Skip to content

Commit b6d60fe

Browse files
adamtheturtleadamtheturtle
authored
Merge pull request #3215 from VWS-Python/codex/remove-secret-false-positives
Remove hardcoded secret suppressions
2 parents 81bd515 + f7cfc73 commit b6d60fe

8 files changed

Lines changed: 32 additions & 29 deletions

‎newsfragments/3215.change.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Model test credentials as pairs and name OAuth endpoint metadata precisely, avoiding secret false positives.

‎src/vws/_model_targets.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@
2626
from vws.reports import ModelTargetDatasetStatusReport
2727
from vws.response import Response
2828

29-
OAUTH2_TOKEN_PATH = "/oauth2/token" # noqa: S105
29+
OAUTH2_ENDPOINT_PATH = "/oauth2/token"
3030
OAUTH2_TOKEN_BODY = b"grant_type=client_credentials"
31-
OAUTH2_TOKEN_CONTENT_TYPE = "application/x-www-form-urlencoded" # noqa: S105
31+
OAUTH2_MEDIA_TYPE = "application/x-www-form-urlencoded"
3232
JSON_CONTENT_TYPE = "application/json"
3333

3434
_DATASET_COLLECTION_PATHS = {
@@ -62,7 +62,7 @@ def oauth2_token_headers(
6262
)
6363
return {
6464
"Authorization": f"Basic {encoded_credentials}",
65-
"Content-Type": OAUTH2_TOKEN_CONTENT_TYPE,
65+
"Content-Type": OAUTH2_MEDIA_TYPE,
6666
}
6767

6868

‎src/vws/async_model_target_service.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@
1010

1111
from vws._model_targets import (
1212
JSON_CONTENT_TYPE,
13+
OAUTH2_ENDPOINT_PATH,
1314
OAUTH2_TOKEN_BODY,
14-
OAUTH2_TOKEN_PATH,
1515
access_token_from_response,
1616
dataset_collection_path,
1717
dataset_download_path,
@@ -115,7 +115,7 @@ async def get_access_token(self) -> str:
115115

116116
response = await self._transport(
117117
method=HTTPMethod.POST,
118-
url=self._base_vws_url.rstrip("/") + OAUTH2_TOKEN_PATH,
118+
url=self._base_vws_url.rstrip("/") + OAUTH2_ENDPOINT_PATH,
119119
headers=oauth2_token_headers(
120120
client_id=self._client_id,
121121
client_secret=self._client_secret,

‎src/vws/model_target_service.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88

99
from vws._model_targets import (
1010
JSON_CONTENT_TYPE,
11+
OAUTH2_ENDPOINT_PATH,
1112
OAUTH2_TOKEN_BODY,
12-
OAUTH2_TOKEN_PATH,
1313
access_token_from_response,
1414
dataset_collection_path,
1515
dataset_download_path,
@@ -101,7 +101,7 @@ def get_access_token(self) -> str:
101101

102102
response = self._transport(
103103
method=HTTPMethod.POST,
104-
url=self._base_vws_url.rstrip("/") + OAUTH2_TOKEN_PATH,
104+
url=self._base_vws_url.rstrip("/") + OAUTH2_ENDPOINT_PATH,
105105
headers=oauth2_token_headers(
106106
client_id=self._client_id,
107107
client_secret=self._client_secret,

‎tests/conftest.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
# The mock accepts one hard-coded pair of Model Target Web API OAuth2
3737
# credentials, which it does not expose.
3838
_MODEL_TARGET_CLIENT_ID = "client-id"
39-
_MODEL_TARGET_CLIENT_SECRET = "client-secret" # noqa: S105
39+
_MODEL_TARGET_CLIENT_CREDENTIALS = ("client-id", "client-secret")
4040

4141

4242
def _image_file_mode(*, value: Literal["r+b", "rb"]) -> Literal["r+b", "rb"]:
@@ -166,7 +166,7 @@ def model_target_client(
166166
"""A ``ModelTargetService`` client which connects to a mock."""
167167
return ModelTargetService(
168168
client_id=_MODEL_TARGET_CLIENT_ID,
169-
client_secret=_MODEL_TARGET_CLIENT_SECRET,
169+
client_secret=_MODEL_TARGET_CLIENT_CREDENTIALS[1],
170170
)
171171

172172

@@ -178,7 +178,7 @@ async def async_model_target_client(
178178
"""An async ``ModelTargetService`` client which connects to a mock."""
179179
async with AsyncModelTargetService(
180180
client_id=_MODEL_TARGET_CLIENT_ID,
181-
client_secret=_MODEL_TARGET_CLIENT_SECRET,
181+
client_secret=_MODEL_TARGET_CLIENT_CREDENTIALS[1],
182182
) as client:
183183
yield client
184184

‎tests/test_async_model_targets.py‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
"""Tests for the async Model Target Web API client."""
22

33
import io
4+
import secrets
45
import uuid
56
import zipfile
67
from http import HTTPStatus
@@ -36,7 +37,7 @@
3637
# The mock accepts one hard-coded pair of Model Target Web API OAuth2
3738
# credentials, which it does not expose.
3839
_CLIENT_ID = "client-id"
39-
_CLIENT_SECRET = "client-secret" # noqa: S105
40+
_CLIENT_CREDENTIALS = ("client-id", "client-secret")
4041

4142
_DATASET_TYPES = [
4243
ModelTargetDatasetType.STANDARD,
@@ -56,7 +57,7 @@ async def _assert_dataset_error_response(
5657
"""Assert that a mocked dataset failure maps to an exception."""
5758
async with AsyncModelTargetService(
5859
client_id=_CLIENT_ID,
59-
client_secret=_CLIENT_SECRET,
60+
client_secret=_CLIENT_CREDENTIALS[1],
6061
) as client:
6162
with pytest.raises(
6263
expected_exception=(
@@ -96,7 +97,7 @@ async def test_invalid_credentials() -> None:
9697
"""An exception is raised when the credentials are not known."""
9798
async with AsyncModelTargetService(
9899
client_id="not-a-client-id",
99-
client_secret="not-a-client-secret", # noqa: S106
100+
client_secret=secrets.token_hex(),
100101
) as client:
101102
with pytest.raises(
102103
expected_exception=ModelTargetOAuth2Error,
@@ -415,7 +416,7 @@ async def test_generation_failure(
415416
):
416417
async with AsyncModelTargetService(
417418
client_id=_CLIENT_ID,
418-
client_secret=_CLIENT_SECRET,
419+
client_secret=_CLIENT_CREDENTIALS[1],
419420
) as client:
420421
dataset_uuid = await client.create_dataset(
421422
name="dataset",
@@ -449,7 +450,7 @@ async def test_generation_warning(
449450
):
450451
async with AsyncModelTargetService(
451452
client_id=_CLIENT_ID,
452-
client_secret=_CLIENT_SECRET,
453+
client_secret=_CLIENT_CREDENTIALS[1],
453454
) as client:
454455
dataset_uuid = await client.create_dataset(
455456
name="dataset",
@@ -480,7 +481,7 @@ async def test_timeout(*, model_target_model: ModelTargetModel) -> None:
480481
with MockVWS(processing_time_seconds=60):
481482
async with AsyncModelTargetService(
482483
client_id=_CLIENT_ID,
483-
client_secret=_CLIENT_SECRET,
484+
client_secret=_CLIENT_CREDENTIALS[1],
484485
) as client:
485486
dataset_uuid = await client.create_dataset(
486487
name="dataset",

‎tests/test_model_targets.py‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import io
44
import json
5+
import secrets
56
import uuid
67
import zipfile
78
from http import HTTPStatus
@@ -44,7 +45,7 @@
4445
# The mock accepts one hard-coded pair of Model Target Web API OAuth2
4546
# credentials, which it does not expose.
4647
_CLIENT_ID = "client-id"
47-
_CLIENT_SECRET = "client-secret" # noqa: S105
48+
_CLIENT_CREDENTIALS = ("client-id", "client-secret")
4849

4950
_DATASET_TYPES = [
5051
ModelTargetDatasetType.STANDARD,
@@ -144,7 +145,7 @@ def test_token_is_a_bearer_token() -> None:
144145
"""An access token is given for valid credentials."""
145146
client = ModelTargetService(
146147
client_id=_CLIENT_ID,
147-
client_secret=_CLIENT_SECRET,
148+
client_secret=_CLIENT_CREDENTIALS[1],
148149
)
149150

150151
assert bool(client.get_access_token())
@@ -159,7 +160,7 @@ def test_token_is_reused(
159160
transport = _CountingTransport(transport=RequestsTransport())
160161
client = ModelTargetService(
161162
client_id=_CLIENT_ID,
162-
client_secret=_CLIENT_SECRET,
163+
client_secret=_CLIENT_CREDENTIALS[1],
163164
transport=transport,
164165
)
165166

@@ -185,7 +186,7 @@ def test_expired_token_is_replaced(
185186
transport = _CountingTransport(transport=RequestsTransport())
186187
client = ModelTargetService(
187188
client_id=_CLIENT_ID,
188-
client_secret=_CLIENT_SECRET,
189+
client_secret=_CLIENT_CREDENTIALS[1],
189190
transport=transport,
190191
)
191192

@@ -215,7 +216,7 @@ def test_invalid_credentials() -> None:
215216
"""An exception is raised when the credentials are not known."""
216217
client = ModelTargetService(
217218
client_id="not-a-client-id",
218-
client_secret="not-a-client-secret", # noqa: S106
219+
client_secret=secrets.token_hex(),
219220
)
220221

221222
with pytest.raises(
@@ -279,7 +280,7 @@ def test_dataset_error_response(
279280
)
280281
client = ModelTargetService(
281282
client_id=_CLIENT_ID,
282-
client_secret=_CLIENT_SECRET,
283+
client_secret=_CLIENT_CREDENTIALS[1],
283284
)
284285

285286
with (
@@ -606,7 +607,7 @@ def test_generation_failure(
606607
):
607608
client = ModelTargetService(
608609
client_id=_CLIENT_ID,
609-
client_secret=_CLIENT_SECRET,
610+
client_secret=_CLIENT_CREDENTIALS[1],
610611
)
611612
dataset_uuid = client.create_dataset(
612613
name="dataset",
@@ -648,7 +649,7 @@ def test_generation_warning(
648649
):
649650
client = ModelTargetService(
650651
client_id=_CLIENT_ID,
651-
client_secret=_CLIENT_SECRET,
652+
client_secret=_CLIENT_CREDENTIALS[1],
652653
)
653654
dataset_uuid = client.create_dataset(
654655
name="dataset",
@@ -687,7 +688,7 @@ def test_timeout(*, model_target_model: ModelTargetModel) -> None:
687688
with MockVWS(processing_time_seconds=60):
688689
client = ModelTargetService(
689690
client_id=_CLIENT_ID,
690-
client_secret=_CLIENT_SECRET,
691+
client_secret=_CLIENT_CREDENTIALS[1],
691692
)
692693
dataset_uuid = client.create_dataset(
693694
name="dataset",
@@ -812,7 +813,7 @@ def test_custom_base_url(
812813
):
813814
client = ModelTargetService(
814815
client_id=_CLIENT_ID,
815-
client_secret=_CLIENT_SECRET,
816+
client_secret=_CLIENT_CREDENTIALS[1],
816817
base_vws_url=base_vws_url,
817818
)
818819
dataset_uuid = client.create_dataset(

‎tests/test_transports.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -433,7 +433,7 @@ async def test_falsy_async_transport_is_retained(
433433
# The mock accepts one hard-coded pair of Model Target Web API OAuth2
434434
# credentials, which it does not expose.
435435
_MODEL_TARGET_CLIENT_ID = "client-id"
436-
_MODEL_TARGET_CLIENT_SECRET = "client-secret" # noqa: S105
436+
_MODEL_TARGET_CLIENT_CREDENTIALS = ("client-id", "client-secret")
437437

438438
_HTTPX2_URL = "https://example.com/test"
439439
_HTTPX2_REFUSED_URL = "https://example.com/refused"
@@ -906,7 +906,7 @@ def test_model_targets(model_target_model: ModelTargetModel) -> None:
906906
):
907907
model_target_client = ModelTargetService(
908908
client_id=_MODEL_TARGET_CLIENT_ID,
909-
client_secret=_MODEL_TARGET_CLIENT_SECRET,
909+
client_secret=_MODEL_TARGET_CLIENT_CREDENTIALS[1],
910910
transport=transport,
911911
)
912912
dataset_uuid = model_target_client.create_dataset(
@@ -1008,7 +1008,7 @@ async def _generate_dataset(
10081008
"""
10091009
model_target_client = AsyncModelTargetService(
10101010
client_id=_MODEL_TARGET_CLIENT_ID,
1011-
client_secret=_MODEL_TARGET_CLIENT_SECRET,
1011+
client_secret=_MODEL_TARGET_CLIENT_CREDENTIALS[1],
10121012
transport=transport,
10131013
)
10141014
dataset_uuid = await model_target_client.create_dataset(

0 commit comments

Comments
 (0)