marketmyna 0.2.0__py3-none-any.whl

marketmyna/utils/deadline.py

@@ -0,0 +1,36 @@
+"""Hard deadlines for third-party calls that can hang (Yahoo's `.info`,
+option chains, batch downloads have no reliable timeout of their own).
+
+The call runs on a daemon thread: if it overruns, the caller gets
+TimeoutError right away and the stuck thread can't delay a reload or
+process exit (a ThreadPoolExecutor's threads would)."""
+
+from __future__ import annotations
+
+import contextvars
+import threading
+from typing import Any, Callable, TypeVar
+
+T = TypeVar("T")
+
+
+def call_with_deadline(fn: Callable[..., T], seconds: float, *args: Any, **kwargs: Any) -> T:
+    box: dict[str, Any] = {}
+    done = threading.Event()
+
+    def run() -> None:
+        try:
+            box["value"] = fn(*args, **kwargs)
+        except BaseException as exc:  # re-raised in the caller's thread
+            box["error"] = exc
+        finally:
+            done.set()
+
+    # Copy the caller's context so the per-user data scope (marketmyna/core/tenant.py) follows the call.
+    ctx = contextvars.copy_context()
+    threading.Thread(target=ctx.run, args=(run,), name=f"deadline:{getattr(fn, '__name__', 'call')}", daemon=True).start()
+    if not done.wait(seconds):
+        raise TimeoutError(f"{getattr(fn, '__name__', 'call')} took longer than {seconds:.0f}s")
+    if "error" in box:
+        raise box["error"]
+    return box["value"]

marketmyna/utils/log_redact.py

@@ -0,0 +1,52 @@
+"""Mask secrets in every log line, tracebacks included.
+
+A failed Telegram call raises an error whose text carries the request URL,
+and that URL holds the bot token (api.telegram.org/bot<token>/...); a plain
+`logger.exception` then wrote the token to the server logs. The same goes for
+AI keys echoed back by a provider. `install()` wraps the log record factory,
+so every record from every logger is cleaned before any handler sees it.
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+import traceback
+
+SECRETS = re.compile(
+    r"(?<=/bot)\d{5,}:[\w-]{20,}"  # Telegram bot token in an API URL
+    r"|\b\d{8,12}:AA[\w-]{30,}"  # Telegram bot token on its own
+    r"|AIza[\w-]{10,}|gsk_\w{10,}|sk-[\w-]{10,}"  # AI provider keys
+    r"|(?<=key=)[^&\s\"']+|(?<=Bearer )[\w.-]+"
+)
+
+_installed = False
+
+
+def redact(text: str) -> str:
+    return SECRETS.sub("***", text)
+
+
+def install() -> None:
+    """Idempotent; safe to call from every entry point."""
+    global _installed
+    if _installed:
+        return
+    make = logging.getLogRecordFactory()
+
+    def factory(*args, **kwargs):
+        record = make(*args, **kwargs)
+        try:
+            message = record.getMessage()
+        except Exception:  # noqa: BLE001 - a bad format string is the handler's problem, not ours
+            return record
+        clean = redact(message)
+        if clean != message:
+            record.msg, record.args = clean, None
+        if record.exc_info and record.exc_info[0] is not None:
+            # Formatters reuse exc_text when it is set, so the raw traceback is never printed.
+            record.exc_text = redact("".join(traceback.format_exception(*record.exc_info)).rstrip("\n"))
+        return record
+
+    logging.setLogRecordFactory(factory)
+    _installed = True

marketmyna/utils/yahoo_gate.py

@@ -0,0 +1,183 @@
+"""One shared pace for every Yahoo Finance request on this server.
+
+Yahoo throttles by IP, not by process. The web app, every scheduled-report
+worker and the background jobs each run their own yfinance, so before this
+gate a report wave of 4 workers fired requests in bursts and one 429 in one
+worker said nothing to the others, which kept hammering and extended the ban.
+
+- Pacing (scheduled-report workers only; web requests are never delayed):
+  a token bucket shared by all worker processes (a small state file under
+  a file lock). Up to `BURST` requests go straight through, so a page that
+  fetches dozens of tickers at once is not slowed; beyond that, requests
+  are released at `RATE` per second. (A strict gap between every request
+  queued page loads behind each other: 80 tickers took 16 s.)
+- Shared cooldown: a 429 anywhere pauses Yahoo for every process for
+  `COOLDOWN` seconds. Scheduled workers (`patient()`) wait it out, up to
+  `MAX_WAIT`; web requests fail fast with yfinance's own YFRateLimitError, so
+  pages fall back to caches instead of hanging.
+
+`install()` wraps yfinance's single request method (YfData._make_request), so
+every Ticker / download / search call goes through the gate without touching
+the call sites. Without fcntl (Windows) the gate works per process only.
+"""
+
+from __future__ import annotations
+
+import functools
+import logging
+import os
+import threading
+import time
+from pathlib import Path
+
+from marketmyna.core.home import app_home
+
+logger = logging.getLogger(__name__)
+
+RATE = float(os.environ.get("YAHOO_RATE", 10))  # sustained requests per second
+BURST = float(os.environ.get("YAHOO_BURST", 60))
+COOLDOWN = float(os.environ.get("YAHOO_COOLDOWN", 30))
+MAX_WAIT = float(os.environ.get("YAHOO_MAX_WAIT", 90))
+
+try:
+    import fcntl
+except ImportError:  # pragma: no cover - Windows
+    fcntl = None
+try:
+    import msvcrt  # Windows file locks
+except ImportError:
+    msvcrt = None
+
+_local_lock = threading.Lock()
+_local_state = [0.0, 0.0]  # bucket clock (see reserve), cooldown until (no-fcntl fallback)
+_patient = False
+_installed = False
+
+
+def state_path() -> Path:
+    return Path(os.environ.get("YAHOO_GATE_FILE") or app_home() / "yahoo_gate")
+
+
+def patient(on: bool = True) -> None:
+    """This process waits out a shared cooldown instead of failing fast
+    (scheduled-report workers: a late report beats a failed one)."""
+    global _patient
+    _patient = on
+
+
+def _lock(f) -> None:
+    if fcntl is not None:
+        fcntl.flock(f, fcntl.LOCK_EX)
+    else:  # Windows: lock the first byte (LK_LOCK retries for about 10 s, then raises OSError)
+        f.seek(0)
+        msvcrt.locking(f.fileno(), msvcrt.LK_LOCK, 1)
+
+
+def _unlock(f) -> None:
+    if fcntl is not None:
+        fcntl.flock(f, fcntl.LOCK_UN)
+    else:
+        f.seek(0)
+        msvcrt.locking(f.fileno(), msvcrt.LK_UNLCK, 1)
+
+
+def _update(change):
+    """Run change(clock, cooldown_until) -> (clock, cooldown_until, result)
+    under the cross-process lock and return result."""
+    if fcntl is not None or msvcrt is not None:
+        try:
+            path = state_path()
+            path.parent.mkdir(parents=True, exist_ok=True)
+            with open(path, "a+", encoding="utf-8") as f:
+                _lock(f)
+                try:
+                    f.seek(0)
+                    parts = f.read().split()
+                    try:
+                        nxt, cool = float(parts[0]), float(parts[1])
+                    except (IndexError, ValueError):
+                        nxt, cool = 0.0, 0.0
+                    nxt, cool, result = change(nxt, cool)
+                    f.seek(0)
+                    f.truncate()
+                    f.write(f"{nxt:.3f} {cool:.3f}")
+                    f.flush()
+                    return result
+                finally:
+                    _unlock(f)
+        except OSError as exc:
+            logger.debug("Yahoo gate file unavailable, pacing this process only: %s", exc)
+    with _local_lock:
+        nxt, cool, result = change(*_local_state)
+        _local_state[:] = [nxt, cool]
+        return result
+
+
+def reserve() -> float:
+    """Book the next request slot; returns seconds to sleep before sending.
+    Raises YFRateLimitError while Yahoo is cooling down (unless patient)."""
+    now = time.time()
+
+    # The bucket is kept as one number, `clock`: the moment it would be full
+    # again. Each request pushes it 1/RATE later; a request may go once the
+    # clock is no more than BURST/RATE ahead of now.
+    def change(clock, cool):
+        if cool > now and (not _patient or cool - now > MAX_WAIT):
+            return clock, cool, -(cool - now)
+        if not _patient:
+            # Web requests are never paced (a page waits on them); only the
+            # scheduled-report workers, which burst for minutes, use the bucket.
+            return clock, cool, 0.0
+        start = max(now, cool)
+        clock = max(clock, start) + 1.0 / RATE
+        return clock, cool, max(0.0, clock - start - BURST / RATE) + (start - now)
+
+    wait = _update(change)
+    if wait < 0:
+        from yfinance.exceptions import YFRateLimitError
+
+        logger.info("Yahoo cooling down for another %.0fs after a 429; not sending", -wait)
+        raise YFRateLimitError()
+    return wait
+
+
+def record_limit() -> None:
+    """Yahoo said 429: every process on this server pauses for COOLDOWN."""
+    until = time.time() + COOLDOWN
+
+    def change(clock, cool):
+        return clock, max(cool, until), None
+
+    _update(change)
+    logger.warning("Yahoo rate limit hit; pausing Yahoo requests for %.0fs on this server", COOLDOWN)
+
+
+def install() -> None:
+    """Route every yfinance HTTP request through the gate (idempotent)."""
+    global _installed
+    if _installed:
+        return
+    try:
+        from yfinance.data import YfData
+        from yfinance.exceptions import YFRateLimitError
+    except Exception as exc:  # noqa: BLE001 - yfinance missing or reshaped: run ungated
+        logger.warning("Yahoo gate not installed: %s", exc)
+        return
+    original = YfData._make_request
+
+    @functools.wraps(original)
+    def paced(self, *args, **kwargs):
+        wait = reserve()
+        if wait > 0:
+            time.sleep(wait)
+        try:
+            response = original(self, *args, **kwargs)
+        except YFRateLimitError:
+            record_limit()
+            raise
+        if getattr(response, "status_code", None) == 429:
+            record_limit()
+        return response
+
+    YfData._make_request = paced
+    _installed = True

marketmyna/utils/yf_lock.py

@@ -0,0 +1,12 @@
+"""One process-wide lock for yfinance.download().
+
+yf.download keeps its results in module-level state (yfinance.shared), so two
+batch downloads running at once on different threads can hand each other's
+rows back: a 1-year commodities fetch and a 2-year crude fetch overlapping
+returned 1-year Brent to the 2-year caller. Every batch download goes through
+this lock; single-ticker Ticker().history() calls do not need it.
+"""
+
+import threading
+
+YF_DOWNLOAD_LOCK = threading.Lock()

marketmyna/web/assets/Account-CA9NFDKO.js

@@ -0,0 +1 @@
+import{r as e}from"./rolldown-runtime-XKyaHtl9.js";import{b as t,n,p as r,r as i}from"./format-d8InM0Zw.js";import{t as a}from"./toast-DDradTZw.js";import{D as o,_ as s,a as c,c as l,f as u,g as d,i as f,o as p,p as m,r as h}from"./ui-gsFb8B2m.js";import{C as g,D as _,_ as v,b as y,g as b,j as x,y as S}from"./index-CKAnq-Or.js";var C=e(t(),1),w=r(),T=[{value:`profile`,label:`Profile`},{value:`data`,label:`Your data`}];function E(){let e=b(e=>e.me),t=b(e=>e.setMe),[n,r]=x(),i=T,a=i.some(e=>e.value===n.get(`tab`))?n.get(`tab`):`profile`;return(0,C.useEffect)(()=>{g().then(t).catch(()=>{})},[t]),e?(0,w.jsxs)(`div`,{className:`space-y-6`,children:[(0,w.jsx)(m,{title:`Account settings`,description:`Your name, time zone and data.`}),(0,w.jsx)(d,{options:i,value:a,onChange:e=>{let t=new URLSearchParams(n);t.set(`tab`,e),r(t,{replace:!0})}}),a===`profile`&&(0,w.jsx)(D,{}),a===`data`&&(0,w.jsx)(j,{})]}):null}function D(){let e=b(e=>e.me),t=b(e=>e.setMe),[r,o]=(0,C.useState)(e.name),d=e.timezone??`Asia/Kolkata`,m=e.timezone_auto!==!1,[g,y]=(0,C.useState)(d),[x,T]=(0,C.useState)(m),[E,D]=(0,C.useState)(!1),A=S(),j=x&&A?A:g,M=(0,C.useMemo)(()=>{let e=typeof Intl.supportedValuesOf==`function`?Intl.supportedValuesOf(`timeZone`).map(v):[];return[...new Set([g,A,...e])].filter(Boolean).sort()},[g,A]);async function N(e){e.preventDefault(),D(!0);try{t(await _({name:r,timezone:j,timezone_auto:x})),a.success(`Profile saved`)}catch(e){a.error(n(e))}finally{D(!1)}}return(0,w.jsxs)(f,{children:[(0,w.jsx)(p,{title:`Profile`,icon:`user`}),(0,w.jsxs)(c,{className:`space-y-5`,children:[(0,w.jsxs)(`div`,{className:`flex items-center gap-4`,children:[(0,w.jsx)(`span`,{className:`flex h-14 w-14 shrink-0 items-center justify-center rounded-full bg-accent-soft text-lg font-semibold text-accent-fg ring-1 ring-accent/30`,children:i(e.name,e.email)}),(0,w.jsx)(`div`,{className:`min-w-0`,children:(0,w.jsx)(`div`,{className:`truncate text-base font-semibold`,children:e.name||`No name yet`})})]}),(0,w.jsxs)(`form`,{onSubmit:N,className:`grid gap-3 sm:grid-cols-[1fr_1fr_auto] sm:items-start`,children:[(0,w.jsx)(l,{label:`Name`,hint:`Shown in the menu.`,children:(0,w.jsx)(u,{value:r,maxLength:80,autoComplete:`name`,onChange:e=>o(e.target.value)})}),(0,w.jsx)(l,{label:(0,w.jsxs)(`span`,{className:`flex items-center justify-between gap-2`,children:[`Time zone`,(0,w.jsx)(k,{checked:x,disabled:!A,onChange:e=>{T(e),!e&&A&&y(A)}})]}),hint:x?`From this device's clock: now ${O(j)}. Changes when you travel.`:`Scheduled report times are in this zone: now ${O(j)}.`,children:x?(0,w.jsx)(u,{value:j.replace(/_/g,` `),readOnly:!0,"aria-readonly":!0,className:`cursor-default text-muted`}):(0,w.jsx)(s,{value:g,onChange:e=>y(e.target.value),options:M.map(e=>({value:e,label:e.replace(/_/g,` `)}))})}),(0,w.jsx)(h,{type:`submit`,variant:`secondary`,className:`sm:mt-[calc(var(--text-xs--line-height)+0.375rem)]`,loading:E,disabled:r.trim()===e.name.trim()&&j===d&&x===m,children:`Save`})]})]})]})}function O(e){try{return new Intl.DateTimeFormat(void 0,{timeZone:e,hour:`numeric`,minute:`2-digit`,timeZoneName:`short`}).format(new Date)}catch{return`—`}}function k({checked:e,disabled:t,onChange:n}){return(0,w.jsxs)(`button`,{type:`button`,role:`switch`,"aria-checked":e,disabled:t,title:t?`This browser doesn't share its time zone`:`Follow this device's time zone`,onClick:t=>{t.preventDefault(),n(!e)},className:`inline-flex items-center gap-1.5 text-xs font-normal text-muted hover:text-fg disabled:opacity-50`,children:[`Set automatically`,(0,w.jsx)(`span`,{className:o(`relative h-4 w-7 shrink-0 rounded-full transition-colors`,e?`bg-accent`:`bg-line-strong`),children:(0,w.jsx)(`span`,{className:o(`absolute top-0.5 start-0 h-3 w-3 rounded-full bg-white transition-transform`,e?`translate-x-3.5`:`translate-x-0.5`)})})]})}function A(){let[e,t]=(0,C.useState)(!1);async function r(){t(!0);try{await y(),a.success(`Your data file is downloading.`)}catch(e){a.error(n(e))}finally{t(!1)}}return(0,w.jsx)(h,{variant:`secondary`,icon:`download`,loading:e,onClick:r,children:`Download my data`})}function j(){return(0,w.jsxs)(f,{children:[(0,w.jsx)(p,{title:`Your data`,icon:`download`,description:`Download a copy of everything MarketMyna stores about you, whenever you like.`}),(0,w.jsxs)(c,{className:`space-y-3`,children:[(0,w.jsx)(`p`,{className:`text-sm text-muted`,children:`One JSON file with your profile, plan and payments, portfolios and transactions, watchlists, alerts, scheduled report settings and usage history. Passwords, login tokens and your saved AI keys are never included.`}),(0,w.jsx)(A,{})]})]})}export{E as default};