xtr-security-csrf 5.0.0__tar.gz

xtr_security_csrf-5.0.0/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 xterr
+Copyright (c) 2004-present Fabien Potencier
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

xtr_security_csrf-5.0.0/PKG-INFO

@@ -0,0 +1,207 @@
+Metadata-Version: 2.4
+Name: xtr-security-csrf
+Version: 5.0.0
+Summary: Cross-site request forgery protection for xtr applications: a manager that mints and checks tokens by id, and the session storage that keeps them.
+Keywords: security,csrf,tokens,session
+Author: Xterr
+Author-email: Xterr <me@xterr.dev>
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Typing :: Typed
+Requires-Dist: typing-extensions>=4.12
+Requires-Dist: xtr-http-foundation>=5.0,<6
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+<div align="center">
+
+# xtr-security-csrf
+
+**Cross-site request forgery protection: a manager that mints and checks tokens by id, and the session storage that keeps them.**
+
+<img alt="python 3.11+" src="https://img.shields.io/badge/python-%E2%89%A5%203.11-3776AB?logo=python&logoColor=white">
+<img alt="typed" src="https://img.shields.io/badge/typed-ty%20%2B%20basedpyright-1f6feb">
+<img alt="license MIT" src="https://img.shields.io/badge/license-MIT-blue">
+
+</div>
+
+---
+
+## Why?
+
+A browser submits a form because a page told it to — and a page on someone else's site can
+tell it to submit yours, carrying the user's cookies as though the request were the user's.
+A **cross-site request forgery token** breaks that: the page that renders a form mints a
+value into it, and the request that submits the form carries the value back, where it is
+checked against what was minted. Another site's page cannot read the value — it is on your
+origin's page, not theirs — so its forged submit does not check out.
+
+This package is that mechanism, in three small pieces:
+
+- 🎫 **A token** — `CsrfToken(token_id, value)`: the id names what the token guards, the
+  value answers for it.
+- 🖋️ **A manager** — `CsrfTokenManager(storage, generator=None, namespace=None)` mints a
+  value per id, stores it, and masks what it hands out: every value a caller sees is
+  masked with a fresh key, so two renders of one form carry different strings — and both
+  check out, because what is *stored* never changes until `refresh_token` replaces it.
+  `is_token_valid` compares in constant time and never raises on what it is handed.
+- 🗄️ **A storage** — `TokenStorageInterface` keeps values by id; `SessionTokenStorage`
+  keeps them in the [xtr-http-foundation](../xtr-http-foundation) session, under
+  `_csrf/<token_id>`, and `ClearableTokenStorageInterface.clear()` drops every token it
+  minted — the session strategy's call when a re-authentication rotates the session, so
+  a value stolen before the rotation cannot answer after it.
+
+It ships no bundle of its own: it is a library member of the security family —
+[xtr-security](../xtr-security) is the bundle that wires the family into an application on
+[xtr-dependency-injection](../xtr-dependency-injection).
+
+## Install
+
+```sh
+uv add xtr-security-csrf
+```
+
+Requires Python 3.11+. One sibling comes with it:
+[xtr-http-foundation](../xtr-http-foundation), whose session the storage keeps tokens in.
+
+## Quick start
+
+Everything below runs without a container: a session on the memory storage, the storage
+over it, the manager over that. Mint a token where a form renders, check it where the form
+submits:
+
+```python
+from __future__ import annotations
+
+import asyncio
+
+from xtr_http_foundation import MemorySessionStorage, Session
+from xtr_security_csrf import CsrfToken, CsrfTokenManager, SessionTokenStorage
+
+
+async def main() -> None:
+    session = Session(MemorySessionStorage())
+    manager = CsrfTokenManager(SessionTokenStorage(session))
+
+    # The page that renders the form mints the token into it.
+    token = await manager.get_token("newsletter")
+    print("render:", token.get_value())
+
+    # The request that submits the form carries the value back.
+    print("carried:", await manager.is_token_valid(token))
+
+    # A value nobody minted does not check out.
+    print("forged:", await manager.is_token_valid(CsrfToken("newsletter", "nope")))
+
+
+asyncio.run(main())
+```
+
+```console
+render: 3.kV3xtkP…  (masked anew on every run)
+carried: True
+forged: False
+```
+
+The manager's four calls:
+
+| Call | What it does |
+|---|---|
+| `await get_token(token_id)` | Returns the token for the id, minting one where none is stored |
+| `await refresh_token(token_id)` | Mints a fresh value for the id, stored or not — for once-only tokens |
+| `await remove_token(token_id)` | Drops the value, returning what it held, or `None` |
+| `await is_token_valid(token)` | Tells whether the token carries the value stored under its id |
+
+### The masked value
+
+What a caller receives is never the stored value: `get_token` masks it with a fresh random
+key every call — three dot-separated parts, a key-derived prefix, the key, the masked
+value. The manager unmasks what comes back before comparing, so any string a request
+carries can be handed to `is_token_valid` without a guard: one that does not read as a
+masked value is compared as it came, and does not check out.
+
+### The namespace
+
+Stored ids carry a prefix: `CsrfTokenManager(storage, namespace="https-")` stores under
+`https-<token_id>`, so tokens minted for one origin do not answer for another. A string is
+used as it is; a callable is asked each time — the scheme a request arrived under can
+change between calls. `None`, the default, prefixes nothing.
+
+### The storage
+
+`SessionTokenStorage(session, namespace="_csrf")` keeps each value under
+`<namespace>/<token_id>` in the session's attributes, and keeps the list of its ids under
+the namespace key itself — the session offers no way to walk its attributes, so the list
+is what `clear()` drops them from: every token this storage minted, and nothing the rest of
+the session holds. A token written under the namespace by something else than this storage
+is not in the list, and survives a clear.
+
+`clear()` is the session strategy's call, on the re-authentication that rotates the
+session: the tokens minted under the old one must not answer for the new. `remove_token`
+is the logout listener's — it drops the ids a listener knows by name.
+
+## Errors
+
+Everything this library raises derives from `CsrfError`, and carries what went wrong as
+typed attributes rather than only a message.
+
+| Error | Base (besides `CsrfError`) | Raised when |
+|---|---|---|
+| `InvalidArgumentError` | `ValueError` | a declaration, configuration or call was malformed — a generator asked for less entropy than a byte holds |
+| `TokenNotFoundError` | — | a value was asked for under an id that holds nothing; carries `get_token_id()` |
+
+## Layout
+
+```
+xtr_security_csrf/
+├── csrf_token.py                    CsrfToken, the id and the value a caller holds
+├── csrf_token_manager_interface.py CsrfTokenManagerInterface, the four calls
+├── csrf_token_manager.py           CsrfTokenManager, minting, masking, checking
+├── token_generator/
+│   ├── token_generator_interface.py  TokenGeneratorInterface, the minting seam
+│   └── uri_safe_token_generator.py   UriSafeTokenGenerator, URI-safe values
+├── token_storage/
+│   ├── token_storage_interface.py          TokenStorageInterface, values by id
+│   ├── clearable_token_storage_interface.py ClearableTokenStorageInterface, + clear()
+│   └── session_token_storage.py            SessionTokenStorage, in the session
+└── exception/                       CsrfError, the root of everything raised
+```
+
+## Testing
+
+The suite runs on `pytest` with `anyio`; the storages are exercised over a real
+[xtr-http-foundation](../xtr-http-foundation) `Session` on `MemorySessionStorage`, so the
+persist-and-reattach path a request actually takes is what the tests prove — not a mock
+of it.
+
+## In an application
+
+This package works on its own and ships no bundle. The
+[`xtr-security`](../xtr-security#use-in-an-application) bundle wires it: a firewall that
+asks for a token — a form login with `enable_csrf`, a logout's `enable_csrf` or
+`clear_csrf_tokens`, a switch-user's `enable_csrf`, or the firewall's
+`csrf_route_markers` for routes proving themselves with `IsCsrfTokenValid` — has the
+bundle build the manager over the session the request
+reattached, registered as the application's one `CsrfTokenManagerInterface` service. See
+that package's [Use in an application](../xtr-security#use-in-an-application).
+
+## Development
+
+Developed in the [python-xtr](https://github.com/xterr/python-xtr) monorepo, under
+`packages/xtr-security-csrf`; run the commands below from there. The `python-xtr-security-csrf`
+repository is a read-only copy, so send issues and pull requests to the monorepo.
+
+```sh
+uv sync
+uv run ruff check && uv run ruff format --check && uv run basedpyright && uv run ty check && uv run pytest
+```
+
+## License
+
+MIT — see [LICENSE](LICENSE).

xtr_security_csrf-5.0.0/README.md

@@ -0,0 +1,186 @@
+<div align="center">
+
+# xtr-security-csrf
+
+**Cross-site request forgery protection: a manager that mints and checks tokens by id, and the session storage that keeps them.**
+
+<img alt="python 3.11+" src="https://img.shields.io/badge/python-%E2%89%A5%203.11-3776AB?logo=python&logoColor=white">
+<img alt="typed" src="https://img.shields.io/badge/typed-ty%20%2B%20basedpyright-1f6feb">
+<img alt="license MIT" src="https://img.shields.io/badge/license-MIT-blue">
+
+</div>
+
+---
+
+## Why?
+
+A browser submits a form because a page told it to — and a page on someone else's site can
+tell it to submit yours, carrying the user's cookies as though the request were the user's.
+A **cross-site request forgery token** breaks that: the page that renders a form mints a
+value into it, and the request that submits the form carries the value back, where it is
+checked against what was minted. Another site's page cannot read the value — it is on your
+origin's page, not theirs — so its forged submit does not check out.
+
+This package is that mechanism, in three small pieces:
+
+- 🎫 **A token** — `CsrfToken(token_id, value)`: the id names what the token guards, the
+  value answers for it.
+- 🖋️ **A manager** — `CsrfTokenManager(storage, generator=None, namespace=None)` mints a
+  value per id, stores it, and masks what it hands out: every value a caller sees is
+  masked with a fresh key, so two renders of one form carry different strings — and both
+  check out, because what is *stored* never changes until `refresh_token` replaces it.
+  `is_token_valid` compares in constant time and never raises on what it is handed.
+- 🗄️ **A storage** — `TokenStorageInterface` keeps values by id; `SessionTokenStorage`
+  keeps them in the [xtr-http-foundation](../xtr-http-foundation) session, under
+  `_csrf/<token_id>`, and `ClearableTokenStorageInterface.clear()` drops every token it
+  minted — the session strategy's call when a re-authentication rotates the session, so
+  a value stolen before the rotation cannot answer after it.
+
+It ships no bundle of its own: it is a library member of the security family —
+[xtr-security](../xtr-security) is the bundle that wires the family into an application on
+[xtr-dependency-injection](../xtr-dependency-injection).
+
+## Install
+
+```sh
+uv add xtr-security-csrf
+```
+
+Requires Python 3.11+. One sibling comes with it:
+[xtr-http-foundation](../xtr-http-foundation), whose session the storage keeps tokens in.
+
+## Quick start
+
+Everything below runs without a container: a session on the memory storage, the storage
+over it, the manager over that. Mint a token where a form renders, check it where the form
+submits:
+
+```python
+from __future__ import annotations
+
+import asyncio
+
+from xtr_http_foundation import MemorySessionStorage, Session
+from xtr_security_csrf import CsrfToken, CsrfTokenManager, SessionTokenStorage
+
+
+async def main() -> None:
+    session = Session(MemorySessionStorage())
+    manager = CsrfTokenManager(SessionTokenStorage(session))
+
+    # The page that renders the form mints the token into it.
+    token = await manager.get_token("newsletter")
+    print("render:", token.get_value())
+
+    # The request that submits the form carries the value back.
+    print("carried:", await manager.is_token_valid(token))
+
+    # A value nobody minted does not check out.
+    print("forged:", await manager.is_token_valid(CsrfToken("newsletter", "nope")))
+
+
+asyncio.run(main())
+```
+
+```console
+render: 3.kV3xtkP…  (masked anew on every run)
+carried: True
+forged: False
+```
+
+The manager's four calls:
+
+| Call | What it does |
+|---|---|
+| `await get_token(token_id)` | Returns the token for the id, minting one where none is stored |
+| `await refresh_token(token_id)` | Mints a fresh value for the id, stored or not — for once-only tokens |
+| `await remove_token(token_id)` | Drops the value, returning what it held, or `None` |
+| `await is_token_valid(token)` | Tells whether the token carries the value stored under its id |
+
+### The masked value
+
+What a caller receives is never the stored value: `get_token` masks it with a fresh random
+key every call — three dot-separated parts, a key-derived prefix, the key, the masked
+value. The manager unmasks what comes back before comparing, so any string a request
+carries can be handed to `is_token_valid` without a guard: one that does not read as a
+masked value is compared as it came, and does not check out.
+
+### The namespace
+
+Stored ids carry a prefix: `CsrfTokenManager(storage, namespace="https-")` stores under
+`https-<token_id>`, so tokens minted for one origin do not answer for another. A string is
+used as it is; a callable is asked each time — the scheme a request arrived under can
+change between calls. `None`, the default, prefixes nothing.
+
+### The storage
+
+`SessionTokenStorage(session, namespace="_csrf")` keeps each value under
+`<namespace>/<token_id>` in the session's attributes, and keeps the list of its ids under
+the namespace key itself — the session offers no way to walk its attributes, so the list
+is what `clear()` drops them from: every token this storage minted, and nothing the rest of
+the session holds. A token written under the namespace by something else than this storage
+is not in the list, and survives a clear.
+
+`clear()` is the session strategy's call, on the re-authentication that rotates the
+session: the tokens minted under the old one must not answer for the new. `remove_token`
+is the logout listener's — it drops the ids a listener knows by name.
+
+## Errors
+
+Everything this library raises derives from `CsrfError`, and carries what went wrong as
+typed attributes rather than only a message.
+
+| Error | Base (besides `CsrfError`) | Raised when |
+|---|---|---|
+| `InvalidArgumentError` | `ValueError` | a declaration, configuration or call was malformed — a generator asked for less entropy than a byte holds |
+| `TokenNotFoundError` | — | a value was asked for under an id that holds nothing; carries `get_token_id()` |
+
+## Layout
+
+```
+xtr_security_csrf/
+├── csrf_token.py                    CsrfToken, the id and the value a caller holds
+├── csrf_token_manager_interface.py CsrfTokenManagerInterface, the four calls
+├── csrf_token_manager.py           CsrfTokenManager, minting, masking, checking
+├── token_generator/
+│   ├── token_generator_interface.py  TokenGeneratorInterface, the minting seam
+│   └── uri_safe_token_generator.py   UriSafeTokenGenerator, URI-safe values
+├── token_storage/
+│   ├── token_storage_interface.py          TokenStorageInterface, values by id
+│   ├── clearable_token_storage_interface.py ClearableTokenStorageInterface, + clear()
+│   └── session_token_storage.py            SessionTokenStorage, in the session
+└── exception/                       CsrfError, the root of everything raised
+```
+
+## Testing
+
+The suite runs on `pytest` with `anyio`; the storages are exercised over a real
+[xtr-http-foundation](../xtr-http-foundation) `Session` on `MemorySessionStorage`, so the
+persist-and-reattach path a request actually takes is what the tests prove — not a mock
+of it.
+
+## In an application
+
+This package works on its own and ships no bundle. The
+[`xtr-security`](../xtr-security#use-in-an-application) bundle wires it: a firewall that
+asks for a token — a form login with `enable_csrf`, a logout's `enable_csrf` or
+`clear_csrf_tokens`, a switch-user's `enable_csrf`, or the firewall's
+`csrf_route_markers` for routes proving themselves with `IsCsrfTokenValid` — has the
+bundle build the manager over the session the request
+reattached, registered as the application's one `CsrfTokenManagerInterface` service. See
+that package's [Use in an application](../xtr-security#use-in-an-application).
+
+## Development
+
+Developed in the [python-xtr](https://github.com/xterr/python-xtr) monorepo, under
+`packages/xtr-security-csrf`; run the commands below from there. The `python-xtr-security-csrf`
+repository is a read-only copy, so send issues and pull requests to the monorepo.
+
+```sh
+uv sync
+uv run ruff check && uv run ruff format --check && uv run basedpyright && uv run ty check && uv run pytest
+```
+
+## License
+
+MIT — see [LICENSE](LICENSE).

xtr_security_csrf-5.0.0/pyproject.toml

@@ -0,0 +1,139 @@
+[project]
+name = "xtr-security-csrf"
+version = "5.0.0"
+description = "Cross-site request forgery protection for xtr applications: a manager that mints and checks tokens by id, and the session storage that keeps them."
+readme = "README.md"
+requires-python = ">=3.11"
+license = "MIT"
+license-files = ["LICENSE"]
+keywords = [
+    "security",
+    "csrf",
+    "tokens",
+    "session",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Typing :: Typed",
+]
+dependencies = [
+    "typing-extensions>=4.12",
+    "xtr-http-foundation>=5.0,<6",
+]
+
+[[project.authors]]
+name = "Xterr"
+email = "me@xterr.dev"
+
+[dependency-groups]
+dev = [
+    "basedpyright>=1.21",
+    "ruff>=0.8",
+    "pytest>=8",
+    "pytest-cov>=5",
+    "anyio>=4.0",
+    "ty>=0.0.83",
+]
+
+[build-system]
+requires = ["uv_build>=0.9.18,<0.10.0"]
+build-backend = "uv_build"
+
+[tool.basedpyright]
+typeCheckingMode = "all"
+pythonVersion = "3.11"
+pythonPlatform = "All"
+include = [
+    "src",
+    "tests",
+]
+exclude = [
+    "**/__pycache__",
+    "**/.venv",
+    "**/build",
+    "**/dist",
+    ".tmp",
+]
+reportUnusedCallResult = "warning"
+reportUnnecessaryTypeIgnoreComment = "error"
+reportUnusedVariable = "error"
+reportMissingParameterType = "error"
+reportPrivateUsage = "error"
+reportImplicitStringConcatenation = "none"
+
+[[tool.basedpyright.executionEnvironments]]
+root = "tests"
+extraPaths = ["."]
+reportPrivateUsage = "none"
+
+[tool.ruff]
+target-version = "py311"
+line-length = 100
+src = [
+    "src",
+    "tests",
+]
+
+[tool.ruff.lint]
+select = ["ALL"]
+ignore = [
+    "COM812",
+    "ISC001",
+    "D203",
+    "D213",
+    "CPY001",
+    "FBT001",
+    "FBT002",
+    "TD002",
+    "TD003",
+    "FIX002",
+    "TRY003",
+    "EM101",
+    "EM102",
+]
+fixable = ["ALL"]
+unfixable = []
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**/*.py" = [
+    "S101",
+    "ARG",
+    "PLR2004",
+    "SLF001",
+    "D",
+]
+
+[tool.ruff.lint.pydocstyle]
+convention = "google"
+
+[tool.ruff.format]
+quote-style = "double"
+indent-style = "space"
+
+[tool.ty.src]
+include = [
+    "src",
+    "tests",
+]
+
+[tool.pytest.ini_options]
+minversion = "8.0"
+testpaths = ["tests"]
+addopts = [
+    "-ra",
+    "--strict-config",
+    "--strict-markers",
+]
+filterwarnings = ["error"]
+
+[tool.coverage.run]
+source = ["src"]
+branch = true
+
+[tool.coverage.report]
+fail_under = 95

xtr_security_csrf-5.0.0/pyproject.toml.orig

@@ -0,0 +1,104 @@
+[project]
+name = "xtr-security-csrf"
+version = "5.0.0"
+description = "Cross-site request forgery protection for xtr applications: a manager that mints and checks tokens by id, and the session storage that keeps them."
+readme = "README.md"
+requires-python = ">=3.11"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [
+    { name = "Xterr", email = "me@xterr.dev" }
+]
+keywords = ["security", "csrf", "tokens", "session"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Typing :: Typed",
+]
+dependencies = [
+    "typing-extensions>=4.12",
+    "xtr-http-foundation>=5.0,<6",
+]
+
+[dependency-groups]
+dev = [
+    "basedpyright>=1.21",
+    "ruff>=0.8",
+    "pytest>=8",
+    "pytest-cov>=5",
+    "anyio>=4.0",
+    "ty>=0.0.83",
+]
+
+[build-system]
+requires = ["uv_build>=0.9.18,<0.10.0"]
+build-backend = "uv_build"
+
+[tool.basedpyright]
+typeCheckingMode = "all"
+pythonVersion = "3.11"
+pythonPlatform = "All"
+include = ["src", "tests"]
+exclude = ["**/__pycache__", "**/.venv", "**/build", "**/dist", ".tmp"]
+reportUnusedCallResult = "warning"
+reportUnnecessaryTypeIgnoreComment = "error"
+reportUnusedVariable = "error"
+reportMissingParameterType = "error"
+reportPrivateUsage = "error"
+
+# An error message long enough to be useful has to wrap, and a 100-column
+# limit puts the break inside the string.
+reportImplicitStringConcatenation = "none"
+
+# Tests reach into what a class keeps to itself, for the same reason ruff's
+# SLF001 is off for tests; the extra path lets them import the support package.
+[[tool.basedpyright.executionEnvironments]]
+root = "tests"
+extraPaths = ["."]
+reportPrivateUsage = "none"
+
+[tool.ruff]
+target-version = "py311"
+line-length = 100
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = ["ALL"]
+ignore = [
+    "COM812", "ISC001", "D203", "D213", "CPY001", "FBT001", "FBT002", "TD002", "TD003", "FIX002",
+    # Errors compose their message from typed fields; the string at a raise site is a reason.
+    "TRY003", "EM101", "EM102",
+]
+fixable = ["ALL"]
+unfixable = []
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**/*.py" = ["S101", "ARG", "PLR2004", "SLF001", "D"]
+
+[tool.ruff.lint.pydocstyle]
+convention = "google"
+
+[tool.ruff.format]
+quote-style = "double"
+indent-style = "space"
+
+[tool.ty.src]
+include = ["src", "tests"]
+
+[tool.pytest.ini_options]
+minversion = "8.0"
+testpaths = ["tests"]
+addopts = ["-ra", "--strict-config", "--strict-markers"]
+filterwarnings = ["error"]
+
+[tool.coverage.run]
+source = ["src"]
+branch = true
+
+[tool.coverage.report]
+# CI runs the tests with --cov; a change taking coverage below this fails there.
+fail_under = 95