From 52a70c3eea3694d5fd840bf223b844c1d79296cc Mon Sep 17 00:00:00 2001
From: Lukas <lukas.pupkalipinski@lpl-mind.de>
Date: Sun, 3 May 2026 22:42:46 +0200
Subject: [PATCH] Add import-linter boundary to forbid routers importing
 app.dependencies

Issue #51: Enforce repository boundary at CI level using import-linter.
Contract 'forbid_router_db_import' checks that app.routers never imports
app.dependencies directly, keeping the DB access path through service
contexts only.

- Add import-linter>=2.0.0 to dev dependencies (backend/pyproject.toml)
- Configure [tool.importlinter] with package_root and root_packages
- Add [[tool.importlinter.contracts]] with type='forbidden', source
  app.routers, forbidden app.dependencies
- Add 'Import Boundary' CI job (import-linter)
- Document import-linter in CONTRIBUTING.md code quality table

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/ci.yml | 23 ++++++++++++++++++++++-
 CONTRIBUTING.md          |  1 +
 backend/pyproject.toml   | 11 +++++++++++
 3 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bc683a2..612421e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -77,4 +77,25 @@ jobs:
         run: pip install -e ".[dev]"
 
       - name: Run mypy
-        run: mypy app
\ No newline at end of file
+        run: mypy app
+
+  import-linter:
+    name: Import Boundary
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: backend
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Run import-linter
+        run: linter
\ No newline at end of file
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d0ee7b2..6a77372 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -93,6 +93,7 @@ BanGUI/
 | `tsc --noEmit` | Frontend type checking | `cd frontend && tsc --noEmit` |
 | `eslint` | Frontend linting | `cd frontend && eslint src` |
 | `prettier --check` | Frontend formatting | `cd frontend && prettier --check src` |
+| `import-linter` | Layer boundary enforcement | `cd backend && linter` |
 
 **All checks must pass before committing.** CI runs the same suite.
 
diff --git a/backend/pyproject.toml b/backend/pyproject.toml
index 44cbfc5..2d6ad57 100644
--- a/backend/pyproject.toml
+++ b/backend/pyproject.toml
@@ -31,6 +31,7 @@ dev = [
     "mypy>=1.13.0",
     "pytest-cov>=6.0.0",
     "pytest-mock>=3.14.0",
+    "import-linter>=2.0.0",
 ]
 
 [tool.hatch.build.targets.wheel]
@@ -64,3 +65,13 @@ pythonpath = [".", "../fail2ban-master"]
 testpaths = ["tests"]
 addopts = "--asyncio-mode=auto --cov=app --cov-report=term-missing"
 filterwarnings = ["ignore::pytest.PytestRemovedIn9Warning"]
+
+[tool.importlinter]
+package_root = "app"
+root_packages = ["app"]
+
+[[tool.importlinter.contracts]]
+name = "forbid_router_db_import"
+type = "forbidden"
+source_modules = ["app.routers"]
+forbidden_modules = ["app.dependencies"]