Skip to content

Add paramters for api_key and basic_auth, resolves #327#869

Open
hmaerki wants to merge 3 commits intodbfixtures:mainfrom
hmaerki:add_authentication
Open

Add paramters for api_key and basic_auth, resolves #327#869
hmaerki wants to merge 3 commits intodbfixtures:mainfrom
hmaerki:add_authentication

Conversation

@hmaerki
Copy link
Copy Markdown
Contributor

@hmaerki hmaerki commented Feb 26, 2026

Add paramters for api_key and basic_auth

This PR allows to provide api_key or basic_auth:

es_external = factories.elasticsearch_noproc(
    host="localhost",
    port=9200,
    basic_auth=("elastic", "<your_password>"),
)
elasticsearch = factories.elasticsearch("es_external")

It is also possible to specify it in pyproject.toml / pytest.ini:

[tool.pytest]
elasticsearch_host="localhost"
elasticsearch_port="9200"
elasticsearch_basic_auth="elastic:<your_password>"

Implementation

  • Added parameters for factories.elasticsearch_noproc
  • Added options and command line parameters
  • Updated README.rst

Testing

Tested both variants (pyproject.toml / fixture) and basic_auth/api_key against the reference docker-container https://www.elastic.co/docs/deploy-manage/deploy/self-managed/local-development-installation-quickstart.

Notes

This resolves #327.

Summary by CodeRabbit

  • New Features

    • Added API key and basic authentication (username:password) support for configuring Elasticsearch connections.
    • Authentication and related options (basic auth, API key, request timeout, verify certs) available via CLI flags, pytest.ini and fixture parameters.
    • Exposed an additional top-level Elasticsearch fixture for convenience.
  • Documentation

    • Updated README with configuration examples and guidance for the new authentication options.

@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Feb 26, 2026

Important

Review skipped

This PR was authored by the user configured for CodeRabbit reviews. By default, CodeRabbit skips reviewing PRs authored by this user. It's recommended to use a dedicated user account to post CodeRabbit review feedback.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • ✅ Review completed - (🔄 Check again to review again)
📝 Walkthrough

Walkthrough

The pull request adds authentication support to pytest-elasticsearch by introducing api_key and basic_auth parameters across the configuration layer, plugin options, executor, and client factory. Changes thread these parameters from CLI/INI configuration through fixture instantiation to Elasticsearch client creation.

Changes

Cohort / File(s) Summary
Plugin Configuration
pytest_elasticsearch/plugin.py
Added CLI and INI options for --elasticsearch-api-key and --elasticsearch-basic-auth with corresponding help text and configuration bindings. Introduced new public module-level elasticsearch binding for proc factory.
Configuration Schema
pytest_elasticsearch/config.py
Added `api_key: str
Executor and Fixtures
pytest_elasticsearch/executor.py, pytest_elasticsearch/factories/noprocess.py, pytest_elasticsearch/factories/client.py
Updated NoopElasticsearch constructor to accept api_key, basic_auth, request_timeout, and verify_certs parameters. Extended elasticsearch_noproc fixture signature to accept these parameters with logic for parsing basic_auth string format. Modified client factory to conditionally pass authentication parameters to Elasticsearch client based on process type.
Documentation
README.rst, newsfragments/869.feature.rst
Updated README with authentication configuration examples, expanded configuration table with api_key and basic_auth options, and added feature news fragment.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

  • PR #859: Modifies the elasticsearch_noproc fixture default port behaviour; both PRs touch the same fixture signature and parameter handling in pytest_elasticsearch/factories/noprocess.py.

Poem

🐰 A furry friend hops with delight,
Authentication flows, credentials done right!
Basic auth and API keys now dance,
Through fixtures and configs, a secure stance!
The rabbit rejoices—no secrets exposed! ✨

🚥 Pre-merge checks | ✅ 6
✅ Passed checks (6 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarises the main change: adding parameters for api_key and basic_auth authentication support, and references the resolved issue #327.
Linked Issues check ✅ Passed The pull request fully addresses issue #327 by implementing api_key and basic_auth parameters across fixtures and configuration options, enabling authenticated Elasticsearch connections.
Out of Scope Changes check ✅ Passed All changes are directly related to implementing authentication support: config fields, factory signatures, executor parameters, client setup, and documentation are all in scope.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Newsfragment Check ✅ Passed A valid newsfragment file has been added at newsfragments/869.feature.rst with correct filename format [number].[type].rst containing appropriate description.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.


Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pytest_elasticsearch/factories/client.py`:
- Around line 33-36: The fixture currently assumes process has api_key,
basic_auth, request_timeout, and verify_certs which can raise AttributeError for
ElasticSearchExecutor; update the client construction to guard these accesses by
using getattr(process, 'api_key', None), getattr(process, 'basic_auth', None),
getattr(process, 'request_timeout', DEFAULT_TIMEOUT_OR_NONE) and
getattr(process, 'verify_certs', True_or_None) (choose sensible defaults) when
passing values into the Elasticsearch client call so missing attributes won’t
crash before client creation; locate the client creation site where process is
used and replace direct attribute access with guarded getattr calls for those
four symbols.

In `@pytest_elasticsearch/factories/noprocess.py`:
- Around line 42-44: The code currently converts a string es_basic_auth by
partitioning on ":" which turns malformed strings without ":" into (user, ""),
so add explicit validation before conversion: if es_basic_auth is a str ensure
it contains ":" (and not empty parts) and raise a ValueError with a clear
message if it doesn't; if es_basic_auth is already a tuple/list validate it has
exactly two non-empty elements; then only after validation perform the
conversion into (user, password). Refer to the es_basic_auth variable and the
conversion block that uses partition to locate where to add these checks.

In `@README.rst`:
- Around line 174-185: Update the two auth rows in the README.rst table so the
"pytest.ini option" column uses the actual registered option names: replace the
existing api_key entry with elasticsearch_api_key for the API key row and
replace basic_auth with elasticsearch_basic_auth for the basic auth row (look
for the table rows containing "api_key" and "basic_auth" to locate the correct
entries).
- Around line 127-134: Replace the TOML section header in the README snippet to
use pytest's ini-style mapping: change the header from [tool.pytest] to
[tool.pytest.ini_options] so the example mirrors pytest.ini compatibility; keep
the same keys (elasticsearch_host, elasticsearch_port, elasticsearch_basic_auth)
and values but update the header to [tool.pytest.ini_options] in the README.rst
snippet that shows pyproject.toml configuration.

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between cf90828 and 987b8ad.

📒 Files selected for processing (6)
  • README.rst
  • pytest_elasticsearch/config.py
  • pytest_elasticsearch/executor.py
  • pytest_elasticsearch/factories/client.py
  • pytest_elasticsearch/factories/noprocess.py
  • pytest_elasticsearch/plugin.py

README.rst Outdated
Comment on lines +127 to +134
The same may be achived by adding options to `pyproject.toml` / `pytest.ini`:

.. code-block:: toml

[tool.pytest]
elasticsearch_host="localhost"
elasticsearch_port="9200"
elasticsearch_basic_auth="elastic:<your_password>"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

pytest pyproject.toml tool.pytest.ini_options configuration

💡 Result:

To configure pytest in pyproject.toml, put options under one of these tables:

1) INI-style (works since pytest 6.0)

# pyproject.toml
[tool.pytest.ini_options]
minversion = "6.0"
addopts = "-ra -q"
testpaths = ["tests", "integration"]
markers = ["slow: long-running tests"]
filterwarnings = ["error", "ignore::DeprecationWarning"]

This mirrors what you’d normally write in pytest.ini, but expressed in TOML. (docs.pytest.org)

2) Native TOML types (recommended since pytest 9.0)

[tool.pytest]
minversion = "9.0"
addopts = ["-ra", "-q"]
testpaths = ["tests", "integration"]

This avoids INI parsing quirks and lets you use “real” TOML lists for options like addopts. (docs.pytest.org)

Notes that commonly trip people up

  • pyproject.toml is only treated as pytest config if it has [tool.pytest] or [tool.pytest.ini_options] (with some precedence/behavior changes in newer pytest versions). (docs.pytest.org)
  • Some plugins also expect you to place their settings into addopts (example: Allure). (allurereport.org)

Citations:


Clarify the pytest configuration section choice.

Both [tool.pytest.ini_options] and [tool.pytest] are valid in pyproject.toml. Use [tool.pytest.ini_options] if mirroring pytest.ini style (supported since pytest 6.0), or [tool.pytest] for native TOML format (recommended since pytest 9.0). Since the snippet references pytest.ini compatibility, [tool.pytest.ini_options] is the more appropriate choice here.

Proposed fix
-    [tool.pytest]
+    [tool.pytest.ini_options]
     elasticsearch_host="localhost"
     elasticsearch_port="9200"
     elasticsearch_basic_auth="elastic:<your_password>"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
The same may be achived by adding options to `pyproject.toml` / `pytest.ini`:
.. code-block:: toml
[tool.pytest]
elasticsearch_host="localhost"
elasticsearch_port="9200"
elasticsearch_basic_auth="elastic:<your_password>"
The same may be achived by adding options to `pyproject.toml` / `pytest.ini`:
.. code-block:: toml
[tool.pytest.ini_options]
elasticsearch_host="localhost"
elasticsearch_port="9200"
elasticsearch_basic_auth="elastic:<your_password>"
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@README.rst` around lines 127 - 134, Replace the TOML section header in the
README snippet to use pytest's ini-style mapping: change the header from
[tool.pytest] to [tool.pytest.ini_options] so the example mirrors pytest.ini
compatibility; keep the same keys (elasticsearch_host, elasticsearch_port,
elasticsearch_basic_auth) and values but update the header to
[tool.pytest.ini_options] in the README.rst snippet that shows pyproject.toml
configuration.

@hmaerki hmaerki changed the title Add authentication Add paramters for api_key and basic_auth Feb 26, 2026
@hmaerki hmaerki changed the title Add paramters for api_key and basic_auth Add paramters for api_key and basic_auth, resolves #327 Feb 26, 2026
@hmaerki hmaerki force-pushed the add_authentication branch 2 times, most recently from b82ff6c to b171792 Compare February 26, 2026 17:38
Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

♻️ Duplicate comments (2)
README.rst (2)

174-185: ⚠️ Potential issue | 🟠 Major

Auth rows list incorrect pytest.ini option names.

The "pytest.ini option" column should use the full option names elasticsearch_api_key and elasticsearch_basic_auth to match the actual registered options in plugin.py.

📝 Proposed fix
   * - api_key
     - api_key
     - --elasticsearch-api-key
-    - api_key
+    - elasticsearch_api_key
     - -
     - -
   * - user and password separated by ':'
     - basic_auth
     - --elasticsearch-basic-auth
-    - basic_auth
+    - elasticsearch_basic_auth
     - -
     - -
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@README.rst` around lines 174 - 185, Update the README.rst auth rows so the
"pytest.ini option" column uses the exact option names registered in plugin.py:
replace occurrences like "api_key" and "basic_auth" with "elasticsearch_api_key"
and "elasticsearch_basic_auth" respectively (and ensure any CLI flag examples
like "--elasticsearch-api-key" map to the full underscore names shown in
pytest.ini); verify the table rows describing the API key and basic auth entries
match the option names defined in plugin.py to avoid mismatch.

131-134: ⚠️ Potential issue | 🟡 Minor

Clarify the pytest configuration section choice.

The TOML section header should use [tool.pytest.ini_options] for pytest.ini-style configuration compatibility (supported since pytest 6.0), not [tool.pytest].

📝 Proposed fix
-    [tool.pytest]
+    [tool.pytest.ini_options]
     elasticsearch_host="localhost"
     elasticsearch_port="9200"
     elasticsearch_basic_auth="elastic:<your_password>"
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@README.rst` around lines 131 - 134, Update the TOML header from
"[tool.pytest]" to "[tool.pytest.ini_options]" so pytest recognizes these
ini-style settings (supported since pytest 6.0); leave the keys
elasticsearch_host, elasticsearch_port, and elasticsearch_basic_auth unchanged
and ensure the values remain quoted as shown.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pytest_elasticsearch/factories/noprocess.py`:
- Around line 39-58: The factory currently assigns the function arg basic_auth
directly to es_basic_auth, skipping the config-path validation—ensure that if
basic_auth is provided as a string (e.g., "user:password") you parse and convert
it into a (username, password) tuple the same way as the config branch does (use
partition(":") and raise ValueError if no separator), and preserve tuple inputs
and None as-is before passing to NoopElasticsearch (refer to variables
basic_auth, es_basic_auth and the NoopElasticsearch() yield call).

In `@README.rst`:
- Around line 125-127: Fix the two typos in README.rst by replacing "to
authentication" with "no authentication" and "achived" with "achieved" so the
sentence reads "If none is provided, no authentication is assumed." and "The
same may be achieved by adding options to `pyproject.toml` / `pytest.ini`:";
update the phrases where they appear in the README.rst content.

---

Duplicate comments:
In `@README.rst`:
- Around line 174-185: Update the README.rst auth rows so the "pytest.ini
option" column uses the exact option names registered in plugin.py: replace
occurrences like "api_key" and "basic_auth" with "elasticsearch_api_key" and
"elasticsearch_basic_auth" respectively (and ensure any CLI flag examples like
"--elasticsearch-api-key" map to the full underscore names shown in pytest.ini);
verify the table rows describing the API key and basic auth entries match the
option names defined in plugin.py to avoid mismatch.
- Around line 131-134: Update the TOML header from "[tool.pytest]" to
"[tool.pytest.ini_options]" so pytest recognizes these ini-style settings
(supported since pytest 6.0); leave the keys elasticsearch_host,
elasticsearch_port, and elasticsearch_basic_auth unchanged and ensure the values
remain quoted as shown.

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 987b8ad and b171792.

📒 Files selected for processing (11)
  • .github/workflows/build.yml
  • .github/workflows/diagram.yml
  • .github/workflows/pypi.yml
  • .pre-commit-config.yaml
  • README.rst
  • newsfragments/869.feature.rst
  • pytest_elasticsearch/config.py
  • pytest_elasticsearch/executor.py
  • pytest_elasticsearch/factories/client.py
  • pytest_elasticsearch/factories/noprocess.py
  • pytest_elasticsearch/plugin.py
✅ Files skipped from review due to trivial changes (2)
  • .github/workflows/diagram.yml
  • .github/workflows/pypi.yml
🚧 Files skipped from review as they are similar to previous changes (1)
  • pytest_elasticsearch/factories/client.py

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (1)
pytest_elasticsearch/factories/noprocess.py (1)

39-49: ⚠️ Potential issue | 🟠 Major

basic_auth string args still bypass normalisation.

On Line 39 to Line 49, only config-derived values are parsed; a direct basic_auth="user:password" argument is passed through as a raw string instead of a tuple. This reintroduces the previously flagged inconsistency and can fail at client construction depending on accepted auth types.

🐛 Proposed fix
         es_basic_auth = basic_auth
-        if es_basic_auth is None:
-            es_basic_auth = config.basic_auth
-            if es_basic_auth is not None:
-                user, sep, password = es_basic_auth.partition(":")
-                if not sep:
-                    raise ValueError(
-                        "elasticsearch_basic_auth must be in the format 'username:password'"
-                    )
-                es_basic_auth = (user, password)
+        if es_basic_auth is None:
+            es_basic_auth = config.basic_auth
+        if isinstance(es_basic_auth, str):
+            user, sep, password = es_basic_auth.partition(":")
+            if not sep:
+                raise ValueError(
+                    "elasticsearch_basic_auth must be in the format 'username:password'"
+                )
+            es_basic_auth = (user, password)
In elasticsearch-py 8.x, what input types are accepted for the `basic_auth` client parameter, and is a single "username:password" string officially supported?
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pytest_elasticsearch/factories/noprocess.py` around lines 39 - 49, The
passed-in basic_auth argument is not normalized when it is a "user:pass"
string—only config.basic_auth gets parsed—so update the normalization logic for
es_basic_auth (the es_basic_auth variable set from basic_auth) to detect when
basic_auth is a string containing ":" and split it into (user, password) the
same way the config branch does; ensure this happens before falling back to
config.basic_auth so both direct basic_auth and config.basic_auth are converted
to a (user, password) tuple and ValueError is raised if the separator is missing
(referencing the es_basic_auth variable, the basic_auth parameter, and
config.basic_auth).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@pytest_elasticsearch/factories/noprocess.py`:
- Around line 39-49: The passed-in basic_auth argument is not normalized when it
is a "user:pass" string—only config.basic_auth gets parsed—so update the
normalization logic for es_basic_auth (the es_basic_auth variable set from
basic_auth) to detect when basic_auth is a string containing ":" and split it
into (user, password) the same way the config branch does; ensure this happens
before falling back to config.basic_auth so both direct basic_auth and
config.basic_auth are converted to a (user, password) tuple and ValueError is
raised if the separator is missing (referencing the es_basic_auth variable, the
basic_auth parameter, and config.basic_auth).

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between b171792 and ba2ce78.

📒 Files selected for processing (6)
  • README.rst
  • newsfragments/869.feature.rst
  • pytest_elasticsearch/config.py
  • pytest_elasticsearch/executor.py
  • pytest_elasticsearch/factories/noprocess.py
  • pytest_elasticsearch/plugin.py
🚧 Files skipped from review as they are similar to previous changes (3)
  • README.rst
  • pytest_elasticsearch/plugin.py
  • pytest_elasticsearch/executor.py

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (1)
pytest_elasticsearch/factories/noprocess.py (1)

39-49: ⚠️ Potential issue | 🟠 Major

basic_auth string normalisation is still inconsistent.

On Line 39–Line 49, string parsing/validation is applied only to config.basic_auth. A direct call like elasticsearch_noproc(basic_auth="user:pass") bypasses conversion and is forwarded as raw string. Normalise and validate both sources identically (including empty-part checks).

Proposed fix
-        es_basic_auth = basic_auth
-        if es_basic_auth is None:
-            es_basic_auth = config.basic_auth
-            if es_basic_auth is not None:
-                user, sep, password = es_basic_auth.partition(":")
-                if not sep:
-                    raise ValueError(
-                        "elasticsearch_basic_auth must be in the format 'username:password'"
-                    )
-                es_basic_auth = (user, password)
+        es_basic_auth = basic_auth if basic_auth is not None else config.basic_auth
+        if isinstance(es_basic_auth, str):
+            user, sep, password = es_basic_auth.partition(":")
+            if not sep or not user or not password:
+                raise ValueError(
+                    "elasticsearch_basic_auth must be in the format 'username:password'"
+                )
+            es_basic_auth = (user, password)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pytest_elasticsearch/factories/noprocess.py` around lines 39 - 49, The
handling of basic_auth only parses/validates config.basic_auth, so update the
normalization to apply the same logic when basic_auth is passed directly: in the
block that sets es_basic_auth = basic_auth, detect if es_basic_auth is a str and
then partition(":"), require a separator and non-empty username and password
(same checks you already have for config.basic_auth), convert it to a (user,
password) tuple; if es_basic_auth is None fall back to config.basic_auth and
keep the existing parsing/validation, and preserve tuples/other truthy types
unchanged; use the existing symbols es_basic_auth, basic_auth, config.basic_auth
to locate where to apply this.
🧹 Nitpick comments (1)
pytest_elasticsearch/executor.py (1)

15-23: Update constructor docstring for new parameters.

NoopElasticsearch.__init__ now exposes four extra arguments, but the docstring still documents only host and port. Please document the new parameters to keep the public surface self-describing.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pytest_elasticsearch/executor.py` around lines 15 - 23, Update the docstring
for NoopElasticsearch.__init__ to document the four new parameters (api_key,
basic_auth, request_timeout, verify_certs): describe each parameter name, its
expected type (api_key: str | tuple[str, str] | None, basic_auth: str |
tuple[str, str] | None, request_timeout: float, verify_certs: bool), default
values (api_key=None, basic_auth=None, request_timeout=30, verify_certs=False),
and their effect (authentication and request/SSL behavior) so the public
constructor signature is fully described; locate the docstring immediately above
the __init__ definition to update.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@pytest_elasticsearch/factories/noprocess.py`:
- Around line 39-49: The handling of basic_auth only parses/validates
config.basic_auth, so update the normalization to apply the same logic when
basic_auth is passed directly: in the block that sets es_basic_auth =
basic_auth, detect if es_basic_auth is a str and then partition(":"), require a
separator and non-empty username and password (same checks you already have for
config.basic_auth), convert it to a (user, password) tuple; if es_basic_auth is
None fall back to config.basic_auth and keep the existing parsing/validation,
and preserve tuples/other truthy types unchanged; use the existing symbols
es_basic_auth, basic_auth, config.basic_auth to locate where to apply this.

---

Nitpick comments:
In `@pytest_elasticsearch/executor.py`:
- Around line 15-23: Update the docstring for NoopElasticsearch.__init__ to
document the four new parameters (api_key, basic_auth, request_timeout,
verify_certs): describe each parameter name, its expected type (api_key: str |
tuple[str, str] | None, basic_auth: str | tuple[str, str] | None,
request_timeout: float, verify_certs: bool), default values (api_key=None,
basic_auth=None, request_timeout=30, verify_certs=False), and their effect
(authentication and request/SSL behavior) so the public constructor signature is
fully described; locate the docstring immediately above the __init__ definition
to update.

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 975c94c and 28e03ee.

📒 Files selected for processing (7)
  • README.rst
  • newsfragments/869.feature.rst
  • pytest_elasticsearch/config.py
  • pytest_elasticsearch/executor.py
  • pytest_elasticsearch/factories/client.py
  • pytest_elasticsearch/factories/noprocess.py
  • pytest_elasticsearch/plugin.py
🚧 Files skipped from review as they are similar to previous changes (3)
  • newsfragments/869.feature.rst
  • README.rst
  • pytest_elasticsearch/factories/client.py

Signed-off-by: Hans Maerki <buhtig.hans.maerki@ergoinfo.ch>
@fizyk
Copy link
Copy Markdown
Member

fizyk commented Feb 27, 2026

@hmaerki Got two questions:

  1. Can we also use authentication for the process fixture factory? Start a process that requires auth?
  2. Please add tests that use that functionality. I'd hate to break it accidentally.

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (1)
pytest_elasticsearch/factories/noprocess.py (1)

39-49: ⚠️ Potential issue | 🟡 Minor

Harden basic_auth validation for empty and malformed values.

Current parsing accepts ":", "user:", and ":pass" and passes through malformed tuple values unchanged. Please fail fast with strict validation before yielding the fixture.

Suggested patch
         es_basic_auth = basic_auth
         if es_basic_auth is None:
             es_basic_auth = config.basic_auth
         if isinstance(es_basic_auth, str):
             user, sep, password = es_basic_auth.partition(":")
-            if not sep:
+            if not sep or not user or not password:
                 raise ValueError(
-                    "elasticsearch_basic_auth must be in the format 'username:password'"
+                    "elasticsearch_basic_auth must be in the format 'username:password' with non-empty values"
                 )
             es_basic_auth = (user, password)
+        elif es_basic_auth is not None:
+            if (
+                not isinstance(es_basic_auth, tuple)
+                or len(es_basic_auth) != 2
+                or not all(isinstance(v, str) and v for v in es_basic_auth)
+            ):
+                raise ValueError(
+                    "basic_auth must be a tuple of two non-empty strings: (username, password)"
+                )
         es_api_key = api_key or config.api_key
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pytest_elasticsearch/factories/noprocess.py` around lines 39 - 49, The
current es_basic_auth parsing in the fixture (variables: es_basic_auth,
basic_auth, config.basic_auth) accepts empty/malformed values like ":", "user:",
":pass" and leaves malformed tuples untouched; update validation so that if
es_basic_auth is a str you split once (e.g., split(':',1)) and require both
username and password to be non-empty strings, raising ValueError with the same
message if either is missing, and if es_basic_auth is a tuple/list ensure it has
exactly two elements that are non-empty strings (otherwise raise ValueError);
after validation convert a valid string into a (user, password) tuple and reject
any other types.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@pytest_elasticsearch/factories/noprocess.py`:
- Around line 39-49: The current es_basic_auth parsing in the fixture
(variables: es_basic_auth, basic_auth, config.basic_auth) accepts
empty/malformed values like ":", "user:", ":pass" and leaves malformed tuples
untouched; update validation so that if es_basic_auth is a str you split once
(e.g., split(':',1)) and require both username and password to be non-empty
strings, raising ValueError with the same message if either is missing, and if
es_basic_auth is a tuple/list ensure it has exactly two elements that are
non-empty strings (otherwise raise ValueError); after validation convert a valid
string into a (user, password) tuple and reject any other types.

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 28e03ee and 0513e1d.

📒 Files selected for processing (3)
  • pytest_elasticsearch/executor.py
  • pytest_elasticsearch/factories/client.py
  • pytest_elasticsearch/factories/noprocess.py
🚧 Files skipped from review as they are similar to previous changes (2)
  • pytest_elasticsearch/executor.py
  • pytest_elasticsearch/factories/client.py

@codecov
Copy link
Copy Markdown

codecov bot commented Feb 27, 2026

@hmaerki
Copy link
Copy Markdown
Contributor Author

hmaerki commented Feb 27, 2026

@hmaerki Got two questions:

  1. Can we also use authentication for the process fixture factory? Start a process that requires auth?

I have never used elastic as a process.

$ elasticsearch --help
Starts Elasticsearch

Option                Description                                               
------                -----------                                               
-E <KeyValuePair>     Configure a setting                                       
-V, --version         Prints Elasticsearch version information and exits        
-d, --daemonize       Starts Elasticsearch in the background                    
--enrollment-token    An existing enrollment token for securely joining a       
                        cluster                                                 
-h, --help            Show help                                                 
-p, --pidfile <Path>  Creates a pid file in the specified path on start         
-q, --quiet           Turns off standard output/error streams logging in console
-s, --silent          Show minimal output                                       
-v, --verbose         Show verbose output   

I can not see how to provide authentication. We can use -E http.port=6200. However there are not environment variables to control authentication. See networking-settings.
Just tell me if I overlooked something.

So may answer would be no!

  1. Please add tests that use that functionality. I'd hate to break it accidentally.

First a question about https://github.com/dbfixtures/pytest-elasticsearch/blob/main/tests/conftest.py#L14. The oo in elasticsearch_nooproc2/elasticsearch2_noop is a typo? If not - what is the meaning of oo?

Second question about https://github.com/dbfixtures/pytest-elasticsearch/blob/main/tests/test_elastic.py#L36-L38:

def test_external_elastic(
    elasticsearch2: Elasticsearch,
    elasticsearch2_noop: Elasticsearch,

In this test, elasticsearch2 spins up the elasticsearch binary and elasticsearch2_noop connects to it. Just using elasticsearch2_noop would not work as no elasticsearch binary would be running.

Did I understand this correct?

Let me think about I would implement a new test for authentication after I got your feedback.

@fizyk
Copy link
Copy Markdown
Member

fizyk commented Feb 28, 2026

  1. Then we'll need additonal task to investigate the possibility

  2. @hmaerki oo in elasticsearch_nooproc2 is definitely a typo, can be fixed.

As for adding tests itself through the noprocess fixture, I think we'd need to start a Docker-based instance and connect the noprocess fixture to it in a test, not through process fixture.
Similar to what I do in pytest-postgresql tests:
https://github.com/dbfixtures/pytest-postgresql/blob/main/.github/workflows/dockerised-postgres.yml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Using authentication

2 participants