     assert cfg.value == "resolved-value"
 
 
-def test_build_config_missing_var_resolves_to_none(
+def test_build_config_missing_var_on_optional_field_resolves_to_none(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
     monkeypatch.delenv("TOKEN", raising=False)
@@ -54,6 +65,58 @@ def test_build_config_missing_var_resolves_to_none(
     assert cfg.value is None
 
 
+def test_build_config_set_var_on_required_field_resolves(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("TOKEN", "resolved-value")
+    path = _write(tmp_path, "value: ${TOKEN}\n")
+    cfg = build_config(path, _RequiredSecretFixture)
+    assert cfg.value == "resolved-value"
+
+
+def test_build_config_missing_var_on_required_field_names_the_variable(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.delenv("TOKEN", raising=False)
+    path = _write(tmp_path, "value: ${TOKEN}\n")
+    with pytest.raises(ValidationError) as exc_info:
+        build_config(path, _RequiredSecretFixture)
+    assert "environment variable 'TOKEN' referenced in the scan config is not set" in str(
+        exc_info.value
+    )
+
+
+def test_build_config_missing_var_on_cspm_external_id_resolves_to_none(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.delenv("CSPM_AWS_EXTERNAL_ID", raising=False)
+    path = _write(
+        tmp_path,
+        "aws_credentials:\n"
+        "  - role: arn:aws:iam::123456789012:role/MyRole\n"
+        "    external_id: ${CSPM_AWS_EXTERNAL_ID}\n",
+    )
+    role = build_config(path, CspmConfig).aws_credentials[0]
+    assert isinstance(role, AwsRole)
+    assert role.external_id is None
+
+
+def test_build_config_missing_var_on_cspm_session_token_resolves_to_none(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.delenv("CSPM_AWS_SESSION_TOKEN", raising=False)
+    path = _write(
+        tmp_path,
+        "aws_credentials:\n"
+        "  - access_key_id: AKIA-fake-key\n"
+        "    secret_access_key: secret\n"
+        "    session_token: ${CSPM_AWS_SESSION_TOKEN}\n",
+    )
+    cred = build_config(path, CspmConfig).aws_credentials[0]
+    assert isinstance(cred, AwsCredentials)
+    assert cred.session_token is None
+
+
 def test_build_config_non_sensitive_field_stays_literal(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
@@ -87,6 +150,15 @@ def test_partial_missing_var_substitutes_empty_string(
     assert cfg.value == "https:///api"
 
 
+def test_partial_missing_var_on_required_field_substitutes_empty_string(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.delenv("HOST", raising=False)
+    path = _write(tmp_path, "value: https://${HOST}/api\n")
+    cfg = build_config(path, _RequiredSecretFixture)
+    assert cfg.value == "https:///api"
+
+
 def test_multi_var_resolved(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("A", "foo")
     monkeypatch.setenv("B", "bar")

fluidattacks_core_models-14.4.0/tests/test_sspm_config.py

@@ -0,0 +1,38 @@
+import pytest
+
+from fluidattacks_core.models.scanners import AzureDevopsPat, GithubPat, SspmConfig
+
+
+def test_azure_devops_credential_resolves_its_token(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("AZURE_TOKEN", "resolved-value")
+    cfg = SspmConfig.model_validate(
+        {
+            "azure_devops_credentials": [
+                {"organization": "acme", "pat_token": "${AZURE_TOKEN}"},
+            ],
+        },
+        context={"resolve_env": True},
+    )
+    assert cfg.azure_devops_credentials == [
+        AzureDevopsPat(organization="acme", pat_token="resolved-value"),  # noqa: S106
+    ]
+
+
+def test_azure_devops_and_github_credentials_stay_independent(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("GH_TOKEN", "gh-value")
+    monkeypatch.setenv("AZ_TOKEN", "az-value")
+    cfg = SspmConfig.model_validate(
+        {
+            "github_credentials": [{"organization": "gh-org", "pat_token": "${GH_TOKEN}"}],
+            "azure_devops_credentials": [{"organization": "az-org", "pat_token": "${AZ_TOKEN}"}],
+        },
+        context={"resolve_env": True},
+    )
+    assert cfg.github_credentials == [
+        GithubPat(organization="gh-org", pat_token="gh-value"),  # noqa: S106
+    ]
+    assert cfg.azure_devops_credentials == [
+        AzureDevopsPat(organization="az-org", pat_token="az-value"),  # noqa: S106
+    ]

{fluidattacks_core_models-14.2.0 → fluidattacks_core_models-14.4.0}/uv.lock

@@ -187,7 +187,7 @@ wheels = [
 
 [[package]]
 name = "fluidattacks-core-models"
-version = "14.1.0"
+version = "14.4.0"
 source = { editable = "." }
 dependencies = [
     { name = "pydantic" },

fluidattacks_core_models-14.2.0/.envrc

@@ -1 +0,0 @@
-use_flake ".#python311.devShell"

fluidattacks_core_models-14.2.0/.gitignore

@@ -1,9 +0,0 @@
-dist/
-dist-*/
-/.cargo-cache
-target/
-.direnv/
-.venv/
-.vscode/settings.json
-.zed/settings.json
-*.so