From 86188385cbdae1ee90c1dca7a7b9db2edef1ecd4 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Sat, 19 Sep 2026 14:24:13 +0200 Subject: style: ruff's own fixes, mechanically applied MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `ruff check .` had gone unrun long enough to report 568 errors, which is the same as having no linter: the next real finding would have been invisible in the noise. This is the 521 it fixes by itself, in 173 files, and nothing else — the 98 it cannot fix are the next commit. What actually changed: import sorting (225), imports nobody used (87, none of them a re-export — no `__init__.py` is touched, which was the one way this could have broken an import elsewhere), `datetime.timezone.utc` to `datetime.UTC` (69) and `asyncio.TimeoutError` to `TimeoutError` (18), both plain aliases on the 3.12 this project requires, `Optional[X]` to `X | None` (24), and f-strings with nothing to interpolate (19). Checked rather than assumed: every module in the three packages still imports, and the suite is 2893 passed — the same count, test for test, as the merge before it. Co-Authored-By: Claude Opus 5 --- .../tests/test_security_regressions.py | 30 ++++++++++++++-------- 1 file changed, 19 insertions(+), 11 deletions(-) (limited to 'packages/meshbay-node/tests/test_security_regressions.py') diff --git a/packages/meshbay-node/tests/test_security_regressions.py b/packages/meshbay-node/tests/test_security_regressions.py index d6ecb71..bfe25b9 100644 --- a/packages/meshbay-node/tests/test_security_regressions.py +++ b/packages/meshbay-node/tests/test_security_regressions.py @@ -9,20 +9,18 @@ only ever exercised happy paths, never an authorization boundary. If one of these starts failing, a fix has been reverted. Do not "fix" the test. """ -import base64 import struct from pathlib import Path import pytest from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey - from meshbay_common.crypto import generate_gek -from meshbay_common.protocol import IndexEntry from meshbay_node.indexer.group_index import GroupIndex from meshbay_node.roots import RootSet -from conftest import one_root, opened_ack, sealed_upload from meshbay_node.transport.webrtc_server import WebRTCPeerSession +from conftest import one_root, opened_ack, sealed_upload + def _safe_name_re(): """ @@ -64,7 +62,7 @@ def test_daemon_exposes_no_plaintext_listener(): C1: the daemon must not bind anything that serves content without a handshake. NodeConfig no longer carries an HTTP port at all. """ - from meshbay_node.config import NodeConfig, GroupConfig + from meshbay_node.config import GroupConfig, NodeConfig assert "http_port" not in NodeConfig.__dataclass_fields__ assert "http_port" not in GroupConfig.__dataclass_fields__ @@ -568,6 +566,7 @@ def test_admin_signature_does_not_transfer_between_operations(tmp_path): def test_admin_challenge_expires(tmp_path): """H5: a stale challenge must not be usable.""" import time as _time + from meshbay_common.adminop import ADMIN_CHALLENGE_TTL, OP_FILE_DELETE session = _session(tmp_path, "operator") @@ -633,6 +632,7 @@ def test_keystore_records_argon2_params_for_migration(tmp_path): envelope records the parameters it was written with. """ import json + from meshbay_node.keystore import create_keystore, load_keystore path = tmp_path / "keystore.enc" @@ -648,11 +648,17 @@ def test_legacy_keystore_still_opens(tmp_path): """M2: a keystore written under the 64 MB profile must still unlock.""" import base64 as _b64 import json + import msgpack from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey from meshbay_common.crypto import ( - LEGACY_ARGON2_ITERATIONS, LEGACY_ARGON2_LANES, LEGACY_ARGON2_MEMORY_COST, - derive_keystore_key, encrypt_keystore, pk_to_b64, sk_to_b64, + LEGACY_ARGON2_ITERATIONS, + LEGACY_ARGON2_LANES, + LEGACY_ARGON2_MEMORY_COST, + derive_keystore_key, + encrypt_keystore, + pk_to_b64, + sk_to_b64, ) from meshbay_node.keystore import load_keystore @@ -717,7 +723,9 @@ def test_pre_handshake_message_budget_is_small(): unauthenticated peer could announce a huge frame and dribble bytes into it. """ from meshbay_node.transport.webrtc_server import ( - MAX_MSG, PRE_HANDSHAKE_MAX_MSG, _DataChannelBuffer, + MAX_MSG, + PRE_HANDSHAKE_MAX_MSG, + _DataChannelBuffer, ) assert PRE_HANDSHAKE_MAX_MSG <= 1024 * 1024 assert PRE_HANDSHAKE_MAX_MSG < MAX_MSG @@ -918,8 +926,8 @@ async def test_an_identified_device_that_is_not_an_operator_is_refused(tmp_path) and `operator_pks()` is rebuilt from the roster on every call so a revoked one stops working at once. """ - from meshbay_node.roster import Roster from meshbay_common.crypto import pk_to_b64 + from meshbay_node.roster import Roster roster = Roster(db_path=tmp_path / "roster.db") await roster.open() @@ -940,9 +948,9 @@ async def test_an_identified_device_that_is_not_an_operator_is_refused(tmp_path) async def test_a_paired_operator_device_is_what_opens_it(tmp_path): """The positive case, so the test above is about authority and not about everything being refused.""" - from meshbay_node.roster import Roster - from meshbay_common.join import ROLE_OPERATOR from meshbay_common.crypto import pk_to_b64 + from meshbay_common.join import ROLE_OPERATOR + from meshbay_node.roster import Roster roster = Roster(db_path=tmp_path / "roster.db") await roster.open() -- cgit v1.2.3