Fix bandit warnings

src/.gitignore

@@ -6,4 +6,5 @@ __pycache__
 **/env
 **/.coverage
 **/db
-**.db
+**.db
+.install.stamp

src/Makefile

@@ -1,14 +1,49 @@
-.PHONY: format lint test
+SHERPA := sherpa_ai
+SHERPA_TESTS := tests
+INSTALL_STAMP := .install.stamp
+POETRY := $(shell command -v poetry 2> /dev/null)
 
-GIT_ROOT ?= $(shell git rev-parse --show-toplevel)
+.DEFAULT_GOAL := help
 
-format:
-	black .
-	isort .
+.PHONY: help
+help:
+	@echo "Please use 'make <target>' where <target> is one of"
+	@echo ""
+	@echo "  install    install packages and prepare environment"
+	@echo "  clean      remove all temporary files"
+	@echo "  lint       run the code linters"
+	@echo "  format     reformat code"
+	@echo "  test       run all the tests"
+	@echo ""
+	@echo "Check the Makefile to know exactly what each target is doing."
 
-lint:
-	flake8 .
-	black . --check
+install: $(INSTALL_STAMP)
+$(INSTALL_STAMP): pyproject.toml poetry.lock
+	@if [ -z $(POETRY) ]; then echo "Poetry could not be found. See https://python-poetry.org/docs/"; exit 2; fi
+	$(POETRY) install
+	# en_core_web_sm required by spacy needs to be installed separately
+	$(POETRY) run python -m spacy download en_core_web_sm 
+	touch $(INSTALL_STAMP)
 
-test:
-	pytest .
+.PHONY: clean
+clean:
+	find . -type d -name "__pycache__" | xargs rm -rf {};
+	rm -rf $(INSTALL_STAMP) .coverage .mypy_cache
+
+.PHONY: lint
+lint: $(INSTALL_STAMP)
+	$(POETRY) run isort --check-only --profile=black --lines-after-imports=2 $(SHERPA) $(SHERPA_TESTS)
+	$(POETRY) run black --check $(SHERPA) $(SHERPA_TESTS) --diff
+	$(POETRY) run flake8 --ignore=W503,E501,F401 $(SHERPA) $(SHERPA_TESTS)
+	# $(POETRY) run mypy $(SHERPA) $(SHERPA_TESTS) --ignore-missing-imports
+	$(POETRY) run bandit -r $(SHERPA)
+	$(POETRY) run bandit -r $(SHERPA_TESTS) -s B101
+
+.PHONY: format
+format: $(INSTALL_STAMP)
+	$(POETRY) run isort --profile=black --lines-after-imports=2 $(SHERPA) $(SHERPA_TESTS)
+	$(POETRY) run black $(SHERPA) $(SHERPA_TESTS)
+
+.PHONY: test
+test: $(INSTALL_STAMP)
+	$(POETRY) run pytest $(SHERPA_TESTS) --cov-report term-missing --cov-fail-under 75 --cov=$(SHERPA)

src/apps/slackapp/Makefile

@@ -0,0 +1,47 @@
+SLACK_APP := slackapp
+SLACK_APP_TESTS := tests
+INSTALL_STAMP := .install.stamp
+POETRY := $(shell command -v poetry 2> /dev/null)
+
+.DEFAULT_GOAL := help
+
+.PHONY: help
+help:
+	@echo "Please use 'make <target>' where <target> is one of"
+	@echo ""
+	@echo "  install    install packages and prepare environment"
+	@echo "  clean      remove all temporary files"
+	@echo "  lint       run the code linters"
+	@echo "  format     reformat code"
+	@echo "  test       run all the tests"
+	@echo ""
+	@echo "Check the Makefile to know exactly what each target is doing."
+
+install: $(INSTALL_STAMP)
+$(INSTALL_STAMP): pyproject.toml poetry.lock
+	@if [ -z $(POETRY) ]; then echo "Poetry could not be found. See https://python-poetry.org/docs/"; exit 2; fi
+	$(POETRY) install
+	# en_core_web_sm required by spacy needs to be installed separately
+	$(POETRY) run python -m spacy download en_core_web_sm 
+	touch $(INSTALL_STAMP)
+
+.PHONY: clean
+clean:
+	find . -type d -name "__pycache__" | xargs rm -rf {};
+	rm -rf $(INSTALL_STAMP) .coverage .mypy_cache
+
+.PHONY: lint
+lint: $(INSTALL_STAMP)
+	$(POETRY) run isort --check-only --profile=black --lines-after-imports=2 $(SLACK_APP) $(SLACK_APP_TESTS)
+	$(POETRY) run black --check $(SLACK_APP) $(SLACK_APP_TESTS) --diff
+	$(POETRY) run flake8 --ignore=W503,E501,F401 $(SLACK_APP) $(SLACK_APP_TESTS)
+	# $(POETRY) run mypy $(SLACK_APP) $(SLACK_APP_TESTS) --ignore-missing-imports
+
+.PHONY: format
+format: $(INSTALL_STAMP)
+	$(POETRY) run isort --profile=black --lines-after-imports=2 $(SLACK_APP) $(SLACK_APP_TESTS)
+	$(POETRY) run black $(SLACK_APP) $(SLACK_APP_TESTS)
+
+.PHONY: test
+test: $(INSTALL_STAMP)
+	$(POETRY) run pytest $(SLACK_APP_TESTS) --cov-report term-missing --cov-fail-under 50 --cov=$(SLACK_APP)

src/apps/slackapp/pyproject.toml

@@ -2,8 +2,9 @@
 name = "slackapp"
 version = "0.1.0"
 description = "Slack bot using sherpa-ai"
-authors = ["Your Name <you@example.com>"]
+authors = []
 readme = "README.md"
+repository = "https://github.com/Aggregate-Intellect/sherpa"
 
 [tool.poetry.dependencies]
 python = "^3.9"
@@ -18,13 +19,15 @@ hydra-core = "^1.3.2"
 sherpa_slack = 'slackapp.bolt_app:main'
 
 [tool.poetry.group.test.dependencies]
-pytest = "7.4.0"
+pytest = "^7.4.0"
+pytest-cov = "^4.1.0"
 
 [tool.poetry.group.lint.dependencies]
-black = "23.7.0"
-flake8 = "6.1.0"
-isort = "5.12.0"
-flake8-pyproject = "1.2.3"
+black = "^23.7.0"
+flake8 = "^6.1.0"
+isort = "^5.12.0"
+flake8-pyproject = "^1.2.3"
+mypy = "^1.9.0"
 
 [build-system]
 requires = ["poetry-core"]

src/apps/slackapp/slackapp/bolt_app.py

@@ -33,6 +33,7 @@
 from sherpa_ai.verbose_loggers import DummyVerboseLogger, SlackVerboseLogger
 from sherpa_ai.verbose_loggers.base import BaseVerboseLogger
 
+
 #######################################################################################
 # Set up Slack client and Chroma database
 #######################################################################################
@@ -336,7 +337,14 @@ def main():
     logger.info(
         "App init: starting HTTP server on port {port}".format(port=cfg.SLACK_PORT)
     )
-    flask_app.run(host="0.0.0.0", port=cfg.SLACK_PORT, debug=cfg.FLASK_DEBUG)
+    # SECURITY host "0.0.0.0" tells Flask to listen on all available IP addresses.
+    # This is handy for development, but unsafe in production.
+    # See https://bandit.readthedocs.io/en/1.7.8/plugins/b104_hardcoded_bind_all_interfaces.html.
+    # In production you would typically place the Flask server behind a WSGI
+    # server like Gunicorn and a reverse proxy, and implement other security measures.
+    flask_app.run(
+        host="0.0.0.0", port=cfg.SLACK_PORT, debug=cfg.FLASK_DEBUG  # nosec B104
+    )
 
 
 # Start the HTTP server

src/apps/slackapp/slackapp/routes/whitelist.py

@@ -2,6 +2,7 @@
 
 from sherpa_ai.database.user_usage_tracker import UserUsageTracker
 
+
 whitelist_blueprint = Blueprint("auth", __name__)