zscaler-sdk-python 1.11.2__tar.gz → 1.11.4__tar.gz

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: zscaler-sdk-python
-Version: 1.11.2
+Version: 1.11.4
 Summary: Official Python SDK for the Zscaler Products
 Home-page: https://github.com/zscaler/zscaler-sdk-python
 License: MIT
@@ -1079,6 +1079,8 @@ Higher numbers win. In other words, configuration passed via the constructor wil
 
 **NOTE:** This option is only supported for OneAPI Zidentity credentials at the moment.
 
+> **Security note:** TLS verification (`sslContext`) can only be set in the configuration passed to the constructor; it is ignored in `zscaler.yaml` files. The SDK logs a warning when it applies a `zscaler.yaml` from the current working directory and whenever TLS verification is disabled. Only run the SDK from directories whose configuration files you trust.
+
 ### YAML configuration
 
 When you use an API Token instead of OAuth 2.0 the full YAML configuration looks like:
@@ -1145,7 +1147,7 @@ Each one of the configuration values above can be turned into an environment var
 | `proxyHost`       | _(String)_ HTTP proxy host  | `ZSCALER_CLIENT_PROXY_HOST` |
 | `proxyUsername`       | _(String)_ HTTP proxy username  | `ZSCALER_CLIENT_PROXY_USERNAME` |
 | `proxyPassword`       | _(String)_ HTTP proxy password  | `ZSCALER_CLIENT_PROXY_PASSWORD` |
-| `disableHttpsCheck`       | _(String)_ Disable SSL checks  | `ZSCALER_TESTING_TESTINGDISABLEHTTPSCHECK` |
+| `sslContext`       | _(Boolean or String)_ TLS certificate verification: `True` (default), `False` (testing only), or a CA bundle path. Constructor only; ignored in YAML files. | _(none)_ |
 | `sandboxToken`       | _(String)_ The Zscaler Internet Access Sandbox Token | `ZSCALER_SANDBOX_TOKEN` |
 | `sandboxCloud`       | _(String)_ The Zscaler Internet Access Sandbox cloud name | `ZSCALER_SANDBOX_CLOUD` |
 

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/README.md

@@ -1040,6 +1040,8 @@ Higher numbers win. In other words, configuration passed via the constructor wil
 
 **NOTE:** This option is only supported for OneAPI Zidentity credentials at the moment.
 
+> **Security note:** TLS verification (`sslContext`) can only be set in the configuration passed to the constructor; it is ignored in `zscaler.yaml` files. The SDK logs a warning when it applies a `zscaler.yaml` from the current working directory and whenever TLS verification is disabled. Only run the SDK from directories whose configuration files you trust.
+
 ### YAML configuration
 
 When you use an API Token instead of OAuth 2.0 the full YAML configuration looks like:
@@ -1106,7 +1108,7 @@ Each one of the configuration values above can be turned into an environment var
 | `proxyHost`       | _(String)_ HTTP proxy host  | `ZSCALER_CLIENT_PROXY_HOST` |
 | `proxyUsername`       | _(String)_ HTTP proxy username  | `ZSCALER_CLIENT_PROXY_USERNAME` |
 | `proxyPassword`       | _(String)_ HTTP proxy password  | `ZSCALER_CLIENT_PROXY_PASSWORD` |
-| `disableHttpsCheck`       | _(String)_ Disable SSL checks  | `ZSCALER_TESTING_TESTINGDISABLEHTTPSCHECK` |
+| `sslContext`       | _(Boolean or String)_ TLS certificate verification: `True` (default), `False` (testing only), or a CA bundle path. Constructor only; ignored in YAML files. | _(none)_ |
 | `sandboxToken`       | _(String)_ The Zscaler Internet Access Sandbox Token | `ZSCALER_SANDBOX_TOKEN` |
 | `sandboxCloud`       | _(String)_ The Zscaler Internet Access Sandbox cloud name | `ZSCALER_SANDBOX_CLOUD` |
 

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "zscaler-sdk-python"
-version = "1.11.2"
+version = "1.11.4"
 description = "Official Python SDK for the Zscaler Products"
 authors = ["Zscaler, Inc. <devrel@zscaler.com>"]
 license = "MIT"

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/__init__.py

@@ -29,7 +29,7 @@ __license__ = "MIT"
 __contributors__ = [
     "William Guilherme",
 ]
-__version__ = "1.11.2"
+__version__ = "1.11.4"
 
 
 from zscaler.oneapi_client import Client as ZscalerClient  # noqa

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/config/config_setter.py

@@ -42,7 +42,6 @@ class ConfigSetter:
                 "maxRetries": 2,
                 "maxRetrySeconds": "",
             },
-            "testing": {"disableHttpsCheck": ""},
         }
     }
 
@@ -97,7 +96,10 @@ class ConfigSetter:
 
         # check if LOCAL yaml exists, apply if true
         if os.path.exists(_LOCAL_YAML_PATH):
-            logger.info(f"Applying local YAML configuration from {_LOCAL_YAML_PATH}.")
+            logger.warning(
+                f"Applying zscaler.yaml from the current working directory ({_LOCAL_YAML_PATH}). "
+                "Only run the SDK from directories whose configuration files you trust."
+            )
             self._apply_yaml_config(_LOCAL_YAML_PATH)
 
         # apply existing environment variables
@@ -138,13 +140,6 @@ class ConfigSetter:
         self._config["client"]["requestTimeout"] = 0
         self._config["client"]["rateLimit"] = {"maxRetries": 2}
 
-        # Add a check for the 'testing' key before accessing it
-        if "testing" not in self._config:
-            self._config["testing"] = {}
-
-        # Initialize the 'testing' section with default values
-        self._config["testing"]["disableHttpsCheck"] = False
-
     def _apply_config(self, new_config: dict):
         """Apply a config dictionary to the current config, overwriting values"""
         # logger.debug("Applying new configuration settings.")
@@ -170,8 +165,13 @@ class ConfigSetter:
         with open(path, "r") as file:
             # Open file stream and attempt to load YAML
             config = yaml.load(file, Loader=yaml.SafeLoader)
-        # Apply acquired config to configuration
-        self._apply_config(config.get("zscaler", {}))
+        zscaler_config = (config or {}).get("zscaler", {}) or {}
+        # TLS verification settings are only honored when passed to the client constructor.
+        client_config = zscaler_config.get("client") or {}
+        if "sslContext" in client_config:
+            client_config.pop("sslContext")
+            logger.warning(f"Ignoring 'sslContext' in {path}; TLS settings must be passed to the client constructor.")
+        self._apply_config(zscaler_config)
 
     def _apply_env_config(self, conf_key):
         """

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/logger.py

@@ -21,6 +21,9 @@ SENSITIVE_FIELDS = {
     "access_token",
     "accessToken",
     "accesstoken",
+    "api_token",
+    "apiToken",
+    "apitoken",
     "refresh_token",
     "refreshToken",
     "refreshtoken",
@@ -181,7 +184,7 @@ def dump_request(logger, url: str, method: str, json, params, headers, request_u
     log_lines.append(f"\n---[ ZSCALER SDK REQUEST | ID:{request_uuid} ]-------------------------------")
     full_url = url
     if params:
-        full_url += "?" + urlencode(params)
+        full_url += "?" + urlencode(_sanitize_for_logging(params))
     log_lines.append(f"{method} {full_url}")
     for key, value in request_headers_filtered.items():
         log_lines.append(f"{key}: {value}")
@@ -214,7 +217,7 @@ def dump_response(
 
     full_url = url
     if params:
-        full_url += "?" + urlencode(params)
+        full_url += "?" + urlencode(_sanitize_for_logging(params))
     log_lines = []
 
     if from_cache:

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/oneapi_http_client.py

@@ -69,13 +69,11 @@ class HTTPClient:
         else:
             self._proxy: Optional[str] = None
 
-        # Setup SSL context or handle disableHttpsCheck
-        if "sslContext" in http_config:
-            self._ssl_context: Union[bool, Any] = http_config["sslContext"]  # Use the custom SSL context
-        elif "disableHttpsCheck" in http_config and http_config["disableHttpsCheck"]:
-            self._ssl_context: Union[bool, Any] = False  # Disable SSL certificate validation if disableHttpsCheck is true
-        else:
-            self._ssl_context: Union[bool, Any] = True  # Enable SSL certificate validation by default
+        # Passed to requests as ``verify``: True (default), False, or a CA bundle path.
+        ssl_context: Union[bool, Any] = http_config.get("sslContext")
+        self._ssl_context: Union[bool, Any] = True if ssl_context is None else ssl_context
+        if self._ssl_context is False:
+            logger.warning("TLS certificate verification is disabled (sslContext=False). Do not use this outside of testing.")
 
         self._session: Optional[requests.Session] = None
 

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/zia/locations.py

@@ -529,7 +529,7 @@ class LocationsAPI(APIClient):
             location_ids (list): The list of unique ids for the ZIA Locations that will be deleted.
 
         Returns:
-            :obj:`int`: The status code for the operation.
+            :obj:`Tuple`: A tuple containing (None, Response, error)
 
         Examples:
             >>> location_ids_to_delete = ['8665786', '8766865']
@@ -541,10 +541,10 @@ class LocationsAPI(APIClient):
         """
         # Validate input before making the request
         if not location_ids:
-            return (None, ValueError("Empty location_ids list provided"))
+            return (None, None, ValueError("Empty location_ids list provided"))
 
         if len(location_ids) > 100:
-            return (None, ValueError("Maximum 100 location IDs allowed per bulk delete request"))
+            return (None, None, ValueError("Maximum 100 location IDs allowed per bulk delete request"))
 
         http_method = "post".upper()
         api_url = format_url(f"""
@@ -558,18 +558,13 @@ class LocationsAPI(APIClient):
             method=http_method, endpoint=api_url, body=payload, headers={}, params={}
         )
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
-
-        # For 204 No Content responses, the executor may return None
         if error:
-            return (None, error)
-        elif response is None:
-            # This is the expected case for 204 No Content
-            return (None, None)
+            return (None, response, error)
 
-        return (response, None)
+        return (None, response, None)
 
     def list_sub_locations(self, location_id: int, query_params: Optional[dict] = None) -> APIResult[List[LocationManagement]]:
         """

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/zia/nss_servers.py

@@ -17,6 +17,7 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 from typing import List, Optional
 
 from zscaler.api_client import APIClient
+from zscaler.errors.response_checker import check_response_for_error
 from zscaler.request_executor import RequestExecutor
 from zscaler.types import APIResult
 from zscaler.utils import format_url
@@ -303,3 +304,72 @@ class NssServersAPI(APIClient):
         if error:
             return (None, response, error)
         return (None, response, None)
+
+def nss_download_certificate(self, nss_id: int, output_file: Optional[str] = None) -> APIResult[bytes]:
+        """
+        Downloads the SSL certificate of the specified NSS server. The server returns a ZIP file
+        (``NssCertificate.zip``) that is installed on the NSS virtual machine with ``sudo nss install-cert``.
+
+        Args:
+            nss_id (int): The unique identifier of the NSS server.
+            output_file (str): Optional path; when given, the downloaded bytes are written to this file.
+
+        Returns:
+            :obj:`Tuple`: A tuple containing (certificate ZIP file as bytes, Response, error)
+
+        Examples:
+            Download the certificate of an NSS server and save it to disk:
+
+            >>> content, _, error = client.zia.nss_servers.nss_download_certificate(
+            ...     nss_id=1254654,
+            ...     output_file='NssCertificate.zip',
+            ... )
+            >>> if error:
+            ...     print(f"Error downloading NSS certificate: {error}")
+            ...     return
+            ... print(f"Downloaded {len(content)} bytes.")
+        """
+        http_method = "get".upper()
+        api_url = format_url(f"""
+            {self._zia_base_endpoint}
+            /nssDownload/{nss_id}
+        """)
+
+        headers = {
+            "Accept": "*/*",
+        }
+
+        request, error = self._request_executor.create_request(
+            method=http_method,
+            endpoint=api_url,
+            body={},
+            headers=headers,
+        )
+        if error:
+            return (None, None, error)
+
+        response, error = self._request_executor.execute(request, return_raw_response=True)
+        if error:
+            return (None, response, error)
+
+        # A raw response skips the executor's error handling, so an API error body
+        # would otherwise be returned, and saved, as if it were the certificate.
+        status_code = getattr(response, "status_code", None)
+        if not isinstance(status_code, int) or not 200 <= status_code < 300:
+            try:
+                _, error = check_response_for_error(request.get("url", api_url), response, getattr(response, "text", ""))
+            except Exception as ex:
+                error = ex
+            if not error:
+                error = ValueError(f"Unexpected response while downloading the certificate of NSS server {nss_id}.")
+            return (None, response, error)
+
+        content = getattr(response, "content", None)
+        if not content:
+            return (None, response, ValueError(f"The API returned no certificate for NSS server {nss_id}."))
+
+        if output_file:
+            with open(output_file, "wb") as f:
+                f.write(content)
+
+        return (content, response, None)

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/zia/outbound_email_dlp_rules.py

@@ -411,10 +411,10 @@ class OutboundEmailDLPRulesAPI(APIClient):
             output_file (str): Optional path; when given, the downloaded bytes are written to this file.
 
         Returns:
-            tuple: A 2-tuple of (the CSV mapping of supported outbound email DLP rule actions as bytes, error).
+            :obj:`Tuple`: A tuple containing (CSV mapping of supported actions as bytes, Response, error)
 
         Examples:
-            >>> content, error = client.zia.outbound_email_dlp_rules.get_actions(output_file='get_actions.csv')
+            >>> content, _, error = client.zia.outbound_email_dlp_rules.get_actions(output_file='get_actions.csv')
             >>> if error:
             ...     print(f"Error downloading outbound email DLP rule: {error}")
             ...     return
@@ -441,11 +441,11 @@ class OutboundEmailDLPRulesAPI(APIClient):
             params=query_params,
         )
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request, return_raw_response=True)
         if error:
-            return (None, f"Request failed: {error}")
+            return (None, response, error)
 
         content = response.content
 
@@ -453,4 +453,4 @@ class OutboundEmailDLPRulesAPI(APIClient):
             with open(output_file, "wb") as f:
                 f.write(content)
 
-        return (content, None)
+        return (content, response, None)

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/zia/policy_export.py

@@ -41,14 +41,11 @@ class PolicyExportAPI(APIClient):
             output_file (str): Optional. If provided, the ZIP is saved to disk at this file path.
 
         Returns:
-            tuple:
-                (export_content, error)
-
-                - export_content (bytes): The raw ZIP file bytes from the server (or raw JSON if only one type).
-                - error (str): Any error message, or None on success.
+            :obj:`Tuple`: A tuple containing (export content as bytes, Response, error). The content is the raw
+            ZIP file from the server (or raw JSON if only one policy type is exported).
 
         Example:
-            >>> export_content, err = client.zia.policy_export.policy_export(
+            >>> export_content, _, err = client.zia.policy_export.policy_export(
             ...     policy_types=["BA","URL_FILTERING"],
             ...     output_file="policy_export.zip"
             ... )
@@ -76,12 +73,12 @@ class PolicyExportAPI(APIClient):
             use_raw_data_for_body=False,  # We'll let JSON be formed from the Python list
         )
         if error:
-            return (None, error)
+            return (None, None, error)
 
         # We want raw bytes so we can save them if it's a ZIP
         response, error = self._request_executor.execute(request, return_raw_response=True)
         if error:
-            return (None, f"Request failed: {error}")
+            return (None, response, error)
 
         content = response.content  # raw bytes (likely a .zip)
 
@@ -90,4 +87,4 @@ class PolicyExportAPI(APIClient):
             with open(output_file, "wb") as f:
                 f.write(content)
 
-        return (content, None)
+        return (content, response, None)

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/zia/traffic_vpn_credentials.py

@@ -331,18 +331,21 @@ class TrafficVPNCredentialAPI(APIClient):
             credential_ids (list): List containing IDs of each vpn credential that will be deleted.
 
         Returns:
-            :obj:`tuple`: Response code for operation.
+            :obj:`Tuple`: A tuple containing (None, Response, error)
 
         Examples:
-            >>> zia.traffic.bulk_delete_vpn_credentials(['94963984', '97679232'])
+            >>> _, _, err = client.zia.traffic_vpn_credentials.bulk_delete_vpn_credentials(['94963984', '97679232'])
+            ... if err:
+            ...     print(f"Error bulk deleting VPN credentials: {err}")
+            ...     return
 
         """
         # Validate input before making the request
         if not credential_ids:
-            return (None, ValueError("Empty credential_ids list provided"))
+            return (None, None, ValueError("Empty credential_ids list provided"))
 
         if len(credential_ids) > 100:
-            return (None, ValueError("Maximum 100 credential IDs allowed per bulk delete request"))
+            return (None, None, ValueError("Maximum 100 credential IDs allowed per bulk delete request"))
 
         http_method = "post".upper()
         api_url = format_url(f"""
@@ -356,12 +359,10 @@ class TrafficVPNCredentialAPI(APIClient):
             method=http_method, endpoint=api_url, body=payload, headers={}, params={}
         )
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
-
         if error:
             return (None, response, error)
 
-        # ✅ Return a 3-tuple, even if response is None (e.g., 204 No Content)
         return (None, response, None)

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/zpa/c2c_ip_ranges.py

@@ -309,7 +309,7 @@ class IPRangesAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
 

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/zpa/client_settings.py

@@ -196,7 +196,7 @@ class ClientSettingsAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
 

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/zpa/enrollment_certificates.py

@@ -335,7 +335,7 @@ class EnrollmentCertificateAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url, params=params)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
 

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/zpa/microtenants.py

@@ -134,10 +134,10 @@ class MicrotenantsAPI(APIClient):
         Returns the name and ID of the configured Microtenant.
 
         Returns:
-            :obj:`Tuple`: Microtenant: The resource record for the microtenant.
+            :obj:`Tuple`: A tuple containing (list of Microtenant instances, Response, error)
 
         Examples:
-            >>> microtenants_list, err = client.zpa.microtenants.get_microtenant_summary()
+            >>> microtenants_list, _, err = client.zpa.microtenants.get_microtenant_summary()
             ... if err:
             ...     print(f"Error listing microtenants: {err}")
             ...     return
@@ -153,20 +153,18 @@ class MicrotenantsAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
         if error:
-            return (None, error)
-
-        microtenant_list = []
-        response_body = response.get_body()
-
-        if isinstance(response_body, list):
-            for item in response_body:
-                microtenant_list.append(Microtenant(item))
+            return (None, response, error)
 
-        return (microtenant_list, None)
+        try:
+            body = response.get_body()
+            result = [Microtenant(self.form_response_body(item)) for item in body] if isinstance(body, list) else []
+        except Exception as error:
+            return (None, response, error)
+        return (result, response, None)
 
     def get_microtenant_search(self, **kwargs) -> APIResult[dict]:
         """

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/zpa/role_controller.py

@@ -350,7 +350,7 @@ class RoleControllerAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url, params=params)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
 

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/zpa/saml_attributes.py

@@ -316,7 +316,7 @@ class SAMLAttributesAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url, {})
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
 

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/zpa/user_portal_controller.py

@@ -301,7 +301,7 @@ class UserPortalControllerAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url, params=params)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
 

{zscaler_sdk_python-1.11.2 → zscaler_sdk_python-1.11.4}/zscaler/zpa/user_portal_link.py

@@ -307,7 +307,7 @@ class UserPortalLinkAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url, params=params)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)