feat: v1 portfolio mutation, sub-resources, ledger path migration (BAT-008~011)
dcy-003/004 기반 v1 API surface 완성 및 BAT-008~011 구현·검증 완료:
- BAT-008 (REQ-019~021,024): 토큰 surface baseline 문서 갱신
- BAT-009 (REQ-025~028): POST/PATCH/DELETE/GET /v1/portfolios CRUD 신설
- _require_write_token, _get_portfolio_or_404, soft delete, daemon-scoped list
- BAT-010 (REQ-030~032): portfolio tag/comment 서브 라우트 신설 + baseline 갱신
- GET/POST/DELETE /v1/portfolios/{id}/tags
- POST/GET/PATCH/DELETE /v1/portfolios/{id}/comments
- BAT-011 (REQ-029): ledger path migration
- POST /v1/assets/{asset_id}/ledger/trades → /v1/portfolios/{portfolio_id}/ledger/trades
- v1_ledger.py 제거, disabled 차단(409) 추가
- test_v1.py / test_daemon_assignment.py 구 path 갱신
- 신규 tests: test_v1_portfolios_crud.py, test_v1_portfolios_list.py,
test_v1_portfolios_tags_comments.py, test_v1_portfolios_ledger.py
- 전체 suite: 340 passed
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Claude Sonnet 4.6
@@ -0,0 +1,493 @@
|
||||
"""Tests for BAT-009: POST/PATCH/DELETE /v1/portfolios (REQ-025, REQ-026, REQ-027)."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from contextlib import ExitStack
|
||||
from typing import Any
|
||||
from unittest.mock import patch
|
||||
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
from app.core.config import Settings, get_settings
|
||||
from app.domain.models import Asset, Portfolio, StrategySet, TokenPrincipal
|
||||
from app.main import create_app
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Helpers
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
_ASSET_UUID = "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
|
||||
_PORTFOLIO_UUID = "cccccccc-cccc-cccc-cccc-cccccccccccc"
|
||||
_USER_ID = "user-001"
|
||||
_OTHER_USER_ID = "user-002"
|
||||
|
||||
|
||||
def _make_settings(**kwargs) -> Settings:
|
||||
return Settings(allowed_origins_raw="http://localhost:3000", **kwargs)
|
||||
|
||||
|
||||
def _make_asset(asset_id: str = _ASSET_UUID, status: str = "active") -> Asset:
|
||||
return Asset(asset_id=asset_id, symbol="005930", markets=["KRX"], status=status)
|
||||
|
||||
|
||||
def _make_portfolio(
|
||||
portfolio_id: str = _PORTFOLIO_UUID,
|
||||
owner: str = _USER_ID,
|
||||
status: str = "enabled",
|
||||
) -> Portfolio:
|
||||
return Portfolio(
|
||||
portfolio_id=portfolio_id,
|
||||
broker="kiwoom",
|
||||
status=status,
|
||||
name="test-portfolio",
|
||||
symbol="005930",
|
||||
asset_id=_ASSET_UUID,
|
||||
owner_user_id=owner,
|
||||
cash_balance=1000.0,
|
||||
asset_quantity=10.0,
|
||||
price=50000.0,
|
||||
profit_buffer=0.0,
|
||||
tag_ids=[],
|
||||
managed_by_daemon_id=None,
|
||||
)
|
||||
|
||||
|
||||
def _make_strategy_set() -> StrategySet:
|
||||
return StrategySet(id="strat-001", name="target_value", config="{}", nick="tv")
|
||||
|
||||
|
||||
class _FakeRepo:
|
||||
def __init__(
|
||||
self,
|
||||
asset: Asset | None = None,
|
||||
portfolios: dict[str, Portfolio] | None = None,
|
||||
token_principal: TokenPrincipal | None = None,
|
||||
) -> None:
|
||||
self._asset = asset or _make_asset()
|
||||
self._portfolios: dict[str, Portfolio] = portfolios or {}
|
||||
self._token_principal = token_principal
|
||||
self._strategy_set = _make_strategy_set()
|
||||
|
||||
def close(self) -> None:
|
||||
pass
|
||||
|
||||
def get_asset_by_id(self, asset_id: str) -> Asset | None:
|
||||
if self._asset and self._asset.asset_id == asset_id:
|
||||
return self._asset
|
||||
return None
|
||||
|
||||
def get_or_create_strategy_set(self, name: str, config: str) -> StrategySet:
|
||||
return self._strategy_set
|
||||
|
||||
def create_portfolio(
|
||||
self,
|
||||
portfolio_id: str,
|
||||
*,
|
||||
owner_user_id: str,
|
||||
broker: str,
|
||||
status: str,
|
||||
name: str,
|
||||
asset_id: str,
|
||||
cash_balance: float,
|
||||
asset_quantity: float,
|
||||
asset_price: float,
|
||||
profit_buffer: float,
|
||||
active_strategy_id: str | None,
|
||||
avabile_strategies: list[str] | None,
|
||||
) -> Portfolio:
|
||||
p = Portfolio(
|
||||
portfolio_id=portfolio_id,
|
||||
broker=broker,
|
||||
status=status,
|
||||
name=name,
|
||||
symbol="005930",
|
||||
asset_id=asset_id,
|
||||
owner_user_id=owner_user_id,
|
||||
cash_balance=cash_balance,
|
||||
asset_quantity=asset_quantity,
|
||||
price=asset_price,
|
||||
profit_buffer=profit_buffer,
|
||||
tag_ids=[],
|
||||
)
|
||||
self._portfolios[portfolio_id] = p
|
||||
return p
|
||||
|
||||
def get(self, portfolio_id: str) -> Portfolio:
|
||||
p = self._portfolios.get(portfolio_id)
|
||||
if p is None:
|
||||
raise ValueError(f"포트폴리오를 찾을 수 없습니다: {portfolio_id}")
|
||||
return p
|
||||
|
||||
def update_portfolio(self, portfolio_id: str, **fields: Any) -> Portfolio:
|
||||
p = self.get(portfolio_id)
|
||||
for k, v in fields.items():
|
||||
if v is not None and hasattr(p, k):
|
||||
setattr(p, k, v)
|
||||
return p
|
||||
|
||||
def soft_delete_portfolio(self, portfolio_id: str) -> Portfolio:
|
||||
p = self.get(portfolio_id)
|
||||
p.status = "disabled"
|
||||
p.managed_by_daemon_id = None
|
||||
return p
|
||||
|
||||
def get_token_principal(self, token_hash: str) -> TokenPrincipal | None:
|
||||
return self._token_principal
|
||||
|
||||
def list_portfolios(self, **kwargs: Any) -> list[Portfolio]:
|
||||
return []
|
||||
|
||||
|
||||
def _make_client(
|
||||
admin_tokens: list[str] | None = None,
|
||||
trade_write_tokens: list[str] | None = None,
|
||||
db_enabled: bool = False,
|
||||
) -> TestClient:
|
||||
get_settings.cache_clear()
|
||||
settings = _make_settings(
|
||||
admin_tokens_raw=",".join(admin_tokens or ["admin-tok"]),
|
||||
trade_write_tokens_raw=",".join(trade_write_tokens or ["user-tok"]),
|
||||
db_enabled=db_enabled,
|
||||
)
|
||||
app = create_app(settings_factory=lambda: settings)
|
||||
app.dependency_overrides[get_settings] = lambda: settings
|
||||
return TestClient(app)
|
||||
|
||||
|
||||
def _with_repo(repo: _FakeRepo, *, db_auth: bool = False) -> ExitStack:
|
||||
"""Patch repo factory for route handlers and optionally for auth middleware."""
|
||||
stack = ExitStack()
|
||||
stack.enter_context(
|
||||
patch("app.api.v1_portfolios.get_portfolio_repository_from_settings", return_value=repo)
|
||||
)
|
||||
if db_auth:
|
||||
stack.enter_context(
|
||||
patch("app.core.auth.get_portfolio_repository_from_settings", return_value=repo)
|
||||
)
|
||||
return stack
|
||||
|
||||
|
||||
def _auth(token: str) -> dict[str, str]:
|
||||
return {"Authorization": f"Bearer {token}"}
|
||||
|
||||
|
||||
def _repo_with_portfolio(owner: str = _USER_ID, status: str = "enabled") -> _FakeRepo:
|
||||
p = _make_portfolio(owner=owner, status=status)
|
||||
repo = _FakeRepo(asset=_make_asset())
|
||||
repo._portfolios[_PORTFOLIO_UUID] = p
|
||||
return repo
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# REQ-025: POST /v1/portfolios
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
def test_post_admin_creates_for_target_user() -> None:
|
||||
"""REQ-025 AC-1: admin + user_id → portfolio owned by target user."""
|
||||
repo = _FakeRepo(asset=_make_asset(_ASSET_UUID, "active"))
|
||||
client = _make_client()
|
||||
|
||||
with _with_repo(repo):
|
||||
resp = client.post(
|
||||
"/v1/portfolios",
|
||||
json={"asset_id": _ASSET_UUID, "broker": "kiwoom", "user_id": _OTHER_USER_ID},
|
||||
headers=_auth("admin-tok"),
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
data = resp.json()
|
||||
assert data["owner_user_id"] == _OTHER_USER_ID
|
||||
assert data["broker"] == "kiwoom"
|
||||
assert data["status"] == "enabled"
|
||||
|
||||
|
||||
def test_post_user_creates_for_self() -> None:
|
||||
"""REQ-025 AC-2: session/env token → owner_user_id == auth.user_id (env: None→'system')."""
|
||||
repo = _FakeRepo(asset=_make_asset(_ASSET_UUID, "active"))
|
||||
client = _make_client()
|
||||
|
||||
with _with_repo(repo):
|
||||
resp = client.post(
|
||||
"/v1/portfolios",
|
||||
json={"asset_id": _ASSET_UUID, "broker": "kiwoom"},
|
||||
headers=_auth("user-tok"),
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
assert resp.json()["status"] == "enabled"
|
||||
|
||||
|
||||
def test_post_service_token_returns_403() -> None:
|
||||
"""REQ-025 AC-3: service token → HTTP 403."""
|
||||
repo = _FakeRepo(
|
||||
asset=_make_asset(_ASSET_UUID, "active"),
|
||||
token_principal=TokenPrincipal(
|
||||
token_id="tid-1", user_id=_USER_ID, permission="trade-write",
|
||||
token_type="service", daemon_id="d-1",
|
||||
),
|
||||
)
|
||||
client = _make_client(db_enabled=True)
|
||||
|
||||
with _with_repo(repo, db_auth=True):
|
||||
resp = client.post(
|
||||
"/v1/portfolios",
|
||||
json={"asset_id": _ASSET_UUID, "broker": "kiwoom"},
|
||||
headers=_auth("svc-raw-token"),
|
||||
)
|
||||
assert resp.status_code == 403
|
||||
|
||||
|
||||
def test_post_inactive_asset_returns_422() -> None:
|
||||
"""REQ-025 AC-5: inactive asset → HTTP 422."""
|
||||
repo = _FakeRepo(asset=_make_asset(_ASSET_UUID, "inactive"))
|
||||
client = _make_client()
|
||||
|
||||
with _with_repo(repo):
|
||||
resp = client.post(
|
||||
"/v1/portfolios",
|
||||
json={"asset_id": _ASSET_UUID, "broker": "kiwoom"},
|
||||
headers=_auth("admin-tok"),
|
||||
)
|
||||
assert resp.status_code == 422
|
||||
|
||||
|
||||
def test_post_missing_asset_returns_422() -> None:
|
||||
"""REQ-025 AC-5: asset not in catalog → HTTP 422."""
|
||||
repo = _FakeRepo(asset=None)
|
||||
repo._asset = None # type: ignore[assignment]
|
||||
client = _make_client()
|
||||
|
||||
with _with_repo(repo):
|
||||
resp = client.post(
|
||||
"/v1/portfolios",
|
||||
json={"asset_id": "no-such-uuid", "broker": "kiwoom"},
|
||||
headers=_auth("admin-tok"),
|
||||
)
|
||||
assert resp.status_code == 422
|
||||
|
||||
|
||||
def test_post_no_bearer_returns_401() -> None:
|
||||
"""REQ-025 AC-6: no token → HTTP 401."""
|
||||
client = _make_client()
|
||||
resp = client.post("/v1/portfolios", json={"asset_id": _ASSET_UUID, "broker": "kiwoom"})
|
||||
assert resp.status_code == 401
|
||||
|
||||
|
||||
def test_post_non_admin_user_id_ignored() -> None:
|
||||
"""REQ-025 AC-7: non-admin + body user_id → user_id ignored (fallback to env user_id = None → 'system')."""
|
||||
repo = _FakeRepo(asset=_make_asset(_ASSET_UUID, "active"))
|
||||
client = _make_client()
|
||||
|
||||
with _with_repo(repo):
|
||||
resp = client.post(
|
||||
"/v1/portfolios",
|
||||
json={"asset_id": _ASSET_UUID, "broker": "kiwoom", "user_id": _OTHER_USER_ID},
|
||||
headers=_auth("user-tok"),
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
assert resp.json()["owner_user_id"] != _OTHER_USER_ID
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# REQ-026: PATCH /v1/portfolios/{portfolio_id}
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
def test_patch_admin_updates_any_portfolio() -> None:
|
||||
"""REQ-026 AC-1: admin token → can update any portfolio."""
|
||||
repo = _repo_with_portfolio(owner=_OTHER_USER_ID)
|
||||
client = _make_client()
|
||||
|
||||
with _with_repo(repo):
|
||||
resp = client.patch(
|
||||
f"/v1/portfolios/{_PORTFOLIO_UUID}",
|
||||
json={"broker": "ebest"},
|
||||
headers=_auth("admin-tok"),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
assert resp.json()["broker"] == "ebest"
|
||||
|
||||
|
||||
def test_patch_user_updates_own_portfolio() -> None:
|
||||
"""REQ-026 AC-2: user token + own portfolio → HTTP 200."""
|
||||
repo = _repo_with_portfolio(owner=_USER_ID)
|
||||
repo._token_principal = TokenPrincipal(
|
||||
token_id="tid", user_id=_USER_ID, permission="trade-write",
|
||||
token_type="session", daemon_id=None,
|
||||
)
|
||||
client = _make_client(db_enabled=True)
|
||||
|
||||
with _with_repo(repo, db_auth=True):
|
||||
resp = client.patch(
|
||||
f"/v1/portfolios/{_PORTFOLIO_UUID}",
|
||||
json={"broker": "ebest"},
|
||||
headers=_auth("session-token"),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
|
||||
|
||||
def test_patch_user_other_portfolio_returns_403() -> None:
|
||||
"""REQ-026 AC-3: user token + other user's portfolio → HTTP 403."""
|
||||
repo = _repo_with_portfolio(owner=_OTHER_USER_ID)
|
||||
repo._token_principal = TokenPrincipal(
|
||||
token_id="tid", user_id=_USER_ID, permission="trade-write",
|
||||
token_type="session", daemon_id=None,
|
||||
)
|
||||
client = _make_client(db_enabled=True)
|
||||
|
||||
with _with_repo(repo, db_auth=True):
|
||||
resp = client.patch(
|
||||
f"/v1/portfolios/{_PORTFOLIO_UUID}",
|
||||
json={"broker": "ebest"},
|
||||
headers=_auth("session-token"),
|
||||
)
|
||||
assert resp.status_code == 403
|
||||
|
||||
|
||||
def test_patch_service_token_returns_403() -> None:
|
||||
"""REQ-026 AC-4: service token → HTTP 403."""
|
||||
repo = _repo_with_portfolio()
|
||||
repo._token_principal = TokenPrincipal(
|
||||
token_id="tid", user_id=_USER_ID, permission="trade-write",
|
||||
token_type="service", daemon_id="d-1",
|
||||
)
|
||||
client = _make_client(db_enabled=True)
|
||||
|
||||
with _with_repo(repo, db_auth=True):
|
||||
resp = client.patch(
|
||||
f"/v1/portfolios/{_PORTFOLIO_UUID}",
|
||||
json={"broker": "ebest"},
|
||||
headers=_auth("svc-token"),
|
||||
)
|
||||
assert resp.status_code == 403
|
||||
|
||||
|
||||
def test_patch_no_bearer_returns_401() -> None:
|
||||
"""REQ-026 AC-6: no token → HTTP 401."""
|
||||
client = _make_client()
|
||||
resp = client.patch(f"/v1/portfolios/{_PORTFOLIO_UUID}", json={"broker": "ebest"})
|
||||
assert resp.status_code == 401
|
||||
|
||||
|
||||
def test_patch_nonexistent_portfolio_returns_404() -> None:
|
||||
"""REQ-026 AC-7: non-existent portfolio_id → HTTP 404."""
|
||||
repo = _FakeRepo()
|
||||
client = _make_client()
|
||||
|
||||
with _with_repo(repo):
|
||||
resp = client.patch("/v1/portfolios/no-such-id", json={"broker": "ebest"}, headers=_auth("admin-tok"))
|
||||
assert resp.status_code == 404
|
||||
|
||||
|
||||
def test_patch_disabled_portfolio_non_status_returns_409() -> None:
|
||||
"""REQ-026 AC-8: disabled portfolio + non-status field → HTTP 409."""
|
||||
repo = _repo_with_portfolio(status="disabled")
|
||||
client = _make_client()
|
||||
|
||||
with _with_repo(repo):
|
||||
resp = client.patch(
|
||||
f"/v1/portfolios/{_PORTFOLIO_UUID}",
|
||||
json={"broker": "ebest"},
|
||||
headers=_auth("admin-tok"),
|
||||
)
|
||||
assert resp.status_code == 409
|
||||
|
||||
|
||||
def test_patch_disabled_portfolio_status_restore_returns_200() -> None:
|
||||
"""REQ-026 AC-9: disabled portfolio + status='enabled' → HTTP 200 (restore)."""
|
||||
repo = _repo_with_portfolio(status="disabled")
|
||||
client = _make_client()
|
||||
|
||||
with _with_repo(repo):
|
||||
resp = client.patch(
|
||||
f"/v1/portfolios/{_PORTFOLIO_UUID}",
|
||||
json={"status": "enabled"},
|
||||
headers=_auth("admin-tok"),
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
assert resp.json()["status"] == "enabled"
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# REQ-027: DELETE /v1/portfolios/{portfolio_id}
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
def test_delete_user_own_active_portfolio_soft_deletes() -> None:
|
||||
"""REQ-027 AC-1: session token + own active portfolio → HTTP 200 + status='disabled'."""
|
||||
repo = _repo_with_portfolio(owner=_USER_ID)
|
||||
repo._token_principal = TokenPrincipal(
|
||||
token_id="tid", user_id=_USER_ID, permission="trade-write",
|
||||
token_type="session", daemon_id=None,
|
||||
)
|
||||
client = _make_client(db_enabled=True)
|
||||
|
||||
with _with_repo(repo, db_auth=True):
|
||||
resp = client.delete(f"/v1/portfolios/{_PORTFOLIO_UUID}", headers=_auth("session-token"))
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert data["status"] == "disabled"
|
||||
assert data["managed_by_daemon_id"] is None
|
||||
|
||||
|
||||
def test_delete_admin_other_user_portfolio() -> None:
|
||||
"""REQ-027 AC-3: admin token + other user's portfolio → HTTP 200."""
|
||||
repo = _repo_with_portfolio(owner=_OTHER_USER_ID)
|
||||
client = _make_client()
|
||||
|
||||
with _with_repo(repo):
|
||||
resp = client.delete(f"/v1/portfolios/{_PORTFOLIO_UUID}", headers=_auth("admin-tok"))
|
||||
assert resp.status_code == 200
|
||||
assert resp.json()["status"] == "disabled"
|
||||
|
||||
|
||||
def test_delete_user_other_portfolio_returns_403() -> None:
|
||||
"""REQ-027 AC-4: session token + other user's portfolio → HTTP 403."""
|
||||
repo = _repo_with_portfolio(owner=_OTHER_USER_ID)
|
||||
repo._token_principal = TokenPrincipal(
|
||||
token_id="tid", user_id=_USER_ID, permission="trade-write",
|
||||
token_type="session", daemon_id=None,
|
||||
)
|
||||
client = _make_client(db_enabled=True)
|
||||
|
||||
with _with_repo(repo, db_auth=True):
|
||||
resp = client.delete(f"/v1/portfolios/{_PORTFOLIO_UUID}", headers=_auth("session-token"))
|
||||
assert resp.status_code == 403
|
||||
|
||||
|
||||
def test_delete_service_token_returns_403() -> None:
|
||||
"""REQ-027 AC-5: service token → HTTP 403."""
|
||||
repo = _repo_with_portfolio()
|
||||
repo._token_principal = TokenPrincipal(
|
||||
token_id="tid", user_id=_USER_ID, permission="trade-write",
|
||||
token_type="service", daemon_id="d-1",
|
||||
)
|
||||
client = _make_client(db_enabled=True)
|
||||
|
||||
with _with_repo(repo, db_auth=True):
|
||||
resp = client.delete(f"/v1/portfolios/{_PORTFOLIO_UUID}", headers=_auth("svc-token"))
|
||||
assert resp.status_code == 403
|
||||
|
||||
|
||||
def test_delete_no_bearer_returns_401() -> None:
|
||||
"""REQ-027 AC-7: no token → HTTP 401."""
|
||||
client = _make_client()
|
||||
resp = client.delete(f"/v1/portfolios/{_PORTFOLIO_UUID}")
|
||||
assert resp.status_code == 401
|
||||
|
||||
|
||||
def test_delete_nonexistent_portfolio_returns_404() -> None:
|
||||
"""REQ-027 AC-8: non-existent portfolio_id → HTTP 404."""
|
||||
repo = _FakeRepo()
|
||||
client = _make_client()
|
||||
|
||||
with _with_repo(repo):
|
||||
resp = client.delete("/v1/portfolios/no-such-id", headers=_auth("admin-tok"))
|
||||
assert resp.status_code == 404
|
||||
|
||||
|
||||
def test_delete_already_disabled_is_idempotent() -> None:
|
||||
"""REQ-027: already disabled portfolio → HTTP 200 (idempotent)."""
|
||||
repo = _repo_with_portfolio(status="disabled")
|
||||
client = _make_client()
|
||||
|
||||
with _with_repo(repo):
|
||||
resp = client.delete(f"/v1/portfolios/{_PORTFOLIO_UUID}", headers=_auth("admin-tok"))
|
||||
assert resp.status_code == 200
|
||||
assert resp.json()["status"] == "disabled"
|
||||
Reference in New Issue
Block a user