fix: parse PUSHER_USE_SSL env var as boolean string

keep/api/core/dependencies.py

@@ -65,6 +65,18 @@ def get_pusher_client() -> Pusher | None:
         logger.debug("Pusher is disabled or missing environment variables")
         return None
 
+    try:
+        pusher_use_ssl = config("PUSHER_USE_SSL", default=False, cast=bool)
+    except ValueError:
+        # Unrecognized values previously enabled SSL, so keep SSL on
+        # (fail-secure) rather than silently downgrading to plaintext.
+        logger.warning(
+            "Invalid PUSHER_USE_SSL value, keeping SSL enabled. "
+            "Use 'true' or 'false'.",
+            extra={"pusher_use_ssl": os.environ.get("PUSHER_USE_SSL")},
+        )
+        pusher_use_ssl = True
+
     # TODO: defaults on open source no docker
     try:
         pusher = Pusher(
@@ -77,7 +89,7 @@ def get_pusher_client() -> Pusher | None:
             app_id=pusher_app_id,
             key=pusher_app_key,
             secret=pusher_app_secret,
-            ssl=False if os.environ.get("PUSHER_USE_SSL", False) is False else True,
+            ssl=pusher_use_ssl,
             cluster=os.environ.get("PUSHER_CLUSTER"),
         )
     except ValueError:

tests/test_pusher_client.py

@@ -0,0 +1,55 @@
+import pytest
+
+from keep.api.core import dependencies
+
+
+class FakePusher:
+    def __init__(self, **kwargs):
+        self.kwargs = kwargs
+
+
+@pytest.fixture
+def pusher_env(monkeypatch):
+    monkeypatch.setattr(dependencies, "Pusher", FakePusher)
+    monkeypatch.setenv("PUSHER_APP_ID", "1")
+    monkeypatch.setenv("PUSHER_APP_KEY", "test-key")
+    monkeypatch.setenv("PUSHER_APP_SECRET", "test-secret")
+    monkeypatch.delenv("PUSHER_DISABLED", raising=False)
+    monkeypatch.delenv("PUSHER_USE_SSL", raising=False)
+
+
+@pytest.mark.parametrize(
+    "value,expected",
+    [
+        ("false", False),
+        ("False", False),
+        ("0", False),
+        ("true", True),
+        ("True", True),
+        ("1", True),
+    ],
+)
+def test_pusher_use_ssl_parsed_from_string(pusher_env, monkeypatch, value, expected):
+    """PUSHER_USE_SSL is always a string when set via docker-compose/k8s env."""
+    monkeypatch.setenv("PUSHER_USE_SSL", value)
+    client = dependencies.get_pusher_client()
+    assert client is not None
+    assert client.kwargs["ssl"] is expected
+
+
+def test_pusher_use_ssl_defaults_to_false(pusher_env):
+    client = dependencies.get_pusher_client()
+    assert client is not None
+    assert client.kwargs["ssl"] is False
+
+
+@pytest.mark.parametrize("value", ["yes", "on", "not-a-bool", ""])
+def test_pusher_use_ssl_unrecognized_value_keeps_ssl_enabled(
+    pusher_env, monkeypatch, value
+):
+    """Any set-but-unrecognized value enabled SSL before the fix, so keep
+    SSL on (fail-secure) instead of silently downgrading to plaintext."""
+    monkeypatch.setenv("PUSHER_USE_SSL", value)
+    client = dependencies.get_pusher_client()
+    assert client is not None
+    assert client.kwargs["ssl"] is True