11# Code Style
22
3- Linter config: ` .ruff.toml ` (repo root — not ` [tool.ruff] ` in ` pyproject.toml ` ).
3+ Linter config: ` .ruff.toml ` (repo root - not ` [tool.ruff] ` in ` pyproject.toml ` ).
44
55## Enforced rule sets
66
7- ` select = ["E", "W", "F", "I", "B", "C4", "UP", "S", "PLC0415"] ` — pycodestyle, pyflakes, isort,
7+ ` select = ["E", "W", "F", "I", "B", "C4", "UP", "S", "PLC0415"] ` - pycodestyle, pyflakes, isort,
88bugbear, comprehensions, pyupgrade, ** bandit (security)** , and no-import-outside-top-level.
99
10- ` ignore = ["E501", "B904", "S101", "S105", "S106"] ` — line length is not enforced despite
11- ` line-length = 100 ` ; ` raise ... from ` is optional; ` assert ` and hardcoded-password-string warnings are
10+ ` ignore = ["E501", "B904", "S101", "S105", "S106"] ` - line length is not enforced despite
11+ ` line-length = 100 ` . ` raise ... from ` is optional. ` assert ` and hardcoded-password-string warnings are
1212off (for tests and for kwargs like ` client_secret= ` ).
1313
14- ` target-version = "py39" ` — pyupgrade will not rewrite to 3.10+ syntax, and must not.
14+ ` target-version = "py39" ` - pyupgrade will not rewrite to 3.10+ syntax, and must not.
1515
1616## Naming
1717
@@ -29,7 +29,7 @@ off (for tests and for kwargs like `client_secret=`).
2929Two-step flows name themselves: ` start_* ` / ` complete_* ` (` start_link_user ` → ` complete_link_user ` ),
3030and challenge-then-exchange flows use ` *_challenge ` → ` signin_with_* ` .
3131
32- ## ✅ Good — the dominant public-method shape
32+ ## ✅ Good - the dominant public-method shape
3333
3434``` python
3535async def passkey_login_challenge (
@@ -71,11 +71,11 @@ async def passkey_login_challenge(
7171
7272What makes it conform:
7373
74- - ` async ` + keyword-only-ish optional params, every one typed, ` Optional[...] ` (not ` X | None ` — py39 floor)
75- - returns a ** Pydantic model** , validated via ` model_validate ` — never a raw ` dict `
74+ - ` async ` + keyword-only-ish optional params, every one typed, ` Optional[...] ` (not ` X | None ` - py39 floor)
75+ - returns a ** Pydantic model** , validated via ` model_validate ` - never a raw ` dict `
7676- ` store_options ` threaded through so MCD domain resolution works
7777- Google-style docstring with ` Args ` / ` Returns ` / ` Raises `
78- - ` async with self._get_http_client() ` — the telemetry-carrying client, never a bare ` httpx.AsyncClient `
78+ - ` async with self._get_http_client() ` - the telemetry-carrying client, never a bare ` httpx.AsyncClient `
7979- catch-all re-raises the SDK's own typed errors untouched, then wraps anything unexpected in a typed
8080 error with a code, chaining the cause
8181
@@ -98,32 +98,32 @@ can mistake for "no passkey" instead of "request failed", and an unvalidated `di
9898
9999## Patterns in use
100100
101- - ** Generic client over the store type** — ` ServerClient(Generic[TStoreOptions]) ` ; store implementations
101+ - ** Generic client over the store type** - ` ServerClient(Generic[TStoreOptions]) ` ; store implementations
102102 subclass ` StateStore ` / ` TransactionStore ` from ` store/abstract.py ` (template method: the ABC owns
103103 ` encrypt ` /` decrypt ` , subclasses own ` set ` /` get ` /` delete ` )
104- - ** Sub-client composition** — ` ServerClient ` owns ` MfaClient ` and ` MyAccountClient ` ; MFA is exposed
104+ - ** Sub-client composition** - ` ServerClient ` owns ` MfaClient ` and ` MyAccountClient ` . MFA is exposed
105105 through the read-only ` mfa ` property, and connected-accounts calls delegate to ` _my_account_client `
106- - ** ` httpx.Auth ` strategies** — ` BearerAuth ` and ` DPoPAuth ` in ` auth_schemes/ ` , selected by a
106+ - ** ` httpx.Auth ` strategies** - ` BearerAuth ` and ` DPoPAuth ` in ` auth_schemes/ ` , selected by a
107107 ` _make_auth(access_token, dpop_key) ` helper. Add a new scheme as another ` httpx.Auth ` , not as
108108 inline header-setting.
109- - ** Pydantic models as the wire contract** — everything in ` auth_types/__init__.py ` ; caller-supplied
109+ - ** Pydantic models as the wire contract** - everything in ` auth_types/__init__.py ` ; caller-supplied
110110 enums are ` Literal[...] ` while server-returned fields stay ` str ` so a new Auth0 factor type doesn't
111111 fail closed
112- - ** Flat typed error hierarchy** — every error subclasses ` Auth0Error ` and carries a stable ` code ` ;
113- code enumeration classes (` AccessTokenErrorCode ` , ` PasskeyErrorCode ` , …) hold the string constants
114- - ** PEP 562 module ` __getattr__ ` ** for deprecated public aliases (` auth_types._DEPRECATED_ALIASES ` ) —
112+ - ** Flat typed error hierarchy** - every error subclasses ` Auth0Error ` and carries a stable ` code ` .
113+ Code enumeration classes (` AccessTokenErrorCode ` , ` PasskeyErrorCode ` , …) hold the string constants
114+ - ** PEP 562 module ` __getattr__ ` ** for deprecated public aliases (` auth_types._DEPRECATED_ALIASES ` ) -
115115 the import keeps working and emits a ` DeprecationWarning ` . Follow this when retiring a public name.
116- - ** Section banners** — long modules are divided with ` # ====== SECTION ====== ` comment blocks;
117- keep new methods inside the matching section and preserve existing declaration order.
118- - ** Deliberate placement, even without banners** — in a file with no section banners, put a new
116+ - ** Section banners** - long modules are divided with ` # ====== SECTION ====== ` comment blocks.
117+ Keep new methods inside the matching section and preserve existing declaration order.
118+ - ** Deliberate placement, even without banners** - in a file with no section banners, put a new
119119 method/class/function next to the related code it belongs with, or append it at the end of the
120120 file/class. Never insert one at an arbitrary position just because it compiles there.
121121
122122## Comments
123123
124- Code is largely self-documenting; comments are reserved for * why* — a protocol citation
125- (` # RFC 9449 §8.2 — server-nonce retry ` ), a non-obvious security decision (`# NFC-normalize before
126- comparison...` ), or an intentional omission ( ` # redirect_uri is intentionally excluded — in MCD mode
124+ Code is largely self-documenting. Comments are reserved for * why* - a protocol citation
125+ (` # RFC 9449 §8.2 - server-nonce retry ` ), a non-obvious security decision (`# NFC-normalize before
126+ comparison...` ), or an intentional omission ( ` # redirect_uri is intentionally excluded - in MCD mode
127127it is built dynamically`). Don't add comments that restate the code.
128128
129129## Repo Conventions
0 commit comments