test: add MaaS API key expiration tests#1292
Merged
dbasunag merged 4 commits intoopendatahub-io:mainfrom Mar 25, 2026
Merged
Conversation
Signed-off-by: Swati Mukund Bagal <sbagal@redhat.com>
|
The following are automatically added/executed:
Available user actions:
Supported labels{'/hold', '/verified', '/lgtm', '/wip', '/cherry-pick', '/build-push-pr-image'} |
for more information, see https://pre-commit.ci
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited) Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughAdds end-to-end tests and fixtures to validate MAAS API key expiration behavior, plus test utility updates to support optional Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Security notes (actionable):
🚥 Pre-merge checks | ✅ 1 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
tests/model_serving/maas_billing/maas_subscription/conftest.py (1)
52-93: Remove dead commented-out code.40+ lines of commented code adds noise. If this fix is still needed, track it in a ticket; otherwise delete.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@tests/model_serving/maas_billing/maas_subscription/conftest.py` around lines 52 - 93, Remove the large block of dead commented-out code related to the temporary maas-controller patch (the fixture maas_controller_pr498_image and its body referencing Deployment, ResourceEditor, MAAS_DB_NAMESPACE, LOGGER); simply delete the entire commented section so the file no longer contains the 40+ lines of noise—if the workaround is still required, add a reference to a tracking ticket in a short comment instead of leaving the full commented implementation.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@tests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.py`:
- Around line 111-131: The test test_create_key_without_expiration is missing an
assertion for the retrieved expiresAt value: after calling get_api_key and
assigning expires_at = get_body.get("expiresAt"), add an assertion to verify the
key has no expiration (e.g., assert expires_at is None or assert "expiresAt" not
in get_body) so the test fails when an expiresAt is present; update the
assertion message to include get_resp.status_code and get_resp.text as context
if desired.
- Around line 29-52: The tests test_create_key_within_expiration_limit and
test_create_key_at_expiration_limit create API keys via create_api_key but never
revoke them; update each test to perform cleanup by calling the existing
revoke_api_key (or switch to using the fixture create_and_yield_api_key_id) to
ensure keys are removed after assertions. Specifically, capture the created key
id from create_body.get("key") (or return value from
create_and_yield_api_key_id), call revoke_api_key with base_url, ocp_user_token,
and request_session_http in a finally block or use a fixture teardown to
guarantee revocation even on assertion failure, and remove any lingering
LOGGER-only behavior so the test always revokes the created key.
- Around line 133-155: In test_create_key_with_short_expiration update the
GET-response field checks to use the API's canonical key name: replace all uses
of "expirationDate" on get_body (the assertion and formatted failure message)
and the LOGGER.info call with "expiresAt" so the assertion reads
get_body.get("expiresAt") and the log prints get_body["expiresAt"]; the change
should be made within the test_create_key_with_short_expiration function where
get_api_key returns get_body and LOGGER.info is called.
---
Nitpick comments:
In `@tests/model_serving/maas_billing/maas_subscription/conftest.py`:
- Around line 52-93: Remove the large block of dead commented-out code related
to the temporary maas-controller patch (the fixture maas_controller_pr498_image
and its body referencing Deployment, ResourceEditor, MAAS_DB_NAMESPACE, LOGGER);
simply delete the entire commented section so the file no longer contains the
40+ lines of noise—if the workaround is still required, add a reference to a
tracking ticket in a short comment instead of leaving the full commented
implementation.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: f8c2789e-e6ef-4b24-8388-0f4a6b42e001
📒 Files selected for processing (3)
tests/model_serving/maas_billing/maas_subscription/conftest.pytests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.pytests/model_serving/maas_billing/maas_subscription/utils.py
tests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.py
Show resolved
Hide resolved
tests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.py
Show resolved
Hide resolved
tests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.py
Show resolved
Hide resolved
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (3)
tests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.py (3)
150-153:⚠️ Potential issue | 🟠 MajorUse
expiresAtconsistently in assertion and logging.Line [150]-Line [153] checks
expirationDate, while this suite/docstring expectsexpiresAt. This mismatch can fail valid responses and hide real regressions.Suggested fix
- assert get_body.get("expirationDate"), ( - f"Expected non-null 'expirationDate' for 1h key, got: {get_body.get('expirationDate')!r}" + assert get_body.get("expiresAt"), ( + f"Expected non-null 'expiresAt' for 1h key, got: {get_body.get('expiresAt')!r}" ) - LOGGER.info(f"[expiration] 1h key expirationDate={get_body['expirationDate']}") + LOGGER.info(f"[expiration] 1h key expiresAt={get_body['expiresAt']}")As per coding guidelines, prioritize “Bug-prone patterns and error handling gaps”.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@tests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.py` around lines 150 - 153, The test currently asserts and logs the wrong key name 'expirationDate' — update the assertion and the LOGGER.info call in the test (where get_body is used) to check and log the 'expiresAt' field instead (i.e., use get_body.get("expiresAt") in the assert message and get_body["expiresAt"] in the LOGGER.info) so the test and docstring/schema remain consistent with the expected response key.
29-52:⚠️ Potential issue | 🟠 MajorAdd guaranteed teardown for keys created in both limit-success tests.
Line [39] and Line [64] create real API keys but never revoke them. This leaves persistent artifacts and introduces cross-test flakiness/quota pressure. Wrap assertions in
try/finallyand revoke byidinfinally.Suggested fix
from tests.model_serving.maas_billing.maas_subscription.utils import ( assert_api_key_created_ok, create_api_key, get_api_key, + revoke_api_key, ) @@ def test_create_key_within_expiration_limit( @@ - create_resp, create_body = create_api_key( - base_url=base_url, - ocp_user_token=ocp_token_for_actor, - request_session_http=request_session_http, - api_key_name=key_name, - expires_in=f"{expires_in_hours}h", - raise_on_error=False, - ) - assert_api_key_created_ok(create_resp, create_body, required_fields=("key", "expiresAt")) - LOGGER.info( - f"[expiration] Created key within limit: expires_in={expires_in_hours}h, " - f"expiresAt={create_body.get('expiresAt')}" - ) + create_resp, create_body = create_api_key( + base_url=base_url, + ocp_user_token=ocp_token_for_actor, + request_session_http=request_session_http, + api_key_name=key_name, + expires_in=f"{expires_in_hours}h", + raise_on_error=False, + ) + key_id = create_body.get("id") + try: + assert_api_key_created_ok(create_resp, create_body, required_fields=("key", "expiresAt")) + LOGGER.info( + f"[expiration] Created key within limit: expires_in={expires_in_hours}h, " + f"expiresAt={create_body.get('expiresAt')}" + ) + finally: + if key_id: + revoke_api_key( + request_session_http=request_session_http, + base_url=base_url, + key_id=key_id, + ocp_user_token=ocp_token_for_actor, + ) @@ def test_create_key_at_expiration_limit( @@ - create_resp, create_body = create_api_key( - base_url=base_url, - ocp_user_token=ocp_token_for_actor, - request_session_http=request_session_http, - api_key_name=key_name, - expires_in=f"{expires_in_hours}h", - raise_on_error=False, - ) - assert_api_key_created_ok(create_resp, create_body, required_fields=("key", "expiresAt")) - LOGGER.info( - f"[expiration] Created key at limit: expires_in={expires_in_hours}h " - f"({MAAS_API_KEY_MAX_EXPIRATION_DAYS} days)" - ) + create_resp, create_body = create_api_key( + base_url=base_url, + ocp_user_token=ocp_token_for_actor, + request_session_http=request_session_http, + api_key_name=key_name, + expires_in=f"{expires_in_hours}h", + raise_on_error=False, + ) + key_id = create_body.get("id") + try: + assert_api_key_created_ok(create_resp, create_body, required_fields=("key", "expiresAt")) + LOGGER.info( + f"[expiration] Created key at limit: expires_in={expires_in_hours}h " + f"({MAAS_API_KEY_MAX_EXPIRATION_DAYS} days)" + ) + finally: + if key_id: + revoke_api_key( + request_session_http=request_session_http, + base_url=base_url, + key_id=key_id, + ocp_user_token=ocp_token_for_actor, + )As per coding guidelines, prioritize “Bug-prone patterns and error handling gaps”.
Also applies to: 54-77
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@tests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.py` around lines 29 - 52, The test test_create_key_within_expiration_limit creates a real API key via create_api_key and never revokes it; wrap the assertion and subsequent logic in a try/finally so the created key is always cleaned up: capture the new key's id from create_body.get("id") (or create_body["id"]) after create_api_key, perform assertions inside try, and in finally call the existing revoke/delete helper (e.g., revoke_api_key or the HTTP DELETE using request_session_http and base_url with ocp_token_for_actor) to revoke the key by id; apply the same try/finally teardown pattern to the other similar test that creates a key (the test in the 54-77 range).
111-131:⚠️ Potential issue | 🟠 MajorAssert the no-expiration contract explicitly.
Line [128] reads
expiresAtbut the test never validates it. This test currently passes even when expiration is unexpectedly set.Suggested fix
expires_at = get_body.get("expiresAt") + assert expires_at is None, ( + f"Expected 'expiresAt' to be None/absent for key without expiration, " + f"got {expires_at!r}; status={get_resp.status_code}, body={get_resp.text[:200]}" + ) LOGGER.info(f"[expiration] Key without expiration field: expiresAt={expires_at!r}")As per coding guidelines, prioritize “Bug-prone patterns and error handling gaps”.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@tests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.py` around lines 111 - 131, The test test_create_key_without_expiration currently reads expires_at from the GET response but never asserts it; update the test to explicitly assert the no-expiration contract by checking the GET response body from get_api_key (refer to get_api_key, test_create_key_without_expiration, and the expires_at local variable) and assert that expires_at is either None or the "expiresAt" key is absent, with a clear failure message so the test fails if an unexpected expiration is present.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In
`@tests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.py`:
- Around line 150-153: The test currently asserts and logs the wrong key name
'expirationDate' — update the assertion and the LOGGER.info call in the test
(where get_body is used) to check and log the 'expiresAt' field instead (i.e.,
use get_body.get("expiresAt") in the assert message and get_body["expiresAt"] in
the LOGGER.info) so the test and docstring/schema remain consistent with the
expected response key.
- Around line 29-52: The test test_create_key_within_expiration_limit creates a
real API key via create_api_key and never revokes it; wrap the assertion and
subsequent logic in a try/finally so the created key is always cleaned up:
capture the new key's id from create_body.get("id") (or create_body["id"]) after
create_api_key, perform assertions inside try, and in finally call the existing
revoke/delete helper (e.g., revoke_api_key or the HTTP DELETE using
request_session_http and base_url with ocp_token_for_actor) to revoke the key by
id; apply the same try/finally teardown pattern to the other similar test that
creates a key (the test in the 54-77 range).
- Around line 111-131: The test test_create_key_without_expiration currently
reads expires_at from the GET response but never asserts it; update the test to
explicitly assert the no-expiration contract by checking the GET response body
from get_api_key (refer to get_api_key, test_create_key_without_expiration, and
the expires_at local variable) and assert that expires_at is either None or the
"expiresAt" key is absent, with a clear failure message so the test fails if an
unexpected expiration is present.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 94bbe35c-da7e-48dc-86d8-b2a77f481556
📒 Files selected for processing (1)
tests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.py
dbasunag
requested changes
Mar 24, 2026
tests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.py
Show resolved
Hide resolved
tests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.py
Show resolved
Hide resolved
tests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.py
Show resolved
Hide resolved
Signed-off-by: Swati Mukund Bagal <sbagal@redhat.com>
mwaykole
reviewed
Mar 25, 2026
tests/model_serving/maas_billing/maas_subscription/test_api_key_expiration.py
Show resolved
Hide resolved
dbasunag
approved these changes
Mar 25, 2026
Member
|
/lgtm |
rhods-ci-bot
approved these changes
Mar 25, 2026
|
Status of building tag latest: success. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
Summary
add MaaS API key expiration tests
Related Issues
How it has been tested
Additional Requirements
Summary by CodeRabbit