qontract-reconcile 0.10.1rc1202__py3-none-any.whl → 0.10.2.dev2__py3-none-any.whl

reconcile/test/test_saasherder_allowed_secret_paths.py

@@ -1,125 +0,0 @@
-from collections.abc import Callable
-
-import pytest
-
-from reconcile.typed_queries.saas_files import SaasFile
-from reconcile.utils.saasherder import SaasHerder
-from reconcile.utils.secret_reader import SecretReader
-
-
-@pytest.mark.parametrize(
-    "allowed_secret_parameter_path,referenced_secret_path,expected_valid",
-    [
-        # covered by parent directory
-        ("foobar", "foobar/baz", True),
-        # not covered by parent directory even though there is a common name prefix
-        ("foo", "foobar/baz", False),
-        # multilevel allowed path
-        ("foo/bar", "foo/bar/baz", True),
-        # multilevel but different intermediary path
-        ("foo/bar", "foo/baz/bar", False),
-    ],
-)
-def test_saasherder_allowed_secret_paths(
-    allowed_secret_parameter_path: str,
-    referenced_secret_path: str,
-    expected_valid: bool,
-    secret_reader: SecretReader,
-    gql_class_factory: Callable[
-        ...,
-        SaasFile,
-    ],
-):
-    """
-    ensure a parent directory in allowed_secret_parameter_paths matches correctly
-    """
-    saas_files = [
-        gql_class_factory(
-            SaasFile,
-            {
-                "path": "path1",
-                "name": "a1",
-                "managedResourceTypes": [],
-                "managedResourceNames": None,
-                "allowedSecretParameterPaths": [allowed_secret_parameter_path],
-                "app": {"name": "app1", "selfServiceRoles": [{"name": "test"}]},
-                "pipelinesProvider": {
-                    "name": "tekton-app-sre-pipelines-appsres03ue1",
-                    "provider": "tekton",
-                    "namespace": {
-                        "name": "app-sre-pipelines",
-                        "cluster": {
-                            "name": "appsres03ue1",
-                            "serverUrl": "https://api.appsres03ue1.5nvu.p1.openshiftapps.com:6443",
-                            "consoleUrl": "https://console.appsres03ue1.5nvu.p1.openshiftapps.com:6443",
-                            "internal": True,
-                        },
-                    },
-                    "defaults": {
-                        "pipelineTemplates": {
-                            "openshiftSaasDeploy": {"name": "openshift-saas-deploy"}
-                        }
-                    },
-                    "pipelineTemplates": {
-                        "openshiftSaasDeploy": {"name": "openshift-saas-deploy"}
-                    },
-                },
-                "imagePatterns": [],
-                "resourceTemplates": [
-                    {
-                        "path": "path1",
-                        "name": "test",
-                        "url": "url",
-                        "targets": [
-                            {
-                                "namespace": {
-                                    "name": "test-ns-subscriber",
-                                    "environment": {
-                                        "name": "App-SRE",
-                                        "parameters": "{}",
-                                    },
-                                    "app": {"name": "test-saas-deployments"},
-                                    "cluster": {
-                                        "name": "appsres03ue1",
-                                        "serverUrl": "https://api.appsres03ue1.5nvu.p1.openshiftapps.com:6443",
-                                        "internal": True,
-                                    },
-                                },
-                                "ref": "main",
-                                "upstream": {
-                                    "instance": {
-                                        "name": "ci",
-                                        "serverUrl": "https://jenkins.com",
-                                    },
-                                    "name": "job",
-                                },
-                                "parameters": "{}",
-                                "secretParameters": [
-                                    {
-                                        "name": "secret",
-                                        "secret": {
-                                            "path": referenced_secret_path,
-                                            "field": "db.endpoint",
-                                        },
-                                    },
-                                ],
-                            },
-                        ],
-                    },
-                ],
-            },
-        )
-    ]
-
-    saasherder = SaasHerder(
-        saas_files,
-        secret_reader=secret_reader,
-        thread_pool_size=1,
-        integration="",
-        integration_version="",
-        hash_length=7,
-        repo_url="https://repo-url.com",
-        validate=True,
-    )
-
-    assert saasherder.valid == expected_valid

reconcile/test/test_secret_reader.py

@@ -1,153 +0,0 @@
-from unittest.mock import create_autospec
-
-import pytest
-
-import reconcile.utils.secret_reader
-from reconcile.utils import vault
-from reconcile.utils.secret_reader import (
-    ConfigSecretReader,
-    SecretNotFound,
-    SecretReader,
-    VaultSecretReader,
-)
-from reconcile.utils.vault import _VaultClient
-
-VAULT_READ_EXPECTED = {"key": "value"}
-VAULT_READ_ALL_EXPECTED = {"key2": "value2"}
-
-
-@pytest.fixture
-def vault_mock():
-    vault_mock = create_autospec(_VaultClient)
-    vault_mock.read.side_effect = [VAULT_READ_EXPECTED] * 100
-    vault_mock.read_all.side_effect = [VAULT_READ_ALL_EXPECTED] * 100
-    return vault_mock
-
-
-def test_vault_secret_reader_typed_read(vault_mock, vault_secret):
-    vault_secret_reader = VaultSecretReader(vault_client=vault_mock)
-    result = vault_secret_reader.read_secret(vault_secret)
-
-    assert result == VAULT_READ_EXPECTED
-    vault_mock.read.assert_called_once_with(SecretReader.to_dict(vault_secret))
-    vault_mock.read_all.assert_not_called()
-
-
-def test_vault_secret_reader_typed_read_all(vault_mock, vault_secret):
-    vault_secret_reader = VaultSecretReader(vault_client=vault_mock)
-    result = vault_secret_reader.read_all_secret(vault_secret)
-
-    assert result == VAULT_READ_ALL_EXPECTED
-    vault_mock.read_all.assert_called_once_with(SecretReader.to_dict(vault_secret))
-    vault_mock.read.assert_not_called()
-
-
-def test_vault_secret_reader_parameters_read(vault_mock, vault_secret):
-    vault_secret_reader = VaultSecretReader(vault_client=vault_mock)
-    result = vault_secret_reader.read_with_parameters(
-        path=vault_secret.path,
-        field=vault_secret.field,
-        format=vault_secret.q_format,
-        version=vault_secret.version,
-    )
-
-    assert result == VAULT_READ_EXPECTED
-    vault_mock.read.assert_called_once_with(SecretReader.to_dict(vault_secret))
-    vault_mock.read_all.assert_not_called()
-
-
-def test_vault_secret_reader_parameters_read_all(vault_mock, vault_secret):
-    vault_secret_reader = VaultSecretReader(vault_client=vault_mock)
-    result = vault_secret_reader.read_all_with_parameters(
-        path=vault_secret.path,
-        field=vault_secret.field,
-        format=vault_secret.q_format,
-        version=vault_secret.version,
-    )
-
-    assert result == VAULT_READ_ALL_EXPECTED
-    vault_mock.read_all.assert_called_once_with(SecretReader.to_dict(vault_secret))
-    vault_mock.read.assert_not_called()
-
-
-def test_vault_secret_reader_raises(vault_mock, vault_secret, patch_sleep):
-    vault_mock.read.side_effect = [vault.SecretNotFound] * 100
-    vault_secret_reader = VaultSecretReader(vault_client=vault_mock)
-
-    with pytest.raises(SecretNotFound):
-        vault_secret_reader.read_secret(vault_secret)
-
-    vault_mock.read.assert_called_with(SecretReader.to_dict(vault_secret))
-    vault_mock.read_all.assert_not_called()
-
-
-def test_config_secret_reader_raises(vault_secret, patch_sleep):
-    config_secret_reader = ConfigSecretReader()
-
-    with pytest.raises(SecretNotFound):
-        config_secret_reader.read_secret(vault_secret)
-
-
-def test_read_vault_raises(mocker, patch_sleep):
-    """
-    Ensure that secret_reader.SecretNotFound is raised instead of
-    vault.SecretNotFound.
-    """
-    mock_vault_client = mocker.patch.object(
-        reconcile.utils.secret_reader, "VaultClient", autospec=_VaultClient
-    )
-    settings = {"vault": True}
-    mock_vault_client.return_value.read.side_effect = vault.SecretNotFound
-
-    secret_reader = SecretReader(settings=settings)
-
-    with pytest.raises(SecretNotFound):
-        secret_reader.read({"path": "test", "field": "some-field"})
-
-
-def test_read_config_raises(mocker, patch_sleep):
-    """
-    Ensure that secret_reader.SecretNotFound is raised instead of
-    config.SecretNotFound.
-    """
-    mocker.patch.object(
-        reconcile.utils.secret_reader, "VaultClient", autospec=_VaultClient
-    )
-
-    secret_reader = SecretReader()
-
-    with pytest.raises(SecretNotFound):
-        secret_reader.read({"path": "test", "field": "some-field"})
-
-
-def test_read_all_vault_raises(mocker, patch_sleep):
-    """
-    Ensure that secret_reader.SecretNotFound is raised instead of
-    vault.SecretNotFound.
-    """
-    mock_vault_client = mocker.patch.object(
-        reconcile.utils.secret_reader, "VaultClient", autospec=_VaultClient
-    )
-
-    settings = {"vault": True}
-    mock_vault_client.return_value.read_all.side_effect = vault.SecretNotFound
-
-    secret_reader = SecretReader(settings=settings)
-
-    with pytest.raises(SecretNotFound):
-        secret_reader.read_all({"path": "test", "field": "some-field"})
-
-
-def test_read_all_config_raises(mocker, patch_sleep):
-    """
-    Ensure that secret_reader.SecretNotFound is raised instead of
-    config.SecretNotFound.
-    """
-    mocker.patch.object(
-        reconcile.utils.secret_reader, "VaultClient", autospec=_VaultClient
-    )
-
-    secret_reader = SecretReader()
-
-    with pytest.raises(SecretNotFound):
-        secret_reader.read_all({"path": "test", "field": "some-field"})

reconcile/test/test_slack_base.py

@@ -1,183 +0,0 @@
-import pytest
-from pydantic import (
-    BaseModel,
-    Json,
-)
-
-from reconcile.slack_base import (
-    get_slackapi,
-    slackapi_from_permissions,
-    slackapi_from_slack_workspace,
-)
-from reconcile.utils.secret_reader import SecretReader
-
-
-def create_api_config():
-    return {
-        "global": {"max_retries": 5, "timeout": 30},
-        "methods": [
-            {"name": "users.list", "args": '{"limit":123}'},
-        ],
-    }
-
-
-@pytest.fixture
-def slack_workspace():
-    return {
-        "workspace": {
-            "name": "coreos",
-            "integrations": [
-                {
-                    "name": "dummy",
-                    "token": {
-                        "path": "some/path",
-                        "field": "bot_token",
-                    },
-                    "channel": "test",
-                    "icon_emoji": "test_emoji",
-                    "username": "foo",
-                },
-            ],
-            "api_client": create_api_config(),
-        }
-    }
-
-
-@pytest.fixture
-def unleash_slack_workspace():
-    return {
-        "workspace": {
-            "name": "coreos",
-            "integrations": [
-                {
-                    "name": "slack-usergroups",
-                    "token": {
-                        "path": "some/path",
-                        "field": "bot_token",
-                    },
-                },
-            ],
-            "api_client": create_api_config(),
-        },
-        "channel": "test",
-        "icon_emoji": "unleash",
-        "username": "test",
-    }
-
-
-@pytest.fixture
-def permissions_workspace():
-    return {
-        "workspace": {
-            "name": "coreos",
-            "token": {
-                "path": "some/path",
-                "field": "bot_token",
-            },
-            "api_client": create_api_config(),
-            "managedUsergroups": ["foo"],
-        }
-    }
-
-
-@pytest.fixture
-def patch_secret_reader(mocker):
-    return mocker.patch(
-        "reconcile.utils.secret_reader.SecretReader.read",
-        return_value="secret",
-        autospec=True,
-    )
-
-
-@pytest.fixture
-def patch__initiate_usergroups(mocker):
-    return mocker.patch(
-        "reconcile.utils.slack_api.SlackApi._initiate_usergroups", autospec=True
-    )
-
-
-def test_slack_workspace_raises():
-    with pytest.raises(ValueError):
-        slackapi_from_slack_workspace({}, SecretReader(), "foo")
-
-
-def test_slack_workspace_ok(
-    patch_secret_reader, patch__initiate_usergroups, slack_workspace
-):
-    slack_api = slackapi_from_slack_workspace(slack_workspace, SecretReader(), "dummy")
-    patch_secret_reader.assert_called_once()
-    patch__initiate_usergroups.assert_called_once()
-    assert slack_api.channel == "test"
-    assert slack_api.chat_kwargs["icon_emoji"] == "test_emoji"
-    assert slack_api.config.get_method_config("users.list") == {"limit": 123}
-
-
-def test_slack_workspace_channel_overwrite(
-    patch_secret_reader, patch__initiate_usergroups, slack_workspace
-):
-    slack_api = slackapi_from_slack_workspace(
-        slack_workspace, SecretReader(), "dummy", channel="foo"
-    )
-    assert slack_api.channel == "foo"
-
-
-def test_unleash_workspace_ok(
-    patch_secret_reader, patch__initiate_usergroups, unleash_slack_workspace
-):
-    slack_api = slackapi_from_slack_workspace(
-        unleash_slack_workspace, SecretReader(), "slack-usergroups"
-    )
-    patch_secret_reader.assert_called_once()
-    patch__initiate_usergroups.assert_called_once()
-    assert slack_api.channel == "test"
-    assert slack_api.chat_kwargs["icon_emoji"] == "unleash"
-    assert slack_api.config.get_method_config("users.list") == {"limit": 123}
-
-
-def test_slack_workspace_no_init(
-    patch_secret_reader, patch__initiate_usergroups, slack_workspace
-):
-    slackapi_from_slack_workspace(
-        slack_workspace, SecretReader(), "dummy", init_usergroups=False
-    )
-    patch__initiate_usergroups.assert_not_called()
-
-
-def test_permissions_workspace(
-    patch_secret_reader, patch__initiate_usergroups, permissions_workspace
-):
-    slack_api = slackapi_from_permissions(permissions_workspace, SecretReader())
-    patch_secret_reader.assert_called_once()
-    patch__initiate_usergroups.assert_called_once()
-
-    assert slack_api.channel is None
-    assert slack_api.config.get_method_config("users.list") == {"limit": 123}
-
-
-class ClientGlobalConfig(BaseModel):
-    max_retries: int | None
-    timeout: int | None
-
-
-class ClientMethodConfig(BaseModel):
-    name: str
-    args: Json
-
-
-class ClientConfig(BaseModel):
-    q_global: ClientGlobalConfig | None
-    methods: list[ClientMethodConfig] | None
-
-
-def test_get_slackapi():
-    slack_api = get_slackapi(
-        "workspace",
-        "token",
-        client_config=ClientConfig(
-            q_global=ClientGlobalConfig(max_retries=1, timeout=4),
-            methods=[ClientMethodConfig(name="users.list", args='{"limit":1000}')],
-        ),
-        init_usergroups=False,
-    )
-    assert slack_api.channel is None
-    assert slack_api.config.get_method_config("users.list") == {"limit": 1000}