Add WAF rate bypass header to GC Articles requests (#2690)

* feat: add WAF rate bypass header to GC Articles requests

* add tests, use env module in config

Author: smcmurtry

app/articles/api.py

@@ -111,8 +111,14 @@ def _get_headers(auth_required=False):
     base_endpoint = current_app.config["GC_ARTICLES_API"]
     username = current_app.config["GC_ARTICLES_API_AUTH_USERNAME"]
     password = current_app.config["GC_ARTICLES_API_AUTH_PASSWORD"]
+    waf_rate_bypass_secret = current_app.config["GC_ARTICLES_WAF_RATE_BYPASS_SECRET"]
+
+    headers = {}
+    if waf_rate_bypass_secret:
+        headers["waf-rate-bypass"] = waf_rate_bypass_secret
 
     if auth_required:
         token = authenticate(username, password, base_endpoint)
-        return {"Authorization": "Bearer {}".format(token)}
-    return {}
+        headers["Authorization"] = "Bearer {}".format(token)
+
+    return headers

app/config.py

@@ -99,6 +99,7 @@ class Config(object):
     GC_ARTICLES_API = os.environ.get("GC_ARTICLES_API", "articles.alpha.canada.ca/notification-gc-notify")
     GC_ARTICLES_API_AUTH_PASSWORD = os.environ.get("GC_ARTICLES_API_AUTH_PASSWORD")
     GC_ARTICLES_API_AUTH_USERNAME = os.environ.get("GC_ARTICLES_API_AUTH_USERNAME")
+    GC_ARTICLES_WAF_RATE_BYPASS_SECRET = env.str("GC_ARTICLES_WAF_RATE_BYPASS_SECRET", "my-secret-key")
     GC_ORGANISATIONS_BUCKET_NAME = os.environ.get("GC_ORGANISATIONS_BUCKET_NAME")
     GC_ORGANISATIONS_FILENAME = os.getenv("GC_ORGANISATIONS_FILENAME", "all.json")
     GOOGLE_ANALYTICS_ID = os.getenv("GOOGLE_ANALYTICS_ID", "G-R04KFLQCVQ")
@@ -175,6 +176,7 @@ def get_sensitive_config(cls) -> list[str]:
             "DEBUG_KEY",
             "GC_ARTICLES_API_AUTH_PASSWORD",
             "GC_ARTICLES_API_AUTH_USERNAME",
+            "GC_ARTICLES_WAF_RATE_BYPASS_SECRET",
             "ROUTE_SECRET_KEY_1",
             "ROUTE_SECRET_KEY_2",
             "SECRET_KEY",

tests/app/articles/test_request_content.py

@@ -2,7 +2,7 @@
 import requests_mock
 from werkzeug.exceptions import Forbidden
 
-from app.articles.api import get_content
+from app.articles.api import _get_headers, get_content
 
 gc_articles_api = "articles.alpha.canada.ca/notification-gc-notify"
 notify_url = f"https://{gc_articles_api}/wp-json/pages"
@@ -54,3 +54,34 @@ def test_get_content_403(app_, mocker, capsys):
                 get_content("pages", {"slug": "mypage", "lang": "en"})
 
             assert "403 Forbidden" in str(exception.value)
+
+
+class TestGetHeaders:
+    def test_waf_rate_bypass_header_included_when_secret_set(self, app_, mocker):
+        with app_.test_request_context():
+            mocker.patch.dict(
+                "app.current_app.config",
+                values={"GC_ARTICLES_WAF_RATE_BYPASS_SECRET": "some-secret"},
+            )
+            headers = _get_headers()
+            assert headers["waf-rate-bypass"] == "some-secret"
+
+    def test_waf_rate_bypass_header_not_included_when_secret_not_set(self, app_, mocker):
+        with app_.test_request_context():
+            mocker.patch.dict(
+                "app.current_app.config",
+                values={"GC_ARTICLES_WAF_RATE_BYPASS_SECRET": None},
+            )
+            headers = _get_headers()
+            assert "waf-rate-bypass" not in headers
+
+    def test_waf_rate_bypass_header_included_alongside_auth_header(self, app_, mocker):
+        mocker.patch("app.articles.api.authenticate", return_value="some-token")
+        with app_.test_request_context():
+            mocker.patch.dict(
+                "app.current_app.config",
+                values={"GC_ARTICLES_WAF_RATE_BYPASS_SECRET": "some-secret"},
+            )
+            headers = _get_headers(auth_required=True)
+            assert headers["waf-rate-bypass"] == "some-secret"
+            assert headers["Authorization"] == "Bearer some-token"