Bandit fixes

application/datamanager/features/steps/equity_bars_steps.py

@@ -24,7 +24,7 @@ def step_impl_api_url(context: Context) -> None:
 @when('I send a POST request to "{endpoint}" for date range')
 def step_impl_post_request(context: Context, endpoint: str) -> None:
     url = f"{context.api_url}{endpoint}"
-    response = requests.post(url, json={"date": context.start_date})
+    response = requests.post(url, json={"date": context.start_date}, timeout=30)
     context.response = response
 
 
@@ -34,6 +34,7 @@ def step_imp_get_request(context: Context, endpoint: str) -> None:
     response = requests.get(
         url,
         params={"start_date": context.start_date, "end_date": context.end_date},
+        timeout=30,
     )
     context.response = response
 
@@ -48,7 +49,7 @@ def step_impl_response_status_code(context: Context, status_code: str) -> None:
 @when('I send a DELETE request to "{endpoint}" for date "{date_str}"')
 def step_impl(context: Context, endpoint: str, date_str: str) -> None:
     url = f"{context.api_url}{endpoint}"
-    response = requests.delete(url, json={"date": date_str})
+    response = requests.delete(url, json={"date": date_str}, timeout=30)
     context.response = response
     context.test_date = date_str
 

application/datamanager/features/steps/health_steps.py

@@ -7,4 +7,4 @@
 @when('I send a GET request to "{endpoint}"')
 def step_impl(context: Context, endpoint: str) -> None:
     url = f"{context.api_url}{endpoint}"
-    context.response = requests.get(url)
+    context.response = requests.get(url, timeout=30)

application/datamanager/src/datamanager/main.py

@@ -21,7 +21,7 @@
 def bars_query(*, bucket: str, start_date: date, end_date: date) -> str:
     path_pattern = f"gs://{bucket}/equity/bars/*/*/*/*"
 
-    return f"""
+    return f""" 
         SELECT *
         FROM read_parquet(
             '{path_pattern}', 
@@ -35,7 +35,7 @@ def bars_query(*, bucket: str, start_date: date, end_date: date) -> str:
             (year < {end_date.year} OR 
              (year = {end_date.year} AND month < {end_date.month}) OR 
              (year = {end_date.year} AND month = {end_date.month} AND day <= {end_date.day}))
-    """
+    """  # noqa: S608
 
 
 @asynccontextmanager
@@ -111,7 +111,7 @@ async def get_equity_bars(
         return Response(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR)
 
 
-@application.post("/equity-bars", response_model=BarsSummary)
+@application.post("/equity-bars")
 async def fetch_equity_bars(request: Request, summary_date: SummaryDate) -> BarsSummary:
     polygon = request.app.state.settings.polygon
     bucket = request.app.state.settings.gcp.bucket

pyproject.toml

@@ -65,11 +65,18 @@ skip_covered = true
 [tool.coverage.xml]
 output = "coverage_output/.python_coverage.xml"
 
-[tool.ruff]
+[tool.ruff.lint]
 select = [
-  "ANN",
-  "ERA"
+  "ANN", # type annotations
+  "ASYNC",
+  "ERA", # dead code
+  "FAST", # fastapi
+  "S", # bandit (security)
+  "YTT" # flake8
 ]
+[tool.ruff.lint.per-file-ignores]
+"**/tests/**/*.py" = ["S101"]
+"**/features/steps/**/*.py" = ["S101"]
 
 [tool.ty.rules]
 unresolved-import = "ignore"