mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-11-09 12:49:27 +00:00
Lydia Vilchez
2f91cf430b
Address Hugo's four review comments on the certificate authentication work: 1. `AzureProvider.__init__` and `AzureProvider.validate_static_credentials` inserted the certificate kwargs between existing positional parameters. A caller that previously passed `resource_groups` or `region_config` positionally would silently rebind their argument to a certificate flag. Both signatures now keep the pre-existing positional layout and mark only the certificate kwargs as keyword-only. 2. `verify_client`'s certificate path used to catch `ServiceRequestError` directly from `credential.get_token()`, but `azure.identity` wraps `_request_token` with `wrap_exceptions`, so a real connect or read timeout arrived here as `ClientAuthenticationError` and was reported to the user as an invalid certificate. Catch `ClientAuthenticationError` and walk `__cause__`/`__context__` via the new `_find_transport_cause`: a `ServiceRequestError` or `ServiceResponseError` cause maps to `AzureCredentialsUnavailableError`; anything else keeps the invalid certificate mapping. Pass `retry_total=0` so Azure Core cannot multiply the effective deadline, and close the transient credential in `finally`, logging and swallowing cleanup failures so `close()` cannot replace the primary typed exception. 3. Rewrite the certificate timeout tests to exercise the real `CertificateCredential` and `RequestsTransport` pipeline, stubbing only `requests.Session.request` with `ConnectTimeout` and `ReadTimeout`. Assert `session.request.call_count == 1` to prove `retry_total=0` is honoured, cover `test_connection(..., raise_on_exception=False)`, and add a cleanup-failure case proving `close()` cannot mask the typed error. 4. Add `inspect.signature(...).bind(...)` regressions for `__init__`, `test_connection` and `validate_static_credentials` using the pre-existing positional call shape, asserting the certificate kwargs are `KEYWORD_ONLY`.