🔒 Secure Fast.com API Token handling

Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com>

src/netsleuth/config.py

@@ -78,7 +78,7 @@ class Speedtest(BaseModel):
     upload_sizes_bytes: list[int] = Field(default_factory=lambda: [1_000_000, 5_000_000])
     cloudflare_base_url: str = "https://speed.cloudflare.com"
     fastcom_api_url: str = "https://api.fast.com/netflix/speedtest/v2"
-    fastcom_api_token: str = "YXNkZmFzZGxmbnNkYWZoYXNkZmhrYWxm"
+    fastcom_api_token: SecretStr | None = None
     ndt7_locate_url: str = "https://locate.measurementlab.net/v2/nearest/ndt/ndt7"
     bufferbloat_probe_interval_seconds: float = 0.2
 

src/netsleuth/speed.py

@@ -176,7 +176,11 @@ async def tier_cloudflare(client: httpx.AsyncClient, cfg: Speedtest, timeout: fl
 async def tier_fastcom(client: httpx.AsyncClient, cfg: Speedtest, timeout: float) -> SpeedResult:
     response = await client.get(
         cfg.fastcom_api_url,
-        params={"https": "true", "token": cfg.fastcom_api_token, "urlCount": "3"},
+        params={
+            "https": "true",
+            "token": cfg.fastcom_api_token.get_secret_value() if cfg.fastcom_api_token else "",
+            "urlCount": "3",
+        },
         timeout=timeout,
     )
     response.raise_for_status()

tests/test_speed.py

@@ -460,10 +460,10 @@ async def test_tier_cloudflare_http_error(httpx_mock: HTTPXMock):
 
 
 async def test_tier_fastcom_happy_path(httpx_mock):
-    config = Speedtest()
+    config = Speedtest(fastcom_api_token="test_dummy_token")
     api_url = config.fastcom_api_url
     httpx_mock.add_response(
-        url=f"{api_url}?https=true&token=YXNkZmFzZGxmbnNkYWZoYXNkZmhrYWxm&urlCount=3",
+        url=f"{api_url}?https=true&token=test_dummy_token&urlCount=3",
         json={
             "targets": [
                 {
@@ -495,10 +495,10 @@ async def test_tier_fastcom_happy_path(httpx_mock):
 
 
 async def test_tier_fastcom_no_targets(httpx_mock):
-    config = Speedtest()
+    config = Speedtest(fastcom_api_token="test_dummy_token")
     api_url = config.fastcom_api_url
     httpx_mock.add_response(
-        url=f"{api_url}?https=true&token=YXNkZmFzZGxmbnNkYWZoYXNkZmhrYWxm&urlCount=3",
+        url=f"{api_url}?https=true&token=test_dummy_token&urlCount=3",
         json={"targets": []},
     )
     async with httpx.AsyncClient() as client:
@@ -510,10 +510,10 @@ async def test_tier_fastcom_no_targets(httpx_mock):
 
 
 async def test_tier_fastcom_missing_urls(httpx_mock):
-    config = Speedtest()
+    config = Speedtest(fastcom_api_token="test_dummy_token")
     api_url = config.fastcom_api_url
     httpx_mock.add_response(
-        url=f"{api_url}?https=true&token=YXNkZmFzZGxmbnNkYWZoYXNkZmhrYWxm&urlCount=3",
+        url=f"{api_url}?https=true&token=test_dummy_token&urlCount=3",
         json={
             "targets": [
                 {"location": {"country": "US"}},
@@ -537,10 +537,10 @@ async def test_tier_fastcom_missing_urls(httpx_mock):
 
 
 async def test_tier_fastcom_api_error(httpx_mock):
-    config = Speedtest()
+    config = Speedtest(fastcom_api_token="test_dummy_token")
     api_url = config.fastcom_api_url
     httpx_mock.add_response(
-        url=f"{api_url}?https=true&token=YXNkZmFzZGxmbnNkYWZoYXNkZmhrYWxm&urlCount=3",
+        url=f"{api_url}?https=true&token=test_dummy_token&urlCount=3",
         status_code=500,
     )
     async with httpx.AsyncClient() as client:
@@ -550,10 +550,10 @@ async def test_tier_fastcom_api_error(httpx_mock):
 
 
 async def test_tier_fastcom_download_error(httpx_mock):
-    config = Speedtest()
+    config = Speedtest(fastcom_api_token="test_dummy_token")
     api_url = config.fastcom_api_url
     httpx_mock.add_response(
-        url=f"{api_url}?https=true&token=YXNkZmFzZGxmbnNkYWZoYXNkZmhrYWxm&urlCount=3",
+        url=f"{api_url}?https=true&token=test_dummy_token&urlCount=3",
         json={
             "targets": [
                 {