0340a670ed
Implements the fixes catalogued under Task Master tasks 1-19, derived from the security audit at .claude/plans/adaptive-sleeping-diffie.md. Critical - C-1 SSRF userinfo bypass: PDF proxy now rejects URLs containing userinfo or non-default ports, and asserts netloc == hostname. - C-2 No authentication: optional NADLAN_API_KEY gate guards /api/search/*, /api/appraisals/pdf and /mcp until Traefik mTLS is wired up. Default behavior unchanged when env unset. High - H-1 Error info leak: HTTPException details replaced with generic string; full exceptions still logged via logger.exception. - H-2 Security headers middleware: HSTS, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, CSP, server-banner stripped. - H-3 Swagger gated: /api/docs and /api/openapi.json hidden when ENVIRONMENT=production. - H-4 PDF proxy DoS: streams in 8KB chunks, rejects upstream above 50MB Content-Length, also rejects mid-stream overrun. Magic-byte check moved before StreamingResponse so we can 502 cleanly. - H-5 Per-IP rate limit: token-bucket per (path, IP) on /mcp, /api/search/*, /api/appraisals/pdf. Reads X-Forwarded-For for client IP behind Traefik. Medium - M-1 CORS: ALLOWED_ORIGINS env, allow_headers narrowed, no creds. - M-2 Deal model: extra="ignore" + explicit fields for gushNum, parcelNum, subParcelNum, streetNameHeb, houseNum, deal_source, deal_type, deal_type_description, distance_meters. Frontend now reads snake_case. - M-3 Input validators: regex on block, plot, appraiser names, dates, address, free-text — Hebrew + Latin + safe punctuation. - M-4 COOLIFY_UUID moved out of deploy.yaml into Gitea Actions secret. - M-5 Base images pinned to sha256 digests. - M-6 Runtime deps tightened to ~= compatible-release. - M-7 1MB request-body size limit middleware. Low / privacy - L-1 Heebo self-hosted via @fontsource. Removed Google Fonts links and CSP entries. Added meta referrer + meta robots noindex. - L-2 Cache-Control: immutable for /assets, no-cache for HTML. - L-3 Logger no longer prints user-supplied addresses; emits length only. - L-4 Dockerfile healthcheck uses literal port 8000. - L-5 PDF proxy stream cleanup uses contextlib.suppress. Tests: 331 passed, 17 skipped. Frontend typecheck passes. Findings file: .claude/plans/adaptive-sleeping-diffie.md Tasks: .taskmaster/tasks/tasks.json Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
178 lines
4.3 KiB
TOML
178 lines
4.3 KiB
TOML
[project]
|
|
name = "nadlan-mcp"
|
|
version = "2.0.0"
|
|
description = "חיפוש עסקאות נדל\"ן (Govmap) והחלטות שמאי מכריע (משרד המשפטים) — שרת MCP + ממשק Web עברי עם תמיכת RTL"
|
|
readme = "README.md"
|
|
requires-python = ">=3.7"
|
|
license = {text = "MIT"}
|
|
authors = [
|
|
{name = "Nadlan MCP Contributors"}
|
|
]
|
|
classifiers = [
|
|
"Development Status :: 4 - Beta",
|
|
"Intended Audience :: Developers",
|
|
"License :: OSI Approved :: MIT License",
|
|
"Programming Language :: Python :: 3",
|
|
"Programming Language :: Python :: 3.7",
|
|
"Programming Language :: Python :: 3.8",
|
|
"Programming Language :: Python :: 3.9",
|
|
"Programming Language :: Python :: 3.10",
|
|
"Programming Language :: Python :: 3.11",
|
|
"Programming Language :: Python :: 3.12",
|
|
"Programming Language :: Python :: 3.13",
|
|
]
|
|
|
|
# Runtime deps are pinned to a known-good upper bound (~=) so a Docker
|
|
# rebuild reproduces the same versions, but minor/patch upgrades come
|
|
# in voluntarily via PR. ~= is "compatible-release" in PEP 440 — locks
|
|
# to the same major+minor (e.g. ~=2.13 means >=2.13,<3.0).
|
|
dependencies = [
|
|
"requests~=2.33",
|
|
"python-dotenv~=1.2",
|
|
"pydantic~=2.13",
|
|
"fastmcp>=2.13.0,<3.0.0",
|
|
"curl_cffi~=0.15",
|
|
"fastapi~=0.136",
|
|
"uvicorn[standard]~=0.46",
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
dev = [
|
|
"pytest>=7.4.0",
|
|
"pytest-cov>=4.1.0",
|
|
"pytest-mock>=3.11.1",
|
|
"pytest-anyio>=0.0.0",
|
|
"ruff>=0.1.0",
|
|
"mypy>=1.5.0",
|
|
"pre-commit>=3.4.0",
|
|
"types-requests>=2.31.0",
|
|
"vcrpy>=4.0.0",
|
|
]
|
|
|
|
[build-system]
|
|
requires = ["setuptools>=61.0"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
# Ruff configuration
|
|
[tool.ruff]
|
|
line-length = 100
|
|
target-version = "py37"
|
|
|
|
# Exclude directories
|
|
exclude = [
|
|
".git",
|
|
".mypy_cache",
|
|
".pytest_cache",
|
|
".ruff_cache",
|
|
".venv",
|
|
"venv",
|
|
"__pycache__",
|
|
"build",
|
|
"dist",
|
|
"*.egg-info",
|
|
]
|
|
|
|
[tool.ruff.lint]
|
|
# Enable specific rule sets
|
|
select = [
|
|
"E", # pycodestyle errors
|
|
"W", # pycodestyle warnings
|
|
"F", # pyflakes
|
|
"I", # isort (import sorting)
|
|
"B", # flake8-bugbear
|
|
"C4", # flake8-comprehensions
|
|
"UP", # pyupgrade
|
|
"SIM", # flake8-simplify
|
|
]
|
|
|
|
# Ignore specific rules
|
|
ignore = [
|
|
"E501", # line too long (handled by formatter)
|
|
"B008", # do not perform function calls in argument defaults
|
|
"B904", # raise from exceptions
|
|
"SIM108", # use ternary operator (sometimes less readable)
|
|
]
|
|
|
|
# Allow autofix for all enabled rules
|
|
fixable = ["ALL"]
|
|
unfixable = []
|
|
|
|
# Per-file ignores
|
|
[tool.ruff.lint.per-file-ignores]
|
|
"__init__.py" = ["F401"] # Allow unused imports in __init__.py
|
|
"tests/**/*.py" = ["S101"] # Allow assert in tests
|
|
|
|
[tool.ruff.lint.isort]
|
|
known-first-party = ["nadlan_mcp"]
|
|
force-sort-within-sections = true
|
|
|
|
[tool.ruff.format]
|
|
quote-style = "double"
|
|
indent-style = "space"
|
|
skip-magic-trailing-comma = false
|
|
line-ending = "auto"
|
|
|
|
# Mypy configuration
|
|
[tool.mypy]
|
|
python_version = "3.10"
|
|
warn_return_any = true
|
|
warn_unused_configs = true
|
|
disallow_untyped_defs = false # Gradual typing - start permissive
|
|
check_untyped_defs = true
|
|
no_implicit_optional = true
|
|
warn_redundant_casts = true
|
|
warn_unused_ignores = true
|
|
warn_no_return = true
|
|
warn_unreachable = true
|
|
strict_equality = true
|
|
pretty = true
|
|
|
|
# Per-module options
|
|
[[tool.mypy.overrides]]
|
|
module = "tests.*"
|
|
disallow_untyped_defs = false
|
|
|
|
[[tool.mypy.overrides]]
|
|
module = "fastmcp.*"
|
|
ignore_missing_imports = true
|
|
|
|
[[tool.mypy.overrides]]
|
|
module = "mcp.*"
|
|
ignore_missing_imports = true
|
|
|
|
# Pytest configuration
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
python_files = ["test_*.py"]
|
|
python_classes = ["Test*"]
|
|
python_functions = ["test_*"]
|
|
addopts = "-ra -q --strict-markers"
|
|
markers = [
|
|
"unit: fast unit tests (default)",
|
|
"integration: slow integration tests requiring real API calls",
|
|
"api_health: weekly API health check tests (run separately)",
|
|
]
|
|
|
|
# Coverage configuration
|
|
[tool.coverage.run]
|
|
source = ["nadlan_mcp"]
|
|
omit = [
|
|
"tests/*",
|
|
"nadlan_mcp/__pycache__/*",
|
|
"*/site-packages/*",
|
|
]
|
|
|
|
[tool.coverage.report]
|
|
precision = 2
|
|
show_missing = true
|
|
skip_covered = false
|
|
exclude_lines = [
|
|
"pragma: no cover",
|
|
"def __repr__",
|
|
"if TYPE_CHECKING:",
|
|
"raise AssertionError",
|
|
"raise NotImplementedError",
|
|
"if __name__ == .__main__.:",
|
|
"@abstractmethod",
|
|
]
|