chore: ruff check + ruff format pass

Apply ruff's safe fixes and format the entire codebase so CI's
'ruff check' and 'ruff format --check' steps are green.

Notable changes:
- Replace typing.List with list[] (PEP 585).
- Replace (str, Enum) classes with StrEnum (Python 3.11+).
- Drop unused typing imports.
- Reformat all touched files to ruff's default style.

No behavior change. 29/29 tests still pass, smoke test still passes.

Author: frangelbarrera

scripts/smoke_test.py

@@ -5,6 +5,7 @@
     ADMIN_PASSWORD="StrongTestAdminPass123!" \
     venv/bin/python scripts/smoke_test.py
 """
+
 from __future__ import annotations
 
 import asyncio
@@ -96,17 +97,13 @@ async def main() -> int:
             if r.status_code != 200:
                 failures.append(f"GET /api/v1/user/me/ returned {r.status_code}, expected 200")
             if "private" not in cache_ctrl_authed.lower():
-                failures.append(
-                    f"cache-control on authed request was {cache_ctrl_authed!r}, expected private"
-                )
+                failures.append(f"cache-control on authed request was {cache_ctrl_authed!r}, expected private")
 
             # --- list users still requires admin (403 for non-admin) ----------
             r = await c.get("/api/v1/users", headers=auth)
             print(f"GET  /api/v1/users (non-admin)           -> {r.status_code} {r.text[:120]}")
             if r.status_code != 403:
-                failures.append(
-                    f"GET /api/v1/users as non-admin returned {r.status_code}, expected 403"
-                )
+                failures.append(f"GET /api/v1/users as non-admin returned {r.status_code}, expected 403")
 
             # --- /execute-command should be gone (replaced by /command) -------
             r = await c.post(
@@ -116,9 +113,7 @@ async def main() -> int:
             )
             print(f"POST .../execute-command (deprecated)    -> {r.status_code} {r.text[:120]}")
             if r.status_code != 404:
-                failures.append(
-                    f"POST /execute-command returned {r.status_code}, expected 404 (endpoint removed)"
-                )
+                failures.append(f"POST /execute-command returned {r.status_code}, expected 404 (endpoint removed)")
 
             # --- /docs should be available in LOCAL ---------------------------
             r = await c.get("/docs")

src/app/admin/initialize.py

@@ -1,13 +1,11 @@
-from typing import Optional
-
 from crudadmin import CRUDAdmin
 
 from ..core.config import EnvironmentOption, settings
 from ..core.db.database import async_get_db
 from .views import register_admin_views
 
 
-def create_admin_interface() -> Optional[CRUDAdmin]:
+def create_admin_interface() -> CRUDAdmin | None:
     """Create and configure the admin interface."""
     if not settings.CRUD_ADMIN_ENABLED:
         return None

src/app/admin/views.py

@@ -1,8 +1,5 @@
-from typing import Annotated
-
 from crudadmin import CRUDAdmin
 from crudadmin.admin_interface.model_view import PasswordTransformer
-from pydantic import BaseModel, Field
 
 from ..core.security import get_password_hash
 from ..models.tier import Tier

src/app/api/v1/logout.py

@@ -1,5 +1,3 @@
-from typing import Optional
-
 from fastapi import APIRouter, Cookie, Depends, Response
 from jose import JWTError
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -15,7 +13,7 @@
 async def logout(
     response: Response,
     access_token: str = Depends(oauth2_scheme),
-    refresh_token: Optional[str] = Cookie(None, alias="refresh_token"),
+    refresh_token: str | None = Cookie(None, alias="refresh_token"),
     db: AsyncSession = Depends(async_get_db),
 ) -> dict[str, str]:
     try:

src/app/api/v1/security_agents.py

@@ -1,5 +1,4 @@
 import uuid
-from typing import List
 
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -14,14 +13,15 @@
 router = APIRouter(prefix="/security-agents", tags=["security-agents"])
 
 
-@router.get("/", response_model=List[SecurityAgentRead], dependencies=[Depends(get_current_user)])
+@router.get("/", response_model=list[SecurityAgentRead], dependencies=[Depends(get_current_user)])
 async def get_security_agents(db: AsyncSession = Depends(async_get_db)):
     agents = await crud_security_agent.get_multi(db)
     return agents
 
 
-@router.post("/{agent_id}/command", response_model=CommandTaskRead, status_code=201,
-             dependencies=[Depends(get_current_user)])
+@router.post(
+    "/{agent_id}/command", response_model=CommandTaskRead, status_code=201, dependencies=[Depends(get_current_user)]
+)
 async def register_command(
     agent_id: str,
     command: CommandTaskCreate,
@@ -47,8 +47,9 @@ async def register_command(
     return task
 
 
-@router.get("/{agent_id}/task-status/{task_id}", response_model=CommandTaskRead,
-            dependencies=[Depends(get_current_user)])
+@router.get(
+    "/{agent_id}/task-status/{task_id}", response_model=CommandTaskRead, dependencies=[Depends(get_current_user)]
+)
 async def get_task_status(agent_id: str, task_id: str, db: AsyncSession = Depends(async_get_db)):
     task = await crud_command_task.get(db, task_id)
     if not task or task.agent_id != agent_id:

src/app/api/v1/users.py

@@ -41,8 +41,7 @@ async def write_user(
     return created_user
 
 
-@router.get("/users", response_model=PaginatedListResponse[UserRead],
-            dependencies=[Depends(get_current_superuser)])
+@router.get("/users", response_model=PaginatedListResponse[UserRead], dependencies=[Depends(get_current_superuser)])
 async def read_users(
     request: Request, db: Annotated[AsyncSession, Depends(async_get_db)], page: int = 1, items_per_page: int = 10
 ) -> dict:
@@ -62,8 +61,7 @@ async def read_users_me(request: Request, current_user: Annotated[dict, Depends(
     return current_user
 
 
-@router.get("/user/{username}", response_model=UserRead,
-            dependencies=[Depends(get_current_user)])
+@router.get("/user/{username}", response_model=UserRead, dependencies=[Depends(get_current_user)])
 async def read_user(
     request: Request, username: str, db: Annotated[AsyncSession, Depends(async_get_db)]
 ) -> dict[str, Any]:

src/app/core/config.py

@@ -1,10 +1,9 @@
 import os
-from enum import Enum
+from enum import StrEnum
 
-from pydantic import SecretStr, field_validator, model_validator, computed_field
+from pydantic import SecretStr, field_validator, model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
-
 # Known-insecure default values that must never be used outside LOCAL env.
 _INSECURE_SECRET_KEY_DEFAULT = "secret-key"
 _INSECURE_ADMIN_PASSWORD_DEFAULT = "!Ch4ng3Th1sP4ssW0rd!"
@@ -46,8 +45,7 @@ class FirstUserSettings(BaseSettings):
     ADMIN_PASSWORD: str = _INSECURE_ADMIN_PASSWORD_DEFAULT
 
 
-class TestSettings(BaseSettings):
-    ...
+class TestSettings(BaseSettings): ...
 
 
 class ClientSideCacheSettings(BaseSettings):
@@ -81,7 +79,7 @@ class CRUDAdminSettings(BaseSettings):
     CRUD_ADMIN_REDIS_SSL: bool = False
 
 
-class EnvironmentOption(str, Enum):
+class EnvironmentOption(StrEnum):
     LOCAL = "local"
     STAGING = "staging"
     PRODUCTION = "production"
@@ -125,13 +123,13 @@ def _validate_secret_key(cls, v: SecretStr) -> SecretStr:
         if v.get_secret_value() == _INSECURE_SECRET_KEY_DEFAULT:
             raise ValueError(
                 "SECRET_KEY is set to the known-insecure placeholder 'secret-key'. "
-                "Generate a strong key with: python -c \"import secrets; print(secrets.token_urlsafe(32))\" "
+                'Generate a strong key with: python -c "import secrets; print(secrets.token_urlsafe(32))" '
                 "and set it as the SECRET_KEY env var."
             )
         if len(v.get_secret_value()) < 32:
             raise ValueError(
                 f"SECRET_KEY must be at least 32 characters long (got {len(v.get_secret_value())}). "
-                "Use: python -c \"import secrets; print(secrets.token_urlsafe(32))\""
+                'Use: python -c "import secrets; print(secrets.token_urlsafe(32))"'
             )
         return v
 
@@ -144,9 +142,7 @@ def _validate_admin_password(cls, v: str) -> str:
                 "Set a strong, unique password via the ADMIN_PASSWORD env var."
             )
         if len(v) < 12:
-            raise ValueError(
-                f"ADMIN_PASSWORD must be at least 12 characters long (got {len(v)})."
-            )
+            raise ValueError(f"ADMIN_PASSWORD must be at least 12 characters long (got {len(v)}).")
         return v
 
     @model_validator(mode="after")
@@ -160,13 +156,11 @@ def _validate_cors_for_environment(self) -> "Settings":
                 )
             if "*" in self.CORS_METHODS:
                 raise ValueError(
-                    "CORS_METHODS cannot contain '*' in non-LOCAL environments. "
-                    "List explicit HTTP methods."
+                    "CORS_METHODS cannot contain '*' in non-LOCAL environments. List explicit HTTP methods."
                 )
             if "*" in self.CORS_HEADERS:
                 raise ValueError(
-                    "CORS_HEADERS cannot contain '*' in non-LOCAL environments. "
-                    "List explicit header names."
+                    "CORS_HEADERS cannot contain '*' in non-LOCAL environments. List explicit header names."
                 )
         return self
 

src/app/core/security.py

@@ -1,6 +1,6 @@
 import hashlib
-from datetime import datetime, timedelta, timezone
-from enum import Enum
+from datetime import UTC, datetime, timedelta
+from enum import StrEnum
 from typing import Any, Literal
 
 import anyio
@@ -28,7 +28,7 @@
 oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/v1/login")
 
 
-class TokenType(str, Enum):
+class TokenType(StrEnum):
     ACCESS = "access"
     REFRESH = "refresh"
 
@@ -70,9 +70,7 @@ async def get_password_hash_async(password: str) -> str:
     return await anyio.to_thread.run_sync(get_password_hash, password)
 
 
-async def authenticate_user(
-    username_or_email: str, password: str, db: AsyncSession
-) -> dict[str, Any] | Literal[False]:
+async def authenticate_user(username_or_email: str, password: str, db: AsyncSession) -> dict[str, Any] | Literal[False]:
     if "@" in username_or_email:
         db_user = await crud_users.get(db=db, email=username_or_email, is_deleted=False)
     else:
@@ -93,7 +91,7 @@ async def authenticate_user(
 
 async def create_access_token(data: dict[str, Any], expires_delta: timedelta | None = None) -> str:
     to_encode = data.copy()
-    expire = datetime.now(timezone.utc) + (
+    expire = datetime.now(UTC) + (
         expires_delta if expires_delta is not None else timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
     )
     to_encode.update({"exp": expire, "token_type": TokenType.ACCESS})
@@ -103,7 +101,7 @@ async def create_access_token(data: dict[str, Any], expires_delta: timedelta | N
 
 async def create_refresh_token(data: dict[str, Any], expires_delta: timedelta | None = None) -> str:
     to_encode = data.copy()
-    expire = datetime.now(timezone.utc) + (
+    expire = datetime.now(UTC) + (
         expires_delta if expires_delta is not None else timedelta(days=REFRESH_TOKEN_EXPIRE_DAYS)
     )
     to_encode.update({"exp": expire, "token_type": TokenType.REFRESH})
@@ -160,7 +158,5 @@ async def blacklist_token(token: str, db: AsyncSession) -> None:
     if exp_timestamp is None:
         return
 
-    expires_at = datetime.fromtimestamp(int(exp_timestamp), tz=timezone.utc)
-    await crud_token_blacklist.create(
-        db, object=TokenBlacklistCreate(token=token, expires_at=expires_at)
-    )
+    expires_at = datetime.fromtimestamp(int(exp_timestamp), tz=UTC)
+    await crud_token_blacklist.create(db, object=TokenBlacklistCreate(token=token, expires_at=expires_at))

src/app/core/setup.py

@@ -19,7 +19,6 @@
     DatabaseSettings,
     EnvironmentOption,
     EnvironmentSettings,
-    settings,
 )
 from .db.database import Base
 from .db.database import async_engine as engine
@@ -38,13 +37,7 @@ async def set_threadpool_tokens(number_of_tokens: int = 100) -> None:
 
 
 def lifespan_factory(
-    settings: (
-        DatabaseSettings
-        | AppSettings
-        | ClientSideCacheSettings
-        | CORSSettings
-        | EnvironmentSettings
-    ),
+    settings: (DatabaseSettings | AppSettings | ClientSideCacheSettings | CORSSettings | EnvironmentSettings),
     create_tables_on_start: bool = True,
 ) -> Callable[[FastAPI], _AsyncGeneratorContextManager[Any]]:
     """Factory to create a lifespan async context manager for a FastAPI app."""
@@ -77,13 +70,7 @@ async def lifespan(app: FastAPI) -> AsyncGenerator:
 # -------------- application --------------
 def create_application(
     router: APIRouter,
-    settings: (
-        DatabaseSettings
-        | AppSettings
-        | ClientSideCacheSettings
-        | CORSSettings
-        | EnvironmentSettings
-    ),
+    settings: (DatabaseSettings | AppSettings | ClientSideCacheSettings | CORSSettings | EnvironmentSettings),
     create_tables_on_start: bool = True,
     lifespan: Callable[[FastAPI], _AsyncGeneratorContextManager[Any]] | None = None,
     **kwargs: Any,

src/app/crud/crud_command_task.py

@@ -1,43 +1,41 @@
-from typing import List
-
-from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy.future import select
-
-from ..models.command_task import CommandTask
-from ..schemas.command_task import CommandTaskCreate, CommandTaskUpdate
-
-
-class CRUDCommandTask:
-    async def create(self, db: AsyncSession, obj_in: CommandTaskCreate, agent_id: str, task_id: str) -> CommandTask:
-        db_obj = CommandTask(task_id=task_id, agent_id=agent_id, **obj_in.model_dump())
-        db.add(db_obj)
-        await db.commit()
-        await db.refresh(db_obj)
-        return db_obj
-
-    async def get(self, db: AsyncSession, task_id: str) -> CommandTask | None:
-        result = await db.execute(select(CommandTask).where(CommandTask.task_id == task_id))
-        return result.scalars().first()
-
-    async def get_by_agent(self, db: AsyncSession, agent_id: str) -> List[CommandTask]:
-        result = await db.execute(select(CommandTask).where(CommandTask.agent_id == agent_id))
-        return list(result.scalars().all())
-
-    async def update(self, db: AsyncSession, db_obj: CommandTask, obj_in: CommandTaskUpdate) -> CommandTask:
-        update_data = obj_in.model_dump(exclude_unset=True)
-        for field, value in update_data.items():
-            setattr(db_obj, field, value)
-        await db.commit()
-        await db.refresh(db_obj)
-        return db_obj
-
-    async def remove(self, db: AsyncSession, task_id: str) -> CommandTask | None:
-        result = await db.execute(select(CommandTask).where(CommandTask.task_id == task_id))
-        db_obj = result.scalars().first()
-        if db_obj:
-            await db.delete(db_obj)
-            await db.commit()
-        return db_obj
-
-
-crud_command_task = CRUDCommandTask()
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.future import select
+
+from ..models.command_task import CommandTask
+from ..schemas.command_task import CommandTaskCreate, CommandTaskUpdate
+
+
+class CRUDCommandTask:
+    async def create(self, db: AsyncSession, obj_in: CommandTaskCreate, agent_id: str, task_id: str) -> CommandTask:
+        db_obj = CommandTask(task_id=task_id, agent_id=agent_id, **obj_in.model_dump())
+        db.add(db_obj)
+        await db.commit()
+        await db.refresh(db_obj)
+        return db_obj
+
+    async def get(self, db: AsyncSession, task_id: str) -> CommandTask | None:
+        result = await db.execute(select(CommandTask).where(CommandTask.task_id == task_id))
+        return result.scalars().first()
+
+    async def get_by_agent(self, db: AsyncSession, agent_id: str) -> list[CommandTask]:
+        result = await db.execute(select(CommandTask).where(CommandTask.agent_id == agent_id))
+        return list(result.scalars().all())
+
+    async def update(self, db: AsyncSession, db_obj: CommandTask, obj_in: CommandTaskUpdate) -> CommandTask:
+        update_data = obj_in.model_dump(exclude_unset=True)
+        for field, value in update_data.items():
+            setattr(db_obj, field, value)
+        await db.commit()
+        await db.refresh(db_obj)
+        return db_obj
+
+    async def remove(self, db: AsyncSession, task_id: str) -> CommandTask | None:
+        result = await db.execute(select(CommandTask).where(CommandTask.task_id == task_id))
+        db_obj = result.scalars().first()
+        if db_obj:
+            await db.delete(db_obj)
+            await db.commit()
+        return db_obj
+
+
+crud_command_task = CRUDCommandTask()