Initial project setup and dependencies

Set up Python 3.12.11 FastAPI project with security-focused dependency management.

Dependencies:
- FastAPI 0.123.9: Modern web framework
- Uvicorn 0.38.0: ASGI server with standard extras
- Pydantic 2.12.5: Data validation (updated for pydantic-ai)
- PydanticAI 1.27.0: LLM agent framework with Ollama support
- HTTPX 0.28.1: Async HTTP client
- SSE-Starlette 3.0.2: Server-Sent Events for streaming
- python-dotenv 1.2.1: Environment configuration

Security:
- All packages checked for CVEs (as of 2025-12-06)
- Minor version locking (>=X.Y,<X.(Y+1)) for supply chain protection
- CVE status documented in requirements.txt

Development tools:
- pytest 8.3.5 + pytest-asyncio for async testing
- pytest-cov 6.0.0 for coverage reporting
- ruff 0.8.6 for linting and formatting
- mypy 1.14.1 for type checking

Configuration:
- pyproject.toml: Build system, coverage, ruff, and mypy config
- .env.example: Environment variable template
- .gitignore: Comprehensive Python/FastAPI patterns

Target model: mistral-nemo:latest on external Ollama instance

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
2025-12-06 10:30:52 +01:00
co-authored by Claude
commit 769c12b33b
5 changed files with 265 additions and 0 deletions
+21
View File
@@ -0,0 +1,21 @@
# Application Configuration
APP_NAME="OpenAI-Compatible API"
APP_VERSION="0.1.0"
ENVIRONMENT=development
DEBUG=false
# API Configuration
API_HOST=0.0.0.0
API_PORT=8000
API_PREFIX=/v1
# Ollama Configuration
OLLAMA_HOST=http://your-ollama-host:11434
OLLAMA_DEFAULT_MODEL=mistral-nemo:latest
OLLAMA_TIMEOUT=120
# Logging
LOG_LEVEL=INFO
# CORS (comma-separated list)
CORS_ORIGINS=*
+97
View File
@@ -0,0 +1,97 @@
# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
lib/
lib64/
parts/
sdist/
var/
wheels/
pip-wheel-metadata/
share/python-wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST
# Virtual environments
venv/
env/
ENV/
.venv/
.venv-*
# PyCharm
.idea/
# VS Code
.vscode/
*.code-workspace
# Environment variables
.env
.env.local
.env.*.local
# Jupyter Notebooks
.ipynb_checkpoints/
*.ipynb
# Testing & Coverage
.pytest_cache/
.coverage
.coverage.*
coverage.xml
htmlcov/
.tox/
.nox/
*.cover
.hypothesis/
# Type checking
.mypy_cache/
.dmypy.json
dmypy.json
.pyre/
.pytype/
# Linting
.ruff_cache/
# Logs
logs/
*.log
# Database
*.db
*.sqlite
*.sqlite3
# Ollama (if running locally)
ollama_data/
# Temporary & Backup files
*.tmp
*.bak
*.swp
*~
*-backup-*.txt
# OS-specific
.DS_Store
.DS_Store?
._*
.Spotlight-V100
.Trashes
ehthumbs.db
Thumbs.db
Desktop.ini
+80
View File
@@ -0,0 +1,80 @@
[build-system]
requires = ["setuptools>=68.0"]
build-backend = "setuptools.build_meta"
[project]
name = "tatlock"
version = "0.1.0"
description = "OpenAI-compatible API with Ollama backend"
requires-python = ">=3.12"
dependencies = []
[tool.pytest.ini_options]
asyncio_mode = "auto"
[tool.coverage.run]
source = ["src"]
branch = true
omit = [
"*/tests/*",
"*/__pycache__/*",
"*/site-packages/*",
"*/.venv/*",
]
[tool.coverage.report]
precision = 2
show_missing = true
skip_covered = false
exclude_lines = [
"pragma: no cover",
"def __repr__",
"raise AssertionError",
"raise NotImplementedError",
"if __name__ == .__main__.:",
"if TYPE_CHECKING:",
"@abstractmethod",
]
[tool.coverage.html]
directory = "htmlcov"
[tool.ruff]
line-length = 100
target-version = "py312"
[tool.ruff.lint]
select = [
"E", # pycodestyle errors
"W", # pycodestyle warnings
"F", # pyflakes
"I", # isort
"B", # flake8-bugbear
"C4", # flake8-comprehensions
"UP", # pyupgrade
]
ignore = [
"E501", # line too long (handled by formatter)
"B008", # do not perform function calls in argument defaults
"C901", # too complex
]
[tool.ruff.lint.per-file-ignores]
"__init__.py" = ["F401"]
[tool.mypy]
python_version = "3.12"
warn_return_any = true
warn_unused_configs = true
disallow_untyped_defs = true
disallow_incomplete_defs = true
check_untyped_defs = true
no_implicit_optional = true
warn_redundant_casts = true
warn_unused_ignores = true
warn_no_return = true
strict_equality = true
[[tool.mypy.overrides]]
module = ["sse_starlette.*", "pydantic_ai.*"]
ignore_missing_imports = true
+25
View File
@@ -0,0 +1,25 @@
# Development and Testing Dependencies
# Install with: pip install -r requirements.txt -r requirements-dev.txt
# Testing Framework
# Latest pytest with async support
pytest>=8.3,<8.4
pytest-asyncio>=0.25,<0.26
pytest-cov>=6.0,<6.1
# Test client for FastAPI
httpx>=0.28,<0.29 # Already in requirements.txt but needed for test client
# Code Quality
# Linting and formatting
ruff>=0.8,<0.9
# Type checking
mypy>=1.14,<1.15
# Testing utilities
pytest-mock>=3.14,<3.15
faker>=34.0,<35.0
# Coverage reporting
coverage[toml]>=7.7,<7.8
+42
View File
@@ -0,0 +1,42 @@
# Core FastAPI framework and server
# FastAPI: Modern, fast web framework for building APIs
# Latest: 0.123.9 (Dec 4, 2025) - No known CVEs
fastapi>=0.123,<0.124
# ASGI server for running FastAPI
# Latest: 0.38.0 (Oct 18, 2025) - No known CVEs
# Note: Old versions had CVE-2020-7694/7695, but 0.38.0 is secure
uvicorn[standard]>=0.38,<0.39
# Additional dependencies
# Pydantic for data validation (comes with pydantic-ai but pinning explicitly)
# Updated to >=2.11 due to ag-ui-protocol dependency requirement
# Latest: 2.12.4 (Nov 5, 2025) - No known CVEs
pydantic>=2.11,<2.13
# AI/LLM integration
# PydanticAI: Agent framework for using Pydantic with LLMs
# Latest: 1.27.0 (Dec 5, 2025) - No known CVEs
# Supports Ollama backend out of the box
pydantic-ai>=1.27,<1.28
# HTTP client for Ollama communication
# Latest: 0.28.1 - No known CVEs
httpx>=0.28,<0.29
# Server-Sent Events for streaming responses
# Required for OpenAI-compatible streaming endpoints
# Latest: 3.0.2 (Oct 30, 2025) - No known CVEs
sse-starlette>=3.0,<3.1
# Configuration management
# Latest: 1.2.1 (Oct 26, 2025) - No known CVEs
python-dotenv>=1.2,<1.3
# ASGI toolkit (dependency of FastAPI, pinning for security)
starlette>=0.45,<0.46
# Note on version locking strategy:
# Using >=X.Y,<X.(Y+1) format to lock to minor versions
# This protects against supply chain attacks while allowing patch updates
# Update regularly and review changelogs before upgrading minor versions