fix(tests): repoint security tests + add CI - #6
Merged
Conversation
requirements.txt pinned fast-query-parsers>=2.0.0, but the latest release published on PyPI is 1.0.3, making the constraint unsatisfiable and breaking `pip install -r requirements.txt` for a fresh install. Verified parse_query_string()'s API and return shape on 1.0.3 match what velocix/core/request.py expects (ordered (key, value) pairs), so the lower pin is safe. Fixes #1
…er metrics 4 security test files imported a standalone API (BruteForceProtection.create, CSRFProtection, RequestLimits, InputSanitizer) that was deliberately reverted before these tests were written — they never ran. Rewrote them against the current middleware-only surface, keeping every real assertion (brute-force unit tests now build via BruteForceProtection(app, ...) instead of the removed .create() sugar). Also fixed test_middleware_blocks_locked_ip, which asserted nothing about actually being locked out. test_router_metrics.py expected CachedRoute.metrics / get_metrics() ["cache_hit_rate"] that were never implemented behind the existing metrics_enabled flag — implemented it instead of weakening the tests. Ran `ruff check --fix` repo-wide and cleaned up the remaining 8 by hand. Added B008 to ruff's ignore list: Depends()/Query()/... as default-arg values is velocix's own DI pattern, not a bug. Fixes #2
Runs on push to main and on every PR, matrixed across Python 3.11/3.12: pip install, pytest, ruff check. mypy runs too but doesn't fail the build yet — there are 13 pre-existing type errors scattered across the codebase unrelated to this change; fixing them is its own PR. Also silences the one mypy error that was actually in scope here (velocix/cli.py's Granian(**granian_params) splat). Fixes #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
4 security test files imported a standalone API that was deliberately reverted before the tests were written — never ran. Rewrote them against the current middleware-only API, keeping every real assertion. Implemented router.py's metrics tracking too (test_router_metrics.py expected it, it was never built).
252/252 tests pass, ruff is clean. Added GitHub Actions running both on push+PR, matrixed 3.11/3.12. mypy runs but doesn't gate yet — 13 pre-existing type errors elsewhere aren't this PR's job to fix.
Fixes #2, Fixes #3