chore(test): implement unit tests

.github/workflows/test.yaml

@@ -10,11 +10,40 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: 3.x
+          cache: pip
       - name: ruff
         run: |
-          pip install -r requirements-dev.txt
+          pip install '.[test]'
           ruff format --check
           ruff check . --output-format=github
+  pytest:
+    runs-on: ubuntu-latest
+    name: Test python ${{ matrix.python-version }}
+    strategy:
+      matrix:
+        python-version:
+          - '3.9'
+          - '3.10'
+          - '3.11'
+          - '3.12'
+        experimental: [false]
+        include:
+          - python-version: '3.x'
+            experimental: true
+    continue-on-error: ${{ matrix.experimental }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: pytest
+        run: |
+          pip install '.[test]'
+          pip install pytest-github-actions-annotate-failures
+          pytest --cov --cov-fail-under=100
   shellcheck:
     runs-on: ubuntu-latest
     steps:

.gitignore

@@ -4,3 +4,4 @@ build/
 dist/
 *.spec
 .venv/
+.coverage

pyproject.toml

@@ -0,0 +1,31 @@
+[project]
+name = "signalilo-scrubbed"
+description = "Signalilo with alert scrubber included"
+version = "0.0.0"
+authors = [
+    { name = "Adfinis", email = "[email protected]" }
+]
+
+dependencies = [
+    "Flask==3.0.3",
+    "requests==2.32.3",
+    "pyinstaller==6.8.0",
+    "waitress==3.0.0",
+]
+
+[project.optional-dependencies]
+test = [
+    "ruff==0.5.0",
+    "types-waitress==3.0.0.20240423",
+    "types-requests==2.32.0.20240622",
+    "pytest==8.2.2",
+    "pytest-cov==5.0.0",
+    "requests-mock==1.12.1",
+]
+
+[tool.flit.module]
+name = "scrubbed"
+
+[build-system]
+build-backend = "flit_core.buildapi"
+requires = ["flit_core >=3.2,<4"]

scrubbed.py → scrubbed/main.py

@@ -37,9 +37,10 @@
 COMMON_ANNOTATIONS = os.environ.get("SCRUBBED_COMMON_ANNOTATIONS", "").split()
 
 # Service configuration
-HOST = os.environ.get("SCRUBBED_LISTEN_HOST", "0.0.0.0")  # noqa: S104  # listening on all instances is fine for now
+HOST = os.environ.get("SCRUBBED_LISTEN_HOST", "127.0.0.1")
 PORT = os.environ.get("SCRUBBED_LISTEN_PORT", 8080)
 URL = os.environ.get("SCRUBBED_DESTINATION_URL", "http://localhost:6725")
+TIMEOUT = 60
 
 
 def redact_fields(fields: dict[str, str], keys_to_keep: list[str]):
@@ -75,14 +76,12 @@ def webhook():
 
             logger.debug("sending: \n%s", alert)
 
-            session = requests.Session()
-
-            # Copy headers
-            session.headers.clear()
-            for h in request.headers:
-                session.headers[h] = request.headers.get(h)
-
-            r = session.post(URL, json=alert)
+            r = requests.post(
+                URL,
+                json=alert,
+                headers=request.headers,
+                timeout=TIMEOUT,
+            )
             msg = "alert received and processed"
             response = {
                 "status": "success",
@@ -108,12 +107,12 @@ def webhook():
 
 
 @app.route("/healthz")
-def health_check():
+def health_check():  # pragma: nocover
     """Endpoint for health probes."""
     return "OK", 200
 
 
-if __name__ == "__main__":
+if __name__ == "__main__":  # pragma: nocover
     from waitress import serve
 
     serve(app, host=HOST, port=PORT)

tests/test_webhook.py

@@ -0,0 +1,128 @@
+import json
+
+import pytest
+from werkzeug.test import Client
+
+from scrubbed.main import app
+
+
+@pytest.fixture()
+def client() -> Client:
+    """Test client for calling server endpoints."""
+    return Client(app)
+
+
+def test_invalid_get(client):
+    response = client.get("/webhook")
+
+    assert response.status == "405 METHOD NOT ALLOWED"
+    assert response.content_type == "text/html; charset=utf-8"
+
+
+def test_invalid_content_type(client):
+    response = client.post(
+        "/webhook", content_type="text/html", data="<h1>Hello World!</h1>"
+    )
+
+    assert response.status == "400 BAD REQUEST"
+    assert response.content_type == "application/json"
+    assert response.json.get("message") == "request must be in JSON format"
+    assert response.json.get("status") == "error"
+
+
+def test_invalid_data(client):
+    response = client.post(
+        "/webhook", content_type="application/json", data="<h1>Hello World!</h1>"
+    )
+
+    assert response.status == "500 INTERNAL SERVER ERROR"
+    assert response.content_type == "application/json"
+    assert (
+        response.json.get("message")
+        == "400 Bad Request: The browser (or proxy) sent a request that this server could not understand."  # noqa: E501
+    )
+    assert response.json.get("status") == "error"
+
+
+def test_scrubbing_alert(requests_mock, client):
+    upstream_request = requests_mock.post("http://localhost:6725")
+
+    alerts = {
+        "version": "4",
+        "groupKey": "groupkey",
+        "truncatedAlerts": 0,
+        "status": "firing",
+        "receiver": "test",
+        "groupLabels": {
+            "KEY": "SECRET",
+        },
+        "commonLabels": {
+            "KEY": "SECRET",
+        },
+        "commonAnnotations": {
+            "KEY": "SECRET",
+        },
+        "externalURL": "https://SECRET.alertmanager.example.com",
+        "alerts": [
+            {
+                "status": "firing",
+                "labels": {"KEY": "SECRET"},
+                "annotations": {"KEY": "SECRET"},
+                "startsAt": "<rfc3339>",
+                "endsAt": "<rfc3339>",
+                "generatorURL": "https://SECRET.generator.example.com",
+                "fingerprint": "fingerprint",
+            }
+        ],
+    }
+    response = client.post(
+        "/webhook",
+        content_type="application/json",
+        headers={
+            "KEY": "SECRET",
+        },
+        data=json.dumps(alerts),
+    )
+
+    assert response.status == "200 OK"
+    assert response.content_type == "application/json"
+    assert upstream_request.call_count == 1
+    assert "SECRET" not in upstream_request.last_request.text
+    assert upstream_request.last_request.json() == {
+        "version": "4",
+        "groupKey": "REDACTED",
+        "truncatedAlerts": 0,
+        "status": "firing",
+        "receiver": "test",
+        "groupLabels": {
+            "KEY": "REDACTED",
+        },
+        "commonLabels": {
+            "KEY": "REDACTED",
+        },
+        "commonAnnotations": {
+            "KEY": "REDACTED",
+        },
+        "externalURL": "REDACTED",
+        "alerts": [
+            {
+                "annotations": {
+                    "KEY": "REDACTED",
+                },
+                "endsAt": "<rfc3339>",
+                "fingerprint": "fingerprint",
+                "generatorURL": "REDACTED",
+                "labels": {
+                    "KEY": "REDACTED",
+                },
+                "startsAt": "<rfc3339>",
+                "status": "firing",
+            },
+        ],
+    }
+    assert upstream_request.last_request.headers == {
+        "Host": "localhost",
+        "Content-Type": "application/json",
+        "Content-Length": "451",
+        "Key": "SECRET",  # TODO: redact this?
+    }