From ccfe179a38c5e75f5fb4bd63783052ff33a74e3b Mon Sep 17 00:00:00 2001
From: Chris Coutinho <chris@coutinho.io>
Date: Sun, 31 May 2026 20:04:44 +0200
Subject: [PATCH] fix: well-form NOSONAR suppressions (SonarCloud S7632/S7503)

The new decomposition modules used `# NOSONAR: reason` (colon form), which
SonarCloud flags as a malformed suppression comment (python:S7632) and which
fails to suppress the intended issue. Switch to the repo's bare `# NOSONAR`
convention with the rationale in a comment above, matching config.py and
auth/storage.py. This also lets the suppression silence python:S7503 (async
method without await) on the protocol-required no-op aclose stubs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 nextcloud_mcp_server/embedding/gateway_client.py | 6 ++++--
 nextcloud_mcp_server/vector/queue/nats.py        | 5 ++++-
 nextcloud_mcp_server/vector/queue/postgres.py    | 5 ++++-
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/nextcloud_mcp_server/embedding/gateway_client.py b/nextcloud_mcp_server/embedding/gateway_client.py
index 1b593498..b63461b6 100644
--- a/nextcloud_mcp_server/embedding/gateway_client.py
+++ b/nextcloud_mcp_server/embedding/gateway_client.py
@@ -121,9 +121,11 @@ class GatewayProvider(OpenAIProvider):
     ):
         # AsyncOpenAI rejects an empty key; use a non-secret placeholder when
         # the gateway is unauthenticated. When a token provider is configured,
-        # the real Bearer is set on the client before each request.
+        # the real Bearer is set on the client before each request. The bare
+        # ``# NOSONAR`` silences the hard-coded-credential hotspot — this is a
+        # public placeholder string, not a secret.
         super().__init__(
-            api_key=_UNAUTHENTICATED_PLACEHOLDER,  # NOSONAR: placeholder, not a secret
+            api_key=_UNAUTHENTICATED_PLACEHOLDER,  # NOSONAR
             base_url=base_url,
             embedding_model=embedding_model,
             generation_model=None,  # gateway never generates
diff --git a/nextcloud_mcp_server/vector/queue/nats.py b/nextcloud_mcp_server/vector/queue/nats.py
index b096f3cf..f0675f4a 100644
--- a/nextcloud_mcp_server/vector/queue/nats.py
+++ b/nextcloud_mcp_server/vector/queue/nats.py
@@ -156,7 +156,10 @@ class NatsTaskProducer:
     ) -> None:
         return None
 
-    async def aclose(self) -> None:  # NOSONAR: async required by TaskProducer protocol
+    # The bare ``# NOSONAR`` silences ``python:S7503`` (async method without
+    # await): ``async def`` is required by the TaskProducer protocol, but this
+    # handle close is a genuine no-op.
+    async def aclose(self) -> None:  # NOSONAR
         # Per-handle close (e.g. a per-user scanner clone exiting). The bus
         # connection is shared and owned by the lifespan, so this is a no-op;
         # the connection is torn down once via ``drain()`` on shutdown.
diff --git a/nextcloud_mcp_server/vector/queue/postgres.py b/nextcloud_mcp_server/vector/queue/postgres.py
index 47acc272..d974fff9 100644
--- a/nextcloud_mcp_server/vector/queue/postgres.py
+++ b/nextcloud_mcp_server/vector/queue/postgres.py
@@ -45,5 +45,8 @@ class PostgresTaskProducer:
     ) -> None:  # pragma: no cover
         return None
 
-    async def aclose(self) -> None:  # pragma: no cover  # NOSONAR: protocol stub
+    # Bare ``# NOSONAR`` silences ``python:S7503`` (async method without await):
+    # ``async def`` is required by the TaskProducer protocol; this stub is a
+    # no-op until the Postgres transport lands.
+    async def aclose(self) -> None:  # NOSONAR  # pragma: no cover
         return None