pyproject.toml

[project]
name = "simple-secrets-manager"
dynamic = ["version"]
description = "Securely store and deliver tokens, passwords, API keys, and other secrets using HTTP API, Swagger UI, or Python Package."
authors = [
    { name = "Krishnakanth Alagiri", email = "39209037+bearlike@users.noreply.github.com" },
]
license = "CC0-1.0"
readme = "README.md"
requires-python = ">=3.13,<4.0"
# Base install = only what the `ssm` / `ssm-cli` client actually imports.
# The Flask server and the reload sidecar pull their heavier deps via the
# `server` / `reload` extras so a CLI-only install stays lean.
dependencies = [
    "click>=8.1.8,<9.0.0",
    "rich>=13.9.4,<14.0.0",
    "requests>=2.32.3,<3.0.0",
    "keyring>=25.6.0,<26.0.0",
]

[project.optional-dependencies]
# OpenTelemetry event emission (the `ssm_telemetry` leaf). Pinned to one
# verified line (opentelemetry-python 1.43.0). We take the OTLP *HTTP*
# exporter on purpose — the umbrella `opentelemetry-exporter-otlp` drags in
# grpcio. `server` and `reload` layer these in via
# `simple-secrets-manager[otel]`; the CLI base stays otel-free (and
# `ssm_telemetry` degrades to a no-op when the extra is absent).
otel = [
    "opentelemetry-api==1.43.0",
    "opentelemetry-sdk==1.43.0",
    "opentelemetry-semantic-conventions==0.64b0",
    "opentelemetry-exporter-otlp-proto-http==1.43.0",
]
# The Flask + flask-restx REST API server (`ssm_server`, `python -m ssm_server.main`).
server = [
    "flask-httpauth>4,<5",
    "flask-cors>=5.0.0,<6.0.0",
    "flask-restx>=0.5.1",
    "pymongo>4,<5",
    "loguru>=0.7.3,<0.8.0",
    # Typed cross-service reload contract (`ssm_contracts`) + OTel events, plus
    # the validated ServerSettings config (`pydantic-settings` also reads the
    # optional `.env`, replacing python-dotenv).
    "pydantic>=2.5,<3.0",
    "pydantic-settings>=2.0,<3.0",
    "simple-secrets-manager[otel]",
]
# The `ssm-reload` container reloader sidecar (needs the Docker SDK).
reload = [
    "docker>=7.0.0,<8.0.0",
    # Typed cross-service reload contract (`ssm_contracts`) + OTel events, plus
    # the validated ReloadSettings config (`pydantic-settings`).
    "pydantic>=2.5,<3.0",
    "pydantic-settings>=2.0,<3.0",
    "simple-secrets-manager[otel]",
]
# Everything, for a full local/dev checkout.
all = ["simple-secrets-manager[server,reload]"]

[project.urls]
Repository = "https://github.com/bearlike/simple-secrets-manager.git"
Issues = "https://github.com/bearlike/simple-secrets-manager/issues"

[dependency-groups]
dev = [
    "ipykernel>=6.29.5,<7.0.0",
    "pytest>=8.3.5,<9.0.0",
    "ruff>=0.13.0,<0.14.0",
    "mypy>=1.17.1,<2.0.0",
    "import-linter>=2.0,<3.0",
]

[build-system]
requires = ["setuptools>=77.0.3"]
build-backend = "setuptools.build_meta"

[project.scripts]
ssm = "ssm_cli.main:cli"
ssm-cli = "ssm_cli.main:cli"
ssm-reload = "ssm_reload.runner:main"

[tool.setuptools.packages.find]
where = ["."]
include = [
    "ssm_server*",
    "ssm_cli*",
    "ssm_reload*",
    "ssm_telemetry*",
    "ssm_contracts*",
    "ssm_projection*",
]
exclude = ["tests*"]

[tool.setuptools.dynamic]
version = { attr = "ssm_cli.__version__" }

[tool.ruff]
line-length = 79
target-version = "py313"
exclude = [".venv"]

[tool.ruff.lint]
# E/F = pycodestyle+pyflakes core; C901 = mccabe complexity; SIM102/PERF403 =
# targeted single rules; C4 = flake8-comprehensions (whole family passes clean).
# Deferred families (violations exist today, would need source edits owned by
# other work): I (import sort, 31), UP (pyupgrade, 97), B (bugbear, 2),
# SIM full (15). Enable them once those are fixed.
select = ["E", "F", "C901", "SIM102", "PERF403", "C4"]

[tool.mypy]
python_version = "3.13"
ignore_missing_imports = true
# Both pass the whole tree today. Deferred (violations exist, need source
# edits): warn_unused_ignores (1: ssm_cli/auth.py redundant ignore) and
# check_untyped_defs (46, mostly untyped test bodies).
warn_redundant_casts = true
no_implicit_optional = true
exclude = [
    "^\\.venv/",
    "^build/",
    "^simple_secrets_manager\\.egg-info/",
]

# The reload sidecar is small and fully typed — hold it to the strict bar so it
# stays that way. Verified: `mypy --strict -p ssm_reload` is clean. NOTE: the
# `strict = true` meta-flag is not scopable in a per-module override (it leaks
# to every module), so the strict sub-flags are enumerated here instead.
[[tool.mypy.overrides]]
module = "ssm_reload.*"
disallow_untyped_defs = true
disallow_incomplete_defs = true
disallow_untyped_calls = true
disallow_untyped_decorators = true
disallow_any_generics = true
disallow_subclassing_any = true
warn_return_any = true
warn_unused_ignores = true
no_implicit_reexport = true
strict_equality = true
check_untyped_defs = true
extra_checks = true

# --- import-linter: enforce the subproduct boundaries (dependencies flow
# inward). Run via `uv run lint-imports` / `make lint-imports`; wired into
# scripts/quality.sh after MyPy. ---
[tool.importlinter]
root_packages = [
    "ssm_server",
    "ssm_cli",
    "ssm_reload",
    "ssm_telemetry",
    "ssm_contracts",
    "ssm_projection",
]

# `ssm_telemetry` (OTel events), `ssm_contracts` (the typed reload contract)
# and `ssm_projection` (the dotenv renderer + sinks) are LEAVES: the server,
# the CLI and the reloader import them across the HTTP boundary, so they must
# never import back into any app package or the reloader's hard isolation (and
# the inward dependency rule) would break.
[[tool.importlinter.contracts]]
name = "ssm_telemetry is a leaf (imports no app package)"
type = "forbidden"
source_modules = ["ssm_telemetry"]
forbidden_modules = [
    "ssm_server",
    "ssm_cli",
    "ssm_reload",
    "ssm_contracts",
    "ssm_projection",
]

[[tool.importlinter.contracts]]
name = "ssm_contracts is a leaf (imports no app package)"
type = "forbidden"
source_modules = ["ssm_contracts"]
forbidden_modules = [
    "ssm_server",
    "ssm_cli",
    "ssm_reload",
    "ssm_telemetry",
    "ssm_projection",
]

# The CLI and the reloader must render byte-identical env_file contents (compose
# hashes the file's CONTENTS), so the renderer is a leaf both import rather than
# a helper either one owns.
[[tool.importlinter.contracts]]
name = "ssm_projection is a leaf (imports no app package)"
type = "forbidden"
source_modules = ["ssm_projection"]
forbidden_modules = [
    "ssm_server",
    "ssm_cli",
    "ssm_reload",
    "ssm_telemetry",
    "ssm_contracts",
]

# The reload sidecar talks only to the API over HTTP + the Docker socket; it
# must never import the server or CLI Python packages.
[[tool.importlinter.contracts]]
name = "ssm_reload is independent of ssm_server and ssm_cli"
type = "forbidden"
source_modules = ["ssm_reload"]
forbidden_modules = ["ssm_server", "ssm_cli"]

# The CLI is a standalone HTTP client; it must not pull in the server or the
# reload sidecar.
[[tool.importlinter.contracts]]
name = "ssm_cli is independent of ssm_server and ssm_reload"
type = "forbidden"
source_modules = ["ssm_cli"]
forbidden_modules = ["ssm_server", "ssm_reload"]

# Dependencies flow inward: the engines (domain layer) must not reach up into
# the API/HTTP layer. The one accepted edge is the leaf serialization util
# (to_iso / sanitize_doc / oid_to_str — pure functions, no Flask), which the
# engines legitimately reuse; everything else in ssm_server.api (the Flask app
# in api.core, the flask-restx resources) stays out of the engines.
[[tool.importlinter.contracts]]
name = "ssm_server.engines does not depend on the API layer"
type = "forbidden"
source_modules = ["ssm_server.engines"]
forbidden_modules = ["ssm_server.api"]
ignore_imports = ["ssm_server.engines.* -> ssm_server.api.serialization"]