fix(api): resolve mypy type errors; fix invalid jwt exception

- cast Any-returning calls (resp.json/json.loads/scalar_one) to declared types
- cast redis smembers/ping awaitables (redis-py async stub returns Awaitable|T)
- fix bug: jwt.InvalidClaimError does not exist (would AttributeError on nonce
  mismatch) -> jwt.InvalidTokenError

Author: gracefullight

apps/api/src/auth/oauth.py

@@ -8,7 +8,7 @@
 import hashlib
 import os
 import time
-from typing import Any
+from typing import Any, cast
 
 import httpx
 import jwt
@@ -185,7 +185,7 @@ async def exchange_code_for_tokens(
     async with httpx.AsyncClient(timeout=10.0) as client:
         resp = await client.post(cfg["token_endpoint"], data=data, headers=headers)
         resp.raise_for_status()
-        return resp.json()
+        return cast(dict[str, Any], resp.json())
 
 
 # ---------------------------------------------------------------------------
@@ -200,7 +200,7 @@ async def _fetch_jwks(jwks_uri: str) -> dict[str, Any]:
     async with httpx.AsyncClient(timeout=10.0) as client:
         resp = await client.get(jwks_uri)
         resp.raise_for_status()
-        return resp.json()
+        return cast(dict[str, Any], resp.json())
 
 
 async def verify_google_id_token(
@@ -245,7 +245,7 @@ async def verify_google_id_token(
     )
 
     if claims.get("nonce") != nonce:
-        raise jwt.InvalidClaimError("nonce mismatch — possible replay attack")
+        raise jwt.InvalidTokenError("nonce mismatch — possible replay attack")
 
     return claims
 
@@ -318,7 +318,7 @@ async def _fetch_apple_jwks() -> dict[str, Any]:
     async with httpx.AsyncClient(timeout=10.0) as client:
         resp = await client.get(APPLE_JWKS_URI)
         resp.raise_for_status()
-        return resp.json()
+        return cast(dict[str, Any], resp.json())
 
 
 def _find_apple_jwk(jwks: dict[str, Any], kid: str | None) -> Any:
@@ -395,4 +395,4 @@ async def exchange_apple_code_for_tokens(
     async with httpx.AsyncClient(timeout=10.0) as client:
         resp = await client.post(APPLE_TOKEN_ENDPOINT, data=data)
         resp.raise_for_status()
-        return resp.json()
+        return cast(dict[str, Any], resp.json())

apps/api/src/auth/tokens.py

@@ -9,7 +9,8 @@
 import os
 import secrets
 import time
-from typing import Any
+from collections.abc import Awaitable
+from typing import Any, cast
 
 import jwt
 from redis.asyncio import Redis
@@ -199,7 +200,7 @@ async def rotate_refresh(
 async def invalidate_family(redis: Redis, family_id: str) -> None:
     """Delete all refresh tokens belonging to a family."""
     fkey = _family_key(family_id)
-    token_hashes = await redis.smembers(fkey)
+    token_hashes = await cast(Awaitable[set[str]], redis.smembers(fkey))
 
     if token_hashes:
         pipe = redis.pipeline()
@@ -217,4 +218,4 @@ async def get_refresh_record(redis: Redis, raw_token: str) -> dict[str, Any] | N
     raw = await redis.get(_refresh_key(token_hash))
     if raw is None:
         return None
-    return json.loads(raw)
+    return cast(dict[str, Any], json.loads(raw))

apps/api/src/contacts/repository.py

@@ -112,7 +112,7 @@ async def count(
             stmt, user_id=user_id, q=q, tag=tag, country=country, city=city
         )
         result = await self.session.execute(stmt)
-        return result.scalar_one()
+        return int(result.scalar_one())
 
     async def find_by_id(self, contact_id: int, user_id: str) -> Contact | None:
         stmt = select(Contact).where(

apps/api/src/main.py

@@ -1,6 +1,7 @@
 import os
-from collections.abc import AsyncGenerator
+from collections.abc import AsyncGenerator, Awaitable
 from contextlib import asynccontextmanager
+from typing import cast
 
 from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
@@ -99,7 +100,7 @@ async def health() -> JSONResponse:
     except Exception:
         db_ok = False
     try:
-        await redis.ping()
+        await cast(Awaitable[bool], redis.ping())
         redis_ok = True
     except Exception:
         redis_ok = False