fix(ai): validate ai_expectations_for_source returns a list (#295)

http_get is typed as Union[Dict, requests.Response] and can return a
non-list JSON shape. Guard the response in ai_expectations_for_source:
raise OpenAEVParsingError when the payload is not a JSON list so the
documented List[Dict] contract holds instead of silently returning the
wrong shape. Add manager-level tests for the success and parsing-error
paths.

Author: SamuelHassine

pyoaev/apis/inject_expectation/inject_expectation.py

@@ -49,11 +49,19 @@ def ai_expectations_for_source(
 
         :param source_id: the identifier of the collector requesting expectations
         :type source_id: str
+        :raises OpenAEVParsingError: if the server does not return a JSON list
         :return: a list of agentless detection/prevention expectation dicts
         :rtype: list[dict]
         """
         path = f"{self.path}/ai/{source_id}"
         result = self.openaev.http_get(path, **kwargs)
+        if not isinstance(result, list):
+            raise exc.OpenAEVParsingError(
+                error_message=(
+                    f"Expected a list of AI expectations from {path}, "
+                    f"got {type(result).__name__}"
+                )
+            )
         return result
 
     def expectations_models_for_source(self, source_id: str, **kwargs: Any):

test/apis/inject_expectation/test_inject_expectation.py

@@ -0,0 +1,49 @@
+from unittest import TestCase, main, mock
+
+from pyoaev import OpenAEV
+from pyoaev.exceptions import OpenAEVParsingError
+
+
+def make_json_response(payload):
+    class MockResponse:
+        def __init__(self):
+            self.status_code = 200
+            self.history = None
+            self.content = None
+            self.headers = {"Content-Type": "application/json"}
+
+        def json(self):
+            return payload
+
+    return MockResponse()
+
+
+class TestAiExpectationsForSource(TestCase):
+    @mock.patch("requests.Session.request")
+    def test_returns_list_of_expectations(self, mock_request):
+        expectations = [
+            {"inject_expectation_id": "exp-1"},
+            {"inject_expectation_id": "exp-2"},
+        ]
+        mock_request.return_value = make_json_response(expectations)
+        api_client = OpenAEV("url", "token")
+
+        result = api_client.inject_expectation.ai_expectations_for_source("collector-1")
+
+        mock_request.assert_called_once()
+        _, kwargs = mock_request.call_args
+        self.assertEqual(kwargs["method"], "get")
+        self.assertEqual(kwargs["url"], "url/api/injects/expectations/ai/collector-1")
+        self.assertEqual(result, expectations)
+
+    @mock.patch("requests.Session.request")
+    def test_raises_parsing_error_when_not_a_list(self, mock_request):
+        mock_request.return_value = make_json_response({"unexpected": "shape"})
+        api_client = OpenAEV("url", "token")
+
+        with self.assertRaises(OpenAEVParsingError):
+            api_client.inject_expectation.ai_expectations_for_source("collector-1")
+
+
+if __name__ == "__main__":
+    main()