Merge pull request #3 from rohitdash08/pre-commit

added security checks and pre-commit rules

Author: rohitdash08

.bandit

@@ -0,0 +1,6 @@
+[bandit]
+# Skip assert usage rule and tests directory
+skips = B101
+exclude = packages/backend/tests
+severity = LOW
+confidence = LOW

.flake8

@@ -0,0 +1,6 @@
+[flake8]
+max-line-length = 88
+extend-ignore = E203, W503
+exclude = .git,__pycache__,build,dist,.venv,venv
+per-file-ignores =
+    packages/backend/tests/*: S101

.github/workflows/ci.yml

@@ -5,27 +5,63 @@ on:
     branches: ["**"]
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   backend:
     runs-on: ubuntu-latest
+    services:
+      redis:
+        image: redis:7
+        ports:
+          - 6379:6379
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
           python-version: "3.11"
+          cache: pip
       - name: Install deps
+        working-directory: packages/backend
         run: |
           python -m pip install --upgrade pip
-          pip install -r backend/requirements.txt || pip install -r packages/backend/requirements.txt
-          pip install black flake8 pytest
-      # - name: Lint
-      #   run: |
-      #     if [ -d backend ]; then black --check backend && flake8 backend; else black --check packages/backend && flake8 packages/backend; fi
-      - name: Tests
-        run: pytest -q || true
-      - name: Build Docker
+          pip install -r requirements.txt
+          pip install black==24.8.0 flake8==7.0.0 bandit==1.7.9 pytest==8.2.2
+      - name: Lint (black, flake8)
+        working-directory: packages/backend
         run: |
-          if [ -d backend ]; then docker build -t finmind-backend ./backend; else docker build -t finmind-backend ./packages/backend; fi
+          black --check .
+          flake8 .
+      - name: Tests (pytest)
+        env:
+          REDIS_URL: redis://localhost:6379/0
+        working-directory: packages/backend
+        run: python -m pytest -q
+
+      - name: Security Scan (Bandit)
+        working-directory: packages/backend
+        run: bandit -r app -ll
+
+  docker_scan:
+    runs-on: ubuntu-latest
+    needs: backend
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build backend image
+        run: docker build -t finmind-backend:ci ./packages/backend
+      - name: Trivy scan
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          image-ref: finmind-backend:ci
+          format: table
+          exit-code: 1
+          vuln-type: os,library
+          severity: CRITICAL,HIGH
 
   frontend:
     runs-on: ubuntu-latest
@@ -41,11 +77,11 @@ jobs:
       - name: Lint
         run: |
           cd app
-          npm run lint || true
+          npm run lint
       - name: Test
         run: |
           cd app
-          npm run test -- --run || true
+          npm run test -- --run
       - name: Build
         run: |
           cd app

.github/workflows/codeql.yml

@@ -0,0 +1,38 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+  schedule:
+    - cron: "0 3 * * 0"  # weekly
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (CodeQL)
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["python", "javascript"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

.pre-commit-config.yaml

@@ -0,0 +1,41 @@
+repos:
+  - repo: https://github.com/psf/black
+    rev: 24.8.0
+    hooks:
+      - id: black
+        name: black (python formatter)
+        language_version: python3.11
+        additional_dependencies: []
+        exclude: |
+          ^app/|^packages/backend/.+\.ipynb$
+
+  - repo: https://github.com/PyCQA/flake8
+    rev: 7.0.0
+    hooks:
+      - id: flake8
+        name: flake8 (python lint)
+        additional_dependencies: []
+        args: ["--config=.flake8"]
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+      - id: check-yaml
+        files: \.(yml|yaml)$
+      - id: check-json
+      - id: check-merge-conflict
+
+  - repo: https://github.com/asottile/yesqa
+    rev: v1.5.0
+    hooks:
+      - id: yesqa
+        name: remove unused noqa comments
+
+  - repo: https://github.com/adrienverge/yamllint
+    rev: v1.35.1
+    hooks:
+      - id: yamllint
+        name: yamllint
+        args: ["-d", "{extends: default, rules: {line-length: disable}}"]

docker-compose.yml

@@ -21,7 +21,9 @@ services:
     volumes:
       - ./packages/backend/app:/app/app
       - ./packages/backend/wsgi.py:/app/wsgi.py
-      - ./packages/backend/tests:/app/tests:ro
+      - ./packages/backend/tests:/app/tests
+      - ./.flake8:/app/.flake8:ro
+      - ./.bandit:/app/.bandit:ro
     command: gunicorn --reload --workers=2 --threads=4 --bind 0.0.0.0:8000 wsgi:app
 
   frontend:

packages/backend/app/__init__.py

@@ -1,6 +1,6 @@
 from flask import Flask, jsonify
 from .config import Settings
-from .extensions import db, jwt, redis_client
+from .extensions import db, jwt
 from .routes import register_routes
 from flask_cors import CORS
 import click
@@ -26,8 +26,10 @@ def create_app(settings: Settings | None = None) -> Flask:
 
     # Logging
     log_level = os.getenv("LOG_LEVEL", "INFO").upper()
-    logging.basicConfig(level=getattr(logging, log_level, logging.INFO),
-                        format="%(asctime)s %(levelname)s [%(name)s] %(message)s")
+    logging.basicConfig(
+        level=getattr(logging, log_level, logging.INFO),
+        format="%(asctime)s %(levelname)s [%(name)s] %(message)s",
+    )
     logger = logging.getLogger("finmind")
     logger.info("Starting FinMind backend with log level %s", log_level)
 

packages/backend/app/models.py

@@ -1,7 +1,6 @@
 from datetime import datetime, date
 from enum import Enum
-from flask_sqlalchemy import SQLAlchemy
-from sqlalchemy import func, Enum as SAEnum
+from sqlalchemy import Enum as SAEnum
 from .extensions import db
 
 
@@ -92,7 +91,9 @@ class UserSubscription(db.Model):
     __tablename__ = "user_subscriptions"
     id = db.Column(db.Integer, primary_key=True)
     user_id = db.Column(db.Integer, db.ForeignKey("users.id"), nullable=False)
-    plan_id = db.Column(db.Integer, db.ForeignKey("subscription_plans.id"), nullable=False)
+    plan_id = db.Column(
+        db.Integer, db.ForeignKey("subscription_plans.id"), nullable=False
+    )
     active = db.Column(db.Boolean, default=False, nullable=False)
     started_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)
 

packages/backend/app/routes/auth.py

@@ -1,6 +1,11 @@
 from flask import Blueprint, request, jsonify
 from werkzeug.security import generate_password_hash, check_password_hash
-from flask_jwt_extended import create_access_token, create_refresh_token, jwt_required, get_jwt_identity
+from flask_jwt_extended import (
+    create_access_token,
+    create_refresh_token,
+    jwt_required,
+    get_jwt_identity,
+)
 from ..extensions import db
 from ..models import User
 import logging

packages/backend/app/routes/bills.py

@@ -14,21 +14,28 @@
 @jwt_required()
 def list_bills():
     uid = int(get_jwt_identity())
-    items = db.session.query(Bill).filter_by(user_id=uid, active=True).order_by(Bill.next_due_date).all()
+    items = (
+        db.session.query(Bill)
+        .filter_by(user_id=uid, active=True)
+        .order_by(Bill.next_due_date)
+        .all()
+    )
     logger.info("List bills user=%s count=%s", uid, len(items))
-    return jsonify([
-        {
-            "id": b.id,
-            "name": b.name,
-            "amount": float(b.amount),
-            "currency": b.currency,
-            "next_due_date": b.next_due_date.isoformat(),
-            "cadence": b.cadence.value,
-            "channel_whatsapp": b.channel_whatsapp,
-            "channel_email": b.channel_email,
-        }
-        for b in items
-    ])
+    return jsonify(
+        [
+            {
+                "id": b.id,
+                "name": b.name,
+                "amount": float(b.amount),
+                "currency": b.currency,
+                "next_due_date": b.next_due_date.isoformat(),
+                "cadence": b.cadence.value,
+                "channel_whatsapp": b.channel_whatsapp,
+                "channel_email": b.channel_email,
+            }
+            for b in items
+        ]
+    )
 
 
 @bp.post("")
@@ -71,5 +78,7 @@ def mark_paid(bill_id: int):
         b.active = False
     db.session.commit()
     cache_delete_patterns([f"user:{uid}:upcoming_bills*"])
-    logger.info("Marked bill paid id=%s user=%s next_due_date=%s", b.id, uid, b.next_due_date)
+    logger.info(
+        "Marked bill paid id=%s user=%s next_due_date=%s", b.id, uid, b.next_due_date
+    )
     return jsonify(message="updated")