mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Marius CiepluchandClaude Opus 4.8
b5e40318db
Release-readiness hardening. - redaction.py (zero-dep): redact_secrets masks provider API keys, AWS/GitHub/Slack/ Google tokens, bearer tokens, URL-embedded credentials, PEM private keys, and sensitive key=value assignments. Wired into the trace writer and the markdown report (on by default), so scan artifacts never leak a credential quoted from source. - provider/openrouter.py: call_with_retry — exponential backoff on transient failures (HTTP 429/5xx, connection errors, timeouts); non-transient errors fail fast. Both the chat and embedding clients use it (max_attempts/retry_base_delay configurable). - config [hardening]: redact_secrets (default true) + max_findings (bounded-CI output cap, 0 = unlimited; truncation is severity-ordered and disclosed as a `budget` degradation). Agentic spend stays bounded by [harnessx] max_cost_usd/token_threshold. - docs/threat-model.md (trust boundaries, controls, sandbox limits) + docs/examples.md (six end-to-end walkthroughs); README "Security & hardening" section links both. - CI lint/typecheck/test/detection-gate/dagger gates already existed. tests/test_redaction.py, test_provider_retry.py, test_hardening_pipeline.py + config tests. 206 passed, 4 skipped; ruff + mypy clean; detection gate PASS. Co-Authored-By: Claude Opus 4.8 <[email protected]>
66 lines
2.0 KiB
Python
66 lines
2.0 KiB
Python
"""Provider retry/backoff policy (Phase 15)."""
|
|
|
|
import urllib.error
|
|
|
|
import pytest
|
|
|
|
from openultrasast.provider.openrouter import OpenRouterError, call_with_retry
|
|
|
|
|
|
class _Counter:
|
|
def __init__(self, fail_times: int, exc: Exception) -> None:
|
|
self.calls = 0
|
|
self._fail_times = fail_times
|
|
self._exc = exc
|
|
|
|
def __call__(self) -> str:
|
|
self.calls += 1
|
|
if self.calls <= self._fail_times:
|
|
raise self._exc
|
|
return "ok"
|
|
|
|
|
|
def _no_sleep(_seconds: float) -> None:
|
|
return None
|
|
|
|
|
|
def test_retries_transient_then_succeeds() -> None:
|
|
op = _Counter(2, TimeoutError("slow"))
|
|
assert call_with_retry(op, attempts=3, base_delay=0, sleep=_no_sleep) == "ok"
|
|
assert op.calls == 3
|
|
|
|
|
|
def test_retries_transient_http_5xx() -> None:
|
|
op = _Counter(1, urllib.error.HTTPError("u", 503, "busy", {}, None)) # type: ignore[arg-type]
|
|
assert call_with_retry(op, attempts=3, base_delay=0, sleep=_no_sleep) == "ok"
|
|
assert op.calls == 2
|
|
|
|
|
|
def test_does_not_retry_non_transient_http_4xx() -> None:
|
|
op = _Counter(5, urllib.error.HTTPError("u", 400, "bad", {}, None)) # type: ignore[arg-type]
|
|
with pytest.raises(urllib.error.HTTPError):
|
|
call_with_retry(op, attempts=3, base_delay=0, sleep=_no_sleep)
|
|
assert op.calls == 1 # tried once, not retried
|
|
|
|
|
|
def test_raises_after_exhausting_attempts() -> None:
|
|
op = _Counter(10, TimeoutError("slow"))
|
|
with pytest.raises(TimeoutError):
|
|
call_with_retry(op, attempts=3, base_delay=0, sleep=_no_sleep)
|
|
assert op.calls == 3
|
|
|
|
|
|
def test_backoff_is_exponential() -> None:
|
|
delays: list[float] = []
|
|
op = _Counter(2, urllib.error.URLError("reset"))
|
|
call_with_retry(op, attempts=3, base_delay=0.5, sleep=delays.append)
|
|
assert delays == [0.5, 1.0] # 0.5 * 2**0, 0.5 * 2**1
|
|
|
|
|
|
def test_non_retryable_value_error_propagates_immediately() -> None:
|
|
def op() -> str:
|
|
raise OpenRouterError("not network")
|
|
|
|
with pytest.raises(OpenRouterError):
|
|
call_with_retry(op, attempts=3, base_delay=0, sleep=_no_sleep)
|