pyproject.toml

[project]
name = "exactsurface"
version = "1.4.3"
description = "Continuous external attack-surface intelligence platform (detection only)"
requires-python = ">=3.11"
readme = "README.md"
license = { text = "Proprietary" }

dependencies = [
    "pydantic>=2.6",
    "pydantic-settings>=2.2",
    "loguru>=0.7",
    "motor>=3.4",
    "redis>=5.0",
    "arq>=0.25",
    "fastapi>=0.110",
    "uvicorn[standard]>=0.29",
    "aiohttp>=3.9",
    "python-jose[cryptography]>=3.3",
    "bcrypt>=4.1",
    "email-validator>=2.1",
    "slowapi>=0.1.9",
]

[project.optional-dependencies]
dev = [
    "pytest>=8.0",
    "pytest-asyncio>=0.23",
    "pytest-cov>=5.0",
    "ruff>=0.4",
    "mypy>=1.10",
    "httpx>=0.27",
    "mcp>=2,<3",  # tests for client/
    "typer>=0.12",
    "rich>=13",
]

[build-system]
requires = ["setuptools>=68"]
build-backend = "setuptools.build_meta"

[tool.setuptools]
packages = ["core", "db", "modules", "taskqueue", "daemon", "api"]

[tool.pytest.ini_options]
asyncio_mode = "auto"
testpaths = ["tests"]
pythonpath = [".", "client"]
addopts = "-q"

[tool.ruff]
line-length = 100
target-version = "py311"

[tool.ruff.lint]
select = ["E", "F", "I", "UP", "B", "ASYNC", "S"]
# S101: allow asserts in tests. UP042: `str, Enum` is deliberate for stable,
# JSON-friendly enum serialization under pydantic v2. ASYNC109: `timeout` is a
# deliberate, threaded parameter on tool wrappers (passed to asyncio.wait_for in
# modules/exec.py), not something to replace with an asyncio.timeout context.
ignore = ["S101", "UP042", "ASYNC109"]

[tool.ruff.lint.per-file-ignores]
# B008: `typer.Argument(...)` / `typer.Option(...)` as parameter defaults is how Typer
# declares a CLI; there is no other spelling.
"client/exactsurface_client/cli.py" = ["B008"]
# ASYNC240: test fakes routinely stand in for a tool-runner by writing a tiny fixture
# file synchronously inside an `async def` -- same justification as backup.py below,
# a single test's event loop has nothing else pending, so it is not actually blocking
# anything. Recurs every time a test fakes a tool that writes an output file.
"tests/**" = ["S", "B", "ASYNC240"]
# HTML template strings are more readable unwrapped than line-broken.
"modules/reporting/html_report.py" = ["E501"]
# ASYNC230/240 guard against blocking a loop that has other work to do. backup.py is
# a one-shot CLI (`asyncio.run(main())`) whose loop has nothing else pending; it is
# async only because it drives subprocesses. Adding anyio to open a file here would
# be ceremony. The big I/O — the dump itself — never passes through Python at all:
# it goes kernel-side through an os.pipe() between mongodump and age.
"scripts/backup.py" = ["ASYNC230", "ASYNC240"]

[tool.ruff.lint.flake8-bugbear]
# FastAPI dependency-injection idiom: calling these in argument defaults is correct.
extend-immutable-calls = [
    "fastapi.Depends",
    "fastapi.Query",
    "fastapi.Header",
    "fastapi.Path",
    "fastapi.Body",
]

[tool.mypy]
python_version = "3.11"
strict = true
ignore_missing_imports = true
plugins = ["pydantic.mypy"]