Bugfix/securitydata search empty filter list (#378)

* fix empty filter list bug

* changelog and version bump

* style

* fix test in CI

* fix test in CI for real

* try again

* mock the profile name

* actually use the mock state 🤦

* style

Author: timabrmsn

CHANGELOG.md

@@ -8,6 +8,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 The intended audience of this file is for py42 consumers -- as such, changes that don't affect
 how a consumer would use the library (e.g. adding unit tests, updating documentation, etc) are not captured here.
 
+## 1.14.2 - 2022-06-17
+
+### Fixed
+
+- Bug where the `code42 security-data search` command using a checkpoint and only the `--include-non-exposure` filter constructed an invalid search query.
+
 ## 1.14.1 - 2022-06-13
 
 ### Fixed

src/code42cli/__version__.py

@@ -1 +1 @@
-__version__ = "1.14.1"
+__version__ = "1.14.2"

src/code42cli/cmds/securitydata.py

@@ -1,3 +1,4 @@
+import datetime
 from pprint import pformat
 
 import click
@@ -474,6 +475,16 @@ def _construct_query(state, begin, end, saved_search, advanced_query, or_query):
             )
     if or_query:
         state.search_filters = convert_to_or_query(state.search_filters)
+
+    if not state.search_filters:
+        # if a checkpoint and _only_ --include-non-exposure is passed, the filter list will be empty, which isn't a
+        # valid query, so in that case we want to fallback to a 90 day (max event age) date range. The checkpoint will
+        # still cause the query results to only contain events after the checkpointed event.
+        _90_days = datetime.datetime.utcnow() - datetime.timedelta(days=90)
+        timestamp = convert_datetime_to_timestamp(_90_days)
+        state.search_filters.append(
+            create_time_range_filter(f.EventTimestamp, timestamp, None)
+        )
     query = FileEventQuery(*state.search_filters)
     query.page_size = MAX_EVENT_PAGE_SIZE
     query.sort_direction = "asc"

tests/cmds/conftest.py

@@ -13,6 +13,7 @@
 from tests.conftest import create_mock_response
 from tests.conftest import TEST_ID
 
+from code42cli.cmds.search.cursor_store import FileEventCursorStore
 from code42cli.logger import CliLogger
 
 
@@ -61,6 +62,16 @@ def cli_state_without_user(sdk_without_user, cli_state):
     return cli_state
 
 
+@pytest.fixture
+def mock_file_event_checkpoint(mocker):
+    mock_file_event_checkpointer = mocker.MagicMock(spec=FileEventCursorStore)
+    mocker.patch(
+        "code42cli.cmds.securitydata._get_file_event_cursor_store",
+        return_value=mock_file_event_checkpointer,
+    )
+    return mock_file_event_checkpointer
+
+
 @pytest.fixture
 def custom_error(mocker):
     err = mocker.MagicMock(spec=HTTPError)

tests/cmds/test_securitydata.py

@@ -1,6 +1,7 @@
 import json
 import logging
 
+import pandas
 import py42.sdk.queries.fileevents.filters as f
 import pytest
 from py42.sdk.queries.fileevents.file_event_query import FileEventQuery
@@ -1388,3 +1389,24 @@ def test_saved_search_list_with_format_option_does_not_return_when_response_is_e
         cli, ["security-data", "saved-search", "list", "-f", "csv"], obj=cli_state
     )
     assert "Name,Id" not in result.output
+
+
+def test_non_exposure_only_query_with_checkpoint_does_not_send_empty_filter_list(
+    runner, cli_state, mock_file_event_checkpoint, mocker
+):
+    mock_file_event_checkpoint.get.return_value = "event_1234"
+    mock_get_all_file_events = mocker.patch(
+        "code42cli.cmds.securitydata._get_all_file_events"
+    )
+
+    def generator():
+        yield pandas.DataFrame()
+
+    mock_get_all_file_events.return_value = generator()
+    result = runner.invoke(
+        cli,
+        ["security-data", "search", "--include-non-exposure", "-c", "checkpoint"],
+        obj=cli_state,
+    )
+    assert result.exit_code == 0
+    assert len(mock_get_all_file_events.call_args[0][1]._filter_group_list) > 0