Fix DependencyTrack API request method (#30)

DT's sbom upload API supports POST for multipart/form-data and PUT for
application/json.

This patch changes the used method in the DT API call from POST to PUT,
to match the passed headers and data.

Also updates DESIGN.md to not mention the request method (it is an
implementation detail).

Signed-off-by: Lukas Puehringer <lukas.puehringer@eclipse-foundation.org>

Author: lukpueh

docs/DESIGN.md

@@ -52,7 +52,7 @@ sequenceDiagram
     IdP->>PIA: 7. Return JWKs
     PIA->>PIA: 8. Authenticate
     Note over PIA: - Verify token<br/>- Match claims with projects settings
-    PIA->>dp: 9. Post SBOM
+    PIA->>dp: 9. Upload SBOM
     dp-->>PIA: Success
     PIA-->>Publisher: Success
 ```
@@ -128,7 +128,7 @@ sequenceDiagram
 
    - see 3.1.1. Token Verification and Authentication Flow
 
-5. **SBOM Publishing**: PIA sends POST request to DependencyTrack:
+5. **SBOM Publishing**: PIA sends upload request to DependencyTrack:
 
    - `Content-Type`: `application/json`
    - `X-Api-Key`: Use internally stored, DependencyTrack access token
@@ -194,7 +194,7 @@ Content-Type: application/json
   - Issuer not allowed
   - No matching project found for token claims
 - `422 Unprocessable Entity`: Missing Authorization header or invalid JSON
-- `502`: DependencyTrack post request failed
+- `502`: DependencyTrack upload request failed
 - `*`: Relay DependencyTrack status code
 
 

pia/dependencytrack.py

@@ -23,7 +23,7 @@ def upload_sbom(
     }
 
     try:
-        response = requests.post(
+        response = requests.put(
             url,
             json=payload.to_dict(),
             headers=headers,

tests/test_dependencytrack.py

@@ -25,17 +25,17 @@ def dt_payload():
 
 
 class TestUploadSBOM:
-    @patch("pia.dependencytrack.requests.post")
-    def test_upload(self, mock_post, dt_payload):
+    @patch("pia.dependencytrack.requests.put")
+    def test_upload(self, mock_put, dt_payload):
         """Test request and response."""
-        mock_post.return_value = "mock_response"
+        mock_put.return_value = "mock_response"
         result = upload_sbom(TEST_URL, TEST_API_KEY, dt_payload)
 
         # Assert result is request response
         assert result == "mock_response"
 
         # Assert request was made correctly
-        mock_post.assert_called_once_with(
+        mock_put.assert_called_once_with(
             "https://dt.example.com/api/v1/bom",
             json={
                 "projectName": "test-product",
@@ -51,10 +51,10 @@ def test_upload(self, mock_post, dt_payload):
             },
         )
 
-    @patch("pia.dependencytrack.requests.post")
-    def test_upload_request_exception(self, mock_post, dt_payload):
+    @patch("pia.dependencytrack.requests.put")
+    def test_upload_request_exception(self, mock_put, dt_payload):
         """Test error handling."""
-        mock_post.side_effect = requests.RequestException()
+        mock_put.side_effect = requests.RequestException()
 
         with pytest.raises(
             DependencyTrackError, match="Failed to upload SBOM to DependencyTrack"