fix(connect): warn when TLS verification is disabled

src/posit/connect/client.py

@@ -2,8 +2,16 @@
 
 from __future__ import annotations
 
+import warnings
+
 from typing_extensions import TYPE_CHECKING, Optional, Union, overload
 
+_TLS_VERIFY_DISABLED_WARNING = (
+    "TLS certificate verification is disabled. This is insecure and should "
+    "not be used in production. Pass a path to a CA bundle via `verify=` "
+    "instead."
+)
+
 from . import hooks, me, urls
 from .auth import Auth, BootstrapAuth
 from .config import Config
@@ -169,6 +177,12 @@ def __init__(self, *args, **kwargs) -> None:
         >>> Client(url="https://connect.example.com", verify="/path/to/ca-bundle.crt")
         """
         verify = kwargs.pop("verify", True)
+        if verify is False:
+            warnings.warn(
+                _TLS_VERIFY_DISABLED_WARNING,
+                UserWarning,
+                stacklevel=2,
+            )
         api_key = None
         url = None
         if len(args) == 1 and isinstance(args[0], str):

tests/posit/connect/test_client.py

@@ -85,9 +85,43 @@ def test_verify_false(
         MockConfig: MagicMock,
         MockSession: MagicMock,
     ):
-        Client(url="https://connect.example.com", api_key="12345", verify=False)
+        with pytest.warns(UserWarning, match="TLS certificate verification is disabled"):
+            Client(url="https://connect.example.com", api_key="12345", verify=False)
         assert MockSession.return_value.verify is False
 
+    def test_verify_false_emits_warning(
+        self,
+        MockAuth: MagicMock,
+        MockConfig: MagicMock,
+        MockSession: MagicMock,
+    ):
+        with pytest.warns(UserWarning, match="TLS certificate verification is disabled"):
+            Client(url="https://connect.example.com", api_key="12345", verify=False)
+
+    def test_verify_true_no_warning(
+        self,
+        MockAuth: MagicMock,
+        MockConfig: MagicMock,
+        MockSession: MagicMock,
+    ):
+        import warnings as _warnings
+
+        with _warnings.catch_warnings():
+            _warnings.simplefilter("error")
+            Client(url="https://connect.example.com", api_key="12345", verify=True)
+
+    def test_verify_ca_bundle_no_warning(
+        self,
+        MockAuth: MagicMock,
+        MockConfig: MagicMock,
+        MockSession: MagicMock,
+    ):
+        import warnings as _warnings
+
+        with _warnings.catch_warnings():
+            _warnings.simplefilter("error")
+            Client(url="https://connect.example.com", api_key="12345", verify="/path/to/ca.crt")
+
     def test_verify_ca_bundle(
         self,
         MockAuth: MagicMock,