fix(expectations): tolerate null inject_expectation_signatures

[Seb-MIGUEL]

Problem

The SentinelOne collector (and any collector polling detection/prevention expectations) stops processing with:

ERROR [CollectorExpectationManager] Error fetching expectations: 1 validation error for PreventionExpectation
inject_expectation_signatures
  Input should be a valid list [type=list_type, input_value=None, input_type=NoneType]

The collector logs Fetched 0 expectations and never matches any alert.

Ref: OpenAEV-Platform/collectors#490

Root cause

Expectation.inject_expectation_signatures was declared as a required, non-nullable List[ExpectationSignature]. The platform serializes this field as null when an expectation has no computed signatures. Because expectations_models_for_source builds every model in a single loop, one such expectation raises a ValidationError that aborts the entire batch fetch — so even valid expectations are never returned.

Fix

• inject_expectation_signatures now defaults to an empty list and a mode="before" validator coerces null → [].
• A single signature-less expectation is parsed as having no signatures instead of crashing the whole batch.

Tests

• Added regression tests: null → [], missing key → [], provided signatures preserved.
• Full suite green (169 passed), black/isort clean, no new mypy errors on the changed file.

Note

This makes the client resilient to null signatures (stops the crash / batch abort). It does not by itself make alerts validate when signatures are genuinely empty — matching requires non-empty signatures, which is a platform-side concern (why signatures are null on the affected environment is being investigated separately).

[github-actions]

Thank you for your contribution. This PR is but one step away from being ready for merging: all commits must be PGP-signed. To get started, please see https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits

[Copilot]

Pull request overview

This PR makes the inject expectation models resilient to inject_expectation_signatures being serialized as null by coercing None → [], preventing a single malformed expectation from aborting batch expectation fetches (per collectors#490).

Changes:

• Default Expectation.inject_expectation_signatures to an empty list via default_factory=list.
• Add a Pydantic mode="before" field validator to coerce None signatures to [].
• Add regression tests covering null → [], missing key defaulting to [], and preserving provided signatures.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
test/apis/expectation/test_expectation.py	Adds regression tests ensuring inject_expectation_signatures tolerates None/missing and preserves provided values.
pyoaev/apis/inject_expectation/model/expectation.py	Implements None → [] coercion and defaults signatures to an empty list to prevent batch parsing failures.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[guzmud]

LGTM