Add unit tests for osism/api.py helpers and Pydantic models

[berendt]

Adds tests/unit/test_api_helpers.py covering the module-level helpers and Pydantic models of the OSISM API server (osism/api.py), as specified in #2359:

• _mask_inventory_secrets() — secret-key matching (password/secret substrings, ironic_osism_ prefix, using the real _is_secret_key), Ansible Vault values (including leading whitespace, and the marker mid-string staying unchanged), nested dict recursion, secret keys with dict values masked as a whole, pass-through of non-dict/non-string values and non-string keys, non-traversal of lists, empty dict, input immutability.
• find_device_by_identifier() — lookup precedence name → cf_inventory_hostname → serial with call-order assertions, early None return without a NetBox connection, first-match semantics for multiple results. utils.nb is injected via patch.dict("osism.utils.__dict__", ...) to avoid triggering the lazy module __getattr__, matching the existing pattern in tests/unit/commands/.
• process_netbox_webhook() — reconciler.run.delay() dispatched exactly once for managed servers; no dispatch for switches, interfaces (device fetched via nb.dcim.devices.get(id=...), asserted), device_type fallback to "node", unknown URLs (early return without NetBox access), and unmanaged devices; KeyError propagation for payloads without url/name.
• LogConfig — defaults, model_dump() structure (formatter, StreamHandler on ext://sys.stderr, all five loggers), dictConfig compatibility.
• Pydantic models — NotificationBaremetal and WebhookNetboxData validation and coercion (UUID, datetime, per-field required checks), BaremetalNode optional fields and default_factory independence, all-optional models, and parametrized required-field enforcement plus model_dump() round trips for the response models, including dict-to-BaremetalNodeNetboxInfo coercion and Any-typed value fields.

Endpoint behavior (HTTP status codes, masking applied in responses) is out of scope here and belongs to the companion endpoint issue (Tier 7, split 2/2).

Closes #2359

🤖 Generated with Claude Code

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

Dismissing — this was meant to be a pending/draft review, not a submitted one. Reposting as a draft.

[ideaship]

This test asserts, as expected behavior, that a secret nested inside a list is returned unmasked:

data = {"hosts": [{"db_password": "hunter2"}]}
assert api._mask_inventory_secrets(data) == {"hosts": [{"db_password": "hunter2"}]}

That codifies a production leak. _mask_inventory_secrets (osism/api.py:35-51) recurses into dict but has no list branch, and it masks the ansible-inventory --host output returned by the API at api.py:833, 903, and 1104. Ansible hostvars routinely contain lists of dicts (e.g. users: [{name: admin, password: ...}]), so any secret nested in a list is returned verbatim through /hostvars and the search endpoints — the masking layer that exists to prevent exactly this is silently bypassed.

The sibling masker _mask_secrets_inplace (osism/tasks/conductor/utils.py:314-320) already has an isinstance(obj, list) branch, so the missing list handling here is an oversight, not an intentional design choice.

Fix _mask_inventory_secrets to traverse lists (mirroring _mask_secrets_inplace), and flip this assertion to expect {"hosts": [{"db_password": "***"}]}. Keep the production fix in its own commit, separate from the test changes. As written, the test would actively resist that fix.