portfolio-hub

89 Commits 1 Branch 12 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
genichin	2e1298a978	fix: enforce trade-write permission check on v1 ledger trade endpoint Security Fix: - Update v1_ledger.py to require trade_write permission instead of read - Fix authentication dependency from require_read to require_trade_write - Ensure trade operations cannot be performed with read-only service tokens Test Coverage: - Add test_v1_ledger_trade_requires_trade_write_permission() to verify permission boundary - Confirm read-only tokens are rejected with 403 Forbidden status - Validate repository methods are not called on permission failure Documentation: - Add new Discovery dcy-005 for production admin bootstrap and operator access - Update docs/discovery/index.md with dcy-005 entry - Update release rel-001 with additional verification notes and issue references	2026-05-11 14:17:27 +00:00
genichin	a5b5e7a93c	fix: resolve SRS conflicts from batch verification analysis (CONFLICT-1~4) Conflict Resolutions: - CONFLICT-1 (High): Fix REQ-006 ownership scope — implement owner_user_id filtering * Change app/api/v1_assets.py: owner_user_id=None → owner_user_id=auth.user_id * Update docs/runtime-flows.md to reflect service-token owner-scoped portfolio filtering * Add regression test in tests/test_v1.py for ownership boundary - CONFLICT-2 (Medium): Transition REQ-001/002/003 to Implemented * REQ-001: local-db-validation-scenarios (via confirm-req-implemented bat-007) * REQ-002: alembic-runtime-schema-ownership (via confirm-req-implemented bat-007) * REQ-003: local-db-operations-runbook-and-baseline-updates (via confirm-req-implemented bat-007) * Update docs/srs/index.md with status transitions - CONFLICT-3 (Low): Document REQ-012 rotate lifecycle * Add rotate lifecycle notes to REQ-012 (change-req req-012) * Clarify runtime_id change behavior and trex-basic reconnection requirements - CONFLICT-4 (Low): Clarify REQ-005 AC-2 endpoint path * Change REQ-005 AC-2: 'POST /auth/tokens or equivalent' → 'POST /auth/service-tokens' * Update docs/srs/index.md change log with change-req entries Documentation Updates: - Update BAT-001 verification status with conflict resolution evidence - Update release rel-001 with verified status confirmation - Add change log entries for all conflict resolutions with dates and references Testing: - Add ownership boundary test to test_v1.py - Verify filter works with auth.user_id context	2026-05-11 11:57:21 +00:00
genichin	3509606c7e	feat(REQ-005): implement TrEx Basic V1 API contract with auth, assets, ledger, and user endpoints - Add V1 API routes for assets, ledger, and user info with complete CRUD operations - Implement authentication scopes and request validation via auth_routes.py - Extend schemas with V1-specific models for accounts, holdings, and positions - Add database queries and aggregations for P&L, performance, and account data - Include comprehensive test coverage for all V1 endpoints and integration flows - Update batch and release documentation with implementation and verification evidence - Sync project structure and runtime flows per V1 API contract requirements Closes implementation phase of BAT-001 (TrEx Basic V1 API Contract)	2026-05-02 11:37:42 +00:00

Author

SHA1

Message

Date

genichin

2e1298a978

fix: enforce trade-write permission check on v1 ledger trade endpoint

Security Fix:
- Update v1_ledger.py to require trade_write permission instead of read
- Fix authentication dependency from require_read to require_trade_write
- Ensure trade operations cannot be performed with read-only service tokens

Test Coverage:
- Add test_v1_ledger_trade_requires_trade_write_permission() to verify permission boundary
- Confirm read-only tokens are rejected with 403 Forbidden status
- Validate repository methods are not called on permission failure

Documentation:
- Add new Discovery dcy-005 for production admin bootstrap and operator access
- Update docs/discovery/index.md with dcy-005 entry
- Update release rel-001 with additional verification notes and issue references

2026-05-11 14:17:27 +00:00

genichin

a5b5e7a93c

fix: resolve SRS conflicts from batch verification analysis (CONFLICT-1~4)

Conflict Resolutions:
- CONFLICT-1 (High): Fix REQ-006 ownership scope — implement owner_user_id filtering
  * Change app/api/v1_assets.py: owner_user_id=None → owner_user_id=auth.user_id
  * Update docs/runtime-flows.md to reflect service-token owner-scoped portfolio filtering
  * Add regression test in tests/test_v1.py for ownership boundary

- CONFLICT-2 (Medium): Transition REQ-001/002/003 to Implemented
  * REQ-001: local-db-validation-scenarios (via confirm-req-implemented bat-007)
  * REQ-002: alembic-runtime-schema-ownership (via confirm-req-implemented bat-007)
  * REQ-003: local-db-operations-runbook-and-baseline-updates (via confirm-req-implemented bat-007)
  * Update docs/srs/index.md with status transitions

- CONFLICT-3 (Low): Document REQ-012 rotate lifecycle
  * Add rotate lifecycle notes to REQ-012 (change-req req-012)
  * Clarify runtime_id change behavior and trex-basic reconnection requirements

- CONFLICT-4 (Low): Clarify REQ-005 AC-2 endpoint path
  * Change REQ-005 AC-2: 'POST /auth/tokens or equivalent' → 'POST /auth/service-tokens'
  * Update docs/srs/index.md change log with change-req entries

Documentation Updates:
- Update BAT-001 verification status with conflict resolution evidence
- Update release rel-001 with verified status confirmation
- Add change log entries for all conflict resolutions with dates and references

Testing:
- Add ownership boundary test to test_v1.py
- Verify filter works with auth.user_id context

2026-05-11 11:57:21 +00:00

genichin

3509606c7e

feat(REQ-005): implement TrEx Basic V1 API contract with auth, assets, ledger, and user endpoints

- Add V1 API routes for assets, ledger, and user info with complete CRUD operations
- Implement authentication scopes and request validation via auth_routes.py
- Extend schemas with V1-specific models for accounts, holdings, and positions
- Add database queries and aggregations for P&L, performance, and account data
- Include comprehensive test coverage for all V1 endpoints and integration flows
- Update batch and release documentation with implementation and verification evidence
- Sync project structure and runtime flows per V1 API contract requirements

Closes implementation phase of BAT-001 (TrEx Basic V1 API Contract)

2026-05-02 11:37:42 +00:00