[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "cloud-audit"
version = "2.5.0"
description = "Open-source, read-only AWS security scanner. 110 checks across 25 services, 31 attack-chain rules, 64 IAM escalation methods (incl. lateral AssumeRole graph), Proof Mode exploitability verification, data perimeter and Bedrock AgentCore checks, Blast Radius CLI, Threat Feed, What-If simulator, AI-SPM, 6 compliance frameworks, breach-cost estimation, MCP server. CLI + Terraform remediation on every finding."
readme = "README.md"
license = "MIT"
requires-python = ">=3.10"
authors = [
    { name = "Mariusz Gebala", email = "kontakt@haitmg.pl" },
]
keywords = ["aws", "cloud", "audit", "security", "compliance", "cis", "soc2", "scanner", "devops", "terraform", "aws-security", "cloud-security", "security-scanner", "cis-benchmark", "remediation", "sarif", "devsecops", "mcp", "mcp-server", "model-context-protocol", "breach-cost"]
classifiers = [
    "Development Status :: 4 - Beta",
    "Environment :: Console",
    "Intended Audience :: System Administrators",
    "Intended Audience :: Developers",
    "Intended Audience :: Information Technology",
    "License :: OSI Approved :: MIT License",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Topic :: Security",
    "Topic :: System :: Systems Administration",
    "Typing :: Typed",
]
dependencies = [
    "boto3>=1.35.0",
    "typer>=0.15.0",
    "rich>=13.9.0",
    "pydantic>=2.10.0",
    "jinja2>=3.1.6",
    "pyyaml>=6.0",
    "mcp>=1.20.0,<2",
]

[project.optional-dependencies]
dev = [
    "pytest>=8.0",
    "pytest-cov>=6.0",
    "ruff>=0.8.0",
    "mypy>=1.13.0",
    "boto3-stubs[essential]>=1.35.0",
    "moto[all]>=5.0.0",
    "types-PyYAML>=6.0",
]

[project.scripts]
cloud-audit = "cloud_audit.cli:app"
cloud-audit-mcp = "cloud_audit.mcp_server:main"

[project.urls]
Homepage = "https://haitmg.pl/cloud-audit/"
Documentation = "https://haitmg.pl/cloud-audit/"
Source = "https://github.com/gebalamariusz/cloud-audit"
Repository = "https://github.com/gebalamariusz/cloud-audit"
Issues = "https://github.com/gebalamariusz/cloud-audit/issues"
Changelog = "https://github.com/gebalamariusz/cloud-audit/blob/main/CHANGELOG.md"

[tool.hatch.build.targets.wheel]
packages = ["src/cloud_audit"]

[tool.ruff]
target-version = "py310"
line-length = 120
src = ["src"]

[tool.ruff.lint]
select = ["E", "F", "I", "N", "W", "UP", "S", "B", "A", "C4", "SIM", "TCH", "RUF", "PIE", "RET"]

[tool.ruff.lint.per-file-ignores]
"src/cloud_audit/providers/*/checks/*.py" = ["E501", "S112"]
"src/cloud_audit/cost_model.py" = ["E501"]
"src/cloud_audit/reports/compliance_html.py" = ["E501"]
"src/cloud_audit/reports/compliance_markdown.py" = ["E501"]
"src/cloud_audit/cli.py" = ["TC003"]
"src/cloud_audit/mcp_server.py" = ["TC003"]
# Blast radius uses camelCase field names to match the BlastRadiusGraph v1.0
# wire-format contract shared with cloud-audit-demo (TypeScript types).
# Renaming would break the JSON output schema consumers depend on.
"src/cloud_audit/blast_radius.py" = ["N815"]
"tests/test_blast_radius.py" = ["S101", "N803", "N806", "N815"]
# Threat-feed modules and tests intentionally use boto3-style CamelCase
# kwargs (UserName, RoleName, FunctionName, EmailIdentity) to match the
# AWS API surface they wrap. N803 (lower_snake_case argument) is wrong here.
# Inner exception classes used to simulate boto3 errors don't need the
# Error suffix N818 mandates. Lambda/SES helpers also use Optional implicitly.
"src/cloud_audit/providers/aws/threat_feed/*.py" = ["N803", "N818", "RUF013", "E501", "S112"]
"tests/aws/threat_feed/*.py" = ["S101", "N803", "N806", "N818", "RUF013", "E501", "TC003", "E402"]
"tests/**" = ["S101", "TC003", "E402"]

# Pydantic resolves field annotations at import time, so model types must stay
# runtime imports even under `from __future__ import annotations`.
[tool.ruff.lint.flake8-type-checking]
runtime-evaluated-base-classes = ["pydantic.BaseModel"]

[tool.mypy]
python_version = "3.10"
strict = true

[[tool.mypy.overrides]]
module = ["mcp.*"]
ignore_missing_imports = true

[[tool.mypy.overrides]]
module = ["cloud_audit.mcp_server"]
disallow_untyped_decorators = false

[tool.pytest.ini_options]
testpaths = ["tests"]