mirror of
https://github.com/kuhyx/WUT_Computer_Science.git
synced 2026-11-10 21:07:09 +01:00
8798105aa1
7 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| 8798105aa1 |
Grade against 3.14 too, not just run on it
The pre-commit workflow already installs `python-version: "3.x"`, but ruff was still grading the archive against py310 -- so it kept withholding the pyupgrade and type-checking fixes that only become safe at the newer target. `pin_ci_python.py` rewrites the knob. The 17 findings that appeared are what the stale target was hiding: `datetime.timezone.utc` where `datetime.UTC` is now correct (UP017), and 14 imports used only in annotations that belong under `TYPE_CHECKING` (TC002, TC003) -- safe here precisely because 3.14's PEP 649 defers annotation evaluation, which is the same reason ruff would not offer them at py310. `ruff check` and `ruff format --check` are clean again, so the zero-findings state this repo reached earlier today holds at the new target. Still contradictory and deliberately untouched: the four `Programming/ERSMS-project/*/Dockerfile` files say `FROM python:3.10-slim`. They build an archived coursework service against its own era's pinned dependencies, and nothing in this repo runs them; bumping the base image would be a rewrite of that project, not a lint-target change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SfnJmxxsZ534AKk16rC2Gr |
|||
| 2a59de6363 |
The six mypy errors are gone: four were fixable, two are scoped
The note in TODO-refactor-remaining.md said ERSMS's four were structural and that a fix "would rewrite both models". Both halves were wrong. flask-sqlalchemy 3.1.1 does ship py.typed; the real blocker was that `class User(db.Model)` is attribute access, which mypy cannot resolve in a base-class position. backend/models.py now declares a named DeclarativeBase with SQLAlchemy 2.0 Mapped[] columns. The Model mixin goes away with the base, so the six legacy Model.query call sites became db.session selects and the two table names are spelled out rather than derived. Verified by driving the real routes through Flask's test client with Firebase stubbed out -- 16 scenarios covering every one of the six call sites, plus both CREATE TABLE statements, byte-identical to the submitted version. That harness caught the one thing review would not have: mapped_column(ForeignKey( "user.uid")) silently infers VARCHAR(80) from the referenced column, which had changed the submitted `user_id INTEGER`. An explicit Integer puts it back. app.py went over the 250-line cap on the way, hence the split; models.py takes the shebang + exec bit that NLP's nine import-only modules already use, since __init__.py would make `from models import` unresolvable to mypy while it still works at runtime. backend/Dockerfile copied only app.py, so it needed the new file too. PSD's two are pyflink's MapFunction and KeyedProcessFunction, which ship no types and are not installed in that venv at all -- a hand-written .pyi would assert an API nothing here can check. A [[tool.mypy.overrides]] scoped to that one module turns off disallow_subclassing_any and nothing else. ERSMS 4 -> 0, PSD 2 -> 0, under --strict. ruff and ruff format clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE |
|||
| f58f55f68b |
ERSMS-project: zero findings, and the SQL is parameterised now
156 ruff findings to 0. That takes the whole archive to 0, from 9,281.
Six of those findings were SQL injection, and they were the real ones. The
connector interpolated a username and an OAuth id straight out of the URL into
f-string SQL. With psycopg2 installed, the difference is not theoretical:
username = "x'; DROP TABLE users; --"
old: select * from users where username='x'; DROP TABLE users; --';
new: select * from users where username='x''; DROP TABLE users; --';
The old form is two statements and the second one runs. The new one is a
parameter, so the whole thing stays a string literal. Every query in that file
is parameterised now.
`get_recommendations` also called
`cursor.execute("... oauth_ID='{}'", oauth_ID)`, which is wrong twice over:
psycopg2 wants %s rather than {}, and its second argument must be a sequence,
not a bare string. That route could never have worked.
Ten blind `except Exception` handlers turned every programming error into a
500 with the message hidden. They are now the exceptions each block can
actually raise -- verified against the installed libraries, where
InvalidIdTokenError and ExpiredIdTokenError really are FirebaseError
subclasses -- and the handlers log a traceback instead of printing the
exception's str().
Three services bound `host="localhost"`. Each of them runs in a container with
a published port, on a compose bridge network, so binding loopback makes them
unreachable from both the host and their siblings. All four now read
ERSMS_HOST, which docker-compose sets to 0.0.0.0, and default to loopback when
run outside Docker. Flask's debug console executes arbitrary code, so that is
opt-in via FLASK_DEBUG too.
`movie_recommender.py` fitted the model at import: reading two CSVs and
building a 4803x4803 similarity matrix as a side effect of `import`. It failed
outright here, since the datasets are not committed. It is in `main()` now, and
the module imports cleanly. `error_decorator` was dead code that swallowed its
wrapped function's return value; it is gone.
Verified: all four modules import (the backend still needs its Firebase
credential JSON, which is not committed, exactly as before), the recommender's
helpers still pick the director out of a crew list, trim cast to three, fold
"Tom Hanks" to "tomhanks" and join a soup in the same order, and every route
parameter rename was matched by the URL rule it comes from.
Three of the four services are clean under mypy --strict. The backend keeps
four errors: flask-sqlalchemy builds `db.Model` dynamically, so `--strict`
refuses to subclass it. Migrating to a typed DeclarativeBase would rewrite both
models in an app that cannot be run here, so those four are reported in
TODO-refactor-remaining.md rather than hidden.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
|||
| 74fb46b4ab |
PSD: zero findings, and four modules that no longer run on import
152 ruff findings to 0 across twelve files, and mypy --strict is clean on all of them but one -- see the end. The course is marked unrunnable because it wants Kafka and Flink, so the verification is what can be run without them. Ten of the twelve modules now import cleanly against a venv with confluent-kafka, kafka-python and flask; the two pyflink ones are skipped. That check did not exist before, because four of these files WERE their own side effect: - `kafka/generate_and_send.py` and `kafka/kafka_consumer.py` ran their `while True:` loop at module level. Importing either never returns; I gave up after twelve seconds of rdkafka connection failures. - `zin1/producent.py` built a KafkaProducer at module level and raised NoBrokersAvailable on import. - `flink/anomaly_detector.py` called `env.execute()` at module level. Each is a `main()` behind a `__main__` guard now, so importing one is free and running it is unchanged. `webinterface.py` called `json.loads` and never imported json, so the first message on the topic would have raised NameError. mypy then found three more of the same shape: confluent-kafka's `msg.error()` and `msg.value()` both return Optional, and the code dereferenced them straight away. They are narrowed to locals now, which also stops `msg.error()` being called twice per message. A malformed alarm with no timestamp is skipped with a warning instead of dividing None by 1000. Two SLF001 findings were reads of `KafkaError._PARTITION_EOF`. That leading underscore is confluent-kafka's own naming and there is no public alias, but `KafkaError.name()` is public and returns exactly that string -- checked against the installed library, where code() is -191 and name() is "_PARTITION_EOF". Flask's `debug=True` is now opt-in via FLASK_DEBUG, because the debug console executes arbitrary code. The ten `random` calls are simulation, not crypto, so S311 is not a real vulnerability -- but `secrets.SystemRandom()` is a drop-in with the same methods and no rule to argue with, so that is what they use. Behaviour is checked, not assumed: the sensor still returns a location in 1..10 and a temperature in -20..40, the thresholds still classify -15 as too cold, 40 as too hot and 20 as normal, transactions still carry a four-digit card id, and TemperatureReading survives a to_dict/from_dict round trip. **Two mypy errors remain and are deliberate.** `--strict` implies `disallow_subclassing_any`, and the Flink job must subclass pyflink's MapFunction and KeyedProcessFunction, which ship no types. Fixing it means weakening strict globally or writing an override for our own module. Neither is worth it, so the two are reported in TODO-refactor-remaining.md rather than hidden. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
|||
| 1fd1de2f82 |
twm_4: zero findings, with the notebook's outputs proved untouched
228 ruff findings to 0 across the notebook, its partial export and twm.py, and mypy --strict is clean on both .py files. A notebook is a deliverable that happens to contain code, so the check that mattered was not "does it still run" -- it needs a GPU, MNIST, CIFAR-10 and a slice of Quick, Draw! to run at all -- but "is anything except the code still exactly as submitted". Hashing every key of the .ipynb EXCEPT cell `source` gives 60242e116d12549d11c93f7f before the first edit and after the last one, across four passes and a `ruff format`. The file also round-trips byte-for-byte through json.dumps(indent=1, ensure_ascii=False), which is what made editing cells programmatically safe rather than a reformat of all 141 of them; the diff touches 38. print() became sys.stdout.write() rather than logging. In a notebook the print IS the output, and a logger with no handler configured would have silently emptied every cell -- the exact regression scripts/check_refactor_safety.py was written for. matprint's `print(x, end=" ")` and bare `print()` are preserved as writes with and without a trailing newline. Both `show_samples` and `show_samples_rgb` took (indices, preds, images, labels, count, names), which is six arguments and a mutable default. They now take a frozen `Samples` holding the last four, which also removed the same four-value tuple from seven call sites. Reviewing that diff is how I caught that I had transcribed `real_score = preds[sample][real_id]` as `samples.labels[sample]` -- a bug I introduced and then fixed before commit. Other real things, not just rule satisfaction: `np.in1d` is removed in NumPy 2 (NPY201) and is now `np.isin(...).ravel()`; `test_model` computed correct_indices and incorrect_indices and used neither; two cells grew `img` inside a loop so it was only bound by the `else` branch; and the Quick, Draw! downloader now builds a URL whose https scheme is a literal, which is what S310 was asking for. The README claimed the .py was "an nbconvert export of that notebook". It is an export of the CIFAR-10 section only -- 28 of 81 code cells -- and has been edited since. It says that now, and says the two are separate artifacts rather than one being regenerable from the other. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
|||
| 24f800d15a |
TRAK: zero findings, and a byte-identical render proving it
494 ruff findings to 0, and mypy --strict is clean too -- the first course in this campaign where that is true of both. Two real bugs turned up on the way, neither of which ruff can see: - `main.py` passed `args.environment_map` to `ray_trace`, and argparse only ever defined `--environment`. Every `--algorithm ray_tracing0` run died with AttributeError before rendering a pixel, so `rendering.py` -- the largest file in the course -- had no way to be exercised at all. - `mouse_button` in the environment-map viewer assigned `mouse_last_x/y` without declaring them `global`, so the drag origin went to locals and was thrown away. Measured against HEAD: a 10x5 px drag turned the camera by 11.0/20.5 degrees because it measured from (0, 0); it is 1.0/0.5 now, which is what the 0.1 degrees-per-pixel constant says it should be. Fixing the first one is what made the rest safe. `ray_tracing0` has no RNG anywhere in it, so it renders byte-identically every time, and the whole refactor of `rendering.py` is verified by one md5 comparison: 02484bdb6b6c1ddeff317d7e5566580f, 248619 rays, before and after. The cornell_box path cannot do that -- its ray count drifts by ~20 between identical runs. Three files were over the 250-line cap and are now split, geometry away from the algorithm that uses it: rendering.py 462 -> 137 + raytracer.py, photon_mapping.py 261 -> 160 + photon_geometry.py, and code/photonmapping/python/main.py 257 -> 203 + geometry.py. No TRAK source file is over the cap now. The two photon mappers do use numpy's legacy global RNG, so NPY002 could not be bit-identical. Each was done in two steps: restructure first, verified identical under an external seed (digests 7220370f60206a62 and 21b4771504ab2351, and an identical 828 photon traces), then the swap to `default_rng` on its own, checked against the before/after distributions. Verified by running, not by reading: - cornell_box through `./run.sh run Programming/TRAK`: 24.27s, 13294 rays - all five scenes build after `from sightpy import *` became explicit imports - the standalone photon mapper end to end: 81.4s, 38742 photon traces - the EXR loader byte for byte: a0c3890350ce6101247c6948, 6291456 bytes - the GLUT viewer under xvfb-run, which drew a real 1024x512 frame `pyproject.toml` gains a mypy override for Imath, OpenEXR, OpenGL and matplotlib. Those four ship neither stubs nor py.typed, and without it mypy cannot import them at all and so reports nothing else about the file. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
|||
| bd24dd57ea |
Hold the coursework to the same lint bar as the tooling
kuhy overruled the "do not fix coursework to be better than it was submitted" rule: git history is the archive, so the working tree can be clean. This lands the config and the mechanical half of the cleanup -- 9,281 ruff findings under the fleet config down to 3,686, with no per-file-ignores anywhere. What is in here: - pyproject.toml, the first one in this repo. select = ["ALL"], mypy strict, and the vendored list mirrored into ruff exclude and coverage omit. Five rules are off and each says why; CPY001 is the only judgement call, because stamping a copyright header onto 137 university assignments would assert a licence that was never claimed. No hook is wired up yet -- a gate lands only once its subject is clean. - ruff format + the safe fixes, then a second pass over the docstring rules ruff marks unsafe (they only edit docstring text). 108 files. - TRAK/sightpy is vendored, not coursework: it is rafael-fuente/Python-Raytracer (BSD 3-Clause). Verified against a fresh upstream clone with line endings normalised -- 30 of 32 files byte-identical, ray.py and scene.py carrying a 12- and 13-line local patch that counts rays for the report. 35 files that should never have been linted, now excluded and restored. - WDWR, SPD, MOM and ECRYPT are fully clean, by hand and verified by running them: WDWR's three plot scripts print the same statistics as before, MOM's PuLP model solves to the same cost. WDWR's graph.py had a 342-character CSV header embedded as a string literal, which cannot be wrapped -- the data moved to data/pareto_front.csv. Two 0-byte .py stubs are deleted; an empty file is not a deliverable and git still has it. Three harness bugs found by actually running things: - `run` now forces MPLBACKEND=Agg. TRAK finished its ray trace in 37 seconds and then sat for 45 minutes: plt.show() had opened an image viewer and was waiting for someone to close the window. - TRAK's main.py only pops that viewer with --show now, and its runner writes to a gitignored build/ via the new --entry-args. The default output path is outputs/output.png, which is TRACKED -- a plain run overwrote a submitted deliverable. - course_lib.sh was 357 lines, over this repo's own cap. Split into course_probe.sh and course_run.sh. Verified: ECOTE 26 tests pass, ECRYPT_PROJECT 99 pass, TRAK renders cornell_box in 37s and exits 0, every module compiles, and every import ruff removed was checked to be genuinely unused. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE |
