core-framework 4.1.0__tar.gz → 4.2.1__tar.gz

{core_framework-4.1.0 → core_framework-4.2.1}/.github/workflows/_deploy.yml

@@ -24,6 +24,12 @@ on:
         required: false
       AGENT_OPENAI_API_KEY:
         required: false
+      AGENT_ANTHROPIC_API_KEY:
+        required: false
+      ENTITLEMENT_SECRET_API_KEY:
+        required: false
+      ENTITLEMENT_WEBHOOK_SIGNING_SECRET:
+        required: false
       FIREBASE_CONFIG:
         required: true
       IMAGE_SERVER_SSH_PRIVATE_KEY:
@@ -101,10 +107,17 @@ jobs:
           EMAIL_FROM_ADDRESS: ${{ vars.EMAIL_FROM_ADDRESS }}
           EMAIL_FROM_NAME: ${{ vars.EMAIL_FROM_NAME }}
           AGENT_ENABLED: ${{ vars.AGENT_ENABLED || 'false' }}
+          AGENT_PROVIDER: ${{ vars.AGENT_PROVIDER || 'openai' }}
           AGENT_MODEL: ${{ vars.AGENT_MODEL }}
           AGENT_OPENAI_API_KEY: ${{ secrets.AGENT_OPENAI_API_KEY }}
           AGENT_OPENAI_BASE_URL: ${{ vars.AGENT_OPENAI_BASE_URL }}
+          AGENT_ANTHROPIC_API_KEY: ${{ secrets.AGENT_ANTHROPIC_API_KEY }}
           AGENT_TIMEOUT_SECONDS: ${{ vars.AGENT_TIMEOUT_SECONDS || '120' }}
+          ENTITLEMENT_ENABLED: ${{ vars.ENTITLEMENT_ENABLED || 'false' }}
+          ENTITLEMENT_SECRET_API_KEY: ${{ secrets.ENTITLEMENT_SECRET_API_KEY }}
+          ENTITLEMENT_PROJECT_ID: ${{ vars.ENTITLEMENT_PROJECT_ID }}
+          ENTITLEMENT_WEBHOOK_SIGNING_SECRET: ${{ secrets.ENTITLEMENT_WEBHOOK_SIGNING_SECRET }}
+          ENTITLEMENT_ALERT_ADDRESS: ${{ vars.ENTITLEMENT_ALERT_ADDRESS }}
         run: |
           set -euo pipefail
 

{core_framework-4.1.0 → core_framework-4.2.1}/.github/workflows/dev-ci-cd.yaml

@@ -131,6 +131,9 @@ jobs:
       READ_POSTGRES_PASSWORD: ${{ secrets.READ_POSTGRES_PASSWORD }}
       EMAIL_API_KEY: ${{ secrets.EMAIL_API_KEY }}
       AGENT_OPENAI_API_KEY: ${{ secrets.AGENT_OPENAI_API_KEY }}
+      AGENT_ANTHROPIC_API_KEY: ${{ secrets.AGENT_ANTHROPIC_API_KEY }}
+      ENTITLEMENT_SECRET_API_KEY: ${{ secrets.ENTITLEMENT_SECRET_API_KEY }}
+      ENTITLEMENT_WEBHOOK_SIGNING_SECRET: ${{ secrets.ENTITLEMENT_WEBHOOK_SIGNING_SECRET }}
       FIREBASE_CONFIG: ${{ secrets.FIREBASE_CONFIG }}
       IMAGE_SERVER_SSH_PRIVATE_KEY: ${{ secrets.IMAGE_SERVER_SSH_PRIVATE_KEY }}
       IMAGE_SERVER_KNOWN_HOSTS: ${{ secrets.IMAGE_SERVER_KNOWN_HOSTS }}

{core_framework-4.1.0 → core_framework-4.2.1}/.github/workflows/manual-deployment.yaml

@@ -47,6 +47,9 @@ jobs:
       READ_POSTGRES_PASSWORD: ${{ secrets.READ_POSTGRES_PASSWORD }}
       EMAIL_API_KEY: ${{ secrets.EMAIL_API_KEY }}
       AGENT_OPENAI_API_KEY: ${{ secrets.AGENT_OPENAI_API_KEY }}
+      AGENT_ANTHROPIC_API_KEY: ${{ secrets.AGENT_ANTHROPIC_API_KEY }}
+      ENTITLEMENT_SECRET_API_KEY: ${{ secrets.ENTITLEMENT_SECRET_API_KEY }}
+      ENTITLEMENT_WEBHOOK_SIGNING_SECRET: ${{ secrets.ENTITLEMENT_WEBHOOK_SIGNING_SECRET }}
       FIREBASE_CONFIG: ${{ secrets.FIREBASE_CONFIG }}
       IMAGE_SERVER_SSH_PRIVATE_KEY: ${{ secrets.IMAGE_SERVER_SSH_PRIVATE_KEY }}
       IMAGE_SERVER_KNOWN_HOSTS: ${{ secrets.IMAGE_SERVER_KNOWN_HOSTS }}

{core_framework-4.1.0 → core_framework-4.2.1}/CHANGELOG.md

@@ -4,6 +4,23 @@ Notable changes to **core-framework** (import **`core_framework`**). Format foll
 
 ## [Unreleased]
 
+## [4.2.1] - 2026-10-10
+
+### Changed
+
+- **Entitlement grant list:** `GET /users/me/entitlements` returns **`identifier`** instead of **`label`**. **`register_entitlement_tier`** takes one **`identifier`**, which is that tier's RevenueCat lookup key. Registering tier **1** replaces **`plus`**. A host that passed **`label`** or **`lookup_keys`** must pass **`identifier`**.
+
+## [4.2.0] - 2026-10-08
+
+### Added
+
+- **Model provider:** a host selects **openai** (default) or **anthropic**. Startup builds only that provider. **`SupportedModel`** adds **`claude-opus-5`**, **`claude-sonnet-5`**, and **`claude-haiku-5-5`**. An omitted or blank **`model`** is **`gpt-6-luna`** for OpenAI and **`claude-haiku-5-5`** for Anthropic. **`claude-haiku-5-5`** is the Claude API id. The pinned Pydantic AI release classifies the Opus and Sonnet ids and leaves Haiku on its generic Anthropic profile (native JSON-schema output off, adaptive thinking and effort off, sampling settings forwarded) until a pin classifies that id. An explicit **`model`** must belong to the selected provider. Secret **`AGENT_ANTHROPIC_API_KEY`** is required only when enabled and the provider is Anthropic. The Anthropic client uses **`https://api.anthropic.com`** and ignores **`ANTHROPIC_API_KEY`**, **`ANTHROPIC_BASE_URL`**, **`ANTHROPIC_CUSTOM_HEADERS`**, **`ANTHROPIC_WEBHOOK_SIGNING_KEY`**, and **`ANTHROPIC_LOG`**. **`responses_model`** returns that provider's content-free model, or raises when the requested member belongs to the other provider.
+- **Entitlement grants:** a signed RevenueCat webhook replaces paid tiers and leaves complimentary tiers. A refused grant returns **200**, leaves that user's paid rows, and emails the operator at most once per reason and entitlement id per hour. Admin complimentary grant and remove return **204**. Account removal tries the RevenueCat customer delete when entitlements are on, then deletes the user's grant and cursor rows. A failed customer delete is logged and removal continues.
+- **Entitlement RevenueCat adapter:** fetch active entitlements, load the project entitlement list, and delete a customer. A missing customer is an empty active list on fetch and success on delete. A **409** with **`retryable`** false on delete is success, because the delete is already queued. **400**, **401**, **403**, and **422** on delete are not retried. A retryable error or a network failure waits and retries up to three times. Wired only while entitlements are on. The API loads the entitlement list before it accepts traffic and does not start if that load fails. It retries a few times; **401** and **403** fail immediately. An empty list is success. The worker does not load the list.
+- **Entitlement repository:** replace paid grants, insert or delete a complimentary grant, and read active tiers from the replica. A webhook delivery stores its event id and advances each user's sync cursor in one transaction. An older event timestamp does not overwrite a newer snapshot.
+- **Entitlement HTTP:** `PUT` and `DELETE /admin/users/{target_user_id}/entitlements/{tier_id}` stay mounted and return **204**. `POST /webhooks/revenuecat` and `GET /users/me/entitlements` mount only when `[entitlement].enabled` is true. A webhook signature failure is **401**. A tier gate allows its route while entitlements are off and returns **403** **Entitlement required** when they are on and the caller has no qualifying tier.
+- **Entitlement domain (scaffold):** package `core_framework/domains/entitlement`, `[postgres_schemas].schema_entitlement` (default `entitlement`), and Alembic tree `alembic/entitlement/` in `ALEMBIC_DOMAINS`. Revision `b7ed2400e94e` creates `paid_grants`, `complimentary_grants`, `sync_cursors`, and `deliveries` (no foreign key to the user schema; `deliveries` has no `user_id`). Optional `[entitlement]` Settings (`enabled` default false). A blank secret key, project id, or webhook signing secret fails load only when enabled. The secret key, project id, and webhook signing secret are stripped; a CR or LF in a non-blank stripped secret or alert address fails load.
+
 ## [4.1.0] - 2026-09-28
 
 ### Breaking
@@ -800,4 +817,6 @@ First **SemVer-stable** release per **`docs/library/package-api.md`**.
 [4.0.0]: https://github.com/NepNepFFXIV/core-framework/compare/v3.3.0...v4.0.0
 [4.0.1]: https://github.com/NepNepFFXIV/core-framework/compare/v4.0.0...v4.0.1
 [4.1.0]: https://github.com/NepNepFFXIV/core-framework/compare/v4.0.1...v4.1.0
-[unreleased]: https://github.com/NepNepFFXIV/core-framework/compare/v4.1.0...HEAD
+[4.2.0]: https://github.com/NepNepFFXIV/core-framework/compare/v4.1.0...v4.2.0
+[4.2.1]: https://github.com/NepNepFFXIV/core-framework/compare/v4.2.0...v4.2.1
+[unreleased]: https://github.com/NepNepFFXIV/core-framework/compare/v4.2.1...HEAD

{core_framework-4.1.0 → core_framework-4.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: core-framework
-Version: 4.1.0
+Version: 4.2.1
 Summary: Core framework package (import as core_framework)
 Project-URL: Homepage, https://github.com/NepNepFFXIV/core-framework
 Project-URL: Repository, https://github.com/NepNepFFXIV/core-framework
@@ -15,7 +15,7 @@ Requires-Dist: asyncpg>=0.31.0
 Requires-Dist: asyncssh>=2.24.0
 Requires-Dist: brotli-asgi>=1.6.0
 Requires-Dist: cashews[redis]>=7.5.0
-Requires-Dist: device-detector>=6.4.0
+Requires-Dist: device-detector<6.5,>=6.4.0
 Requires-Dist: fastapi[standard]>=0.141.1
 Requires-Dist: firebase-admin>=7.5.0
 Requires-Dist: httpx[http2]>=0.28.1
@@ -33,7 +33,7 @@ Requires-Dist: opentelemetry-semantic-conventions<0.66,>=0.65b0
 Requires-Dist: orjson>=3.12.0
 Requires-Dist: pillow-heif>=1.7.0
 Requires-Dist: pillow>=12.3.0
-Requires-Dist: pydantic-ai-slim[openai]<3,>=2.51.0
+Requires-Dist: pydantic-ai-slim[anthropic,openai]<3,>=2.51.0
 Requires-Dist: pyinstrument>=5.1.3
 Requires-Dist: python-ulid>=4.0.1
 Requires-Dist: resend[async]>=2.44.0

core_framework-4.2.1/alembic/entitlement/alembic/env.py

@@ -0,0 +1,77 @@
+import asyncio
+from logging.config import fileConfig
+
+from sqlalchemy import pool, text
+from sqlalchemy.engine import Connection
+from sqlalchemy.ext.asyncio import async_engine_from_config
+
+from alembic import context
+from core_framework.core.settings import load_default_settings
+
+settings = load_default_settings()
+
+# this is the Alembic Config object, which provides
+# access to the values within the .ini file in use.
+config = context.config
+
+# Interpret the config file for Python logging.
+if config.config_file_name is not None:
+    fileConfig(config.config_file_name)
+
+target_metadata = None
+
+config.set_main_option("sqlalchemy.url", settings.write_postgres.alembic_postgres_url)
+
+
+def run_migrations_offline() -> None:
+    """Run migrations in 'offline' mode."""
+    url = config.get_main_option("sqlalchemy.url")
+    context.configure(
+        url=url,
+        target_metadata=target_metadata,
+        literal_binds=True,
+        dialect_opts={"paramstyle": "named"},
+    )
+
+    quoted_schema_name = f'"{settings.postgres_schemas.schema_entitlement.replace('"', '""')}"'
+
+    with context.begin_transaction():
+        context.execute(text(f"set search_path to {quoted_schema_name}"))
+        context.run_migrations()
+
+
+def do_run_migrations(connection: Connection) -> None:
+    quoted_schema_name = f'"{settings.postgres_schemas.schema_entitlement.replace('"', '""')}"'
+
+    connection.execute(text(f"create schema if not exists {quoted_schema_name}"))
+    connection.execute(text(f"set search_path to {quoted_schema_name}"))
+    connection.commit()
+
+    context.configure(connection=connection, target_metadata=target_metadata)
+
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+async def run_async_migrations() -> None:
+    """Run migrations in 'online' mode."""
+    connectable = async_engine_from_config(
+        config.get_section(config.config_ini_section, {}),
+        prefix="sqlalchemy.",
+        poolclass=pool.NullPool,
+    )
+
+    async with connectable.connect() as connection:
+        await connection.run_sync(do_run_migrations)
+
+    await connectable.dispose()
+
+
+def run_migrations_online() -> None:
+    asyncio.run(run_async_migrations())
+
+
+if context.is_offline_mode():
+    run_migrations_offline()
+else:
+    run_migrations_online()

core_framework-4.2.1/alembic/entitlement/alembic/versions/b7ed2400e94e_entitlement_schema.py

@@ -0,0 +1,58 @@
+"""create entitlement schema tables
+
+Revision ID: b7ed2400e94e
+Revises:
+Create Date: 2026-10-01 11:11:00.000000
+
+"""
+
+from collections.abc import Sequence
+
+from alembic import op
+
+revision: str = "b7ed2400e94e"
+down_revision: str | Sequence[str] | None = None
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.execute("""
+        create table paid_grants (
+            user_id varchar(128) not null,
+            tier_id integer not null,
+            expires_at timestamptz not null,
+            synced_at timestamptz not null,
+            primary key (user_id, tier_id),
+            constraint paid_grants_tier_id_positive check (tier_id >= 1)
+        );
+    """)
+
+    op.execute("""
+        create table complimentary_grants (
+            user_id varchar(128) not null,
+            tier_id integer not null,
+            granted_by varchar(128) not null,
+            granted_at timestamptz not null,
+            primary key (user_id, tier_id),
+            constraint complimentary_grants_tier_id_positive check (tier_id >= 1)
+        );
+    """)
+
+    op.execute("""
+        create table sync_cursors (
+            user_id varchar(128) primary key,
+            last_event_timestamp timestamptz not null
+        );
+    """)
+
+    op.execute("""
+        create table deliveries (
+            event_id varchar(255) primary key,
+            applied_at timestamptz not null
+        );
+    """)
+
+
+def downgrade() -> None:
+    raise RuntimeError("downgrade is not supported for this revision")

core_framework-4.2.1/alembic/post/alembic/versions/b3c61daef9b5_post_add_post_bookmarks.py

@@ -0,0 +1,37 @@
+"""add post_bookmarks
+
+Revision ID: b3c61daef9b5
+Revises: 0a89b4c23746
+Create Date: 2026-10-06 05:13:00.000000
+
+"""
+
+from collections.abc import Sequence
+
+from alembic import op
+
+revision: str = "b3c61daef9b5"
+down_revision: str | Sequence[str] | None = "0a89b4c23746"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.execute("""
+        create table post_bookmarks (
+            user_id varchar(128) not null,
+            post_id varchar(26) not null references posts(id) on delete cascade,
+            saved_at timestamptz not null default now(),
+            primary key (user_id, post_id)
+        );
+    """)
+
+    op.execute("""
+        create index if not exists idx_post_bookmarks_user_saved_post
+        on post_bookmarks (user_id, saved_at desc, post_id desc);
+    """)
+
+
+def downgrade() -> None:
+    op.execute("drop index if exists idx_post_bookmarks_user_saved_post;")
+    op.execute("drop table if exists post_bookmarks;")

core_framework-4.2.1/alembic/rating/alembic.ini

@@ -0,0 +1,52 @@
+# A generic, single database configuration.
+
+[alembic]
+# path to migration scripts.
+# this is typically a path given in POSIX (e.g. forward slashes)
+# format, relative to the token %(here)s which refers to the location of this
+# ini file
+script_location = %(here)s/alembic
+
+# sys.path path, will be prepended to sys.path if present.
+prepend_sys_path = .
+
+path_separator = os
+
+sqlalchemy.url = driver://user:pass@localhost/dbname
+
+
+[post_write_hooks]
+
+[loggers]
+keys = root,sqlalchemy,alembic
+
+[handlers]
+keys = console
+
+[formatters]
+keys = generic
+
+[logger_root]
+level = WARNING
+handlers = console
+qualname =
+
+[logger_sqlalchemy]
+level = WARNING
+handlers =
+qualname = sqlalchemy.engine
+
+[logger_alembic]
+level = INFO
+handlers =
+qualname = alembic
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = NOTSET
+formatter = generic
+
+[formatter_generic]
+format = %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %H:%M:%S

core_framework-4.2.1/alembic/user/alembic/README

@@ -0,0 +1 @@
+Generic single-database configuration with an async dbapi.

core_framework-4.2.1/alembic/user/alembic/script.py.mako

@@ -0,0 +1,28 @@
+"""${message}
+
+Revision ID: ${up_revision}
+Revises: ${down_revision | comma,n}
+Create Date: ${create_date}
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+${imports if imports else ""}
+
+# revision identifiers, used by Alembic.
+revision: str = ${repr(up_revision)}
+down_revision: Union[str, Sequence[str], None] = ${repr(down_revision)}
+branch_labels: Union[str, Sequence[str], None] = ${repr(branch_labels)}
+depends_on: Union[str, Sequence[str], None] = ${repr(depends_on)}
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    ${upgrades if upgrades else "pass"}
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    ${downgrades if downgrades else "pass"}

core_framework-4.2.1/alembic/user/alembic/versions/089f4398f943_user_add_preference_switches.py

@@ -0,0 +1,40 @@
+"""add user_preferences inbox type switches
+
+Revision ID: 089f4398f943
+Revises: 24ba262c4ef2
+Create Date: 2026-10-09 15:57:00.000000
+
+"""
+
+from collections.abc import Sequence
+
+from alembic import op
+
+revision: str = "089f4398f943"
+down_revision: str | Sequence[str] | None = "24ba262c4ef2"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.execute("""
+        alter table user_preferences
+            add column comments boolean not null default true,
+            add column replies boolean not null default true,
+            add column mentions boolean not null default true,
+            add column follows boolean not null default true,
+            add column friend_requests boolean not null default true,
+            add column group_invites boolean not null default true;
+    """)
+
+
+def downgrade() -> None:
+    op.execute("""
+        alter table user_preferences
+            drop column if exists comments,
+            drop column if exists replies,
+            drop column if exists mentions,
+            drop column if exists follows,
+            drop column if exists friend_requests,
+            drop column if exists group_invites;
+    """)

{core_framework-4.1.0 → core_framework-4.2.1}/config.toml

@@ -134,6 +134,7 @@ schema_notification = "notification"
 schema_media = "media"
 schema_analytics = "analytics"
 schema_rating = "rating"
+schema_entitlement = "entitlement"
 
 [redis]
 host = "127.0.0.1"
@@ -150,3 +151,16 @@ from_name = ""
 
 [agent]
 enabled = false
+provider = "openai"
+model = ""
+openai_api_key = ""
+openai_base_url = ""
+anthropic_api_key = ""
+timeout_seconds = 300
+
+[entitlement]
+enabled = false
+secret_api_key = ""
+project_id = ""
+webhook_signing_secret = ""
+alert_address = ""

{core_framework-4.1.0 → core_framework-4.2.1}/config.toml.template

@@ -122,6 +122,7 @@ schema_notification = "notification"
 schema_media = "media"
 schema_analytics = "analytics"
 schema_rating = "rating"
+schema_entitlement = "entitlement"
 
 [redis]
 host = "$REDIS_HOST"
@@ -138,7 +139,16 @@ from_name = "$EMAIL_FROM_NAME"
 
 [agent]
 enabled = $AGENT_ENABLED
+provider = "$AGENT_PROVIDER"
 model = "$AGENT_MODEL"
 openai_api_key = "$AGENT_OPENAI_API_KEY"
 openai_base_url = "$AGENT_OPENAI_BASE_URL"
+anthropic_api_key = "$AGENT_ANTHROPIC_API_KEY"
 timeout_seconds = $AGENT_TIMEOUT_SECONDS
+
+[entitlement]
+enabled = $ENTITLEMENT_ENABLED
+secret_api_key = "$ENTITLEMENT_SECRET_API_KEY"
+project_id = "$ENTITLEMENT_PROJECT_ID"
+webhook_signing_secret = "$ENTITLEMENT_WEBHOOK_SIGNING_SECRET"
+alert_address = "$ENTITLEMENT_ALERT_ADDRESS"

core_framework-4.2.1/core_framework/api/admin/entitlements/router.py

@@ -0,0 +1,41 @@
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Path, status
+
+from core_framework.api.dependencies import RequiredUserID, check_admin_role
+from core_framework.api.users.shared.schemas import validate_user_id
+from core_framework.application.entitlement.grant_service import grant_complimentary_tier, remove_complimentary_tier
+
+router = APIRouter(
+    prefix="/users",
+    tags=["entitlements - admin"],
+    dependencies=[Depends(check_admin_role)],
+)
+
+
+@router.put("/{target_user_id}/entitlements/{tier_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def put_complimentary_entitlement(
+    actor_id: RequiredUserID,
+    target_user_id: str,
+    tier_id: Annotated[int, Path(ge=1)],
+) -> None:
+    validated_target_user_id = validate_user_id(user_id=target_user_id)
+    await grant_complimentary_tier(
+        actor_id=actor_id,
+        target_user_id=validated_target_user_id,
+        tier_id=tier_id,
+    )
+
+
+@router.delete("/{target_user_id}/entitlements/{tier_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_complimentary_entitlement(
+    actor_id: RequiredUserID,
+    target_user_id: str,
+    tier_id: Annotated[int, Path(ge=1)],
+) -> None:
+    validated_target_user_id = validate_user_id(user_id=target_user_id)
+    await remove_complimentary_tier(
+        actor_id=actor_id,
+        target_user_id=validated_target_user_id,
+        tier_id=tier_id,
+    )

{core_framework-4.1.0 → core_framework-4.2.1}/core_framework/api/admin/router.py

@@ -4,6 +4,7 @@ from core_framework.api.admin.agent.router import router as agent_router
 from core_framework.api.admin.analytics.router import router as analytics_router
 from core_framework.api.admin.cache.router import router as cache_router
 from core_framework.api.admin.comments.router import router as comments_router
+from core_framework.api.admin.entitlements.router import router as entitlements_router
 from core_framework.api.admin.moderation.router import router as moderation_router
 from core_framework.api.admin.outbox.router import router as outbox_router
 from core_framework.api.admin.posts.router import router as posts_router
@@ -21,6 +22,7 @@ router.include_router(cache_router)
 router.include_router(analytics_router)
 router.include_router(outbox_router)
 router.include_router(users_router)
+router.include_router(entitlements_router)
 router.include_router(moderation_router)
 router.include_router(posts_router)
 router.include_router(comments_router)

core_framework-4.2.1/core_framework/api/entitlements/dependencies.py

@@ -0,0 +1,23 @@
+from typing import Annotated
+
+from fastapi import Depends
+
+from core_framework.api.dependencies import RequiredUserID, check_caller_identity
+from core_framework.application.entitlement.grant_service import require_caller_tier
+from core_framework.application.entitlement.registry import note_tier_gate
+
+
+def require_tier(tier_id: int):
+    """Route dependency for one tier id. Allows the route while entitlements are off."""
+    if tier_id < 1:
+        raise ValueError("tier_id must be at least 1")
+    note_tier_gate(tier_id)
+
+    async def gate(
+        user_id: RequiredUserID,
+        _: Annotated[None, Depends(check_caller_identity)],
+    ) -> None:
+        del _
+        await require_caller_tier(user_id=user_id, tier_id=tier_id)
+
+    return gate

core_framework-4.2.1/core_framework/api/entitlements/router.py

@@ -0,0 +1,33 @@
+from typing import Any
+
+from fastapi import APIRouter, Depends, Request
+
+from core_framework.api.dependencies import RequiredUserID, check_caller_identity
+from core_framework.api.entitlements.schemas import EntitlementItemResponse, EntitlementsResponse
+from core_framework.application.entitlement.grant_service import list_caller_entitlements
+from core_framework.application.entitlement.webhook_service import handle_revenuecat_webhook
+
+webhook_router = APIRouter(tags=["entitlements"])
+me_router = APIRouter(prefix="/users", tags=["entitlements"])
+
+
+@webhook_router.post("/webhooks/revenuecat")
+async def post_revenuecat_webhook(request: Request) -> None:
+    raw_body = await request.body()
+    header = request.headers.get("x-revenuecat-webhook-signature")
+    await handle_revenuecat_webhook(body=raw_body, signature_header=header)
+
+
+@me_router.get(
+    "/me/entitlements",
+    response_model=EntitlementsResponse,
+    dependencies=[Depends(check_caller_identity)],
+)
+async def get_my_entitlements(user_id: RequiredUserID) -> Any:
+    items = await list_caller_entitlements(user_id=user_id)
+    return EntitlementsResponse(
+        items=[
+            EntitlementItemResponse(tier_id=item.tier_id, identifier=item.identifier, expires_at=item.expires_at)
+            for item in items
+        ]
+    )

core_framework-4.2.1/core_framework/api/entitlements/schemas.py

@@ -0,0 +1,13 @@
+from datetime import datetime
+
+from pydantic import BaseModel, Field
+
+
+class EntitlementItemResponse(BaseModel):
+    tier_id: int = Field(ge=1)
+    identifier: str = Field(min_length=1)
+    expires_at: datetime | None
+
+
+class EntitlementsResponse(BaseModel):
+    items: list[EntitlementItemResponse]

{core_framework-4.1.0 → core_framework-4.2.1}/core_framework/api/posts/authenticated/router.py

@@ -5,6 +5,7 @@ from ulid import ULID
 
 from core_framework.api.attachments.schemas import attachment_asset_id_strings
 from core_framework.api.dependencies import RequiredUserID, check_caller_identity
+from core_framework.api.entitlements.dependencies import require_tier
 from core_framework.api.idempotency.dependencies import optional_idempotency_key
 from core_framework.api.posts.authenticated.mappers import post_update_from_request
 from core_framework.api.posts.authenticated.schemas import (
@@ -19,7 +20,9 @@ from core_framework.application.posts.authenticated_service import (
     create_post,
     edit_post,
     like_post,
+    remove_post_bookmark,
     remove_post_report,
+    save_post_bookmark,
     tombstone_post_for_author,
     unlike_post,
 )
@@ -86,6 +89,26 @@ async def delete_post_like(post_id: ULID, user_id: RequiredUserID, background_ta
         background_tasks.add_task(mark_post_stats_dirty, post_id=post_id_str)
 
 
+@router.put(
+    "/{post_id}/bookmark",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(require_tier(1))],
+)
+@RateLimitKey.POST_BOOKMARK()
+async def put_post_bookmark(post_id: ULID, user_id: RequiredUserID) -> None:
+    await save_post_bookmark(user_id=user_id, post_id=str(post_id))
+
+
+@router.delete(
+    "/{post_id}/bookmark",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(require_tier(1))],
+)
+@RateLimitKey.POST_BOOKMARK()
+async def delete_post_bookmark(post_id: ULID, user_id: RequiredUserID) -> None:
+    await remove_post_bookmark(user_id=user_id, post_id=str(post_id))
+
+
 @router.post("/{post_id}/report", status_code=status.HTTP_204_NO_CONTENT)
 @RateLimitKey.POST_REPORT()
 async def post_post_report(

{core_framework-4.1.0 → core_framework-4.2.1}/core_framework/api/posts/authenticated/schemas.py

@@ -1,3 +1,4 @@
+from datetime import datetime
 from typing import Annotated
 
 from pydantic import BaseModel, Field, field_validator
@@ -25,6 +26,11 @@ class CreatedPostResponse(BaseModel):
     id: ULID
 
 
+class BookmarkItemResponse(BaseModel):
+    post_id: ULID
+    saved_at: datetime
+
+
 class CreatePostRequest(BaseModel):
     content: PostContent
     visibility: PostVisibility = PostVisibility.PUBLIC

{core_framework-4.1.0 → core_framework-4.2.1}/core_framework/api/posts/public/schemas.py

@@ -19,6 +19,7 @@ class PostStatsResponse(BaseModel):
 class PostViewerContext(BaseModel):
     is_liked: bool
     is_reported: bool
+    is_bookmarked: bool
 
 
 class AuthorContext(BaseModel):