pyproject.toml

[build-system]
requires = ["setuptools>=68"]
build-backend = "setuptools.build_meta"

[project]
name = "queer-the-stacks"
version = "0.1.0"
description = "A self-hosted, read-only reading dashboard + ethical recommender over your Calibre + KOReader stack."
readme = "README.md"
requires-python = ">=3.14"
license = { text = "AGPL-3.0-or-later" }
authors = [{ name = "Chelsea" }]
dependencies = [
    "requests>=2.33",
]

[project.optional-dependencies]
app = [
    "fastapi>=0.110",
    "uvicorn>=0.27",
    # starlette is a FastAPI transitive; floor raised above the fixed release so
    # the resolver can never select a vulnerable build (installs are unpinned).
    # PYSEC-2026-249 (fix 1.3.0) + PYSEC-2026-248 (fix 1.3.1) → require >=1.3.1.
    "starlette>=1.3.1",
    # Required by Starlette's Request.form() even for urlencoded bodies (the
    # /login POST form) — Starlette asserts its presence at parse time.
    "python-multipart>=0.0.9",
]
dev = [
    "pytest>=8",
    "pytest-cov>=5",
    "ruff>=0.15",
    "mypy>=1.18",
    "types-requests",
    "pip-audit>=2.7",
    "httpx>=0.27",          # FastAPI TestClient transport
    # msgpack is a pip-audit→CacheControl transitive; floor raised above the
    # fixed release. GHSA-6v7p-g79w-8964 → require >=1.2.1.
    "msgpack>=1.2.1",
    # Load-smoke gate (Quality §2, merge-blocking): tests/perf/locustfile.py,
    # driven headlessly by scripts/perf-smoke.sh / `make perf-load`.
    "locust>=2.29",
]

[project.scripts]
stacks = "ingest.cli:main"

[tool.setuptools]
packages = ["ingest", "recommender", "app"]

[tool.setuptools.package-data]
ingest = ["py.typed"]
recommender = ["py.typed"]
app = ["py.typed"]

# ---------------------------------------------------------------------------
# Lint / format gate (QUALITY-AND-METRICS-STANDARD §7, CI stage 1)
# ---------------------------------------------------------------------------
[tool.ruff]
line-length = 100
target-version = "py314"
src = ["ingest", "recommender", "app", "tests"]

[tool.ruff.lint]
# pycodestyle, pyflakes, isort, bugbear, comprehensions, pyupgrade, simplify,
# flake8-print (no stray prints), flake8-bandit (S) for a light SAST subset,
# mccabe (C90) for a cyclomatic-complexity gate.
select = ["E", "F", "I", "B", "C4", "UP", "SIM", "T20", "S", "C90"]
# S101: assert is allowed in tests (scoped per-file below).
# UP045/UP007: keep explicit `Optional[...]` for readability over `X | None`.
ignore = ["S101", "UP045", "UP007"]

[tool.ruff.lint.mccabe]
max-complexity = 10

[tool.ruff.lint.per-file-ignores]
"tests/*" = ["S101", "S105", "S106", "S311", "S314"]  # asserts, dummy secrets, demo RNG,
                                                       # stdlib XML parse of our own output
"ingest/cli.py" = ["T20"]                     # CLI prints to stdout by design
"app/build_static.py" = ["T20"]              # build script prints its output path

# ---------------------------------------------------------------------------
# Type-check gate (CI stage 2) — strict.
# ---------------------------------------------------------------------------
[tool.mypy]
python_version = "3.14"
strict = true
warn_unused_configs = true
disallow_untyped_defs = true
disallow_any_generics = true
no_implicit_optional = true
warn_redundant_casts = true
warn_return_any = true
files = ["ingest", "recommender", "app"]

[[tool.mypy.overrides]]
# Third-party libs without stubs shipped here — don't fail strict on them.
module = ["fastapi.*"]
ignore_missing_imports = true

# ---------------------------------------------------------------------------
# Test + coverage gate (CI stage 3)
# Coverage is measured on everything a reader can reach: ingest + recommender +
# app, including the FastAPI wiring in app/server.py (exercised via TestClient
# in tests/test_auth.py and tests/test_server_lifecycle.py) and ingest/cli.py
# (exercised in tests/test_lists_cli.py, tests/test_cli_recommend.py, and
# tests/test_cli_export.py). Only app/build_static.py is omitted; see below.
# ---------------------------------------------------------------------------
[tool.pytest.ini_options]
addopts = [
    "--strict-markers",
    "--strict-config",
    "--import-mode=importlib",
    "--cov=ingest",
    "--cov=recommender",
    "--cov=app",
    "--cov-branch",
    "--cov-report=term-missing",
    "--cov-report=xml:docs/audits/coverage.xml",
    "--cov-fail-under=85",
    "-ra",
]
testpaths = ["tests"]
filterwarnings = [
    "error::DeprecationWarning:ingest.*",
    "error::DeprecationWarning:recommender.*",
    "error::DeprecationWarning:app.*",
    # Upstream: starlette's TestClient now prefers the `httpx2` transport over
    # `httpx`; unrelated to this project's code. Silence the noise.
    "ignore:Using `httpx` with `starlette.testclient`",
]

[tool.coverage.run]
branch = true
omit = [
    # Genuinely thin: 44 lines that render three documents to disk, and the
    # a11y gate fails loudly if any of them stops being produced, which is a
    # stronger check than a coverage percentage would be.
    "app/build_static.py",
]
# ingest/cli.py used to be omitted here as "thin argparse glue". It is 503
# lines carrying real behaviour (refresh, doctor, import/export, list
# authoring), it already has three dedicated test files, and it measured 57%
# — the least-covered module in the project, sitting outside the denominator
# the 85% gate is computed from. Including it moves the reported total from
# ~96.9% to ~94.4%, still comfortably over the floor, and makes a CLI
# regression something the gate can actually see.

[tool.coverage.report]
# The genuinely untestable live-network glue is pragma-excluded at its class;
# parsers it feeds are unit-tested via fixtures.
exclude_lines = [
    "pragma: no cover",
    "if TYPE_CHECKING:",
    "raise NotImplementedError",
    "if __name__ == .__main__.:",
]