Upgrade debs, add ruff, pyright and pytest

Author: wlanboy

.github/workflows/ci.yaml

@@ -0,0 +1,43 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: "latest"
+          enable-cache: true # Enormer Speed-Boost für Folgeruns
+
+      - name: Install dependencies
+        # --frozen stellt sicher, dass exakt deine uv.lock verwendet wird
+        run: uv sync --frozen
+
+      - name: Lint & Syntax (Ruff)
+        # Ersetzt das manuelle py_compile für jede Datei. 
+        # Prüft das gesamte Projekt (inkl. scanner, extractor, etc.) auf einmal.
+        run: uv run ruff check .
+
+      - name: Type Check (Pyright)
+        # profitiert extrem von Type-Checks für Tools und Resources
+        run: uv run pyright .
+
+      - name: Run Tests
+        # Führt deine Tests aus (erwartet pytest im Projekt)
+        run: uv run pytest
+
+      - name: Verify app imports
+        # Letzter Check: Lässt sich die App ohne Environment-Fehler importieren?
+        run: |
+          uv run python -c "from main import app; print('🚀 app OK')"

main.py

@@ -11,6 +11,7 @@
 from cryptography.x509.oid import NameOID
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import rsa, ec
+from cryptography.hazmat.primitives.asymmetric.types import CertificateIssuerPrivateKeyTypes
 
 app = FastAPI()
 templates = Jinja2Templates(directory="templates")
@@ -97,6 +98,7 @@ async def create_cert(
         ca_cert = x509.load_pem_x509_certificate(f.read())
     with open(CA_KEY, "rb") as f:
         ca_key = serialization.load_pem_private_key(f.read(), password=None)
+    assert isinstance(ca_key, CertificateIssuerPrivateKeyTypes)
 
     # CSR bauen
     subject = x509.Name(

pyproject.toml

@@ -11,3 +11,10 @@ dependencies = [
     "python-multipart>=0.0.20",
     "uvicorn>=0.38.0",
 ]
+
+[dependency-groups]
+dev = [
+    "pyright>=1.1.408",
+    "pytest>=9.0.2",
+    "ruff>=0.15.2",
+]

tests/__init__.py

@@ -0,0 +1,85 @@
+import pytest
+from fastapi import HTTPException
+from cryptography import x509
+from cryptography.hazmat.primitives.asymmetric import rsa, ec
+
+from main import validate_safe_name, parse_san_entry, generate_key
+
+
+class TestValidateSafeName:
+    def test_valid_hostname(self):
+        assert validate_safe_name("example.com") is True
+
+    def test_valid_with_dash_and_underscore(self):
+        assert validate_safe_name("my-host_01") is True
+
+    def test_empty_string(self):
+        assert validate_safe_name("") is False
+
+    def test_path_traversal_dotdot(self):
+        assert validate_safe_name("..") is False
+
+    def test_path_traversal_embedded(self):
+        assert validate_safe_name("foo/../bar") is False
+
+    def test_slash(self):
+        assert validate_safe_name("foo/bar") is False
+
+    def test_space(self):
+        assert validate_safe_name("foo bar") is False
+
+    def test_semicolon(self):
+        assert validate_safe_name("foo;bar") is False
+
+    def test_wildcard(self):
+        assert validate_safe_name("foo*bar") is False
+
+
+class TestParseSanEntry:
+    def test_ipv4(self):
+        result = parse_san_entry("192.168.1.1")
+        assert isinstance(result, x509.IPAddress)
+
+    def test_ipv6(self):
+        result = parse_san_entry("::1")
+        assert isinstance(result, x509.IPAddress)
+
+    def test_dns_name(self):
+        result = parse_san_entry("example.com")
+        assert isinstance(result, x509.DNSName)
+
+    def test_wildcard_dns(self):
+        result = parse_san_entry("*.example.com")
+        assert isinstance(result, x509.DNSName)
+
+
+class TestGenerateKey:
+    def test_rsa2048(self):
+        key = generate_key("rsa2048")
+        assert isinstance(key, rsa.RSAPrivateKey)
+        assert key.key_size == 2048
+
+    def test_rsa4096(self):
+        key = generate_key("rsa4096")
+        assert isinstance(key, rsa.RSAPrivateKey)
+        assert key.key_size == 4096
+
+    def test_secp256r1(self):
+        key = generate_key("secp256r1")
+        assert isinstance(key, ec.EllipticCurvePrivateKey)
+        assert key.curve.name == "secp256r1"
+
+    def test_secp384r1(self):
+        key = generate_key("secp384r1")
+        assert isinstance(key, ec.EllipticCurvePrivateKey)
+        assert key.curve.name == "secp384r1"
+
+    def test_secp521r1(self):
+        key = generate_key("secp521r1")
+        assert isinstance(key, ec.EllipticCurvePrivateKey)
+        assert key.curve.name == "secp521r1"
+
+    def test_invalid_key_type_raises(self):
+        with pytest.raises(HTTPException) as exc_info:
+            generate_key("invalid")
+        assert exc_info.value.status_code == 400