chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

app/services/auth_service.py

@@ -2,9 +2,8 @@
 
 from __future__ import annotations
 
-import hashlib
 import uuid
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 from typing import Any
 
 import redis.asyncio as aioredis
@@ -12,14 +11,19 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.config import get_settings
-from app.core.auth import (
-    create_session, get_session_data, hash_password, hash_token,
-    invalidate_session, update_session_tenant, verify_password,
-)
 from app.core.audit import log_audit
+from app.core.auth import (
+    create_session,
+    get_session_data,
+    hash_password,
+    hash_token,
+    invalidate_session,
+    update_session_tenant,
+    verify_password,
+)
 from app.models.auth import PasswordResetToken
-from app.models.user import User, UserTenant
 from app.models.tenant import Tenant
+from app.models.user import User, UserTenant
 
 
 class AuthService:
@@ -37,7 +41,7 @@ class AuthService:
         Returns (session_id, csrf_token, user, tenant) or None.
         """
         # Find user by email — need to check across tenants or use default tenant
-        q = select(User).where(User.email == email, User.is_active == True)
+        q = select(User).where(User.email == email, User.is_active == True)  # noqa: E712
         result = await db.execute(q)
         user = result.scalar_one_or_none()
         if user is None:
@@ -53,7 +57,7 @@ class AuthService:
                 Tenant.slug == tenant_slug
             )
         else:
-            ut_q = ut_q.where(UserTenant.is_default == True)
+            ut_q = ut_q.where(UserTenant.is_default == True)  # noqa: E712
         ut_result = await db.execute(ut_q)
         user_tenant = ut_result.scalar_one_or_none()
 
@@ -75,7 +79,12 @@ class AuthService:
 
         # Log the login in audit trail
         await log_audit(
-            db, tenant.id, user.id, "login", "user", user.id,
+            db,
+            tenant.id,
+            user.id,
+            "login",
+            "user",
+            user.id,
             changes={"email": email},
         )
 
@@ -153,7 +162,7 @@ class AuthService:
         tenant_id: uuid.UUID | None = None,
     ) -> bool:
         """Create a password reset token. Always returns True (no user enumeration)."""
-        q = select(User).where(User.email == email, User.is_active == True)
+        q = select(User).where(User.email == email, User.is_active == True)  # noqa: E712
         result = await db.execute(q)
         user = result.scalar_one_or_none()
         if user is None:
@@ -166,14 +175,15 @@ class AuthService:
         )
         prev_result = await db.execute(prev_q)
         for prev_token in prev_result.scalars().all():
-            prev_token.used_at = datetime.now(timezone.utc)
+            prev_token.used_at = datetime.now(UTC)
 
         # Create new token
         import secrets
+
         raw_token = secrets.token_urlsafe(32)
         token_hash = hash_token(raw_token)
         settings = get_settings()
-        expires_at = datetime.now(timezone.utc) + timedelta(hours=settings.password_reset_expiry_hours)
+        expires_at = datetime.now(UTC) + timedelta(hours=settings.password_reset_expiry_hours)
 
         reset_token = PasswordResetToken(
             tenant_id=user.tenant_id,
@@ -206,7 +216,7 @@ class AuthService:
         if reset_token is None:
             return False
 
-        if reset_token.expires_at < datetime.now(timezone.utc):
+        if reset_token.expires_at < datetime.now(UTC):
             return False  # Token expired
 
         # Get user
@@ -218,7 +228,7 @@ class AuthService:
 
         # Update password
         user.password_hash = hash_password(new_password)
-        reset_token.used_at = datetime.now(timezone.utc)
+        reset_token.used_at = datetime.now(UTC)
         await db.flush()
 
         return True
@@ -229,6 +239,7 @@ class AuthService:
         """
         # This is a test helper — in production the token goes via email only
         import secrets
+
         q = select(User).where(User.email == email)
         result = await db.execute(q)
         user = result.scalar_one_or_none()
@@ -238,7 +249,7 @@ class AuthService:
         raw_token = secrets.token_urlsafe(32)
         token_hash = hash_token(raw_token)
         settings = get_settings()
-        expires_at = datetime.now(timezone.utc) + timedelta(hours=settings.password_reset_expiry_hours)
+        expires_at = datetime.now(UTC) + timedelta(hours=settings.password_reset_expiry_hours)
 
         reset_token = PasswordResetToken(
             tenant_id=user.tenant_id,
@@ -253,6 +264,7 @@ class AuthService:
     async def create_expired_reset_token(self, db: AsyncSession, email: str) -> str | None:
         """Create an already-expired reset token for testing."""
         import secrets
+
         q = select(User).where(User.email == email)
         result = await db.execute(q)
         user = result.scalar_one_or_none()
@@ -261,7 +273,7 @@ class AuthService:
 
         raw_token = secrets.token_urlsafe(32)
         token_hash = hash_token(raw_token)
-        expires_at = datetime.now(timezone.utc) - timedelta(hours=1)  # Already expired
+        expires_at = datetime.now(UTC) - timedelta(hours=1)  # Already expired
 
         reset_token = PasswordResetToken(
             tenant_id=user.tenant_id,