pyproject.toml

[project]
name = "crypt"
version = "0.1.0"
description = "Pure Python implementation of common cryptographic algorithms for educational purposes"
readme = "README.md"
requires-python = ">=3.10"
license = { text = "MIT" }
authors = [
    { name = "azwpayne", email = "paynewu0719@gmail.com" }
]
keywords = [
    "cryptography",
    "encryption",
    "hash",
    "security",
    "education",
    "aes",
    "rsa",
    "sha",
    "blake2",
]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Education",
    "License :: OSI Approved :: MIT License",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
    "Topic :: Security :: Cryptography",
    "Typing :: Typed",
]
dependencies = [
    "blake3>=0.4",
    # pycryptodome: used by rc4's __main__ self-check and by tests as a reference
    # oracle. NOTE: `cryptography>=42.0` was removed — it was never imported in
    # src/ or tests/ (verified), so it was dead supply-chain weight.
    "pycryptodome>=3.20",
]

[dependency-groups]
dev = [
    "poethepoet",
    "ruff",
]
test = [
    "pytest",
    # Parallel & ordering (referenced by addopts: -n, --randomly-seed)
    "pytest-xdist[psutil]",
    "pytest-randomly",
    "pytest-order",
    "pytest-repeat",
    "pytest-rerunfailures",
    "pytest-timeout",
    # Mocking
    "pytest-mock",
    # Property-based testing
    "hypothesis",
    # Coverage & mutation testing
    "pytest-cov",
    "coverage[toml]",
    "diff-cover",
    "mutmut",
    "pytest-deadfixtures",
    # Reporting (referenced by addopts: --html, --instafail, --profile*)
    "pytest-html",
    "pytest-instafail",
    "pytest-profiling",
    # Async (asyncio_mode=auto)
    "pytest-asyncio",
    # Security & quality (run as dedicated CI jobs, not inside pytest)
    "pytest-bandit",
    # pip-audit replaces `safety` — safety requires interactive login and hangs
    # in CI; pip-audit is free, needs no login, and audits the resolved env.
    "pip-audit",
    "pytest-mypy",
    "pytest-ruff",
    # Removed (verified 0 imports in tests/ and not referenced by addopts):
    # pytest-parallel, responses, moto[all], vcrpy, time-machine, pytest-socket,
    # testcontainers, faker, factory-boy, pytest-factoryboy, polyfactory, syrupy,
    # allure-pytest, pytest-sugar, pytest-pretty, pytest-watcher, pytest-memray,
    # pytest-leaks, pytest-anyio, cosmic-ray, pytest-check, pytest-subtests,
    # pytest-describe. (moto[all] was also the transitive source of `cryptography`.)
]

[tool.poe]
executor.type = "uv"
tasks.full = ["clean", "format"]
tasks.test = [
    "clean",
    "test-py310",
    "test-py311",
    "test-py312",
    "test-py313",
    "test-py314",
    "test-py314t",
]

tasks.format = "ruff format"
tasks.lint = "ruff check --fix --unsafe-fixes"

tasks.test-py310 = { shell = "uv run --python 3.10 --group test pytest" }
tasks.test-py311 = { shell = "uv run --python 3.11 --group test pytest" }
tasks.test-py312 = { shell = "uv run --python 3.12 --group test pytest" }
tasks.test-py313 = { shell = "uv run --python 3.13 --group test pytest" }
tasks.test-py314 = { shell = "uv run --python 3.14 --group test pytest" }
tasks.test-py314t = { shell = "uv run --python 3.14t --group test pytest" }

tasks.clean = { shell = """
	rm -rf .*_cache htmlcov .coverage .coverage.* .benchmarks reports prof
	find . -type d -name __pycache__ -exec rm -rf {} +
	find . -type f -name "*.pyc" -delete
""" }

[tool.ruff]
# Project-level config — overrides the user's global ~/.config/ruff/ruff.toml
# (ruff uses the nearest config and does not fall back to global once found).
# Codebase uses 2-space indent; preserve it to avoid churn.
target-version = "py310"
line-length = 120
indent-width = 2

[tool.ruff.lint]
# Effective set: real bugs + import consistency. Pre-existing style/docstring
# debt (D*, ANN*, PLR2004, PLC0415) is intentionally NOT selected so CI can be
# green AND still catch regressions. Enable incrementally via roadmap.
select = [
  "E",   # pycodestyle errors
  "F",   # pyflakes: undefined names, unused imports/vars (real bugs)
  "I",   # isort
  "B",   # flake8-bugbear
  "RUF", # ruff-specific (unused noqa, etc.)
]
ignore = [
  "E501",   # line too long — S-box tables / test vectors are inherently long
  "E731",   # lambda assignment
  "B007",   # unused loop variable
  "B904",   # raise ... from err — keep noise low
  "RUF001", # ambiguous unicode in strings (Chinese punctuation)
  "RUF002", # ambiguous unicode in docstrings
  "RUF003", # ambiguous unicode in comments
  "RUF005", # collection-literal-concatenation (intentional byte ops)
  "RUF012", # mutable-class-default (lookup tables / caches)
]

[tool.ruff.lint.per-file-ignores]
"tests/**/*.py" = ["E402"]  # module-level import not at top is common in tests

[tool.pytest.ini_options]
minversion = "8.0"
python_files = ["test_*.py", "*_test.py", "testing.py"]
python_classes = ["Test*", "*Test"]
python_functions = ["test_*", "it_*", "its_*", "check_*"]
pythonpath = ["src", "."]
testpaths = ["tests", "src"]
asyncio_mode = "auto"
asyncio_default_fixture_loop_scope = "function"
timeout = 300
addopts = [
    # Parallel & randomization
    "-n=8",
    # Fixed seed (not "last"): on fresh CI there is no cached "last" seed, so
    # each xdist worker would pick a different one and diverge ("Different tests
    # collected between gwN and gwM"). A fixed seed keeps randomization while
    # guaranteeing identical collection order across workers.
    "--randomly-seed=42",
    "--dist=loadscope",
    # Coverage
    "--cov=src",
    "--cov-branch",
    "--cov-report=term-missing:skip-covered",
    "--cov-report=html:reports/coverage",
    "--cov-report=xml:reports/coverage.xml",
    "--cov-report=json:reports/coverage.json",
    "--cov-fail-under=90",
    "--no-cov-on-fail",
    # Performance & timeout
    "--timeout=300",
    "--timeout-method=thread",
    "--profile",
    "--profile-svg",
    # "--benchmark-only",
    # "--benchmark-max-time=1.0",
    # Visual & experience
    "-v",
    "--tb=short",
    "--strict-markers",
    "--strict-config",
    "--html=reports/test_report.html",
    "--self-contained-html",
    # "--sugar",
    "--instafail",
    # Quality gates (ruff / mypy / bandit) run as dedicated CI jobs, not inside pytest.
]
filterwarnings = [
    #    "ignore::pytest_benchmark.logger.PytestBenchmarkWarning",
    "default::UserWarning", # surface but don't fail on 3rd-party deprecations
    "ignore::DeprecationWarning:pkg_resources.*",
]
markers = [
    "unit: Pure unit tests (no IO, <10ms)",
    "integration: Integration tests (with DB/HTTP)",
    "e2e: End-to-end tests (full user flows)",
    "slow: Tests taking >1s to execute",
    "flaky: Known unstable tests (needs retry)",
    "security: Security-related tests",
    "mutation: Mutation testing filter",
    "benchmark: Performance benchmark tests",
    "snapshot: Snapshot tests",
    "property: Hypothesis property-based tests",
]
[tool.pyrefly]
strict = true

# Special config for test directory
[[tool.pyrefly.overrides]]
pattern = "tests/**/*.py"
strict = false
ignore_errors = ["bad-argument-type"]

[tool.coverage.run]
source = ["src"]
# Store relative paths in data files so coverage from the ubuntu + macos
# matrix cells can be combined without "No source for code" path mismatches.
relative_files = true
omit = [
    "*/tests/*",
    "*/test_*",
    "*/conftest.py",
    "*/migrations/*",
    "*/venv/*",
    "*/gcm.py",
    "*/ccm.py",
]
branch = true
parallel = true
concurrency = ["thread", "multiprocessing"]

[tool.coverage.report]
precision = 2
exclude_lines = [
    "pragma: no cover",
    "def __repr__",
    "raise AssertionError",
    "raise NotImplementedError",
    "if __name__ == .__main__.:",
    "if TYPE_CHECKING:",
    "class .*\\bProtocol\\):",
    "@(abc\\.)?abstractmethod",
]

[tool.coverage.html]
directory = "reports/coverage"
title = "Coverage Report"

[tool.mutmut]
paths_to_mutate = "src/"
backup = false
runner = "python -m pytest -x --timeout=60"
tests_dir = "tests/"
show_mutations = true

[tool.bandit]
exclude_dirs = ["tests"]
# Educational crypto library: these primitives ARE the subject matter, not
# accidental misuse. Kept explicit so real mistakes (e.g. shell injection,
# pickle deserialization) still get caught.
skips = [
  "B101", # assert — pytest uses many asserts
  "B304", # DES/ARC4/Blowfish/blacklisted ciphers — implemented intentionally
  "B324", # hashlib MD5/SHA1 — weak hashes are the educational subject
  "B413", # pycryptodome flagged as pycrypto — false positive (maintained fork)
]
# B311 (`random` module) is intentionally NOT skipped globally. It is suppressed
# per-file via inline `# nosec B311` only in classical ciphers that use `random`
# by design (e.g. alphabet shuffling). Keeping it on globally lets bandit catch
# real CSPRNG mistakes — e.g. a DH private key generated with `random`.

[tool.mypy]
warn_return_any = false
warn_unused_configs = true
disallow_untyped_defs = false
disallow_incomplete_defs = false
check_untyped_defs = true
no_implicit_optional = true
warn_redundant_casts = true
warn_unused_ignores = false
warn_no_return = true
follow_imports = "normal"
ignore_missing_imports = true
show_error_codes = true
pretty = true

[tool.pytest-watcher]
now = true
patterns = ["*.py", "*.toml"]
ignore_patterns = ["*.pyc", "__pycache__/*", "reports/*"]


[tool.pytest_benchmark]
min_rounds = 5
min_time = 0.000005
max_time = 1.0
calibration_precision = 10
warmup = true
warmup_iterations = 100000