Skip to content

Conversation

@joeblackwaslike
Copy link
Owner

@joeblackwaslike joeblackwaslike commented Apr 12, 2023

Note

Introduces a full simulation app (auth/web3) and extensively refactors the core library (Base/binds/sessions/signals/CLI), with Python 3.12 + tooling/deps updates and breaking API changes.

  • Core API (breaking):
    • Replace Model with Base/BaseMixins; new default metadata/type maps.
    • Overhaul Bind/AsyncBind: named instances, URL-first config, thread-safe init, transaction() helpers, improved test transactions.
    • Config rework: cleaner Pydantic models, async engine config, Empty sentinel; SQLAlchemyConfig.from_framework and defaults.
    • Sessions: global contextual session proxy/decorator; new paginate/get_or_404 helpers.
    • Types: add Operator, refine ColumnExpr; utilities add ID encrypt/decrypt.
  • Framework/CLI:
    • Extension lazily initializes from app config; exports via Base.registry.
    • New CLI: db info/create/drop/recreate and fixtures loader; improved outputs.
  • Models/Mixins/Columns:
    • New columns: IntPK, UUID, ULID, Created, Updated; JSON default fix.
    • Mixins enhanced (repr/order/recursive dict/timestamps/soft-delete setup).
  • Simulation app (src/quart_sqlalchemy/sim):
    • DI container, auth (API key/bearer), web3 integration, repositories/logic, models, schemas, signals, CLI; REST endpoints for auth user/wallet/client.
  • Examples:
    • Repository interfaces updated to accept SessionT; add get_by_field; decorators to provide sessions.
  • Tests:
    • Refactored to new config style and Base injection; added mixin/model/concurrency tests.
  • Tooling & deps:
    • Python 3.12, drop legacy configs; switch linting to Ruff; update tox to uv; add deps (bases, blinker, cryptography, reedsolo, simonspeckciphers, python-ulid); remove flake8 configs.
  • Docs:
    • New docs/usage.md and docs/Simulation.md with configuration and examples.

Written by Cursor Bugbot for commit 38cf5a1. This will update automatically on new commits. Configure here.

…tup.cfg, add new settings in pyproject.toml, and adjust .editorconfig for improved code style. Update Python version to 3.12 and version to 4.0.0. Enhance signal handling in signals.py and implement encryption/decryption functions in util.py.
Copy link

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New security issues found


client = MagicClient(
app_name="My App",
public_api_key="4700aed5ee9f76f7be6398cd4b00b586",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (generic-api-key): Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Source: gitleaks

auth_users=[
AuthUser(
email="[email protected]",
current_session_token="97ee741d53e11a490460927c8a2ce4a3",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (generic-api-key): Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Source: gitleaks

quart auth add-client
```
```
Created client 2VolejRejNmG with public_api_key: 5f794cf72d0cef2dd008be2c0b7a632b
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (generic-api-key): Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Source: gitleaks

# Create new auth_user via api
```shell
curl -X POST localhost:8081/api/auth_user/ \
-H 'X-Public-API-Key: 5f794cf72d0cef2dd008be2c0b7a632b' \
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (generic-api-key): Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Source: gitleaks

"data": {
"auth_user": {
"client_id": "2VolejRejNmG",
"current_session_token": "69ee9af5b9296a09f90be5b71c1dda38",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (generic-api-key): Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Source: gitleaks

Comment on lines +24 to +25
curl -X POST localhost:8081/api/auth_user/ \
-H 'X-Public-API-Key: 5f794cf72d0cef2dd008be2c0b7a632b' \
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (curl-auth-header): Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.

Source: gitleaks

Comment on lines +58 to +59
curl -X GET localhost:8081/api/auth_user/ \
-H 'X-Public-API-Key: 5f794cf72d0cef2dd008be2c0b7a632b' \
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (curl-auth-header): Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.

Source: gitleaks

Comment on lines +89 to +90
curl -X POST localhost:8081/api/auth_wallet/sync \
-H 'X-Public-API-Key: 5f794cf72d0cef2dd008be2c0b7a632b' \
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (curl-auth-header): Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.

Source: gitleaks

Comment on lines +112 to +113
curl -X GET localhost:8081/api/magic_client/ \
-H 'X-Public-API-Key: 5f794cf72d0cef2dd008be2c0b7a632b' \
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (curl-auth-header): Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.

Source: gitleaks

Comment on lines +136 to +137
curl -X POST localhost:8081/api/magic_client/ \
-H 'X-Public-API-Key: 5f794cf72d0cef2dd008be2c0b7a632b' \
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (curl-auth-header): Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.

Source: gitleaks

Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR is being reviewed by Cursor Bugbot

Details

You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

Bug: Reactivation Method Incorrectly Sets Status

The reactivate method currently sets an entity's is_active status to False. This seems like a bug, as reactivating an entity should likely set is_active to True.

src/quart_sqlalchemy/sim/repo.py#L287-L289

def reactivate(self, session: sa.orm.Session, id_: EntityIdT) -> EntityT:
return self.update(session, id_, dict(is_active=False))

examples/repository/sqla.py#L216-L220

if self.has_soft_delete:
raise RuntimeError("Can't delete entity that uses soft-delete semantics.")
entity = self.get(id_)
if not entity:

Fix in Cursor Fix in Web


continue
def __lt__(self: ORMModel, other: ORMModel) -> bool:
if type(self).__name__ != type(other).__name__:
raise NotImplemented
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Comparison Method Fails with Incorrect Return Value

The __lt__ method raises NotImplemented when comparing different types. Since NotImplemented is a singleton value and not an exception class, this will cause a TypeError at runtime.

Fix in Cursor Fix in Web

...
"""
try:
return Bind._instances[name]()
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Object Misuse as Function

There are two places where an object is incorrectly called as a function:

  1. In Bind.get_instance, the Bind instance retrieved from _instances is called with (), which will raise a TypeError.
  2. In AuthWalletHandler.get_by_public_address, self.logic.AuthWallet is called with (), which is likely unintended and may cause an error when accessing get_by_public_address.
Additional Locations (1)

Fix in Cursor Fix in Web

builder: StatementBuilder

def __init__(self, session: sa.orm.Session, **kwargs):
def __init__(self, model: sa.orm.Session, **kwargs):
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Parameter Renaming Causes Initialization Error

The __init__ method's session parameter was renamed to model, but the method body still tries to assign self.session using the old session parameter name. This causes a NameError.

Fix in Cursor Fix in Web

return

if name in Bind._instances:
raise ValueError("Bind instance `{name}` already exists, use another name.")
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Bind Name Error Message Formatting Issue

The ValueError raised in _track_instance when a bind name already exists uses {name} without f-string formatting. This results in the literal string {name} appearing in the error message, making it unhelpful for debugging.

Fix in Cursor Fix in Web

@sonarqubecloud
Copy link

Quality Gate Failed Quality Gate failed

Failed conditions
1 Security Hotspot
6.2% Duplication on New Code (required ≤ 3%)
E Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants