(tooling-trusted-releases) branch sbp updated: Omit LDAP details from error responses

[sb...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sbp pushed a commit to branch sbp
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git


The following commit(s) were added to refs/heads/sbp by this push:
     new bac86f6b Omit LDAP details from error responses
bac86f6b is described below

commit bac86f6b4f66fef3b038ff505325e99c605a8ae6
Author: Sean B. Palmer <se...@miscoranda.com>
AuthorDate: Thu Oct 1 16:19:37 2026 +0100

    Omit LDAP details from error responses
---
 atr/principal.py        |  4 +---
 tests/unit/test_ldap.py | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/atr/principal.py b/atr/principal.py
index 753cd8cd..170ec769 100644
--- a/atr/principal.py
+++ b/atr/principal.py
@@ -157,9 +157,7 @@ class Committer:
             raise
         except Exception as ex:
             log.exception(f"An unknown error occurred while fetching group memberships from {ldap_base}: {ex!s}")
-            raise CommitterError(
-                f"An unknown error occurred while fetching group memberships from {ldap_base}."
-            ) from ex
+            raise CommitterError("An unknown error occurred while fetching group memberships.") from None
 
         members = getattr(result[0], attribute)
         if len(members) < min_members:
diff --git a/tests/unit/test_ldap.py b/tests/unit/test_ldap.py
index b9d4b268..488a1d18 100644
--- a/tests/unit/test_ldap.py
+++ b/tests/unit/test_ldap.py
@@ -23,7 +23,9 @@ import ldap3.core.exceptions
 import pytest
 
 import atr.cache as cache
+import atr.errors as errors
 import atr.ldap as ldap
+import atr.principal as principal
 
 if TYPE_CHECKING:
     from pytest import MonkeyPatch
@@ -182,6 +184,24 @@ async def test_github_to_apache_raises_when_ldap_unavailable(monkeypatch: "Monke
         await ldap.github_to_apache(12345)
 
 
+def test_group_membership_error_hides_ldap_base(monkeypatch: "MonkeyPatch"):
+    ldap_base = principal.LDAP_MEMBER_BASE
+    error = RuntimeError(f"Search failed at {ldap_base}")
+    ldap_search = mock.Mock(spec=ldap.Search)
+    ldap_search.search.side_effect = error
+    logged = mock.Mock()
+    monkeypatch.setattr(principal.log, "exception", logged)
+    committer = object.__new__(principal.Committer)
+
+    with pytest.raises(principal.CommitterError) as raised:
+        committer._get_group_membership(ldap_search, ldap_base, "member_uid")
+
+    assert ldap_base not in errors.traceback_text(raised.value)
+    logged.assert_called_once_with(
+        f"An unknown error occurred while fetching group memberships from {ldap_base}: {error}"
+    )
+
+
 @pytest.mark.asyncio
 async def test_handle_update_handles_invalid_payload():
     detail = await ldap.handle_update({"not": "valid"})


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org