feat(pan-cortex-xdr-intel): implement Cortex XDR API client with advanced authentication (#7184)

[Pauline Eustachy (Powlinett)]

Proposed changes

• Implement CortexXdrClient (src/cortex_xdr_client/client.py) on top of connectors_sdk.BaseClientApi, with Advanced API key authentication (x-xdr-auth-id, x-xdr-timestamp, x-xdr-nonce, Authorization headers, freshly generated per request to prevent replay attacks)
• Add upsert_indicator/delete_indicator methods, request bodies validated and serialized via new Pydantic models (models.py) and a datetime_to_utc helper (utils.py)
• Add typed client exceptions (exceptions.py): CortexXdrRequestBodyError and CortexXdrApiError, wrapping SDK/validation errors
• Reuse the connector's own helper.connector_logger for consistent, structured client logging, via setter injection after construction, keeping CortexXdrClient's 3-parameter constructor frozen (per the feat(pan-cortex-xdr-intel): bootstrap bare skeleton and freeze concrete class contracts #7182 contract)
• Add unit tests covering auth header generation (shape, hash correctness, freshness), request payload shapes, and error propagation

Related issues

• Close feat(pan-cortex-xdr-intel): implement Cortex XDR client with advanced auth in src/api_client #7184

Checklist

• I consider the submitted work as finished
• I have signed my commits using GPG key.
• I tested the code for its functionality using different use cases
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality

Further comments

This PR is stacked on top of #7292 and #7293, and targets feat/2690-pan-cortex-xdr-intel-new-connector as its base branch, not master, following the same pattern as its predecessors. CortexXdrClient's 3-parameter constructor (api_base_url, api_key_id, api_key) remains frozen and unchanged from #7182.

While implementing this client, a pre-existing bug was found in connectors_sdk.BaseClientApi._parse_response (it does not wrap malformed JSON body errors for application/json responses). This is out of scope here and tracked separately in #7299 to be fixed upstream in the SDK.

[codecov]

Codecov Report

❌ Patch coverage is 93.33333% with 5 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...n-cortex-xdr-intel/src/cortex_xdr_client/client.py	90.69%	4 Missing ⚠️
...an-cortex-xdr-intel/src/cortex_xdr_client/utils.py	80.00%	1 Missing ⚠️

Additional details and impacted files

@@                                 Coverage Diff                                 @@
##           feat/7183-pan-cortex-xdr-intel-settings-runtime    #7309      +/-   ##
===================================================================================
+ Coverage                                            85.67%   86.52%   +0.85%     
===================================================================================
  Files                                                    9       12       +3     
  Lines                                                  691      757      +66     
===================================================================================
+ Hits                                                   592      655      +63     
- Misses                                                  99      102       +3     

Files with missing lines	Coverage Δ
...rtex-xdr-intel/src/cortex_xdr_client/exceptions.py	100.00% <100.00%> (ø)
...n-cortex-xdr-intel/src/cortex_xdr_client/models.py	100.00% <100.00%> (ø)
...an-cortex-xdr-intel/src/cortex_xdr_client/utils.py	80.00% <80.00%> (ø)
...n-cortex-xdr-intel/src/cortex_xdr_client/client.py	90.90% <90.69%> (+10.90%)	⬆️

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR implements the Cortex XDR low-level API client for the stream/pan-cortex-xdr-intel connector, including Advanced API key authentication, typed request/response models, and unit tests to validate request shapes and error behavior.

Changes:

• Implement CortexXdrClient on top of connectors_sdk.BaseClientApi, including per-request Advanced auth header generation and upsert/delete indicator methods.
• Add Pydantic models (IndicatorData, IndicatorFilters), a datetime_to_utc helper, and typed client exceptions.
• Add unit tests for auth header generation, payload serialization, and error propagation; wire the connector to inject the helper’s logger into the client.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
stream/pan-cortex-xdr-intel/src/cortex_xdr_client/client.py	Implements the API client, auth header generation, and upsert/delete methods with error wrapping.
stream/pan-cortex-xdr-intel/src/cortex_xdr_client/models.py	Adds Pydantic request-body models and datetime serialization for API payloads.
stream/pan-cortex-xdr-intel/src/cortex_xdr_client/utils.py	Adds a helper to normalize datetimes to UTC prior to serialization.
stream/pan-cortex-xdr-intel/src/cortex_xdr_client/exceptions.py	Introduces typed client exceptions for validation and API failures.
stream/pan-cortex-xdr-intel/src/connector/connector.py	Injects the connector helper logger into the client for consistent logging.
stream/pan-cortex-xdr-intel/tests/tests_cortex_xdr_client/test_client.py	Adds unit tests for auth headers, request payloads, and error propagation/logging.
stream/pan-cortex-xdr-intel/tests/test_main.py	Extends main wiring test to assert logger injection into the client.

Suppressed comments (2)

stream/pan-cortex-xdr-intel/src/cortex_xdr_client/client.py:139

• This logger.error(msg, dict) call has the same stdlib logging.Logger incompatibility as in upsert_indicator (extra positional args without % placeholders can raise TypeError).

        except ValidationError as err:
            self.logger.error("Invalid request's body", {"error": str(err)})
            raise CortexXdrRequestBodyError("Invalid request's body") from err

stream/pan-cortex-xdr-intel/src/cortex_xdr_client/client.py:155

• Same as upsert_indicator: malformed JSON in a successful application/json response currently raises ValueError from BaseClientApi._parse_response() and will bypass this ApiClientError wrapper. Also, logger.error(msg, dict) is not stdlib-logger safe and can raise TypeError, masking the real error.

        except ApiClientError as err:
            self.logger.error(
                "Error while fetching Cortex XDR API", {"error": str(err)}
            )
            raise CortexXdrApiError("Error while fetching Cortex XDR API") from err

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.