Skip to content

Fortigate: Validate entrypoint arguments via Pydantic#2887

Open
PierrickV wants to merge 1 commit into
developfrom
fix-fortigate-guards
Open

Fortigate: Validate entrypoint arguments via Pydantic#2887
PierrickV wants to merge 1 commit into
developfrom
fix-fortigate-guards

Conversation

@PierrickV

@PierrickV PierrickV commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

What

Validate Fortigate's action arguments via Pydantic v2 models before each action runs, so missing/blank/malformed input fails immediately with a clear validation error instead of calling the API with bad data.

Changes

  • ipIPvAnyAddress (add_ip_address)
  • fqdn, nameNonEmptyStr (kept as plain non-empty strings — no built-in stricter Pydantic type exists for FQDNs/object names)

Testing

  • pytest and black pass.

@sourcery-ai

sourcery-ai Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Reviewer's Guide

Adds early argument validation guards to Fortigate actions to prevent API calls when required entrypoint parameters are missing or empty, covers them with regression tests, and bumps the module patch version with a changelog entry.

Sequence diagram for early Fortigate action argument guards

sequenceDiagram
  actor User
  participant FortigateAction

  User->>FortigateAction: run(arguments)
  alt [missing_or_empty_required_argument]
    FortigateAction->>FortigateAction: error
    FortigateAction-->>User: return None
  else [arguments_valid]
    FortigateAction-->>User: proceed with Fortigate API call
  end
Loading

File-Level Changes

Change Details Files
Add early guards for required Fortigate action arguments to avoid API calls when values are missing or empty.
  • Validate fqdn argument before proceeding in the FQDN add action and return early on missing/empty values with a clear error message.
  • Validate ip argument before proceeding in the IP address add action and return early on missing/empty values with a clear error message.
  • Validate name argument before proceeding in the address group add action and return early on missing/empty values with a clear error message.
  • Validate name argument before proceeding in the disable local user action and return early on missing/empty values with a clear error message.
Fortigate/fortigate/action_fortigate_add_fqdn.py
Fortigate/fortigate/action_fortigate_add_ip_address.py
Fortigate/fortigate/action_fortigate_add_group_address.py
Fortigate/fortigate/action_fortigate_disable_local_user.py
Add regression tests ensuring early argument validation prevents Fortigate API calls when entrypoint arguments are missing or empty.
  • Introduce parametrized tests to assert that missing or empty ip in the IP address add action results in an error and no HTTP requests.
  • Introduce parametrized tests to assert that missing or empty fqdn in the FQDN add action results in an error and no HTTP requests.
  • Introduce parametrized tests to assert that missing or empty name in the address group add action results in an error and no HTTP requests.
  • Introduce parametrized tests to assert that missing or empty name in the disable local user action results in an error and no HTTP requests.
  • Mock the error handler on the action instances and use requests_mock to assert zero outbound calls in guarded scenarios.
Fortigate/tests/test_action_fortigate_addaddress.py
Fortigate/tests/test_action_fortigate_addfqdn.py
Fortigate/tests/test_action_fortigate_addgroup.py
Fortigate/tests/test_action_fortigate_disablelocaluser.py
Update Fortigate module metadata to reflect the bugfix release.
  • Add a 1.30.1 Fixed section to the changelog describing the new guards on FQDN, IP address, local user name, and address group name arguments.
  • Update the manifest version from 1.30.0 to 1.30.1.
Fortigate/CHANGELOG.md
Fortigate/manifest.json

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've reviewed your changes and they look great!


Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@PierrickV
PierrickV requested a review from a team July 9, 2026 15:31
@PierrickV
PierrickV force-pushed the fix-fortigate-guards branch from e1d15c1 to 53814ca Compare July 10, 2026 15:00
@PierrickV

Copy link
Copy Markdown
Contributor Author

Updated this PR to use native Pydantic v2 end-to-end by upgrading sekoia-automation-sdk to 1.23.1 and aligning the module's Python requirement with the SDK (>=3.11,<3.12).

Migrated files:

  • fortigate/action_fortigate_add_ip_address.py
  • fortigate/action_fortigate_add_group_address.py
  • fortigate/action_fortigate_disable_local_user.py
  • fortigate/action_fortigate_add_fqdn.py
  • tests/test_action_fortigate_addaddress.py
  • tests/test_action_fortigate_addgroup.py
  • tests/test_action_fortigate_disablelocaluser.py
  • tests/test_action_fortigate_addfqdn.py

Validation: pytest (17 passed), mypy passed, black --check passed.

@PierrickV PierrickV changed the title Fortigate: guard against missing/empty entrypoint arguments Fortigate: Validate entrypoint arguments via Pydantic Jul 11, 2026
@PierrickV

Copy link
Copy Markdown
Contributor Author

Updated the Fortigate argument models so add_ip_address.ip now uses Pydantics IPvAnyAddress, which preserves the existing non-empty guard and also rejects invalid IP shapes like "not-an-ip" before we build the Fortigate payload. The FQDN and opaque Fortigate object/user names were kept as trimmed non-empty strings because Pydantic core does not provide a built-in FQDN type and those name fields are Fortigate-specific identifiers rather than standard network primitives.

…action

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@PierrickV
PierrickV force-pushed the fix-fortigate-guards branch from c4da5ce to a865e1c Compare July 13, 2026 07:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant