style: repo-wide lint pass — make the lint gate green again

Push builds have been RED on the lint step since ~build 209 from accumulated formatting drift. This is the mechanical cleanup: ruff format + ruff --fix (UP038 isinstance unions, SIM105 contextlib.suppress, UP031 f-strings, SIM115 tempfile context manager), shfmt -i 2 -ci, nixpkgs-fmt/statix/deadnix (merged attrsets, dropped unused lib args), yamllint, and shell quoting fixes in tests/lasuite-docs/setup_custom_tests.sh. No behaviour changes intended; lint: PASS, unit tests: 138 passed.
2026-06-09 21:56:15 +00:00
parent e76d4005ab
commit 9a7772563a
115 changed files with 952 additions and 660 deletions
@@ -21,6 +21,8 @@ def test_lasuite_meet_returns_200(live_app):
    status, _ = harness_http.retry_http_get(
        url, expect_status=(200, 301, 302), max_wait=60, interval=3
    )
-    assert status in (200, 301, 302), (
-        f"lasuite-meet at {url} returned HTTP {status} (expected 200/301/302)"
-    )
+    assert status in (
+        200,
+        301,
+        302,
+    ), f"lasuite-meet at {url} returned HTTP {status} (expected 200/301/302)"
@@ -28,7 +28,8 @@ import sys
 import pytest

 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", "runner"))
-from harness import http as harness_http, sso  # noqa: E402
+from harness import http as harness_http  # noqa: E402
+from harness import sso


 def _b64url(seg: str) -> bytes:
@@ -74,33 +75,40 @@ def test_create_room_get_livekit_token_and_read_back(live_app, deps_creds):
    lk_room = livekit.get("room")
    lk_token = livekit.get("token")
    assert room_id, f"room created but no id: {body!r}"
-    assert lk_token and isinstance(lk_token, str) and lk_token.count(".") == 2, (
-        f"room created but no LiveKit JWT token: {livekit!r}"
-    )
+    assert (
+        lk_token and isinstance(lk_token, str) and lk_token.count(".") == 2
+    ), f"room created but no LiveKit JWT token: {livekit!r}"

    try:
        # --- read it back (a fresh authenticated GET of the created room) ---
-        status, got = harness_http.http_request("GET", f"{base}/api/v1.0/rooms/{room_id}/", headers=auth)
+        status, got = harness_http.http_request(
+            "GET", f"{base}/api/v1.0/rooms/{room_id}/", headers=auth
+        )
        assert status == 200, f"room read-back returned HTTP {status} (expected 200); body={got!r}"
-        assert isinstance(got, dict) and got.get("id") == room_id, (
-            f"read-back room id mismatch: {got!r}"
-        )
-        got_lk = (got.get("livekit") or {})
+        assert (
+            isinstance(got, dict) and got.get("id") == room_id
+        ), f"read-back room id mismatch: {got!r}"
+        got_lk = got.get("livekit") or {}
        assert got_lk.get("token"), f"read-back room missing LiveKit token: {got!r}"
-        assert got_lk.get("room") == lk_room, (
-            f"read-back LiveKit room {got_lk.get('room')!r} != create-time {lk_room!r}"
-        )
+        assert (
+            got_lk.get("room") == lk_room
+        ), f"read-back LiveKit room {got_lk.get('room')!r} != create-time {lk_room!r}"

        # --- the LiveKit token is a real signaling grant for this room (WebRTC subset) ---
        payload = json.loads(_b64url(lk_token.split(".")[1]))
        video = payload.get("video") or {}
-        assert video.get("room") == lk_room or payload.get("room") == lk_room, (
-            f"LiveKit JWT does not grant the created room {lk_room!r}: {payload!r}"
-        )
+        assert (
+            video.get("room") == lk_room or payload.get("room") == lk_room
+        ), f"LiveKit JWT does not grant the created room {lk_room!r}: {payload!r}"
    finally:
        # --- delete the room (cleanup + a real DELETE mutation) ---
-        del_status, _ = harness_http.http_request("DELETE", f"{base}/api/v1.0/rooms/{room_id}/", headers=auth)
-        assert del_status in (204, 200), f"room delete returned HTTP {del_status} (expected 204/200)"
+        del_status, _ = harness_http.http_request(
+            "DELETE", f"{base}/api/v1.0/rooms/{room_id}/", headers=auth
+        )
+        assert del_status in (
+            204,
+            200,
+        ), f"room delete returned HTTP {del_status} (expected 204/200)"

    # --- best-effort: confirm the delete took (404 on re-GET). The §4.3 floor (create-an-object +
    # read-it-back + LiveKit-token issuance) is already proven by the hard assertions above; this
@@ -112,7 +120,9 @@ def test_create_room_get_livekit_token_and_read_back(live_app, deps_creds):

    gone = False
    for _ in range(5):
-        status, _ = harness_http.http_request("GET", f"{base}/api/v1.0/rooms/{room_id}/", headers=auth)
+        status, _ = harness_http.http_request(
+            "GET", f"{base}/api/v1.0/rooms/{room_id}/", headers=auth
+        )
        if status == 404:
            gone = True
            break
@@ -46,9 +46,9 @@ def test_oidc_password_grant_against_dep_keycloak(live_app, deps_creds):

    # Creds shape. WC1: realm is per-run namespaced "<parent>-<6hex>"; client_id stays the parent.
    assert kc["domain"]
-    assert re.fullmatch(r"lasuite-meet-[0-9a-f]{6}", kc["realm"]), (
-        f"realm {kc['realm']!r} not the per-run namespaced form lasuite-meet-<6hex>"
-    )
+    assert re.fullmatch(
+        r"lasuite-meet-[0-9a-f]{6}", kc["realm"]
+    ), f"realm {kc['realm']!r} not the per-run namespaced form lasuite-meet-<6hex>"
    assert kc["client_id"] == "lasuite-meet"
    assert isinstance(kc["client_secret"], str) and len(kc["client_secret"]) >= 16
    assert isinstance(kc["password"], str) and len(kc["password"]) >= 16
@@ -77,16 +77,14 @@ def test_oidc_password_grant_against_dep_keycloak(live_app, deps_creds):

    # Password grant → real JWT
    token = sso.oidc_password_grant(creds)
-    assert isinstance(token, str) and token.count(".") == 2, (
-        f"access_token is not a JWT: {token!r}"
-    )
+    assert isinstance(token, str) and token.count(".") == 2, f"access_token is not a JWT: {token!r}"
    payload = json.loads(_b64url_decode(token.split(".")[1]))
    assert payload.get("iss") == expected_iss, f"JWT iss={payload.get('iss')!r} != {expected_iss!r}"
-    assert payload.get("azp") == kc["client_id"], (
-        f"JWT azp={payload.get('azp')!r} != {kc['client_id']!r}"
-    )
+    assert (
+        payload.get("azp") == kc["client_id"]
+    ), f"JWT azp={payload.get('azp')!r} != {kc['client_id']!r}"
    assert payload.get("typ") == "Bearer", f"JWT typ={payload.get('typ')!r} != 'Bearer'"
    exp = payload.get("exp")
-    assert isinstance(exp, int) and exp > time.time(), (
-        f"JWT exp={exp!r} not a future timestamp (now={time.time():.0f})"
-    )
+    assert (
+        isinstance(exp, int) and exp > time.time()
+    ), f"JWT exp={exp!r} not a future timestamp (now={time.time():.0f})"
@@ -26,7 +26,7 @@ if [ -z "${CCCI_DEPS_FILE:-}" ] || [ ! -s "${CCCI_DEPS_FILE}" ]; then
  exit 0
 fi
 KC_DOMAIN=$(jq -r '.keycloak.domain        // empty' "$CCCI_DEPS_FILE")
-KC_REALM=$( jq -r '.keycloak.realm         // empty' "$CCCI_DEPS_FILE")
+KC_REALM=$(jq -r '.keycloak.realm         // empty' "$CCCI_DEPS_FILE")
 KC_CLIENT=$(jq -r '.keycloak.client_id     // empty' "$CCCI_DEPS_FILE")
 KC_SECRET=$(jq -r '.keycloak.client_secret // empty' "$CCCI_DEPS_FILE")
 if [ -z "$KC_DOMAIN" ] || [ -z "$KC_SECRET" ]; then
@@ -40,31 +40,34 @@ echo "  lasuite-meet install_steps: wiring OIDC at install against keycloak ${KC
 # forbids overwriting a secret at the same version). The app is not deployed yet — a swarm secret can
 # be created independently — so the single deploy below picks up v2.
 CUR_VER=$(grep -E '^\s*SECRET_OIDC_RPCS_VERSION=' "$ENV_PATH" | tail -1 | cut -d= -f2 | tr -d '"\r' || echo "v1")
-NEW_NUM=$(( ${CUR_VER#v} + 1 ))
+NEW_NUM=$((${CUR_VER#v} + 1))
 NEW_VER="v${NEW_NUM}"
-INSERT_LOG=$(abra app secret insert "$CCCI_APP_DOMAIN" oidc_rpcs "$NEW_VER" "$KC_SECRET" --no-input -C -o 2>&1) \
-  || INSERT_LOG=$(script -qec "abra app secret insert $CCCI_APP_DOMAIN oidc_rpcs $NEW_VER $KC_SECRET --no-input -C -o" /dev/null 2>&1) \
-  || { echo "  install_steps: abra app secret insert oidc_rpcs@$NEW_VER failed: $INSERT_LOG"; exit 1; }
+INSERT_LOG=$(abra app secret insert "$CCCI_APP_DOMAIN" oidc_rpcs "$NEW_VER" "$KC_SECRET" --no-input -C -o 2>&1) ||
+  INSERT_LOG=$(script -qec "abra app secret insert $CCCI_APP_DOMAIN oidc_rpcs $NEW_VER $KC_SECRET --no-input -C -o" /dev/null 2>&1) ||
+  {
+    echo "  install_steps: abra app secret insert oidc_rpcs@$NEW_VER failed: $INSERT_LOG"
+    exit 1
+  }
 sed -i "s|^\s*SECRET_OIDC_RPCS_VERSION=.*|SECRET_OIDC_RPCS_VERSION=$NEW_VER|" "$ENV_PATH"
 echo "  install_steps: oidc_rpcs secret inserted at $NEW_VER (was $CUR_VER)"

 # 2) Write the OIDC env vars (explicit endpoints — deterministic). Meet's .env.sample templates the
 # endpoints off ${AUTH_DOMAIN}; set AUTH_DOMAIN + override each endpoint with the concrete realm URL.
-write_env () {
+write_env() {
  local key="$1" val="$2"
  sed -i "/^\s*#\?\s*${key}=/d" "$ENV_PATH"
-  [ -z "$(tail -c1 "$ENV_PATH" 2>/dev/null)" ] || printf '\n' >> "$ENV_PATH"
-  printf '%s=%s\n' "$key" "$val" >> "$ENV_PATH"
+  [ -z "$(tail -c1 "$ENV_PATH" 2>/dev/null)" ] || printf '\n' >>"$ENV_PATH"
+  printf '%s=%s\n' "$key" "$val" >>"$ENV_PATH"
 }
-write_env AUTH_DOMAIN                      "$KC_DOMAIN"
-write_env OIDC_REALM                       "$KC_REALM"
-write_env OIDC_OP_JWKS_ENDPOINT            "https://${KC_DOMAIN}/realms/${KC_REALM}/protocol/openid-connect/certs"
-write_env OIDC_OP_AUTHORIZATION_ENDPOINT   "https://${KC_DOMAIN}/realms/${KC_REALM}/protocol/openid-connect/auth"
-write_env OIDC_OP_TOKEN_ENDPOINT           "https://${KC_DOMAIN}/realms/${KC_REALM}/protocol/openid-connect/token"
-write_env OIDC_OP_USER_ENDPOINT            "https://${KC_DOMAIN}/realms/${KC_REALM}/protocol/openid-connect/userinfo"
-write_env OIDC_OP_LOGOUT_ENDPOINT          "https://${KC_DOMAIN}/realms/${KC_REALM}/protocol/openid-connect/logout"
-write_env OIDC_RP_CLIENT_ID                "$KC_CLIENT"
-write_env OIDC_RP_SIGN_ALGO                "RS256"
-write_env OIDC_RP_SCOPES                   "openid email"
+write_env AUTH_DOMAIN "$KC_DOMAIN"
+write_env OIDC_REALM "$KC_REALM"
+write_env OIDC_OP_JWKS_ENDPOINT "https://${KC_DOMAIN}/realms/${KC_REALM}/protocol/openid-connect/certs"
+write_env OIDC_OP_AUTHORIZATION_ENDPOINT "https://${KC_DOMAIN}/realms/${KC_REALM}/protocol/openid-connect/auth"
+write_env OIDC_OP_TOKEN_ENDPOINT "https://${KC_DOMAIN}/realms/${KC_REALM}/protocol/openid-connect/token"
+write_env OIDC_OP_USER_ENDPOINT "https://${KC_DOMAIN}/realms/${KC_REALM}/protocol/openid-connect/userinfo"
+write_env OIDC_OP_LOGOUT_ENDPOINT "https://${KC_DOMAIN}/realms/${KC_REALM}/protocol/openid-connect/logout"
+write_env OIDC_RP_CLIENT_ID "$KC_CLIENT"
+write_env OIDC_RP_SIGN_ALGO "RS256"
+write_env OIDC_RP_SCOPES "openid email"

 echo "  lasuite-meet install_steps: OIDC env wired into .env (deploy will pick it up, no reconverge)"
@@ -10,7 +10,8 @@ import os
 import sys

 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
-from harness import browser as harness_browser, generic, lifecycle  # noqa: E402
+from harness import browser as harness_browser  # noqa: E402
+from harness import generic, lifecycle


 def test_serving_and_frontend(live_app, meta):
@@ -33,9 +34,11 @@ def test_serving_and_frontend(live_app, meta):
            resp = harness_browser.goto_with_retry(
                page, url, accept_statuses=(200, 301, 302), goto_timeout_ms=60_000
            )
-            assert resp is not None and resp.status in (200, 301, 302), (
-                f"page status {resp and resp.status}"
-            )
+            assert resp is not None and resp.status in (
+                200,
+                301,
+                302,
+            ), f"page status {resp and resp.status}"
            assert "<html" in page.content().lower(), "no HTML served by the frontend"
        finally:
            browser.close()