forexsmartbot 3.2.4__tar.gz → 3.3.0__tar.gz

{forexsmartbot-3.2.4 → forexsmartbot-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forexsmartbot
-Version: 3.2.4
+Version: 3.3.0
 Summary: Professional forex trading bot with advanced risk management and strategy plugins
 Author-email: VoxHash <contact@voxhash.dev>
 License: MIT

{forexsmartbot-3.2.4 → forexsmartbot-3.3.0}/forexsmartbot/__init__.py

@@ -1 +1,2 @@
 # ForexSmartBot Package
+__version__ = "3.3.0"

{forexsmartbot-3.2.4 → forexsmartbot-3.3.0}/forexsmartbot/cloud/__init__.py

@@ -1,5 +1,5 @@
 """
-Cloud Integration Module for ForexSmartBot v3.3.0
+Cloud Integration Module for ForexSmartBot
 Provides cloud sync, remote monitoring, and API access.
 """
 
@@ -7,8 +7,11 @@ from .cloud_sync import CloudSyncManager
 from .remote_monitor import RemoteMonitorServer
 from .api_server import APIServer, WebSocketServer
 from .mobile_api import MobileAppAPI, PushNotificationService
+from .companion_api import CompanionAPI, WebhookNotifier
 from .security import SecurityManager, RateLimiter
 from .api_client import APIClient, WebSocketClient
+from .error_handler import CloudErrorHandler, CloudHealthMonitor, retry_call
+from .auth_utils import generate_api_token, package_version
 
 __all__ = [
     'CloudSyncManager',
@@ -17,8 +20,15 @@ __all__ = [
     'WebSocketServer',
     'MobileAppAPI',
     'PushNotificationService',
+    'CompanionAPI',
+    'WebhookNotifier',
     'SecurityManager',
     'RateLimiter',
     'APIClient',
     'WebSocketClient',
+    'CloudErrorHandler',
+    'CloudHealthMonitor',
+    'retry_call',
+    'generate_api_token',
+    'package_version',
 ]

forexsmartbot-3.3.0/forexsmartbot/cloud/api_client.py

@@ -0,0 +1,231 @@
+"""
+Python SDK for ForexSmartBot API
+Provides easy-to-use client for REST API and WebSocket API.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from typing import Dict, List, Optional
+
+import requests
+import websockets
+from dotenv import load_dotenv
+
+from .auth_utils import resolve_api_key
+from .error_handler import retry_call
+
+load_dotenv(override=False)
+
+
+class APIClient:
+    """Python client for ForexSmartBot REST API."""
+
+    def __init__(
+        self,
+        api_key: Optional[str] = None,
+        base_url: Optional[str] = None,
+        *,
+        max_retries: int = 3,
+        timeout: float = 10.0,
+    ):
+        """
+        Initialize API client.
+
+        Args:
+            api_key: API key for authentication (defaults to API_KEY env var)
+            base_url: Base URL of the API server (defaults to API_BASE_URL env var or http://localhost:5000)
+            max_retries: Transient failure retries
+            timeout: Request timeout seconds
+        """
+        self.api_key = resolve_api_key(api_key, env_names=("API_KEY",))
+        default_base = os.getenv("API_BASE_URL", "http://localhost:5000")
+        self.base_url = (base_url or default_base).rstrip("/")
+        self.max_retries = max_retries
+        self.timeout = timeout
+        self.session = requests.Session()
+        self.session.headers.update({"Content-Type": "application/json"})
+        if self.api_key:
+            self.session.headers["Authorization"] = f"Bearer {self.api_key}"
+            self.session.headers["X-API-Key"] = self.api_key
+
+    def _request(self, method: str, path: str, **kwargs) -> requests.Response:
+        url = f"{self.base_url}{path}"
+        kwargs.setdefault("timeout", self.timeout)
+
+        def _do() -> requests.Response:
+            response = self.session.request(method, url, **kwargs)
+            if response.status_code >= 500:
+                response.raise_for_status()
+            response.raise_for_status()
+            return response
+
+        return retry_call(_do, max_retries=self.max_retries, base_delay=1.0)
+
+    def health(self) -> Dict:
+        """Call public health endpoint."""
+        for path in ("/healthz", "/api/v1/health"):
+            try:
+                response = self.session.get(
+                    f"{self.base_url}{path}", timeout=min(5.0, self.timeout)
+                )
+                if response.status_code == 200:
+                    return response.json()
+            except Exception:
+                continue
+        raise requests.exceptions.ConnectionError(
+            f"Health endpoint unreachable at {self.base_url}"
+        )
+
+    def get_balance(self) -> float:
+        """Get account balance."""
+        response = self._request("GET", "/api/v1/account/balance")
+        return response.json()["balance"]
+
+    def get_positions(self) -> List[Dict]:
+        """Get open positions."""
+        response = self._request("GET", "/api/v1/account/positions")
+        return response.json()["positions"]
+
+    def get_trades(self) -> List[Dict]:
+        """Get trade history."""
+        response = self._request("GET", "/api/v1/trades")
+        return response.json()["trades"]
+
+    def create_order(
+        self,
+        symbol: str,
+        side: int,
+        quantity: float,
+        stop_loss: Optional[float] = None,
+        take_profit: Optional[float] = None,
+    ) -> Dict:
+        """
+        Create a new order.
+
+        Args:
+            symbol: Trading symbol
+            side: 1 for buy, -1 for sell
+            quantity: Order quantity
+            stop_loss: Stop loss price (optional)
+            take_profit: Take profit price (optional)
+
+        Returns:
+            Order response dictionary
+        """
+        payload = {"symbol": symbol, "side": side, "quantity": quantity}
+        if stop_loss:
+            payload["stop_loss"] = stop_loss
+        if take_profit:
+            payload["take_profit"] = take_profit
+
+        response = self._request("POST", "/api/v1/orders", json=payload)
+        return response.json()
+
+    def close_positions(self, symbol: str) -> Dict:
+        """
+        Close all positions for a symbol.
+
+        Args:
+            symbol: Trading symbol
+
+        Returns:
+            Response dictionary
+        """
+        response = self._request("DELETE", f"/api/v1/orders/{symbol}")
+        return response.json()
+
+    def get_price(self, symbol: str) -> float:
+        """
+        Get current price for a symbol.
+
+        Args:
+            symbol: Trading symbol
+
+        Returns:
+            Current price
+        """
+        response = self._request("GET", f"/api/v1/market/price/{symbol}")
+        return response.json()["price"]
+
+
+class WebSocketClient:
+    """Python client for ForexSmartBot WebSocket API."""
+
+    def __init__(self, url: Optional[str] = None, api_key: Optional[str] = None):
+        """
+        Initialize WebSocket client.
+
+        Args:
+            url: WebSocket server URL (defaults to WS_URL env var or ws://localhost:8765)
+            api_key: API key for authentication (defaults to API_KEY env var)
+        """
+        default_url = os.getenv("WS_URL", "ws://localhost:8765")
+        self.url = url or default_url
+        self.api_key = resolve_api_key(api_key, env_names=("API_KEY", "WS_API_KEY"))
+        self.websocket = None
+
+    async def connect(self):
+        """Connect to WebSocket server and authenticate when a key is set."""
+        self.websocket = await websockets.connect(self.url)
+        if self.api_key:
+            await self.websocket.send(
+                json.dumps({"command": "auth", "token": self.api_key})
+            )
+            raw = await self.websocket.recv()
+            data = json.loads(raw)
+            if not data.get("ok"):
+                await self.disconnect()
+                raise PermissionError("WebSocket authentication failed")
+
+    async def disconnect(self):
+        """Disconnect from WebSocket server."""
+        if self.websocket:
+            await self.websocket.close()
+            self.websocket = None
+
+    async def subscribe(self, symbol: str):
+        """Subscribe to price updates for a symbol."""
+        if not self.websocket:
+            await self.connect()
+
+        message = {"command": "subscribe", "symbol": symbol}
+        await self.websocket.send(json.dumps(message))
+
+    async def get_balance(self) -> float:
+        """Get balance via WebSocket."""
+        if not self.websocket:
+            await self.connect()
+
+        message = {"command": "get_balance"}
+        await self.websocket.send(json.dumps(message))
+
+        response = await self.websocket.recv()
+        data = json.loads(response)
+        return data.get("value", 0.0)
+
+    async def get_positions(self) -> List[Dict]:
+        """Get positions via WebSocket."""
+        if not self.websocket:
+            await self.connect()
+
+        message = {"command": "get_positions"}
+        await self.websocket.send(json.dumps(message))
+
+        response = await self.websocket.recv()
+        data = json.loads(response)
+        return data.get("data", [])
+
+    async def listen(self, callback):
+        """Listen for real-time updates."""
+        if not self.websocket:
+            await self.connect()
+
+        while True:
+            try:
+                message = await self.websocket.recv()
+                data = json.loads(message)
+                callback(data)
+            except websockets.exceptions.ConnectionClosed:
+                break

{forexsmartbot-3.2.4 → forexsmartbot-3.3.0}/forexsmartbot/cloud/api_server.py

@@ -1,5 +1,5 @@
 """
-API Server for ForexSmartBot v3.3.0
+API Server for ForexSmartBot
 Provides REST API and WebSocket API for external integrations.
 """
 
@@ -13,16 +13,26 @@ from flask import Flask, jsonify, request
 from flask_cors import CORS
 from flask_limiter import Limiter
 from flask_limiter.util import get_remote_address
-import jwt
 from functools import wraps
 from threading import Thread
 import websockets
 from websockets.server import serve
 from dotenv import load_dotenv
 
+from .auth_utils import (
+    constant_time_equals,
+    extract_bearer_or_api_key,
+    is_insecure_secret,
+    package_version,
+    resolve_api_key,
+    validate_server_credentials,
+)
+
 # Ensure .env is loaded
 load_dotenv(override=False)
 
+logger = logging.getLogger(__name__)
+
 
 class APIServer:
     """REST API server for external integrations."""
@@ -40,8 +50,8 @@ class APIServer:
         """
         self.host = host or os.getenv('API_HOST', '127.0.0.1')
         self.port = port or int(os.getenv('API_PORT', '5000'))
-        self.api_key = api_key or os.getenv('API_KEY', '')
-        self.secret_key = secret_key or os.getenv('API_SECRET_KEY', 'default-secret-key-change-in-production')
+        self.api_key = resolve_api_key(api_key, env_names=('API_KEY',))
+        self.secret_key = secret_key or os.getenv('API_SECRET_KEY', '')
         
         self.app = Flask(__name__)
         CORS(self.app)
@@ -60,16 +70,28 @@ class APIServer:
         self.setup_routes()
         self.server_thread = None
         self.running = False
+        self.started_at: Optional[datetime] = None
         
     def setup_routes(self):
         """Setup API routes."""
-        
+
+        @self.app.route('/healthz', methods=['GET'])
         @self.app.route('/api/v1/health', methods=['GET'])
         def health():
-            """Health check endpoint."""
+            """Health check endpoint (public)."""
+            broker_ok = False
+            if self.broker is not None:
+                try:
+                    broker_ok = bool(self.broker.is_connected()) if hasattr(self.broker, 'is_connected') else True
+                except Exception:
+                    broker_ok = False
             return jsonify({
-                'status': 'healthy',
-                'version': '3.3.0',
+                'status': 'healthy' if self.running else 'starting',
+                'service': 'api_server',
+                'version': package_version(),
+                'auth_configured': not is_insecure_secret(self.api_key),
+                'broker_connected': broker_ok,
+                'started_at': self.started_at.isoformat() if self.started_at else None,
                 'timestamp': datetime.now().isoformat()
             })
             
@@ -193,20 +215,19 @@ class APIServer:
                 return jsonify({'error': str(e)}), 500
                 
     def require_auth(self, f):
-        """Decorator for API authentication."""
+        """Decorator for API authentication (Bearer or X-API-Key, constant-time)."""
         @wraps(f)
         def decorated_function(*args, **kwargs):
-            if not self.api_key:
+            if is_insecure_secret(self.api_key):
                 return jsonify({'error': 'API key not configured'}), 500
-                
-            auth_header = request.headers.get('Authorization', '')
-            if not auth_header.startswith('Bearer '):
-                return jsonify({'error': 'Missing or invalid authorization header'}), 401
-                
-            token = auth_header[7:]
-            if token != self.api_key:
+
+            token = extract_bearer_or_api_key(
+                request.headers.get('Authorization', ''),
+                request.headers.get('X-API-Key', ''),
+            )
+            if not constant_time_equals(token, self.api_key):
                 return jsonify({'error': 'Invalid API key'}), 401
-                
+
             return f(*args, **kwargs)
         return decorated_function
         
@@ -226,10 +247,19 @@ class APIServer:
         """Start the API server."""
         if self.running:
             return
-            
+
+        validate_server_credentials(
+            self.api_key,
+            host=self.host,
+            secret_key=self.secret_key or None,
+            service_name='APIServer',
+        )
+
         self.running = True
+        self.started_at = datetime.now()
         self.server_thread = Thread(target=self._run_server, daemon=True)
         self.server_thread.start()
+        logger.info("API server started on http://%s:%s", self.host, self.port)
         print(f"API server started on http://{self.host}:{self.port}")
         
     def stop(self):
@@ -257,36 +287,54 @@ class WebSocketServer:
         """
         self.host = host or os.getenv('WS_HOST', '127.0.0.1')
         self.port = port or int(os.getenv('WS_PORT', '8765'))
-        self.api_key = api_key or os.getenv('API_KEY', '')
+        self.api_key = resolve_api_key(api_key, env_names=('API_KEY', 'WS_API_KEY'))
         self.clients = set()
+        self.authenticated_clients = set()
         self.running = False
         self.broker = None
         
     async def register_client(self, websocket, path):
-        """Register a new WebSocket client."""
-        # Simple authentication check
-        if self.api_key:
-            # In production, implement proper authentication
-            pass
-            
+        """Register a new WebSocket client (must auth when API key configured)."""
         self.clients.add(websocket)
         print(f"WebSocket client connected: {websocket.remote_address}")
         
         try:
             async for message in websocket:
-                # Handle incoming messages
                 await self.handle_message(websocket, message)
         except websockets.exceptions.ConnectionClosed:
             pass
         finally:
-            self.clients.remove(websocket)
+            self.clients.discard(websocket)
+            self.authenticated_clients.discard(websocket)
             print(f"WebSocket client disconnected: {websocket.remote_address}")
+
+    def _ws_authorized(self, websocket) -> bool:
+        if is_insecure_secret(self.api_key):
+            return True
+        return websocket in self.authenticated_clients
             
     async def handle_message(self, websocket, message):
         """Handle incoming WebSocket message."""
         try:
             data = json.loads(message)
             command = data.get('command')
+
+            if command == 'auth':
+                token = data.get('token') or data.get('api_key') or ''
+                if constant_time_equals(token, self.api_key):
+                    self.authenticated_clients.add(websocket)
+                    await websocket.send(json.dumps({'type': 'auth', 'ok': True}))
+                else:
+                    self.authenticated_clients.discard(websocket)
+                    await websocket.send(json.dumps({'type': 'auth', 'ok': False}))
+                return
+
+            if not self._ws_authorized(websocket):
+                await websocket.send(json.dumps({
+                    'type': 'error',
+                    'message': 'Unauthorized — send {"command":"auth","token":"..."} first'
+                }))
+                return
             
             if command == 'subscribe':
                 symbol = data.get('symbol')

forexsmartbot-3.3.0/forexsmartbot/cloud/auth_utils.py

@@ -0,0 +1,151 @@
+"""
+Shared authentication helpers for remote monitoring and cloud APIs.
+"""
+
+from __future__ import annotations
+
+import hmac
+import logging
+import os
+import secrets
+from typing import Optional, Tuple
+
+logger = logging.getLogger(__name__)
+
+# Weak / placeholder secrets that must never be used in production.
+_INSECURE_SECRETS = frozenset(
+    {
+        "",
+        "default-secret-key-change-in-production",
+        "changeme",
+        "secret",
+        "password",
+        "api_key",
+        "test",
+    }
+)
+
+
+def package_version() -> str:
+    """Return installed package version, falling back to local __version__."""
+    try:
+        from importlib.metadata import version
+
+        return version("forexsmartbot")
+    except Exception:
+        try:
+            from forexsmartbot import __version__
+
+            return __version__
+        except Exception:
+            return "0.0.0"
+
+
+def is_insecure_secret(value: Optional[str]) -> bool:
+    """True if the value is empty or a known placeholder secret."""
+    if value is None:
+        return True
+    normalized = value.strip().lower()
+    return normalized in _INSECURE_SECRETS or len(value.strip()) < 16
+
+
+def allow_insecure_mode() -> bool:
+    """Explicit opt-in for local/dev use without a strong API key."""
+    return os.getenv("FSB_ALLOW_INSECURE_MONITOR", "").strip().lower() in {
+        "1",
+        "true",
+        "yes",
+        "on",
+    }
+
+
+def extract_bearer_or_api_key(
+    authorization_header: str = "",
+    api_key_header: str = "",
+) -> Optional[str]:
+    """
+    Extract a token from Authorization: Bearer <token> or X-API-Key.
+
+    Returns None when neither header provides a token.
+    """
+    auth = (authorization_header or "").strip()
+    if auth.lower().startswith("bearer "):
+        token = auth[7:].strip()
+        if token:
+            return token
+    key = (api_key_header or "").strip()
+    return key or None
+
+
+def constant_time_equals(provided: Optional[str], expected: Optional[str]) -> bool:
+    """Constant-time string compare; False if either side is missing."""
+    if provided is None or expected is None:
+        return False
+    try:
+        return hmac.compare_digest(provided.encode("utf-8"), expected.encode("utf-8"))
+    except Exception:
+        return False
+
+
+def generate_api_token(nbytes: int = 32) -> str:
+    """Generate a cryptographically strong URL-safe API token."""
+    return secrets.token_urlsafe(nbytes)
+
+
+def resolve_api_key(
+    explicit: Optional[str] = None,
+    env_names: Tuple[str, ...] = ("API_KEY", "CLOUD_API_KEY"),
+) -> str:
+    """Resolve API key from constructor arg or environment (first non-empty)."""
+    if explicit is not None and explicit.strip():
+        return explicit.strip()
+    for name in env_names:
+        value = os.getenv(name, "")
+        if value and value.strip():
+            return value.strip()
+    return ""
+
+
+def validate_server_credentials(
+    api_key: str,
+    *,
+    host: str = "127.0.0.1",
+    secret_key: Optional[str] = None,
+    service_name: str = "service",
+) -> None:
+    """
+    Enforce safe defaults before binding a network service.
+
+    Raises ValueError when credentials are too weak for the bind address
+    unless FSB_ALLOW_INSECURE_MONITOR is set.
+    """
+    loopback = host in {"127.0.0.1", "localhost", "::1"}
+    insecure_key = is_insecure_secret(api_key)
+    insecure_secret = secret_key is not None and is_insecure_secret(secret_key)
+
+    if not insecure_key and not insecure_secret:
+        return
+
+    if allow_insecure_mode():
+        logger.warning(
+            "%s starting with insecure credentials (FSB_ALLOW_INSECURE_MONITOR=1)",
+            service_name,
+        )
+        return
+
+    if not loopback:
+        raise ValueError(
+            f"{service_name}: strong API_KEY required when binding to {host}. "
+            "Set API_KEY (min 16 chars) or FSB_ALLOW_INSECURE_MONITOR=1 for local testing only."
+        )
+
+    if insecure_key:
+        logger.warning(
+            "%s has no strong API key; localhost-only. Set API_KEY for authenticated access.",
+            service_name,
+        )
+    if insecure_secret:
+        logger.warning(
+            "%s using weak API_SECRET_KEY; set a strong secret for JWT signing.",
+            service_name,
+        )