Fix: Harden error handling in ripple plugin

.pre-commit-config.yaml

@@ -14,7 +14,7 @@ default_language_version:
 
 repos:
   - repo: https://github.com/ibm/detect-secrets
-    rev: 0.13.1+ibm.62.dss
+    rev: 0.13.1+ibm.64.dss
     hooks:
       - id: detect-secrets  # pragma: whitelist secret
         args:

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "^.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2025-06-12T10:16:52Z",
+  "generated_at": "2026-07-28T11:52:51Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -77,34 +77,6 @@
     }
   ],
   "results": {
-    ".ci/bundle.sh": [
-      {
-        "hashed_secret": "3a272afad27cd2a102600d836c3684fb32a4303b",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 56,
-        "type": "Secret Keyword",
-        "verified_result": null
-      }
-    ],
-    "docs/kubernetes-env.md": [
-      {
-        "hashed_secret": "9ecc8459ea5f39f9da55cb4d71a70b5d1e0f0b80",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 75,
-        "type": "Secret Keyword",
-        "verified_result": null
-      },
-      {
-        "hashed_secret": "374e85f02d474ce2135f17236522c53178923c28",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 79,
-        "type": "Secret Keyword",
-        "verified_result": null
-      }
-    ],
     "fireblocks-plugin/tests/data/messages_request.json": [
       {
         "hashed_secret": "a4f5b1f3796b07b1b6436bb225cc3d49267ff1c9",
@@ -132,95 +104,9 @@
         "type": "Hex High Entropy String",
         "verified_result": null
       }
-    ],
-    "fireblocks-utilities/verifyecdsasignature.py": [
-      {
-        "hashed_secret": "4c01896b029cafed006b5f7c4fcc63e56b2aea90",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 19,
-        "type": "Hex High Entropy String",
-        "verified_result": null
-      },
-      {
-        "hashed_secret": "2bd1ca992255001a8711229cb08a7a413c02205e",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 21,
-        "type": "Hex High Entropy String",
-        "verified_result": null
-      },
-      {
-        "hashed_secret": "7ca923e8de42415cecc8e46a8fff0695a74092bf",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 24,
-        "type": "Hex High Entropy String",
-        "verified_result": null
-      },
-      {
-        "hashed_secret": "4a9c6c77d9389f297b4feb223ff7a1d023770dc0",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 25,
-        "type": "Hex High Entropy String",
-        "verified_result": null
-      },
-      {
-        "hashed_secret": "9011c60951228a2558ed1552746ef65e1164b017",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 26,
-        "type": "Hex High Entropy String",
-        "verified_result": null
-      }
-    ],
-    "gateway-mock/Containerfile": [
-      {
-        "hashed_secret": "b991a3507ae53155dfb37a8c817f74f847d66043",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 53,
-        "type": "Secret Keyword",
-        "verified_result": null
-      }
-    ],
-    "gateway-mock/src/gateway-mock/fbserverapimock.py": [
-      {
-        "hashed_secret": "f498fdf2b39bdaa43aeaea4d4376d94ae5766e41",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 48,
-        "type": "Hex High Entropy String",
-        "verified_result": null
-      },
-      {
-        "hashed_secret": "a4f5b1f3796b07b1b6436bb225cc3d49267ff1c9",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 51,
-        "type": "Hex High Entropy String",
-        "verified_result": null
-      },
-      {
-        "hashed_secret": "df16869fed241f9af136290f24694d7534101be2",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 55,
-        "type": "Hex High Entropy String",
-        "verified_result": null
-      },
-      {
-        "hashed_secret": "89395f31963680bc4a5acf68a2dd7d3d82315429",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 59,
-        "type": "Hex High Entropy String",
-        "verified_result": null
-      }
     ]
   },
-  "version": "0.13.1+ibm.62.dss",
+  "version": "0.13.1+ibm.64.dss",
   "word_list": {
     "file": null,
     "hash": null

ripple-plugin/src/oso_ripple_plugins/backend_plugin/api/v1alpha1.py

@@ -110,8 +110,23 @@ def get(self):
 
 @api.route("/status", methods=["GET"])
 class Status(Resource):
+    error_model = api.model(
+        "Error",
+        {
+            "code": fields.String(description="Error code"),
+            "message": fields.String(description="Error message"),
+        },
+    )
+
     component_status_model = api.model(
-        "ComponentStatus", {"status": fields.String(), "error": fields.String()}
+        "ComponentStatus",
+        {
+            "status_code": fields.Integer(description="HTTP status code"),
+            "status": fields.String(description="Human readable message"),
+            "errors": fields.List(
+                fields.Nested(error_model), default=[], description="List of errors"
+            ),
+        },
     )
 
     @api.response(code=200, description="Success", model=component_status_model)
@@ -120,7 +135,11 @@ def get(self):
         try:
             current_app.bpm.backend_status()
         except Exception as e:
-            logger.exception(e)
-            abort(503)
-
-        return {"status": "OK"}, 200
+            logger.exception("Backend status check failed")
+            return {
+                "status_code": 503,
+                "status": "Unavailable",
+                "errors": [{"code": "BACKEND_ERROR", "message": str(e)}],
+            }, 503
+
+        return {"status_code": 200, "status": "OK", "errors": []}, 200

ripple-plugin/src/oso_ripple_plugins/backend_plugin/backend_plugin_manager.py

@@ -26,20 +26,23 @@
 import urllib3
 from urllib3.exceptions import InsecureRequestWarning
 
-from oso_ripple_plugins.common import crypt, errors
+from oso_ripple_plugins.common import crypt
 
 urllib3.disable_warnings(InsecureRequestWarning)
 
 
 class BackendPluginManager:
     def __init__(self):
-        self.cold_bridge_endpoint = os.environ.get("COLD_BRIDGE_ENDPOINT", 
-                "http://localhost:8080")
+        self.cold_bridge_endpoint = os.environ.get(
+            "COLD_BRIDGE_ENDPOINT", "http://localhost:8080"
+        )
         self.seed = os.environ.get("SEED", "")
 
         logging.basicConfig(stream=sys.stdout, level=logging.INFO)
         self.logger = logging.getLogger(__name__)
-        self.logger.info(f"Cold-bridge endpoint configured as: {self.cold_bridge_endpoint}")
+        self.logger.info(
+            f"Cold-bridge endpoint configured as: {self.cold_bridge_endpoint}"
+        )
 
     def backend_status(self):
         response = requests.get(
@@ -49,7 +52,9 @@ def backend_status(self):
         response.raise_for_status()
 
     def bulk_download(self) -> List[Dict]:
-        response = requests.get(f"{self.cold_bridge_endpoint}/v1/feed/download?clean=True")
+        response = requests.get(
+            f"{self.cold_bridge_endpoint}/v1/feed/download?clean=True"
+        )
         response.raise_for_status()
         response_json = response.json()
 
@@ -135,7 +140,7 @@ def bulk_upload(self, documents):
                 continue
 
         if not vault_id:
-            return Exception("Could not get vault id")
+            raise Exception("Could not get vault id")
 
         content = {
             "vaultId": vault_id,
@@ -146,19 +151,30 @@ def bulk_upload(self, documents):
 
         self.logger.info("Performing bulk upload to backend")
 
+        vault_file_path = None
         try:
             with tempfile.NamedTemporaryFile(mode="w", delete=False) as vault_file:
                 json.dump(content, vault_file)
+                vault_file_path = vault_file.name
 
-            files = {"files": (vault_id, open(vault_file.name, "rb"))}
-            response = requests.post(
-                url=f"{self.cold_bridge_endpoint}/v1/feed/upload",
-                files=files,
-            )
+            with open(vault_file_path, "rb") as f:
+                response = requests.post(
+                    url=f"{self.cold_bridge_endpoint}/v1/feed/upload",
+                    files={"files": (vault_id, f)},
+                )
             response.raise_for_status()
+        except requests.HTTPError:
+            self.logger.error(
+                "HTTP error uploading to backend: %s - %s",
+                response.status_code,
+                response.text,
+            )
+            raise
         except Exception as e:
-            raise e
+            self.logger.error("Unexpected error during upload: %s", e)
+            raise
         finally:
-            os.remove(vault_file.name)
+            if vault_file_path:
+                os.remove(vault_file_path)
 
         self.logger.info("Bulk upload finished successfully")

ripple-plugin/src/oso_ripple_plugins/common/errors.py

@@ -14,8 +14,25 @@
 # limitations under the License.
 
 
-
 class ConfigError(Exception):
     """Exception raised when an Environment Variable is not found"""
 
     pass
+
+
+class NetworkError(Exception):
+    """Raised for network-level failures (timeout, connection error)"""
+
+    pass
+
+
+class AuthenticationError(Exception):
+    """Raised when the token endpoint returns 401 or 403"""
+
+    pass
+
+
+class TokenError(Exception):
+    """Raised when a token cannot be obtained or parsed from the response"""
+
+    pass

ripple-plugin/src/oso_ripple_plugins/frontend_plugin/api/v1alpha1.py

@@ -37,10 +37,6 @@
     },
 )
 
-component_status_model = api.model(
-    "ComponentStatus", {"status": fields.String(), "error": fields.String()}
-)
-
 
 @api.route("/documents", methods=["GET"])
 class Download(Resource):
@@ -93,8 +89,23 @@ def post(self):
 
 @api.route("/status", methods=["GET"])
 class Status(Resource):
+    error_model = api.model(
+        "Error",
+        {
+            "code": fields.String(description="Error code"),
+            "message": fields.String(description="Error message"),
+        },
+    )
+
     component_status_model = api.model(
-        "ComponentStatus", {"status": fields.String(), "error": fields.String()}
+        "ComponentStatus",
+        {
+            "status_code": fields.Integer(description="HTTP status code"),
+            "status": fields.String(description="Human readable message"),
+            "errors": fields.List(
+                fields.Nested(error_model), default=[], description="List of errors"
+            ),
+        },
     )
 
     @api.response(code=200, description="Success", model=component_status_model)
@@ -103,7 +114,11 @@ def get(self):
         try:
             current_app.fpm.backend_status()
         except Exception as e:
-            logger.exception(e)
-            abort(503)
-
-        return {"status": "OK"}, 200
+            logger.exception("Backend status check failed")
+            return {
+                "status_code": 503,
+                "status": "Unavailable",
+                "errors": [{"code": "BACKEND_ERROR", "message": str(e)}],
+            }, 503
+
+        return {"status_code": 200, "status": "OK", "errors": []}, 200