test: add unit tests for aws sdk service client#1240
test: add unit tests for aws sdk service client#1240muddlebee merged 2 commits intoTracer-Cloud:mainfrom
Conversation
Greptile SummaryThis PR adds a new offline unit test suite ( Confidence Score: 4/5Safe to merge; only P2 style issues found, no logic errors or runtime failures. All test assertions match the source implementation correctly. Two P2 style findings (misleading variable name and magic numbers) do not affect test correctness or safety. No P0/P1 issues present. No files require special attention. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[execute_aws_sdk_call] --> B{service/op empty?}
B -- yes --> ERR1[return success=False\nrequired fields missing]
B -- no --> C{_is_operation_allowed}
C --> D{blocklist match?}
D -- yes --> ERR2[return success=False\nblocked pattern]
D -- no --> E{allowlist match?}
E -- no --> ERR3[return success=False\nno allowed pattern]
E -- yes --> F[boto3.client]
F -- NoCredentialsError --> ERR4[return success=False\ncredentials]
F --> G{hasattr client op?}
G -- no --> ERR5[return success=False\nop not found]
G -- yes --> H[call operation]
H -- ParamValidationError --> ERR6[return success=False\nvalidation]
H -- ClientError --> ERR7[return success=False\nclient_error]
H -- Exception --> ERR8[return success=False\nunexpected]
H -- success --> I[_sanitize_response]
I --> J[return success=True\nwith sanitized data]
Reviews (1): Last reviewed commit: "add direct unit tests for aws sdk client..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
@muddlebee Could you take a look? There hasn’t been a PR for this in about a week, so I went ahead and started working on it. |
|
🚀 Houston, we have a merge. @4arjun your PR is in orbit. Thanks for launching this one!
👋 Join us on Discord - OpenSRE : hang out, contribute, or hunt for features and issues. Everyone's welcome. |
|
@4arjun thank you. Welcome to opensre. |
2 participants
Fixes #884
Describe the changes you have made in this PR -
This PR adds offline unit tests for
app/services/aws_sdk_client.py, which acts as the critical safety boundary for the generic read-only AWS tool.The tests cover:
describe_,list_,get_(etc.) operations are permitted, and explicitly verifies that destructive operations (e.g.,delete_,terminate_,modify_) are blocked even if they match an allowed prefix._sanitize_response()confirming that datetimes are converted to ISO strings, binary bytes are replaced with safe placeholders, deep recursive nesting is caught to prevent stack overflows, and oversized lists are truncated.execute_aws_sdk_call()using a fakeboto3client to simulate happy paths, credential failures (NoCredentialsError), parameter validation failures (ParamValidationError), and generic API client errors. All tests are 100% offline.Demo/Screenshot for feature changes and bug fixes -
Code Understanding and AI Usage
Did you use AI assistance (ChatGPT, Claude, Copilot, etc.) to write any part of this code?
If you used AI assistance:
Explain your implementation approach:
What problem does your code solve? The
aws_sdk_client.pymodule acts as the primary safety boundary for our generic AWS tool. Because this client is generic, it lacked direct, offline unit tests to mathematically guarantee that dangerous operations are never executed and that excessively large payloads don't crash the agent.Why did you choose this specific implementation? I chose standard pytest parametrization and
unittest.mock.MagicMockto fully isolate the boto3 client. This guarantees the tests remain 100% offline without hitting live AWS endpoints, executing rapidly as regression tests.What are the key functions/components and what do they do?
TestIsOperationAllowedAllowlistandTestIsOperationAllowedBlocklistEvaluate string matching to ensure destructive operations are preemptively blocked.TestSanitizeResponse*Tests bounds limits like depth recursion cutoffs, list truncations, and type casting.TestExecuteAwsSdkCall*: Mocks the boto3 client to force various botocore.exceptions (like NoCredentialsError and ParamValidationError) to ensure our client handles downstream exceptions cleanly.Checklist before requesting a review
Note: Please check Allow edits from maintainers if you would like us to assist in the PR.