fix: lint and format fixes (ruff check + ruff format)

Remove unused imports, fix import sorting, apply ruff formatter
to all Python source and test files.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: mariuspruvot

apps/api/src/helprs/admin/views.py

@@ -10,7 +10,11 @@
 
 class GitHubUserAdmin(ModelView, model=GitHubUser):
     column_list = [
-        GitHubUser.id, GitHubUser.github_id, GitHubUser.github_login, GitHubUser.email, GitHubUser.created_at,
+        GitHubUser.id,
+        GitHubUser.github_id,
+        GitHubUser.github_login,
+        GitHubUser.email,
+        GitHubUser.created_at,
     ]
     column_searchable_list = [GitHubUser.github_login, GitHubUser.email]
     column_sortable_list = [GitHubUser.github_id, GitHubUser.github_login, GitHubUser.created_at]
@@ -70,9 +74,7 @@ async def login(self, request: Request) -> bool:
         settings = get_settings()
         # For MVP: accept any login if ENVIRONMENT is development,
         # otherwise require ADMIN_PASSWORD
-        if settings.ENVIRONMENT == "development" or (
-            settings.ADMIN_PASSWORD and password == settings.ADMIN_PASSWORD
-        ):
+        if settings.ENVIRONMENT == "development" or (settings.ADMIN_PASSWORD and password == settings.ADMIN_PASSWORD):
             request.session.update({"authenticated": True})
             return True
         return False

apps/api/src/helprs/core/dependencies.py

@@ -63,9 +63,7 @@ async def get_current_user(
     except (ValueError, AttributeError) as e:
         raise UnauthorizedError("Invalid token payload") from e
 
-    result = await session.execute(
-        select(GitHubUser).where(GitHubUser.id == user_id)
-    )
+    result = await session.execute(select(GitHubUser).where(GitHubUser.id == user_id))
     user = result.scalar_one_or_none()
     if not user:
         raise UnauthorizedError("User not found")

apps/api/src/helprs/modules/identity/router.py

@@ -29,11 +29,13 @@ async def github_login(request: Request, settings: GetSettings):
     """Redirect to GitHub OAuth authorization page."""
     state = secrets.token_urlsafe(32)
     # Store state in a cookie for CSRF validation on callback
-    params = urlencode({
-        "client_id": settings.GITHUB_CLIENT_ID,
-        "scope": OAUTH_SCOPES,
-        "state": state,
-    })
+    params = urlencode(
+        {
+            "client_id": settings.GITHUB_CLIENT_ID,
+            "scope": OAUTH_SCOPES,
+            "state": state,
+        }
+    )
     is_secure = settings.ENVIRONMENT != "development"
     response = RedirectResponse(url=f"{GITHUB_AUTHORIZE_URL}?{params}")
     response.set_cookie(

apps/api/src/helprs/modules/identity/service.py

@@ -79,9 +79,7 @@ async def get_or_create_user(
     github_id = github_user_data["id"]
     encrypted_token = fernet_encrypt(access_token, settings.FERNET_KEY)
 
-    result = await session.execute(
-        select(GitHubUser).where(GitHubUser.github_id == github_id)
-    )
+    result = await session.execute(select(GitHubUser).where(GitHubUser.github_id == github_id))
     user = result.scalar_one_or_none()
 
     if user:
@@ -148,9 +146,7 @@ async def refresh_tokens(
     except (ValueError, AttributeError) as e:
         raise UnauthorizedError("Invalid refresh token payload") from e
 
-    result = await session.execute(
-        select(GitHubUser).where(GitHubUser.id == user_id)
-    )
+    result = await session.execute(select(GitHubUser).where(GitHubUser.id == user_id))
     user = result.scalar_one_or_none()
     if not user:
         raise UnauthorizedError("User not found")

apps/api/src/helprs/modules/installation/models.py

@@ -14,9 +14,7 @@ class Installation(Base):
 
     __tablename__ = "installations"
 
-    github_installation_id: Mapped[int] = mapped_column(
-        BigInteger, unique=True, index=True, nullable=False
-    )
+    github_installation_id: Mapped[int] = mapped_column(BigInteger, unique=True, index=True, nullable=False)
     account_login: Mapped[str] = mapped_column(String(255), nullable=False)
     account_id: Mapped[int] = mapped_column(BigInteger, nullable=False)
     account_type: Mapped[str] = mapped_column(String(50), nullable=False)
@@ -26,16 +24,10 @@ class Installation(Base):
     permissions: Mapped[dict | None] = mapped_column(JSON, nullable=True)
     events: Mapped[list | None] = mapped_column(JSON, nullable=True)
     suppression_labels: Mapped[list | None] = mapped_column(JSON, nullable=True, default=list)
-    suspended_at: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True
-    )
-    deleted_at: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True
-    )
+    suspended_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    deleted_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
 
-    byok_config: Mapped["BYOKConfig | None"] = relationship(
-        "BYOKConfig", back_populates="installation", uselist=False
-    )
+    byok_config: Mapped["BYOKConfig | None"] = relationship("BYOKConfig", back_populates="installation", uselist=False)
 
 
 class BYOKConfig(Base):
@@ -48,11 +40,7 @@ class BYOKConfig(Base):
     )
     encrypted_api_key: Mapped[str] = mapped_column(String(1024), nullable=False)
     key_status: Mapped[str] = mapped_column(String(20), default="valid")
-    validated_at: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True
-    )
+    validated_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
     key_hint: Mapped[str | None] = mapped_column(String(20), nullable=True)
 
-    installation: Mapped["Installation"] = relationship(
-        "Installation", back_populates="byok_config"
-    )
+    installation: Mapped["Installation"] = relationship("Installation", back_populates="byok_config")

apps/api/src/helprs/modules/installation/router.py

@@ -17,7 +17,6 @@
 from helprs.modules.installation.service import (
     configure_byok,
     delete_byok_config,
-    get_byok_config,
     get_installation_by_github_id,
     get_installations_for_user,
     update_suppression_labels,
@@ -100,9 +99,7 @@ async def post_byok(
     if not installation:
         raise NotFoundError("Installation not found")
     await verify_admin_permission(user, installation, settings)
-    config = await configure_byok(
-        session, installation.id, body.api_key, settings.FERNET_KEY
-    )
+    config = await configure_byok(session, installation.id, body.api_key, settings.FERNET_KEY)
     return BYOKConfigResponse.model_validate(config)
 
 

apps/api/src/helprs/modules/installation/schemas.py

@@ -42,9 +42,7 @@ def validate_labels(cls, v: list[str]) -> list[str]:
             if len(label) > 50:
                 raise ValueError(f"Label '{label}' exceeds maximum 50 characters")
             if not re.match(r"^[a-zA-Z0-9\-]+$", label):
-                raise ValueError(
-                    f"Label '{label}' contains invalid characters. Only alphanumeric and hyphens allowed"
-                )
+                raise ValueError(f"Label '{label}' contains invalid characters. Only alphanumeric and hyphens allowed")
         return v
 
 

apps/api/src/helprs/modules/installation/service.py

@@ -46,9 +46,7 @@ async def get_installation_access_token(installation_id: int, app_jwt: str) -> d
     except httpx.HTTPStatusError as e:
         if e.response.status_code == 401:
             raise UnauthorizedError("GitHub App JWT is invalid or expired") from e
-        raise ExternalServiceError(
-            f"GitHub API error: {e.response.status_code}"
-        ) from e
+        raise ExternalServiceError(f"GitHub API error: {e.response.status_code}") from e
     return resp.json()
 
 
@@ -106,9 +104,7 @@ async def create_installation(session: AsyncSession, webhook_data: dict) -> Inst
     return installation
 
 
-async def soft_delete_installation(
-    session: AsyncSession, github_installation_id: int
-) -> Installation | None:
+async def soft_delete_installation(session: AsyncSession, github_installation_id: int) -> Installation | None:
     """Soft-delete an installation by setting deleted_at. Returns None if not found."""
     result = await session.execute(
         select(Installation).where(
@@ -128,9 +124,7 @@ async def soft_delete_installation(
     return installation
 
 
-async def suspend_installation(
-    session: AsyncSession, github_installation_id: int
-) -> Installation | None:
+async def suspend_installation(session: AsyncSession, github_installation_id: int) -> Installation | None:
     """Set suspended_at on an installation."""
     result = await session.execute(
         select(Installation).where(
@@ -150,9 +144,7 @@ async def suspend_installation(
     return installation
 
 
-async def unsuspend_installation(
-    session: AsyncSession, github_installation_id: int
-) -> Installation | None:
+async def unsuspend_installation(session: AsyncSession, github_installation_id: int) -> Installation | None:
     """Clear suspended_at on an installation."""
     result = await session.execute(
         select(Installation).where(
@@ -172,9 +164,7 @@ async def unsuspend_installation(
     return installation
 
 
-async def get_installation_by_github_id(
-    session: AsyncSession, github_installation_id: int
-) -> Installation | None:
+async def get_installation_by_github_id(session: AsyncSession, github_installation_id: int) -> Installation | None:
     """Lookup installation by GitHub ID, excluding soft-deleted records."""
     result = await session.execute(
         select(Installation).where(
@@ -185,9 +175,7 @@ async def get_installation_by_github_id(
     return result.scalar_one_or_none()
 
 
-async def get_installations_for_user(
-    session: AsyncSession, user, settings: Settings
-) -> list[Installation]:
+async def get_installations_for_user(session: AsyncSession, user, settings: Settings) -> list[Installation]:
     """Get installations the user has access to via the GitHub API."""
     try:
         github_token = fernet_decrypt(user.github_access_token_enc, settings.FERNET_KEY)
@@ -210,13 +198,9 @@ async def get_installations_for_user(
     except httpx.HTTPStatusError as e:
         if e.response.status_code == 401:
             raise UnauthorizedError("GitHub token is invalid or revoked") from e
-        raise ExternalServiceError(
-            f"GitHub API error: {e.response.status_code}"
-        ) from e
+        raise ExternalServiceError(f"GitHub API error: {e.response.status_code}") from e
 
-    user_installation_ids = {
-        inst["id"] for inst in resp.json().get("installations", [])
-    }
+    user_installation_ids = {inst["id"] for inst in resp.json().get("installations", [])}
 
     if not user_installation_ids:
         return []
@@ -230,9 +214,7 @@ async def get_installations_for_user(
     return list(result.scalars().all())
 
 
-async def verify_admin_permission(
-    user, installation: Installation, settings: Settings
-) -> bool:
+async def verify_admin_permission(user, installation: Installation, settings: Settings) -> bool:
     """Verify user has admin permission on the installation's org/repo."""
     try:
         github_token = fernet_decrypt(user.github_access_token_enc, settings.FERNET_KEY)
@@ -262,12 +244,8 @@ async def verify_admin_permission(
         if e.response.status_code == 401:
             raise UnauthorizedError("GitHub token is invalid or revoked") from e
         if e.response.status_code in (403, 404):
-            raise ForbiddenError(
-                "You do not have admin access to this installation"
-            ) from e
-        raise ExternalServiceError(
-            f"GitHub API error: {e.response.status_code}"
-        ) from e
+            raise ForbiddenError("You do not have admin access to this installation") from e
+        raise ExternalServiceError(f"GitHub API error: {e.response.status_code}") from e
 
     membership = resp.json()
     if membership.get("role") != "admin" or membership.get("state") != "active":
@@ -298,9 +276,7 @@ async def validate_anthropic_api_key(api_key: str) -> bool:
     except httpx.TimeoutException as e:
         raise ExternalServiceError("Anthropic API is temporarily unavailable") from e
     except httpx.HTTPStatusError as e:
-        raise ExternalServiceError(
-            f"Anthropic API error: {e.response.status_code}"
-        ) from e
+        raise ExternalServiceError(f"Anthropic API error: {e.response.status_code}") from e
     except httpx.TransportError as e:
         raise ExternalServiceError("Anthropic API is temporarily unavailable") from e
 
@@ -314,9 +290,7 @@ async def configure_byok(
     """Configure BYOK key for an installation. Validates, encrypts, and upserts."""
     is_valid = await validate_anthropic_api_key(api_key)
     if not is_valid:
-        raise BYOKKeyInvalidError(
-            "API key validation failed -- check your key and try again"
-        )
+        raise BYOKKeyInvalidError("API key validation failed -- check your key and try again")
 
     encrypted_key = fernet_encrypt(api_key, fernet_key)
     key_hint = f"...{api_key[-4:]}"
@@ -346,13 +320,9 @@ async def configure_byok(
     return config
 
 
-async def get_byok_config(
-    session: AsyncSession, installation_id: uuid.UUID
-) -> BYOKConfig | None:
+async def get_byok_config(session: AsyncSession, installation_id: uuid.UUID) -> BYOKConfig | None:
     """Get BYOK config for an installation."""
-    result = await session.execute(
-        select(BYOKConfig).where(BYOKConfig.installation_id == installation_id)
-    )
+    result = await session.execute(select(BYOKConfig).where(BYOKConfig.installation_id == installation_id))
     return result.scalar_one_or_none()
 
 
@@ -364,9 +334,7 @@ def decrypt_byok_key(byok_config: BYOKConfig, fernet_key: str) -> str:
         raise BYOKKeyInvalidError("Stored API key could not be decrypted") from e
 
 
-async def delete_byok_config(
-    session: AsyncSession, installation_id: uuid.UUID
-) -> bool:
+async def delete_byok_config(session: AsyncSession, installation_id: uuid.UUID) -> bool:
     """Hard delete BYOK config for an installation."""
     config = await get_byok_config(session, installation_id)
     if not config:
@@ -395,9 +363,7 @@ async def update_suppression_labels(
         raise DomainValidationError("Maximum 20 suppression labels allowed")
     for label in labels:
         if len(label) > 50:
-            raise DomainValidationError(
-                f"Label '{label}' exceeds maximum length of 50 characters"
-            )
+            raise DomainValidationError(f"Label '{label}' exceeds maximum length of 50 characters")
         if not LABEL_PATTERN.match(label):
             raise DomainValidationError(
                 f"Label '{label}' contains invalid characters. Only alphanumeric and hyphens allowed"

apps/api/src/helprs/modules/webhook/dispatcher.py

@@ -21,9 +21,7 @@
 }
 
 
-async def dispatch_webhook(
-    event_type: str, action: str, payload: dict, session: AsyncSession
-) -> None:
+async def dispatch_webhook(event_type: str, action: str, payload: dict, session: AsyncSession) -> None:
     """Route webhook events to the appropriate handler."""
     handler = _HANDLERS.get((event_type, action))
     if handler:

apps/api/tests/modules/identity/test_router.py

@@ -116,9 +116,7 @@ async def test_valid_callback(self, app_with_db):
                 follow_redirects=False,
             ) as client:
                 client.cookies.set("oauth_state", state)
-                resp = await client.get(
-                    f"/api/v1/auth/github/callback?code=test_code&state={state}"
-                )
+                resp = await client.get(f"/api/v1/auth/github/callback?code=test_code&state={state}")
                 assert resp.status_code == 307
                 location = resp.headers["location"]
                 assert "access_token=" in location
@@ -130,9 +128,7 @@ async def test_invalid_state(self, app_with_db):
             base_url="http://test",
             follow_redirects=False,
         ) as client:
-            resp = await client.get(
-                "/api/v1/auth/github/callback?code=test&state=invalid"
-            )
+            resp = await client.get("/api/v1/auth/github/callback?code=test&state=invalid")
             assert resp.status_code == 401