pyproject.toml

[build-system]
requires = ["setuptools>=61.0", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "vlog"
version = "0.1.0"
description = "Self-hosted video platform with 4K support and HLS streaming"
readme = "README.md"
requires-python = ">=3.9"
dependencies = [
    "fastapi>=0.100.0",
    "uvicorn[standard]>=0.23.0",
    "python-multipart>=0.0.6",
    "asyncpg>=0.29.0",
    "databases[postgresql]>=0.8.0",
    "psycopg2-binary>=2.9.0",
    "sqlalchemy>=2.0.0",
    "alembic>=1.13.0",
    "python-slugify>=8.0.0",
    "python-dateutil>=2.8.0",  # Required for partition management
    "aiofiles>=23.0.0",
    "httpx>=0.25.0",
    "faster-whisper>=1.0.0",
    "watchdog>=3.0.0",
    "slowapi>=0.1.9",
    "rich>=13.0.0",
    "redis>=4.0.0",  # Required for job queue and pub/sub
    "sse-starlette>=1.6.0",  # Server-Sent Events support
    "prometheus-client>=0.19.0",  # Prometheus metrics
    "psutil>=5.9.0",  # System resource monitoring for sprite worker
    "Pillow>=10.0.0",  # Image processing for thumbnail uploads (security hardening)
    "argon2-cffi>=23.1.0",  # Secure API key hashing (Issue #445)
    "email-validator>=2.0.0",  # Pydantic EmailStr validation (Issue #200)
    "authlib>=1.3.0",  # OIDC integration (Issue #200)
    # Security patches for transitive dependencies
    # Note: filelock>=3.20.3 fix requires Python 3.10+, pinned in Dockerfile only
    "jaraco-context>=6.1.0",  # GHSA-58pv-8j8x-9vj2 path traversal vulnerability
    "wheel>=0.46.2",  # CVE-2026-24049 privilege escalation vulnerability
    "urllib3>=2.6.3",  # GHSA-38jv-5279-wg99, GHSA-2xpw-w6gg-jr37, GHSA-gm62-xv2j-4w53, GHSA-pq67-6m6q-mj2v
    "python-json-logger>=2.0.0",  # Structured JSON logging (Issue #208)
]

[project.optional-dependencies]
dev = [
    "pytest>=7.0.0",
    "pytest-asyncio>=0.21.0",
    "pytest-cov>=4.0.0",
    "ruff>=0.1.0",
]

[project.scripts]
vlog = "cli.main:main"

[tool.setuptools.packages.find]
include = ["api", "worker", "cli"]
where = ["."]

[tool.setuptools]
py-modules = ["config", "code_version"]

[tool.setuptools.package-data]
"*" = ["py.typed"]

[tool.pytest.ini_options]
testpaths = ["tests"]
python_files = "test_*.py"
python_classes = "Test*"
python_functions = "test_*"
asyncio_mode = "auto"
asyncio_default_fixture_loop_scope = "function"
addopts = "-v --tb=short --cov=api --cov=worker --cov=cli --cov-report=html --cov-report=term-missing"
filterwarnings = [
    "ignore::DeprecationWarning",
    "ignore::PendingDeprecationWarning",
]
markers = [
    "slow: marks test as slow (deselect with '-m \"not slow\"')",
    "integration: marks test as integration test",
]

[tool.coverage.run]
source = ["api", "worker", "cli"]
omit = [
    "*/tests/*",
    "*/migrations/*",
    "*/__init__.py",
]

[tool.coverage.report]
precision = 2
skip_empty = true
exclude_lines = [
    "pragma: no cover",
    "def __repr__",
    "raise AssertionError",
    "raise NotImplementedError",
    "if __name__ == .__main__.:",
    "if TYPE_CHECKING:",
    "@abstract",
]

[tool.coverage.html]
directory = "htmlcov"

[tool.ruff]
line-length = 120
target-version = "py39"

[tool.ruff.lint]
select = ["E", "F", "W", "I"]
ignore = ["E501"]  # Line too long (handled by formatter)