marketmyna 0.2.0__py3-none-any.whl

marketmyna/api/middlewares/auth.py

@@ -0,0 +1,116 @@
+"""Single-user build: there is no login. Every request runs as the one
+local owner, an admin account made on first use (accounts.ensure_local_owner),
+so the per-user data scoping underneath works unchanged. Run it only where
+you alone can reach it (localhost, a VPN, or behind your own proxy auth).
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import threading
+
+import anyio
+from fastapi import APIRouter, Request
+from starlette.types import ASGIApp, Receive, Scope, Send
+
+from marketmyna.core import tenant
+
+logger = logging.getLogger(__name__)
+
+OPEN_PATHS = ("/health", "/api/health", "/api/auth/")
+
+
+def accounts_config():
+    """The app Config the owner lookup uses. Tests patch this."""
+    from marketmyna.api.deps import get_config_dep
+
+    return get_config_dep()
+
+
+def accounts_db(config):
+    from marketmyna.storage import DatabaseManager, get_db_url
+
+    return DatabaseManager.instance(get_db_url(config=config))
+
+
+_owner_ids: dict[str, int] = {}
+_owner_lock = threading.Lock()
+
+
+def local_owner_id(config) -> int:
+    """Id of the local owner account, made on first use (cached per database)."""
+    from marketmyna.storage import get_db_url
+
+    url = get_db_url(config=config)
+    with _owner_lock:
+        if url not in _owner_ids:
+            from marketmyna.services.accounts import ensure_local_owner
+
+            with accounts_db(config).get_session() as session, tenant.system_scope():
+                _owner_ids[url] = ensure_local_owner(session).id
+        return _owner_ids[url]
+
+
+def _session_user(config, raw: str | None):
+    """(user_id, role): always the local owner."""
+    return local_owner_id(config), "admin"
+
+
+def current_user_from_request(request: Request, session):
+    """The local owner's UserRecord (in the caller's DB session)."""
+    from marketmyna.storage import UserRecord
+
+    return session.get(UserRecord, local_owner_id(accounts_config()))
+
+
+def api_docs_enabled() -> bool:
+    """/docs, /redoc and /openapi.json exist only with API_DOCS=1."""
+    return os.environ.get("API_DOCS", "").strip() == "1"
+
+
+def check_auth_config() -> None:
+    """Turns per-user scoping on (every request runs as the local owner)."""
+    from marketmyna.api.deps import get_config_dep
+
+    get_config_dep().accounts_enabled = True
+
+
+def is_authenticated(scope: Scope) -> bool:
+    """Always true: the request runs as the local owner."""
+    state = scope.setdefault("state", {})
+    state["user_id"], state["user_role"] = _session_user(accounts_config(), None)
+    return True
+
+
+def require_admin(request: Request) -> None:
+    """Dependency kept on admin routes (AI configuration, integrations). The
+    local owner is the admin, so it always passes."""
+
+
+class AuthMiddleware:
+    """Puts every request in the owner's data scope. Pure ASGI (not
+    BaseHTTPMiddleware) so SSE streams pass through untouched."""
+
+    def __init__(self, app: ASGIApp) -> None:
+        self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] not in ("http", "websocket") or scope.get("path", "").startswith(OPEN_PATHS):
+            await self.app(scope, receive, send)
+            return
+        # The owner lookup hits the database on first use: keep it off the event loop.
+        await anyio.to_thread.run_sync(is_authenticated, scope)
+        token = tenant.set_scope(scope["state"]["user_id"])
+        try:
+            await self.app(scope, receive, send)
+        finally:
+            tenant.reset_scope(token)
+
+
+router = APIRouter()
+
+
+@router.get("/status")
+def auth_status(request: Request) -> dict:
+    return {"authenticated": is_authenticated(request.scope)}

marketmyna/api/middlewares/csrf.py

@@ -0,0 +1,66 @@
+"""Refuse cross-site writes to the API (CSRF defence in depth).
+
+The session is an HttpOnly cookie (marketmyna/api/middlewares/auth.py) with
+SameSite=Lax, which already stops other sites' forms and fetches from
+sending it on POST. This adds a second, header-based check so a cookie
+policy change, an old browser or a sibling subdomain can't be used to make
+a signed-in user's browser change their account, alerts or keys.
+
+For POST / PUT / PATCH / DELETE under /api/:
+- Sec-Fetch-Site (sent by every current browser) must be "same-origin" or
+  "none"; anything else needs an Origin on the allowed list.
+- Without Sec-Fetch-Site, an Origin header, if present, must match the
+  request's own host or the allowed list.
+- No browser headers at all (server-to-server, tests, curl) passes: that
+  caller has no victim's cookie to ride on.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+from urllib.parse import urlsplit
+
+from starlette.types import ASGIApp, Receive, Scope, Send
+
+logger = logging.getLogger(__name__)
+
+UNSAFE_METHODS = {"POST", "PUT", "PATCH", "DELETE"}
+SKIP_PREFIXES: tuple[str, ...] = ()
+
+
+class CSRFMiddleware:
+    def __init__(self, app: ASGIApp, allowed_origins: list[str] | None = None) -> None:
+        self.app = app
+        self.allowed = {o.rstrip("/").lower() for o in (allowed_origins or [])}
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] == "http" and not self._allowed(scope):
+            logger.warning("CSRF: refused %s %s", scope.get("method"), scope.get("path"))
+            body = json.dumps({"detail": "Cross-site request refused"}).encode()
+            await send({"type": "http.response.start", "status": 403,
+                        "headers": [(b"content-type", b"application/json"),
+                                    (b"content-length", str(len(body)).encode())]})
+            await send({"type": "http.response.body", "body": body})
+            return
+        await self.app(scope, receive, send)
+
+    def _allowed(self, scope: Scope) -> bool:
+        path = scope.get("path", "")
+        if scope.get("method") not in UNSAFE_METHODS or not path.startswith("/api/"):
+            return True
+        if path.startswith(SKIP_PREFIXES):
+            return True
+        headers = {k.decode("latin-1").lower(): v.decode("latin-1") for k, v in scope.get("headers", [])}
+        origin = (headers.get("origin") or "").rstrip("/").lower()
+        fetch_site = (headers.get("sec-fetch-site") or "").lower()
+        if fetch_site:
+            return fetch_site in ("same-origin", "none") or (origin != "" and origin in self.allowed)
+        if not origin or origin == "null":
+            # Some privacy setups send "Origin: null"; without Sec-Fetch-Site
+            # there's nothing better to go on, and SameSite=Lax still applies.
+            return True
+        if origin in self.allowed:
+            return True
+        host = (headers.get("x-forwarded-host") or headers.get("host") or "").split(",")[0].strip().lower()
+        return urlsplit(origin).netloc == host

marketmyna/api/middlewares/error_handler.py

@@ -0,0 +1,38 @@
+"""Uniform error envelope for the API: {"error", "message", "detail"}."""
+
+from __future__ import annotations
+
+import logging
+
+from fastapi import FastAPI, HTTPException, Request
+from fastapi.exceptions import RequestValidationError
+from fastapi.responses import JSONResponse
+
+logger = logging.getLogger(__name__)
+
+
+def add_error_handlers(app: FastAPI) -> None:
+    @app.exception_handler(HTTPException)
+    async def http_exception_handler(request: Request, exc: HTTPException) -> JSONResponse:
+        return JSONResponse(
+            status_code=exc.status_code,
+            content={"error": "http_error", "message": str(exc.detail), "detail": None},
+        )
+
+    @app.exception_handler(RequestValidationError)
+    async def validation_exception_handler(
+        request: Request, exc: RequestValidationError
+    ) -> JSONResponse:
+        return JSONResponse(
+            status_code=422,
+            content={"error": "validation_error", "message": "Invalid request", "detail": exc.errors()},
+        )
+
+    @app.exception_handler(Exception)
+    async def unhandled_exception_handler(request: Request, exc: Exception) -> JSONResponse:
+        logger.exception("Unhandled error on %s %s", request.method, request.url.path)
+        detail = str(exc) if logger.isEnabledFor(logging.DEBUG) else None
+        return JSONResponse(
+            status_code=500,
+            content={"error": "internal_error", "message": "Internal server error", "detail": detail},
+        )

marketmyna/api/middlewares/slashes.py

@@ -0,0 +1,27 @@
+"""Treat /api/v1/foo/ the same as /api/v1/foo instead of redirecting.
+
+FastAPI's default answer to a trailing-slash mismatch is a 307 to an
+absolute URL built from the Host header and scheme it sees, which behind a
+proxy can be the internal address. Stripping the slash before routing
+avoids the redirect (and its extra round trip) entirely.
+"""
+
+from __future__ import annotations
+
+from starlette.types import ASGIApp, Receive, Scope, Send
+
+
+class StripTrailingSlashMiddleware:
+    def __init__(self, app: ASGIApp) -> None:
+        self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] in ("http", "websocket"):
+            path = scope.get("path", "")
+            if len(path) > 1 and path.endswith("/"):
+                scope = dict(scope)
+                scope["path"] = path.rstrip("/") or "/"
+                raw = scope.get("raw_path")
+                if raw:
+                    scope["raw_path"] = raw.rstrip(b"/") or b"/"
+        await self.app(scope, receive, send)

marketmyna/api/v1/endpoints/account.py

@@ -0,0 +1,166 @@
+"""The owner's profile, mounted at /api/auth/account. Single-user build: no
+sign-up, login, plans or billing; every route works on the local owner
+(marketmyna/api/middlewares/auth.py)."""
+
+from __future__ import annotations
+
+import json
+from datetime import datetime
+from typing import Optional
+
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
+from pydantic import BaseModel
+
+from marketmyna.api.deps import get_config_dep
+from marketmyna.api.middlewares.auth import accounts_db, current_user_from_request
+from marketmyna.core.compliance import mode_for as compliance_mode_for
+from marketmyna.services import accounts
+from marketmyna.services.accounts import AccountError
+from marketmyna.storage import UserRecord
+
+router = APIRouter()
+
+# Everything is on for the owner; the frontend reads these shapes.
+ALL_FEATURES_PLAN = {
+    "id": "all",
+    "name": "Self-hosted",
+    "description": "",
+    "ai_calls_month": None,
+    "limits": {"watchlist_symbols": None, "price_alerts": None, "scheduled_runs_day": None, "portfolios": None},
+    "features": {},
+}
+
+
+def me_dict(user: UserRecord) -> dict:
+    return {
+        "id": user.id,
+        "email": user.email,
+        "name": user.display_name or "",
+        "role": user.role,
+        # "trader" | "investor": the area the menus and pages follow; None shows both.
+        "area": user.last_area,
+        # IANA zone, e.g. Asia/Kolkata: scheduled report times are in this zone.
+        "timezone": user.timezone or "Asia/Kolkata",
+        "timezone_auto": user.timezone_auto is not False,
+        # Always 'analytics': no buy / sell calls, targets or stops (marketmyna/core/compliance.py).
+        "compliance": compliance_mode_for(user.id),
+        "plan": ALL_FEATURES_PLAN,
+    }
+
+
+def _owner(request: Request, session) -> UserRecord:
+    user = current_user_from_request(request, session)
+    if user is None:
+        raise HTTPException(status_code=500, detail="The local owner account is missing.")
+    return user
+
+
+@router.get("/me")
+def me(request: Request, config=Depends(get_config_dep)) -> dict:
+    with accounts_db(config).get_session() as session:
+        return me_dict(_owner(request, session))
+
+
+class ProfileRequest(BaseModel):
+    name: Optional[str] = None
+    timezone: Optional[str] = None
+    # True: the app keeps `timezone` equal to the device's zone (sent on each visit).
+    timezone_auto: Optional[bool] = None
+
+
+@router.patch("/profile")
+def update_profile(body: ProfileRequest, request: Request, config=Depends(get_config_dep)) -> dict:
+    from marketmyna.services.schedule_time import valid_zone
+
+    name = " ".join((body.name or "").split()) if body.name is not None else None
+    if name is not None and len(name) > 80:
+        raise HTTPException(status_code=400, detail="Keep the name under 80 characters.")
+    if body.timezone is not None and not valid_zone(body.timezone):
+        raise HTTPException(status_code=400, detail="Unknown time zone.")
+    with accounts_db(config).get_session() as session:
+        user = _owner(request, session)
+        if name is not None:
+            user.display_name = name
+        if body.timezone is not None:
+            user.timezone = body.timezone
+        if body.timezone_auto is not None:
+            user.timezone_auto = body.timezone_auto
+        session.flush()
+        return me_dict(user)
+
+
+AREAS = ("trader", "investor")
+
+
+class AreaRequest(BaseModel):
+    area: str
+
+
+@router.post("/area")
+def choose_area(body: AreaRequest, request: Request, config=Depends(get_config_dep)) -> dict:
+    """Switch between the Trader and Investor areas (kept on the account)."""
+    if body.area not in AREAS:
+        raise HTTPException(status_code=400, detail="Choose the Trader or the Investor area.")
+    with accounts_db(config).get_session() as session:
+        user = _owner(request, session)
+        user.last_area = body.area
+        session.flush()
+        return me_dict(user)
+
+
+@router.get("/export")
+def export_my_data(request: Request, config=Depends(get_config_dep)) -> Response:
+    """Everything the app stores for you as a JSON download. Credentials are
+    left out, see data_export.REDACT."""
+    from marketmyna.services.data_export import export_user
+
+    with accounts_db(config).get_session() as session:
+        user = _owner(request, session)
+        data = export_user(session, user.id)
+    name = f"marketmyna-data-{datetime.now():%Y-%m-%d}.json"
+    return Response(
+        content=json.dumps(data, ensure_ascii=False, indent=2),
+        media_type="application/json",
+        headers={"Content-Disposition": f'attachment; filename="{name}"', "Cache-Control": "no-store"},
+    )
+
+
+# ---- AI keys: paste a key, the provider and model are worked out from it
+
+
+class ApiKeyRequest(BaseModel):
+    provider: Optional[str] = None  # omitted: detected from the key
+    key: str  # one key, or several separated by new lines, spaces or commas
+
+
+def _keys(session, user: UserRecord, errors: Optional[list] = None) -> dict:
+    out = {"providers": list(accounts.BYOK_PROVIDERS), "keys": accounts.api_keys(session, user)}
+    if errors is not None:
+        out["errors"] = errors
+    return out
+
+
+@router.get("/api-keys")
+def list_api_keys(request: Request, config=Depends(get_config_dep)) -> dict:
+    with accounts_db(config).get_session() as session:
+        return _keys(session, _owner(request, session))
+
+
+@router.put("/api-keys")
+def put_api_key(body: ApiKeyRequest, request: Request, config=Depends(get_config_dep)) -> dict:
+    with accounts_db(config).get_session() as session:
+        user = _owner(request, session)
+        try:
+            errors = accounts.set_api_keys(session, config, user, body.provider, body.key)
+        except AccountError as exc:
+            raise HTTPException(status_code=exc.status, detail=exc.message)
+        return _keys(session, user, errors)
+
+
+@router.delete("/api-keys/{key_id}")
+def remove_api_key(key_id: str, request: Request, config=Depends(get_config_dep)) -> dict:
+    """key_id: a key's id, or a provider name (removes all its keys)."""
+    with accounts_db(config).get_session() as session:
+        user = _owner(request, session)
+        accounts.delete_api_key(session, user, key_id)
+        return _keys(session, user)

marketmyna/api/v1/endpoints/agent.py

@@ -0,0 +1,114 @@
+"""AI agent analysis endpoints: the technical/risk/decision pipeline
+(marketmyna/agent/orchestrator.py) over a configured LLM backend, exposed as
+one synchronous call and one Server-Sent-Events streaming call."""
+
+from __future__ import annotations
+
+import contextvars
+import json
+import queue
+import threading
+from typing import Any, Literal, Optional
+
+from fastapi import APIRouter, Depends, HTTPException
+from fastapi.responses import StreamingResponse
+from pydantic import BaseModel
+
+from marketmyna.agent.context import AgentOpinion
+from marketmyna.agent.dashboard import _public_opinion, build_dashboard
+from marketmyna.agent.orchestrator import AgentOrchestrator
+from marketmyna.api.deps import get_config_dep
+from marketmyna.data.resilience import DataSourceUnavailable
+from marketmyna.llm.channels import llm_configured
+from marketmyna.llm.protocol import GenerationError
+
+router = APIRouter()
+
+
+class AnalyzeRequest(BaseModel):
+    symbol: str
+    market: str = "us"
+    mode: str = "standard"
+    # The login area: "trader" gets a short-term trade plan, "investor" a long-term view.
+    area: Optional[Literal["trader", "investor"]] = None
+
+
+NO_AI_MESSAGE = (
+    "No AI model is set up yet (no llm_model configured). Add an AI key under Settings -> AI keys, "
+    "or set LLM_MODEL for a local model. The data cards work without it."
+)
+
+
+def _require_ai(config) -> None:
+    """The last step (the AI summary) needs a model: refuse before the data steps run for nothing."""
+    if not llm_configured(config):
+        raise HTTPException(status_code=400, detail=NO_AI_MESSAGE)
+
+
+@router.get("/agent/status")
+def ai_status(config=Depends(get_config_dep)) -> dict:
+    """Whether Run AI can work: a saved AI key, or a model set in config / env (e.g. a local Ollama)."""
+    return {"configured": llm_configured(config)}
+
+
+@router.post("/agent/analyze")
+def analyze(body: AnalyzeRequest, config=Depends(get_config_dep)) -> dict:
+    _require_ai(config)
+    orchestrator = AgentOrchestrator(config=config)
+    try:
+        ctx = orchestrator.run(body.symbol, body.market, mode=body.mode, area=body.area)
+    except GenerationError as exc:
+        raise HTTPException(status_code=502, detail=f"LLM backend error: {exc}")
+    except DataSourceUnavailable as exc:
+        raise HTTPException(status_code=503, detail=f"Market data unavailable: {exc}")
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+    return build_dashboard(ctx)
+
+
+def stream_agent_events(orchestrator: AgentOrchestrator, body: AnalyzeRequest):
+    """A plain generator (usable standalone, e.g. in tests, or wrapped in
+    a StreamingResponse) that relays pipeline progress as it actually
+    happens. AgentOrchestrator.run() is a single blocking call, so it runs
+    in a background thread; its on_stage callback pushes events onto a
+    queue this generator drains and yields as SSE `data:` lines, rather
+    than collecting everything and yielding it only after run() returns."""
+    events: "queue.Queue[Any]" = queue.Queue()
+    done = object()
+    # The worker runs in the request's context: the signed-in user's data
+    # scope and AI key (a bare thread would start empty).
+    context = contextvars.copy_context()
+
+    def on_stage(event: str, stage: str, payload: object) -> None:
+        data: dict = {"event": event, "agent": stage}
+        if event == "stage_done" and isinstance(payload, AgentOpinion):
+            # No per-agent buy / sell, target or stop, as in the dashboard.
+            data["opinion"] = _public_opinion(payload.to_dict())
+        elif payload is not None:
+            data["message"] = str(payload)
+        events.put(data)
+
+    def worker() -> None:
+        try:
+            ctx = orchestrator.run(body.symbol, body.market, mode=body.mode, on_stage=on_stage, area=body.area)
+        except Exception as exc:  # noqa: BLE001 - the one place a critical failure surfaces to the client
+            events.put({"event": "error", "message": str(exc)})
+        else:
+            events.put({"event": "done", "dashboard": build_dashboard(ctx)})
+        finally:
+            events.put(done)
+
+    threading.Thread(target=context.run, args=(worker,), daemon=True).start()
+
+    while True:
+        item = events.get()
+        if item is done:
+            return
+        yield f"data: {json.dumps(item)}\n\n"
+
+
+@router.post("/agent/analyze/stream")
+def analyze_stream(body: AnalyzeRequest, config=Depends(get_config_dep)) -> StreamingResponse:
+    _require_ai(config)
+    orchestrator = AgentOrchestrator(config=config)
+    return StreamingResponse(stream_agent_events(orchestrator, body), media_type="text/event-stream")

marketmyna/api/v1/endpoints/bot.py

@@ -0,0 +1,38 @@
+"""Platform-agnostic bot-command endpoint: exercises the same
+CommandDispatcher a real chat platform listener uses, without needing
+any chat platform at all - the web app's Bot console, or curl.
+
+Open to every signed-in user: the auth middleware scopes each request to
+its user, so /portfolio, /alerts and the rest see only their own rows, and
+the AI commands go through the same plan quota as the Analyze page - the
+same as a linked Telegram chat."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends
+from pydantic import BaseModel
+
+from marketmyna.api.deps import get_bot_dispatcher
+from marketmyna.bot.models import IncomingMessage
+
+router = APIRouter()
+
+
+class BotCommandRequest(BaseModel):
+    text: str
+    platform: str = "http"
+    chat_id: str = "http"
+
+
+@router.post("/bot/command")
+def run_bot_command(body: BotCommandRequest, dispatcher=Depends(get_bot_dispatcher)) -> dict:
+    message = IncomingMessage(platform=body.platform, chat_id=body.chat_id, text=body.text)
+    result = dispatcher.dispatch(message)
+    return {"text": result.text, "success": result.success}
+
+
+@router.get("/bot/commands")
+def list_bot_commands(dispatcher=Depends(get_bot_dispatcher)) -> list[dict]:
+    """Every registered command with usage, description, group and an example
+    (the console's reference panel and "/" menu)."""
+    return [{**c.describe(), "group": group} for group, commands in dispatcher.groups().items() for c in commands]