Pouzor
aa17edf1d0
- Replace passlib.CryptContext with bcrypt 4.2.1 directly (passlib is unmaintained and only emitted warnings when paired with bcrypt 4+). hash_password / verify_password now call bcrypt.checkpw / .hashpw, and verify_password is hardened against empty inputs without raising. scripts/hash_password.py + tests/conftest.py updated to match. - status_checker.check_node() now rejects targets starting with '-' before any subprocess invocation, defending ping/tcp paths against arg-injection if an admin sets a check_target like '-O'. Tests added: - test_auth: expired JWT, malformed JWT, wrong-secret JWT, empty password vs empty server hash, verify_password edge cases. - test_scan: _background_scan failure path marks ScanRun failed, leaves non-running terminal status alone, success path invokes run_scan. - test_status_checker: ping/tcp invocations are bypassed when target or ip starts with '-'. Backend coverage 89% → 90%.
27 lines
517 B
Plaintext
27 lines
517 B
Plaintext
# Requires Python 3.13+ (3.14 not yet supported by pydantic-core)
|
|
fastapi==0.135.1
|
|
uvicorn[standard]==0.30.6
|
|
sqlalchemy[asyncio]==2.0.35
|
|
aiosqlite==0.20.0
|
|
alembic==1.13.3
|
|
pydantic==2.9.2
|
|
pydantic-settings==2.5.2
|
|
python-jose[cryptography]==3.5.0
|
|
bcrypt==4.2.1
|
|
python-multipart==0.0.27
|
|
apscheduler==3.10.4
|
|
python-nmap==0.7.1
|
|
pyyaml==6.0.2
|
|
types-PyYAML==6.0.12.20240917
|
|
websockets==13.1
|
|
httpx==0.27.2
|
|
zeroconf==0.131.0
|
|
aiomqtt==2.3.0
|
|
|
|
# Dev
|
|
ruff==0.6.9
|
|
mypy==1.11.2
|
|
pytest==9.0.3
|
|
pytest-asyncio==1.3.0
|
|
pytest-cov==5.0.0
|