genichin
e6b6a8715b
Core Implementation (BAT-010):
- Add daemon registry schema and CRUD operations (req-023)
- Implement single-daemon asset assignment constraint (one asset per daemon)
- Add daemon_id field to service_token for daemon identification
- Add daemon.py CLI module for daemon management commands
- Add 20260513_0016_daemon_model.py migration for daemon tables
API Changes:
- GET /v1/assets: include daemon_id in AssetResponse
- POST /v1/assets/{asset_id}/ledger/trades: require daemon token binding
- GET /v1/user_info: include daemon metadata
- Enhanced service-token rotate to preserve daemon bindings
CLI Commands:
- pfhub daemon register --name <name> --runtime-id <runtime-id>
- pfhub daemon list
- pfhub daemon get <daemon-id>
- pfhub daemon revoke <daemon-id>
Requirements (REQ-023, REQ-028):
- REQ-023: Daemon Registry and Service Token Daemon Binding (Interface, Approved)
* AC-1: daemon CRUD operations
* AC-2: service token daemon binding for POST /v1/assets/{asset_id}/ledger/trades
* AC-3: single daemon per asset (exact-one assignment model)
- REQ-028: README.md Daemon Provisioning Runbook update (Documentation, Approved)
Documentation:
- Add dcy-006 Discovery for daemon-id and single-daemon asset assignment
- Update README.md with Daemon Provisioning Runbook section
- Add BAT-010 batch documentation with planning, implementation, verification
- Update rel-006 release document (daemon model implementation)
- Update data-model.md with daemon and daemon_asset_assignment tables
- Update interface-contract.md with daemon registry APIs
- Update runtime-flows.md with daemon lifecycle flows
Breaking Changes:
- REQ-005~009, REQ-011~012 status reverted to Approved due to revised contract
* daemon_id field addition and exact-one asset assignment requirement
* Existing Implemented evidence invalidated by contract revision
* BAT-001/002/008 re-verification required
Testing:
- Add test_daemon_registry.py for daemon CRUD operations
- Add test_daemon_assignment.py for single-asset assignment constraints
- Update test_auth.py, test_cli.py, test_v1.py for daemon support
- Verify daemon token binding in trade endpoint authorization
Impact:
- Database: 2 new tables (daemons, daemon_asset_assignments)
- Migration: 20260513_0016 creates daemon model schema
- CLI: 4 new daemon subcommands
- API: daemon_id propagation through v1 endpoints
- Verification: BAT-001/002/008 re-verification gates next release
82 lines
2.9 KiB
Python
82 lines
2.9 KiB
Python
"""GET /v1/user_info — service-token authenticated user info endpoint."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import logging
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, status
|
|
|
|
from app.core.auth import AuthContext, require_read
|
|
from app.core.config import Settings, get_settings
|
|
from app.core.encryption import InvalidToken, decrypt_payload
|
|
from app.repositories.factory import get_portfolio_repository_from_settings
|
|
from app.schemas.v1 import BrokerItem, UserInfoResponse
|
|
|
|
logger = logging.getLogger(__name__)
|
|
router = APIRouter(prefix="/v1", tags=["v1"])
|
|
|
|
|
|
def _require_service_token(auth: AuthContext = Depends(require_read)) -> AuthContext:
|
|
if auth.token_source != "db" or auth.token_type != "service":
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Service token required",
|
|
)
|
|
return auth
|
|
|
|
|
|
@router.get("/user_info", response_model=UserInfoResponse)
|
|
def get_user_info(
|
|
auth: AuthContext = Depends(_require_service_token),
|
|
settings: Settings = Depends(get_settings),
|
|
) -> UserInfoResponse:
|
|
repo = get_portfolio_repository_from_settings(settings)
|
|
try:
|
|
user = repo.get_user(auth.user_id) # type: ignore[arg-type]
|
|
|
|
# Fetch broker credentials and decrypt
|
|
brokers: list[BrokerItem] = []
|
|
try:
|
|
credentials = repo.list_broker_credentials(auth.user_id) # type: ignore[arg-type]
|
|
enc_key: str | None = None
|
|
for cred in credentials:
|
|
credential_payload = None
|
|
try:
|
|
if enc_key is None:
|
|
enc_key = settings.require_credential_encryption_key()
|
|
raw = decrypt_payload(enc_key, cred.encrypted_payload)
|
|
credential_payload = json.loads(raw)
|
|
except (InvalidToken, RuntimeError, Exception) as exc:
|
|
logger.warning("credential decryption failed for broker %s: %s", cred.broker, exc)
|
|
brokers.append(BrokerItem(
|
|
broker=cred.broker,
|
|
account_ref=cred.account_ref,
|
|
credential_payload=credential_payload,
|
|
credential_version=cred.credential_version,
|
|
last_rotated_at=cred.last_rotated_at,
|
|
))
|
|
except AttributeError:
|
|
# repo does not implement list_broker_credentials yet (mock or older impl)
|
|
pass
|
|
|
|
finally:
|
|
if callable(getattr(type(repo), "close", None)):
|
|
repo.close()
|
|
|
|
disabled_reason: str | None = None
|
|
if not user.is_active:
|
|
disabled_reason = "account_inactive"
|
|
|
|
return UserInfoResponse(
|
|
runtime_id=auth.runtime_id,
|
|
daemon_id=auth.daemon_id,
|
|
trading_enabled=user.is_active,
|
|
disabled_reason=disabled_reason,
|
|
brokers=brokers,
|
|
user_id=user.id,
|
|
username=user.username,
|
|
email=user.email,
|
|
permission=user.permission,
|
|
)
|