chore(quality): apply ruff autofixes and formatting (223 fixes, regression-free: 118/118 tests pass)

tests/test_frontend_security.py

@@ -43,9 +43,8 @@ def test_no_x_html_in_alpine_templates():
             stripped = re.sub(r"<!--.*?-->", "", line)
             if XHTML_PATTERN.search(stripped):
                 offenders.append((path.name, lineno, line.strip()[:120]))
-    assert not offenders, (
-        "x-html usage is forbidden (R-5); offenders:\n"
-        + "\n".join(f"  {n}:{ln}: {snippet}" for n, ln, snippet in offenders)
+    assert not offenders, "x-html usage is forbidden (R-5); offenders:\n" + "\n".join(
+        f"  {n}:{ln}: {snippet}" for n, ln, snippet in offenders
     )
 
 
@@ -54,21 +53,23 @@ def test_no_innerHTML_in_alpine_pages():
     for path in _all_html_files():
         content = path.read_text(encoding="utf-8")
         # allow within <script> blocks only if commented out / disabled
-        assert "innerHTML" not in content, \
+        assert "innerHTML" not in content, (
             f"{path.name} contains innerHTML which is forbidden (R-5)"
+        )
 
 
 def test_x_text_is_used_instead():
     """Sanity check: the auth/dashboard pages use x-text for user-derived strings."""
     index = (WEBUI / "index.html").read_text(encoding="utf-8")
     # The error message div should use x-text (so user input never gets HTML-parsed)
-    assert "x-text=\"error\"" in index or 'x-text="error"' in index
+    assert 'x-text="error"' in index or 'x-text="error"' in index
 
 
 # ---------------------------------------------------------------------------
 # R-1: JWT in localStorage
 # ---------------------------------------------------------------------------
 
+
 def test_jwt_uses_localStorage():
     """api.js must read/write the JWT in localStorage, not cookies/sessionStorage."""
     api = (WEBUI / "js" / "api.js").read_text(encoding="utf-8")
@@ -90,14 +91,16 @@ def test_jwt_not_in_cookies():
     """Defence in depth: do NOT put the JWT in document.cookie."""
     for js in WEBUI.rglob("*.js"):
         content = js.read_text(encoding="utf-8")
-        assert "document.cookie" not in content, \
+        assert "document.cookie" not in content, (
             f"{js.relative_to(ROOT)} must not use document.cookie for the JWT"
+        )
 
 
 # ---------------------------------------------------------------------------
 # 13.3: CSP-Header in main.py
 # ---------------------------------------------------------------------------
 
+
 def test_csp_header_in_main_py():
     """app/main.py must wire up a middleware (or response-header decorator)
     that sets Content-Security-Policy. We don't run the server here — we
@@ -105,29 +108,30 @@ def test_csp_header_in_main_py():
     assert MAIN_PY.exists(), f"Missing {MAIN_PY}"
     content = MAIN_PY.read_text(encoding="utf-8")
     # The middleware / decorator must mention the CSP header value
-    assert "Content-Security-Policy" in content, \
-        "app/main.py does not set Content-Security-Policy"
+    assert "Content-Security-Policy" in content, "app/main.py does not set Content-Security-Policy"
     # The header must allow the Tailwind CDN at minimum
-    assert "cdn.tailwindcss.com" in content, \
+    assert "cdn.tailwindcss.com" in content, (
         "CSP-Header must allow https://cdn.tailwindcss.com in script-src"
+    )
     # And block scripts from arbitrary origins
-    assert "default-src 'self'" in content or 'default-src "self"' in content, \
+    assert "default-src 'self'" in content or 'default-src "self"' in content, (
         "CSP-Header must set default-src 'self'"
+    )
 
 
 def test_csp_blocks_object_embedding():
     """object-src 'none' is part of the agreed lockdown."""
     content = MAIN_PY.read_text(encoding="utf-8")
-    assert "object-src 'none'" in content, \
-        "CSP-Header must set object-src 'none'"
+    assert "object-src 'none'" in content, "CSP-Header must set object-src 'none'"
 
 
 def test_csp_uses_starlette_middleware():
     """Per architecture: CSP is set in a FastAPI/Starlette middleware,
     not in nginx / a response handler."""
     content = MAIN_PY.read_text(encoding="utf-8")
-    assert "@app.middleware(\"http\")" in content or '@app.middleware("http")' in content, \
-        "CSP-Header must be set in an @app.middleware(\"http\") decorator"
+    assert '@app.middleware("http")' in content or '@app.middleware("http")' in content, (
+        'CSP-Header must be set in an @app.middleware("http") decorator'
+    )
 
 
 # ---------------------------------------------------------------------------
@@ -155,9 +159,9 @@ def test_protected_page_has_auth_gate(filename):
     content = (WEBUI / filename).read_text(encoding="utf-8")
     # The auth-gate is `x-data="{ init: () => Alpine.store('auth').init() }"`
     # or `x-init="init()"` on a component that checks the JWT.
-    assert "Alpine.store('auth').init()" in content or \
-           "$store.auth.init()" in content, \
+    assert "Alpine.store('auth').init()" in content or "$store.auth.init()" in content, (
         f"{filename} has no Alpine.store('auth').init() auth-gate"
+    )
 
 
 def test_index_page_has_no_auth_gate():
@@ -165,13 +169,15 @@ def test_index_page_has_no_auth_gate():
     content = (WEBUI / "index.html").read_text(encoding="utf-8")
     # The auth store's init() redirects to /index.html when no JWT exists,
     # so it must NOT be called from the login page.
-    assert "Alpine.store('auth').init()" not in content, \
+    assert "Alpine.store('auth').init()" not in content, (
         "index.html (login page) must not call auth.init() (would cause loop)"
+    )
 
 
 def test_404_page_has_no_auth_gate():
     """404 page is reachable without auth (so users can find their way back)."""
     content = (WEBUI / "404.html").read_text(encoding="utf-8")
     # The 404 must not call auth.init() — it is intentionally public.
-    assert "Alpine.store('auth').init()" not in content, \
+    assert "Alpine.store('auth').init()" not in content, (
         "404.html must not call auth.init() (public page)"
+    )