Run `ruff check app tests scripts --fix` with the configured rule set
(E4/E7/E9/F/I): import sorting (I001), f-strings without placeholders
(F541), lambda/variable/unused-import cleanups that ruff marks safe.
Nine files whose only ruff debt sits next to pre-existing pylint
import-resolution errors (lazy exports, sys.path script imports) or
whose "unused" imports are reached through attribute access by tests are
left untouched so the changed-file pylint gate and the benchmark tests
stay green; their diagnostics remain in the baseline.
app/startup/lifecycle/__init__.py and app/main.py import business
modules after cache composition, import-path and stdio setup on purpose
(the source comments document the contract), so declare E402
per-file-ignores for them instead of adding per-line noqa.
Ruff ratchet watermark drops from 498 to 100; sync the baseline fixture
and the optimization checklist figure.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The access-token endpoint accepted unlimited password attempts; the
only existing rate limiters are single-instance helpers for outbound
site requests. Add app/application/security/throttle.py, an in-memory
LoginThrottle keyed by (client address, normalized username) that locks
for 30s after five consecutive failures and doubles the lockout up to
15 minutes. The endpoint answers 429 with Retry-After while locked,
counts only real credential failures (an MFA challenge after a correct
password does not count), and clears the record on success.
X-Forwarded-For is deliberately not trusted because there is no
trusted-proxy setting; behind the bundled nginx all requests share one
address, so the key degrades to per-username throttling, which is the
dimension brute-force protection needs. Sync the dependency snapshot
and architecture metrics for the new module.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
test_chain_rate_limit.py and test_system_notification_dispatch.py
installed a bare qbittorrentapi/transmission_rpc/psutil ModuleType into
sys.modules at import time with sys.modules.setdefault. When either file
is collected before a test that imports the real package in the same
shard (for example tests/test_downloader_add_failure_message.py and its
TorrentDictionary import), the placeholder wins and collection fails
with "cannot import name ... (unknown location)". Any change to the test
file set reshuffles the six CI shards and can surface this.
Use app.testing.bootstrap.ensure_optional_stub, which keeps the real
module when it is installed, and convert both unittest.TestCase files to
pytest-native functions as the testing guide requires when touching a
TestCase file. Record the resulting lower Ruff watermark.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Keep strict binding lookup as the default and explicitly match alternative channel identifiers for the Agent API gateway. Reject ambiguous active-user matches and cover single-field bindings with database-backed tests.
Refs #6905
