Add type annotations

modified:   CHANGES.rst
modified:   src/hibpcli/cli.py
modified:   src/hibpcli/keepass.py
modified:   src/hibpcli/password.py
modified:   tox.ini

CHANGES.rst

@@ -8,6 +8,7 @@ added
 ~~~~~
 - add the `bandit` security checker
 - add support for Python 3.9
+- add type annotations
 
 0.4.1 (30.09.2020)
 ------------------

src/hibpcli/cli.py

@@ -1,19 +1,21 @@
+from typing import Optional
+
 import click
 from hibpcli.exceptions import ApiError
 from hibpcli.keepass import check_passwords_from_db
 from hibpcli.password import Password
 
 
 @click.group()
-def main():
+def main() -> None:
     """Command line interface to the haveibeenpwned.com API."""
     pass
 
 
 @click.command()
 @click.argument("path")
 @click.option("--password", default=None, help="Password for the KeePass database.")
-def check_keepass(path, password):
+def check_keepass(path: str, password: Optional[str]) -> None:
     """Check all passwords stored in the keepass database."""
     if password is None:
         password = click.prompt(
@@ -33,7 +35,7 @@ def check_keepass(path, password):
 
 @click.command()
 @click.option("--password", default=None, help="Password which should be checked.")
-def check_password(password):
+def check_password(password: Optional[str]) -> None:
     """Check a single password."""
     if password is None:
         password = click.prompt(

src/hibpcli/keepass.py

@@ -1,8 +1,10 @@
+from typing import List
+
 from hibpcli.password import Password
-from pykeepass import PyKeePass
+from pykeepass import PyKeePass  # type: ignore
 
 
-def check_passwords_from_db(path, master_password):
+def check_passwords_from_db(path: str, master_password: str) -> List[str]:
     """ - """
     kp = PyKeePass(path, password=master_password)
     return [

src/hibpcli/password.py

@@ -6,10 +6,10 @@
 
 
 class Password:
-    def __init__(self, password):
+    def __init__(self, password: str) -> None:
         self.password = password
 
-    def is_leaked(self):
+    def is_leaked(self) -> bool:
         hex_digest = self._generate_hash()
         first_hash_part, second_hash_part = hex_digest[:5], hex_digest[5:]
         try:
@@ -25,7 +25,7 @@ def is_leaked(self):
             # cut off string - information after the hash is of no interest
             return second_hash_part in (line[:35] for line in result.splitlines())
 
-    def _generate_hash(self):
+    def _generate_hash(self) -> str:
         # using sha1 here is no security issue
         # the API uses it, so there is no other way to access the data
         hash_object = hashlib.sha1(bytes(self.password, "UTF-8"))  # nosec

tox.ini

@@ -24,6 +24,12 @@ deps =
 commands =
     pre-commit run --all-files --show-diff-on-failure
 
+[testenv:mypy]
+deps =
+    mypy
+commands =
+    mypy --strict src {posargs}
+
 [flake8]
 max-line-length = 88
 ignore = E231  # clashes with black