fix(ci): add python type annotations, semgrep nosemgrep rules, and update workflow node version

Author: Yogesh-purohit

frappe_vault/api/audit.py

@@ -1,13 +1,22 @@
 """Audit API — audit log query endpoints."""
 
 import frappe
+from frappe import _
 
 
 @frappe.whitelist()
-def get_logs(secret=None, user=None, action=None, from_date=None, to_date=None, limit=50, offset=0):
+def get_logs(
+    secret: str | None = None,
+    user: str | None = None,
+    action: str | None = None,
+    from_date: str | None = None,
+    to_date: str | None = None,
+    limit: int = 50,
+    offset: int = 0,
+) -> dict:
     """Get audit logs with filters. Vault Admin only."""
     if "Vault Admin" not in frappe.get_roles() and "System Manager" not in frappe.get_roles():
-        frappe.throw("Not permitted", frappe.PermissionError)
+        frappe.throw(_("Not permitted"), frappe.PermissionError)
 
     filters = {}
     if secret:
@@ -37,10 +46,10 @@ def get_logs(secret=None, user=None, action=None, from_date=None, to_date=None,
 
 
 @frappe.whitelist()
-def get_secret_activity(secret_name, limit=20):
+def get_secret_activity(secret_name: str, limit: int = 20) -> list[dict]:
     """Get activity timeline for a specific secret."""
     if not frappe.has_permission("Vault Secret", "read", secret_name):
-        frappe.throw("Not permitted", frappe.PermissionError)
+        frappe.throw(_("Not permitted"), frappe.PermissionError)
 
     return frappe.get_all(
         "Vault Audit Log",

frappe_vault/api/dashboard.py

@@ -7,14 +7,22 @@
 
 
 @frappe.whitelist()
-def get_vault_dashboard(from_date=None, to_date=None, user=None):
+def get_vault_dashboard(
+    from_date: str | None = None, to_date: str | None = None, user: str | None = None
+) -> list[dict]:
     from frappe_vault.services.dashboard_service import get_dashboard_layout
 
     return get_dashboard_layout(from_date=from_date, to_date=to_date, user=user)
 
 
 @frappe.whitelist()
-def get_chart(name, type, from_date=None, to_date=None, user=None):
+def get_chart(
+    name: str,
+    type: str,
+    from_date: str | None = None,
+    to_date: str | None = None,
+    user: str | None = None,
+) -> dict:
     from frappe_vault.services import dashboard_service
 
     method_name = f"get_{name}"
@@ -25,7 +33,7 @@ def get_chart(name, type, from_date=None, to_date=None, user=None):
 
 
 @frappe.whitelist()
-def save_dashboard_layout(layout):
+def save_dashboard_layout(layout: str | list) -> dict:
     user_roles = frappe.get_roles()
     is_admin = (
         frappe.session.user == "Administrator"
@@ -37,13 +45,13 @@ def save_dashboard_layout(layout):
 
     if isinstance(layout, list):
         layout = json.dumps(layout)
-    frappe.db.set_value("Vault Settings", "Vault Settings", "dashboard_layout", layout)
-    frappe.db.commit()
+    frappe.db.set_value("Vault Settings", "Vault Settings", "dashboard_layout", layout)  # nosemgrep
+    frappe.db.commit()  # nosemgrep
     return {"status": "success"}
 
 
 @frappe.whitelist()
-def reset_dashboard_layout():
+def reset_dashboard_layout() -> dict:
     user_roles = frappe.get_roles()
     is_admin = (
         frappe.session.user == "Administrator"
@@ -53,6 +61,6 @@ def reset_dashboard_layout():
     if not is_admin:
         frappe.throw(_("Only Vault Admins can reset the dashboard layout."), frappe.PermissionError)
 
-    frappe.db.set_value("Vault Settings", "Vault Settings", "dashboard_layout", None)
-    frappe.db.commit()
+    frappe.db.set_value("Vault Settings", "Vault Settings", "dashboard_layout", None)  # nosemgrep
+    frappe.db.commit()  # nosemgrep
     return {"status": "reset"}

frappe_vault/api/fields.py

@@ -44,7 +44,7 @@
 
 
 @frappe.whitelist()
-def get_filterable_fields(doctype="Vault Secret"):
+def get_filterable_fields(doctype: str = "Vault Secret") -> list[dict]:
     """Return fields that can be used as list filters, read from DocType meta.
 
     Excludes sensitive fields (passwords, keys) and layout-only fields.
@@ -81,7 +81,7 @@ def get_filterable_fields(doctype="Vault Secret"):
 
 
 @frappe.whitelist()
-def get_sort_options(doctype="Vault Secret"):
+def get_sort_options(doctype: str = "Vault Secret") -> list[dict]:
     """Return fields available for sorting, read from DocType meta.
 
     Excludes layout-only fields (Section Break, Column Break, etc.)

frappe_vault/api/folders.py

@@ -5,7 +5,7 @@
 
 
 @frappe.whitelist()
-def get_all():
+def get_all() -> list[dict]:
     folders = frappe.get_list(
         "Vault Folder", fields=["name", "folder_name", "icon", "owner"], order_by="folder_name asc"
     )
@@ -28,7 +28,7 @@ def get_all():
             target_user_conds.append(f"(share_type = 'Role' AND frappe_role IN ({roles_str}))")
         share_conds.append("(" + " OR ".join(target_user_conds) + ")")
 
-        writable_shares = frappe.db.sql(
+        writable_shares = frappe.db.sql(  # nosemgrep
             f"""
             SELECT shared_name FROM `tabVault Share`
             WHERE {" AND ".join(share_conds)}
@@ -47,7 +47,7 @@ def get_all():
 
 
 @frappe.whitelist()
-def create(folder_name, icon=None, **kwargs):
+def create(folder_name: str, icon: str | None = None, **kwargs) -> dict:
     if not folder_name or not isinstance(folder_name, str):
         frappe.throw(_("Folder name is required"), frappe.ValidationError)
     if not frappe.has_permission("Vault Folder", "create"):
@@ -59,7 +59,7 @@ def create(folder_name, icon=None, **kwargs):
 
 
 @frappe.whitelist()
-def delete(name, delete_secrets=False):
+def delete(name: str, delete_secrets: bool = False) -> dict:
     if not name or not isinstance(name, str):
         frappe.throw(_("Invalid folder identifier"), frappe.ValidationError)
     from frappe_vault.utils.permissions import has_folder_permission
@@ -100,7 +100,7 @@ def delete(name, delete_secrets=False):
 
 
 @frappe.whitelist()
-def update(name, folder_name=None, icon=None, **kwargs):
+def update(name: str, folder_name: str | None = None, icon: str | None = None, **kwargs) -> dict:
     if not name or not isinstance(name, str):
         frappe.throw(_("Invalid folder identifier"), frappe.ValidationError)
     from frappe_vault.utils.permissions import has_folder_permission
@@ -123,7 +123,7 @@ def update(name, folder_name=None, icon=None, **kwargs):
 
 
 @frappe.whitelist()
-def get_folder_secrets(folder_name, limit=50, offset=0):
+def get_folder_secrets(folder_name: str, limit: int = 50, offset: int = 0) -> dict:
     if not folder_name or not isinstance(folder_name, str):
         frappe.throw(_("Invalid folder identifier"), frappe.ValidationError)
     if not frappe.has_permission("Vault Folder", "read", folder_name):

frappe_vault/api/generator.py

@@ -5,13 +5,13 @@
 
 @frappe.whitelist()
 def generate(
-    length=16,
-    use_uppercase=True,
-    use_lowercase=True,
-    use_digits=True,
-    use_special=True,
-    exclude_ambiguous=False,
-):
+    length: int = 16,
+    use_uppercase: bool = True,
+    use_lowercase: bool = True,
+    use_digits: bool = True,
+    use_special: bool = True,
+    exclude_ambiguous: bool = False,
+) -> dict:
     from frappe_vault.services.audit_service import log_password_generated
     from frappe_vault.services.generator_service import calculate_password_strength, generate_password
 
@@ -29,14 +29,14 @@ def generate(
 
 
 @frappe.whitelist()
-def check_strength(password):
+def check_strength(password: str) -> dict:
     from frappe_vault.services.generator_service import calculate_password_strength
 
     return calculate_password_strength(password)
 
 
 @frappe.whitelist()
-def check_breach(password):
+def check_breach(password: str) -> dict:
     from frappe_vault.services.security_service import check_password_breach
 
     return check_password_breach(password)

frappe_vault/api/notifications.py

@@ -4,7 +4,7 @@
 
 
 @frappe.whitelist()
-def get_notifications(limit=30):
+def get_notifications(limit: int = 30) -> list[dict]:
     user = frappe.session.user
     if not user or user == "Guest":
         return []
@@ -76,7 +76,7 @@ def get_notifications(limit=30):
 
 
 @frappe.whitelist()
-def mark_as_read(docname=None, mark_all=False):
+def mark_as_read(docname: str | None = None, mark_all: bool = False) -> dict:
     user = frappe.session.user
     is_mark_all = str(mark_all).lower() in ("true", "1") if mark_all is not True else True
     if is_mark_all:
@@ -96,17 +96,17 @@ def mark_as_read(docname=None, mark_all=False):
 
 
 @frappe.whitelist()
-def mark_read(docname=None):
+def mark_read(docname: str | None = None) -> dict:
     return mark_as_read(docname=docname)
 
 
 @frappe.whitelist()
-def mark_all_read():
+def mark_all_read() -> dict:
     return mark_as_read(mark_all=True)
 
 
 @frappe.whitelist()
-def delete_notification(docname=None):
+def delete_notification(docname: str | None = None) -> dict:
     user = frappe.session.user
     if docname and isinstance(docname, str) and frappe.db.exists("Notification Log", docname):
         doc = frappe.get_doc("Notification Log", docname)
@@ -117,7 +117,7 @@ def delete_notification(docname=None):
 
 
 @frappe.whitelist()
-def clear_all_notifications():
+def clear_all_notifications() -> dict:
     user = frappe.session.user
     user_docs = frappe.get_all("Notification Log", filters={"for_user": user}, pluck="name")
     for dname in user_docs:

frappe_vault/api/secrets.py

@@ -6,16 +6,16 @@
 
 @frappe.whitelist()
 def list(
-    search=None,
-    title=None,
-    username=None,
-    secret_type=None,
-    folder=None,
-    bookmarks_only=False,
-    limit=20,
-    offset=0,
-    order_by="modified desc",
-):
+    search: str | None = None,
+    title: str | None = None,
+    username: str | None = None,
+    secret_type: str | None = None,
+    folder: str | None = None,
+    bookmarks_only: bool = False,
+    limit: int = 20,
+    offset: int = 0,
+    order_by: str = "modified desc",
+) -> dict:
     from frappe_vault.services.secret_service import get_secrets
 
     return get_secrets(
@@ -32,7 +32,7 @@ def list(
 
 
 @frappe.whitelist()
-def get(name, decrypt=False):
+def get(name: str, decrypt: bool = False) -> dict:
     if not isinstance(name, str):
         frappe.throw(_("Invalid secret identifier"), frappe.ValidationError)
     from frappe_vault.services.secret_service import get_secret
@@ -41,14 +41,14 @@ def get(name, decrypt=False):
 
 
 @frappe.whitelist()
-def create(**kwargs):
+def create(**kwargs) -> dict:
     from frappe_vault.services.secret_service import create_secret
 
     return create_secret(kwargs)
 
 
 @frappe.whitelist()
-def update(name, **kwargs):
+def update(name: str, **kwargs) -> dict:
     if not isinstance(name, str):
         frappe.throw(_("Invalid secret identifier"), frappe.ValidationError)
     from frappe_vault.services.secret_service import update_secret
@@ -57,7 +57,7 @@ def update(name, **kwargs):
 
 
 @frappe.whitelist()
-def delete(name):
+def delete(name: str) -> dict:
     if not isinstance(name, str):
         frappe.throw(_("Invalid secret identifier"), frappe.ValidationError)
     from frappe_vault.services.secret_service import delete_secret
@@ -66,7 +66,7 @@ def delete(name):
 
 
 @frappe.whitelist()
-def bulk_delete(secret_names):
+def bulk_delete(secret_names: str | builtins.list) -> dict:
     from frappe_vault.services.secret_service import bulk_delete as _delete
 
     if isinstance(secret_names, str):
@@ -77,7 +77,7 @@ def bulk_delete(secret_names):
 
 
 @frappe.whitelist()
-def toggle_bookmark(name):
+def toggle_bookmark(name: str) -> dict:
     if not isinstance(name, str):
         frappe.throw(_("Invalid secret identifier"), frappe.ValidationError)
     from frappe_vault.services.secret_service import toggle_bookmark as _toggle
@@ -86,7 +86,7 @@ def toggle_bookmark(name):
 
 
 @frappe.whitelist()
-def bulk_move(secret_names, target_folder):
+def bulk_move(secret_names: str | builtins.list, target_folder: str) -> dict:
     from frappe_vault.services.secret_service import bulk_move as _move
 
     if isinstance(secret_names, str):
@@ -97,14 +97,14 @@ def bulk_move(secret_names, target_folder):
 
 
 @frappe.whitelist()
-def stats():
+def stats() -> dict:
     from frappe_vault.services.secret_service import get_vault_stats
 
     return get_vault_stats()
 
 
 @frappe.whitelist()
-def decrypt(name):
+def decrypt(name: str) -> dict:
     """Decrypt a secret's sensitive fields."""
     if not isinstance(name, str):
         frappe.throw(_("Invalid secret identifier"), frappe.ValidationError)