build: consolidate packaging in pyproject.toml and bump dependencies

- Removed requirements.txt and dev-requirements.txt
- Bumped Flask, Flask-Babel, and redis-py to modern versions
- Bumped fakeredis to natively support RESP3/HELLO protocol
- Updated Makefile, Dockerfile, and tox pipelines to use pyproject.toml
- Fixed pip-audit vulnerabilities by bumping pytest and wheel

Author: neuhaus

.gitignore

@@ -46,6 +46,8 @@ htmlcov/
 .coverage.*
 .cache
 .pytest_cache/
+.ruff_cache/
+.mypy_cache/
 
 # virtualenv
 venv/

Dockerfile

@@ -8,10 +8,10 @@ RUN groupadd -r snappass && \
 
 WORKDIR $APP_DIR
 
-COPY ["pyproject.toml", "requirements.txt", "README.rst", "AUTHORS.rst", "LICENSE", "$APP_DIR/"]
+COPY ["pyproject.toml", "README.rst", "AUTHORS.rst", "LICENSE", "$APP_DIR/"]
 COPY ["./snappass", "$APP_DIR/snappass"]
 
-RUN pip install --no-cache-dir -r requirements.txt && \
+RUN pip install --no-cache-dir . && \
     pybabel compile -d snappass/translations && \
     pip install --no-cache-dir . && \
     chown -R snappass $APP_DIR && \

Makefile

@@ -1,10 +1,10 @@
 .PHONY: dev prod run test
 
-dev: dev-requirements.txt
-	pip install -r dev-requirements.txt
+dev:
+	pip install .[dev]
 
-prod: requirements.txt
-	pip install -r requirements.txt
+prod:
+	pip install .
 
 run: prod
 	FLASK_DEBUG=1 FLASK_APP=snappass.main NO_SSL=True flask run

README.rst

@@ -295,7 +295,7 @@ Alternatively, you can use `Docker`_ and `Docker Compose`_ to install and run Sn
 
     $ docker-compose up -d
 
-This will pull all dependencies, i.e. Redis and appropriate Python version (3.7), then start up SnapPass and Redis server. SnapPass server is accessible at: http://localhost:5000
+This will pull all dependencies, i.e. Redis and appropriate Python version (3.14), then start up SnapPass and Redis server. SnapPass server is accessible at: http://localhost:5000
 
 Similar Tools
 -------------

dev-requirements.txt

@@ -17,9 +17,9 @@ classifiers = [
     "Programming Language :: Python :: 3",
 ]
 dependencies = [
-    "Flask>=1.1.1",
-    "redis>=4.0.0,<5.0.0",
-    "Flask-Babel>=1.0.0",
+    "Flask>=3.1.0",
+    "redis>=5.0.0",
+    "Flask-Babel>=4.0.0",
 ]
 
 [project.urls]
@@ -33,3 +33,18 @@ select = ["E", "F", "S"]
 
 [tool.ruff.lint.per-file-ignores]
 "tests.py" = ["S105", "S101"]
+
+[project.optional-dependencies]
+dev = [
+    "coverage==7.6.0",
+    "fakeredis>=2.26.0",
+    "ruff==0.6.2",
+    "pip-audit==2.7.3",
+    "freezegun==1.5.1",
+    "pytest>=9.0.3",
+    "pytest-cov==5.0.0",
+    "tox==4.23.0",
+    "bumpversion==0.6.0",
+    "wheel>=0.46.2",
+    "mypy==1.11.1"
+]

pyproject.toml

@@ -12,7 +12,7 @@
 if os.environ.get('MOCK_REDIS'):
     from fakeredis import FakeStrictRedis
 
-    redis_client = FakeStrictRedis(version=(6, 2), protocol=2)  # type: ignore
+    redis_client = FakeStrictRedis()  # type: ignore
 elif os.environ.get('REDIS_URL'):
     redis_url = os.environ.get('REDIS_URL')
     if not redis_url:

requirements.txt

@@ -3,12 +3,10 @@
 import time
 import unittest
 from unittest import TestCase
-from unittest import mock
 from urllib.parse import quote
 from urllib.parse import unquote
 
 from freezegun import freeze_time
-from fakeredis import FakeStrictRedis
 
 os.environ['MOCK_REDIS'] = 'true'
 
@@ -21,7 +19,6 @@
 
 class SnapPassTestCase(TestCase):
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_get_password(self):
         password = "melatonin overdose 1337!$"
         key = snappass.set_password(password, 30)
@@ -46,13 +43,11 @@ def test_returned_token_format(self):
         # 16 bytes urlsafe base64 is 22 chars
         self.assertEqual(len(storage.REDIS_PREFIX) + 22, len(token))
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_password_before_expiration(self):
         password = 'fidelio'
         key = snappass.set_password(password, 1)
         self.assertEqual(password, snappass.get_password(key))
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_password_after_expiration(self):
         password = 'open sesame'
         key = snappass.set_password(password, 1)
@@ -92,29 +87,25 @@ def test_handle_password_missing_data(self):
         rv = self.app.post('/', data={})
         self.assertEqual(rv.status_code, 500)
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_preview_password(self):
         password = "I like novelty kitten statues!"
         key = snappass.set_password(password, 30)
         rv = self.app.get('/{0}'.format(key))
         # The password payload should not be visible in preview
         self.assertNotIn(password, rv.get_data(as_text=True))
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_preview_password_not_found(self):
         rv = self.app.get('/invalid_key')
         self.assertEqual(rv.status_code, 404)
         self.assertIn('Secret Not Found', rv.get_data(as_text=True))
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_show_password(self):
         password = "I like novelty kitten statues!"
         key = snappass.set_password(password, 30)
         rv = self.app.post('/{0}'.format(key))
         # The payload (encrypted text) is shown in the text area
         self.assertIn(password, rv.get_data(as_text=True))
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_show_password_not_found(self):
         rv = self.app.post('/invalid_key')
         self.assertEqual(rv.status_code, 404)
@@ -126,7 +117,6 @@ def test_url_prefix(self):
         rv = self.app.post('/', data={'password': password, 'ttl': 'hour'})
         self.assertIn("localhost/test/prefix/", rv.get_data(as_text=True))
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_set_password_json(self):
         with freeze_time("2020-05-08 12:00:00") as frozen_time:
             password = 'my name is my passport. verify me.'
@@ -147,7 +137,6 @@ def test_set_password_json(self):
             frozen_time.move_to("2020-05-22 12:00:00")
             self.assertIsNone(snappass.get_password(key))
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_set_password_api(self):
         with freeze_time("2020-05-08 12:00:00") as frozen_time:
             password = 'my name is my passport. verify me.'
@@ -176,7 +165,6 @@ def test_api_handle_password_missing_data(self):
         )
         self.assertEqual(rv.status_code, 500)
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_set_password_api_default_ttl(self):
         with freeze_time("2020-05-08 12:00:00") as frozen_time:
             password = 'my name is my passport. verify me.'
@@ -229,7 +217,6 @@ def test_uses_host_override_with_untrusted_host_header(self):
             json_content['link'].startswith('https://snappass.example.org/')
         )
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_set_password_api_v2(self):
         with freeze_time("2020-05-08 12:00:00") as frozen_time:
             password = 'my name is my passport. verify me.'
@@ -248,7 +235,6 @@ def test_set_password_api_v2(self):
             frozen_time.move_to("2020-05-22 12:00:00")
             self.assertIsNone(snappass.get_password(key))
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_set_password_api_v2_default_ttl(self):
         with freeze_time("2020-05-08 12:00:00") as frozen_time:
             password = 'my name is my passport. verify me.'
@@ -315,7 +301,6 @@ def test_set_password_api_v2_no_password_and_too_big_ttl(self):
         bad_ttl = invalid_params[1]
         self.assertEqual(bad_ttl['name'], 'ttl')
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_check_password_api_v2(self):
         password = 'my name is my passport. verify me.'
         rv = self.app.post(
@@ -330,7 +315,6 @@ def test_check_password_api_v2(self):
         rvc = self.app.head('/api/v2/passwords/' + quote(key))
         self.assertEqual(rvc.status_code, 200)
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_check_password_api_v2_bad_keys(self):
         password = 'my name is my passport. verify me.'
         rv = self.app.post(
@@ -345,7 +329,6 @@ def test_check_password_api_v2_bad_keys(self):
         rvc = self.app.head('/api/v2/passwords/' + quote(key[::-1]))
         self.assertEqual(rvc.status_code, 404)
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_retrieve_password_api_v2(self):
         password = 'my name is my passport. verify me.'
         rv = self.app.post(
@@ -364,7 +347,6 @@ def test_retrieve_password_api_v2(self):
         retrieved_password = json_content_retrieved['password']
         self.assertEqual(retrieved_password, password)
 
-    @mock.patch('redis.client.StrictRedis', FakeStrictRedis)
     def test_retrieve_password_api_v2_bad_keys(self):
         password = 'my name is my passport. verify me.'
         rv = self.app.post(

snappass/storage.py

@@ -7,22 +7,21 @@ setenv =
     MOCK_REDIS = 1
     SECRET_KEY = test-secret-key-1234567890
 commands =
-    pip install -r requirements.txt
-    pip install -r dev-requirements.txt
+    pip install .[dev]
     pytest --cov=snappass --cov-report=term-missing tests.py
 
 [testenv:ruff]
 commands =
-   pip install -r dev-requirements.txt
+   pip install .[dev]
    ruff check .
 
 [testenv:pip-audit]
 commands =
-   pip install -r dev-requirements.txt
-   pip-audit -r requirements.txt
+   pip install .[dev]
+   pip-audit
 
 [testenv:mypy]
 commands =
-   pip install -r dev-requirements.txt
+   pip install .[dev]
    mypy snappass