posture 0.2.2__tar.gz → 0.2.4__tar.gz

{posture-0.2.2 → posture-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: posture
-Version: 0.2.2
+Version: 0.2.4
 Summary: Runtime-agnostic Python library for CCM (Continuous Control Monitoring) data collection.
 Project-URL: Homepage, https://github.com/massyn/posture
 Author-email: Phil Massyn <phil.massyn@icloud.com>

{posture-0.2.2 → posture-0.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "posture"
-version = "0.2.2"
+version = "0.2.4"
 description = "Runtime-agnostic Python library for CCM (Continuous Control Monitoring) data collection."
 readme = "README.md"
 requires-python = ">=3.10"

{posture-0.2.2 → posture-0.2.4}/src/posture/__init__.py

@@ -30,7 +30,7 @@ logger = logging.getLogger("posture")
 load_dotenv()
 logger.debug("loaded .env via python-dotenv")
 
-__version__ = "0.2.2"
+__version__ = "0.2.4"
 
 __all__ = [
     "CCM",

{posture-0.2.2 → posture-0.2.4}/src/posture/collectors/mde.py

@@ -33,6 +33,11 @@ each retry just re-bursts at lower concurrency instead of avoiding the 429s
 in the first place. This is the same root cause and fix as the KnowBe4
 collector's ``_pace_request``.
 
+A 5xx for a single machine (e.g. a stale/decommissioned device record) is
+handled locally per-machine — see ``_fetch_all_vulns_for_machine`` — rather
+than propagating up to base.py's batch-level retry, which would otherwise
+fail (or re-burst) the whole fan-out over one bad machine.
+
 Resources: ``machines``, ``vulnerabilities``, ``device_av_info``,
 ``machine_vulnerabilities`` (requires machines ids).
 """
@@ -40,17 +45,32 @@ Resources: ``machines``, ``vulnerabilities``, ``device_av_info``,
 from __future__ import annotations
 
 import concurrent.futures
+import logging
 import threading
 import time
 from typing import Any
 
+import requests
+
 from posture.base import Collector, RateLimitedSignal, UnauthorizedSignal
 from posture.collectors._azure_oauth import fetch_azure_ad_token
 
+logger = logging.getLogger("posture.collectors.mde")
+
 _API_BASE_URL = "https://api.security.microsoft.com"
 _PAGE_SIZE = 1000  # comfortably under the documented $top max of 8,000
 _DEFAULT_MACHINE_VULN_MAX_WORKERS = 10
 
+# A lone machine 500ing is a per-device MDE fault, not a whole-tenant problem
+# (unlike 429/401, which are meaningful at the batch level and handled by
+# base.py's _request_with_retry). Retrying the entire fan-out for one bad
+# machine would burn the shared retry budget and re-halve concurrency for
+# every other machine, so a 5xx for a single machine is retried locally here
+# and, if it still fails, that machine is skipped rather than failing the
+# whole 'machine_vulnerabilities' resource.
+_MACHINE_VULN_SERVER_ERROR_RETRIES = 2
+_MACHINE_VULN_SERVER_ERROR_WAIT_SECONDS = 60.0
+
 # MDE's documented general API limit is ~100 calls/minute per app registration.
 # Staying comfortably under that (0.65s between requests ~= 92/min) leaves
 # headroom for other traffic against the same app registration.
@@ -294,8 +314,50 @@ class MdeCollector(Collector):
         # No $top/$skip/nextLink documented for this endpoint — it's a
         # single, complete response (unlike the org-wide list endpoints).
         endpoint = _ENDPOINTS["machine_vulnerabilities"].format(id=machine_id)
-        response = self._get(_API_BASE_URL + endpoint)
-        return response.json().get("value", [])
+        attempt = 0
+        while True:
+            try:
+                response = self._get(_API_BASE_URL + endpoint)
+                return response.json().get("value", [])
+            except requests.exceptions.HTTPError as exc:
+                status = exc.response.status_code if exc.response is not None else None
+                if status == 404:
+                    # Machine-specific endpoint: a 404 means this machine has
+                    # no vulnerability data (e.g. offboarded since the machine
+                    # list was pulled), not a collection-wide failure.
+                    logger.info(
+                        "machine_vulnerabilities: no data for machine (404), skipping",
+                        extra={
+                            "source": self.env_prefix.lower(),
+                            "machine_id": machine_id,
+                        },
+                    )
+                    return []
+                if status is None or status < 500:
+                    raise
+                attempt += 1
+                if attempt > _MACHINE_VULN_SERVER_ERROR_RETRIES:
+                    logger.warning(
+                        "machine_vulnerabilities: skipping machine after repeated "
+                        "server errors",
+                        extra={
+                            "source": self.env_prefix.lower(),
+                            "machine_id": machine_id,
+                            "status": status,
+                            "attempts": attempt,
+                        },
+                    )
+                    return []
+                logger.warning(
+                    "machine_vulnerabilities: server error for machine, retrying",
+                    extra={
+                        "source": self.env_prefix.lower(),
+                        "machine_id": machine_id,
+                        "status": status,
+                        "attempt": attempt,
+                    },
+                )
+                time.sleep(_MACHINE_VULN_SERVER_ERROR_WAIT_SECONDS)
 
     def _pace_request(self) -> None:
         # Shared across threads so concurrent machine_vulnerabilities workers

{posture-0.2.2 → posture-0.2.4}/tests/test_mde.py

@@ -1,4 +1,5 @@
 import json
+from unittest.mock import patch
 
 import responses
 
@@ -139,3 +140,86 @@ def test_machine_vulnerabilities_fans_out_and_injects_machine_id() -> None:
 
     assert len(df) == 2
     assert set(df["machine_id"]) == {"machine-1", "machine-2"}
+
+
+@responses.activate
+def test_machine_vulnerabilities_retries_then_recovers_from_server_error() -> None:
+    responses.add(
+        responses.POST,
+        "https://login.microsoftonline.com/tenant-1/oauth2/v2.0/token",
+        json={"access_token": "tok"},
+        status=200,
+    )
+    responses.add(
+        responses.GET,
+        "https://api.security.microsoft.com/api/machines",
+        json={"value": [{"id": "machine-1"}]},
+        status=200,
+    )
+    responses.add(
+        responses.GET,
+        "https://api.security.microsoft.com/api/machines/machine-1/vulnerabilities",
+        status=500,
+    )
+    responses.add(
+        responses.GET,
+        "https://api.security.microsoft.com/api/machines/machine-1/vulnerabilities",
+        json={"value": [{"id": "mv-1"}]},
+        status=200,
+    )
+
+    ccm = CCM(
+        "mde", {"tenant_id": "tenant-1", "client_id": "id", "client_secret": "secret"}
+    )
+    with patch("posture.collectors.mde.time.sleep") as mock_sleep:
+        df = ccm.collect("machine_vulnerabilities")
+
+    assert len(df) == 1
+    assert 60.0 in [call.args[0] for call in mock_sleep.call_args_list]
+
+
+@responses.activate
+def test_machine_vulnerabilities_skips_machine_after_repeated_server_errors() -> None:
+    responses.add(
+        responses.POST,
+        "https://login.microsoftonline.com/tenant-1/oauth2/v2.0/token",
+        json={"access_token": "tok"},
+        status=200,
+    )
+    responses.add(
+        responses.GET,
+        "https://api.security.microsoft.com/api/machines",
+        json={"value": [{"id": "machine-1"}, {"id": "machine-2"}]},
+        status=200,
+    )
+    responses.add(
+        responses.GET,
+        "https://api.security.microsoft.com/api/machines/machine-1/vulnerabilities",
+        status=500,
+    )
+    responses.add(
+        responses.GET,
+        "https://api.security.microsoft.com/api/machines/machine-1/vulnerabilities",
+        status=500,
+    )
+    responses.add(
+        responses.GET,
+        "https://api.security.microsoft.com/api/machines/machine-1/vulnerabilities",
+        status=500,
+    )
+    responses.add(
+        responses.GET,
+        "https://api.security.microsoft.com/api/machines/machine-2/vulnerabilities",
+        json={"value": [{"id": "mv-2"}]},
+        status=200,
+    )
+
+    ccm = CCM(
+        "mde", {"tenant_id": "tenant-1", "client_id": "id", "client_secret": "secret"}
+    )
+    with patch("posture.collectors.mde.time.sleep"):
+        df = ccm.collect("machine_vulnerabilities")
+
+    # machine-1 is skipped after exhausting retries; machine-2 still succeeds.
+    assert len(df) == 1
+    assert df.iloc[0]["machine_id"] == "machine-2"

{posture-0.2.2 → posture-0.2.4}/tests/test_posture.py

@@ -2,4 +2,4 @@ import posture
 
 
 def test_version() -> None:
-    assert posture.__version__ == "0.2.0"
+    assert posture.__version__ == "0.2.4"