trex/portfolio-hub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: resolve SRS conflicts from batch verification analysis (CONFLICT-1~4)

Browse Source 
Conflict Resolutions:
- CONFLICT-1 (High): Fix REQ-006 ownership scope — implement owner_user_id filtering
  * Change app/api/v1_assets.py: owner_user_id=None → owner_user_id=auth.user_id
  * Update docs/runtime-flows.md to reflect service-token owner-scoped portfolio filtering
  * Add regression test in tests/test_v1.py for ownership boundary

- CONFLICT-2 (Medium): Transition REQ-001/002/003 to Implemented
  * REQ-001: local-db-validation-scenarios (via confirm-req-implemented bat-007)
  * REQ-002: alembic-runtime-schema-ownership (via confirm-req-implemented bat-007)
  * REQ-003: local-db-operations-runbook-and-baseline-updates (via confirm-req-implemented bat-007)
  * Update docs/srs/index.md with status transitions

- CONFLICT-3 (Low): Document REQ-012 rotate lifecycle
  * Add rotate lifecycle notes to REQ-012 (change-req req-012)
  * Clarify runtime_id change behavior and trex-basic reconnection requirements

- CONFLICT-4 (Low): Clarify REQ-005 AC-2 endpoint path
  * Change REQ-005 AC-2: 'POST /auth/tokens or equivalent' → 'POST /auth/service-tokens'
  * Update docs/srs/index.md change log with change-req entries

Documentation Updates:
- Update BAT-001 verification status with conflict resolution evidence
- Update release rel-001 with verified status confirmation
- Add change log entries for all conflict resolutions with dates and references

Testing:
- Add ownership boundary test to test_v1.py
- Verify filter works with auth.user_id context
This commit is contained in:
genichin
2026-05-11 11:57:21 +00:00
parent 829629fa8f
commit a5b5e7a93c
12 changed files with 251 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/runtime-flows.md
+3 -2
View File
@@ -78,11 +78,12 @@
## Flow: `v1 API — GET /v1/assets`
1. Service-token auth required (see above).
2. `list_portfolios_with_strategies()` fetches all portfolios from DB.
2. `list_portfolios_with_strategies()` fetches only the authenticated service-token owner's portfolios from DB by passing `owner_user_id=auth.user_id`.
3. Optional `?status=<value>` query param filters portfolios by status field.
4. For portfolios with `active_strategy_id`, `get_strategy_set()` fetches config and JSON-parses `strategy_params`; failures fall back to `{}`.
5. Returns `AssetsResponse` with `total` and `assets[]` using new field names: `cash`, `quantity`, `broker_type`, `strategy_params`.
6. `asset_id` in each asset item equals `portfolio.portfolio_id` which is a server-generated UUID after BAT-006 migration (dcy-002 A-3 updated: text identity assumption replaced by UUID).
6. Portfolios owned by other users must not be included in the response.
7. `asset_id` in each asset item equals `portfolio.portfolio_id` which is a server-generated UUID after BAT-006 migration (dcy-002 A-3 updated: text identity assumption replaced by UUID).
## Flow: `v1 API — GET /v1/user_info`