ms-markets 2.2.5.dev15__tar.gz → 2.2.6.dev16__tar.gz

{ms_markets-2.2.5.dev15 → ms_markets-2.2.6.dev16}/CHANGELOG.md

@@ -7,6 +7,41 @@ and this project follows versioned releases.
 
 ## [Unreleased]
 
+### Changed
+
+- Requires `mainsequence>=9.0.19,<10` and `mainsequence-metatable>=0.1.26,<0.2`;
+  the lock and exported `requirements.txt` select `mainsequence` 9.0.19 and
+  `mainsequence-metatable` 0.1.26. MetaTables 0.1.24 and later require
+  `mainsequence[mcp]>=9.0.19` and always install `fastembed`, so `onnxruntime`,
+  `tokenizers`, `huggingface-hub` and `mcp` are new runtime dependencies (about
+  100 MB installed). The API does not import them at startup. No ms-markets
+  code uses an API that changed in this range.
+- The local MetaTables API is now one per laptop. After upgrading, restart
+  `metatables serve --local` and apply the local system migration
+  `0011_table_search` (`metatables --local runtime upgrade`); projects on
+  MetaTables 0.1.21 or earlier then fail against the shared local file.
+- Every request to the Markets API is authenticated before its handler (see
+  Fixed). A local request must send the signed-in user's
+  `Authorization: Bearer` token, which is checked against
+  `MAINSEQUENCE_ENDPOINT`; without one it receives `401`.
+- Refreshed the Main Sequence SDK agent skills and the managed `AGENTS.md`
+  block to 9.0.19, and the MetaTables agent skills to 0.1.26. The 0.1.18
+  MetaTables skills said registered foreign keys must use `RESTRICT` or
+  `NO ACTION`; 0.1.26 allows any referential action, including the cascades
+  ms-markets declares.
+
+### Fixed
+
+- The Markets API installs the SDK request identity with
+  `install_request_identity(app)` in `create_app()`. The platform launcher
+  refuses to serve an application that does not install it, and SDK releases
+  before 9.0.18 reject the platform's current caller assertions. Handlers read
+  the verified caller from `request.state.user`, which the platform never
+  injected, so the Index routes treated every hosted request as anonymous.
+- The Index actor takes its Teams from the request identity's `team_uids`. It
+  read `organization_teams`, which a request identity does not have, so an
+  HTTP caller's Teams were always empty.
+
 ## [2.2.5] - 2026-10-04
 
 ### Fixed

{ms_markets-2.2.5.dev15 → ms_markets-2.2.6.dev16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-markets
-Version: 2.2.5.dev15
+Version: 2.2.6.dev16
 Summary: Financial markets ORM, engines, and application management extensions for Main Sequence.
 Project-URL: Changelog, https://github.com/mainsequence-projects/MainSequenceMarkets/blob/main/CHANGELOG.md
 Project-URL: Source, https://github.com/mainsequence-projects/MainSequenceMarkets
@@ -227,8 +227,8 @@ Requires-Python: <3.14,>=3.13
 Requires-Dist: alembic>=1.18.4
 Requires-Dist: cachetools
 Requires-Dist: fastapi>=0.136.3
-Requires-Dist: mainsequence-metatable<0.2,>=0.1.18
-Requires-Dist: mainsequence<10,>=9.0.5
+Requires-Dist: mainsequence-metatable<0.2,>=0.1.26
+Requires-Dist: mainsequence<10,>=9.0.19
 Requires-Dist: numpy
 Requires-Dist: pandas
 Requires-Dist: pip>=26.1.1
@@ -384,8 +384,8 @@ Recommended entry points:
 
 ## Quick Start
 
-`ms-markets` 2.x requires Python 3.13, Main Sequence SDK `>=9.0.5,<10`, and
-the MetaTables client `mainsequence-metatable>=0.1.18,<0.2`, which is imported
+`ms-markets` 2.x requires Python 3.13, Main Sequence SDK `>=9.0.19,<10`, and
+the MetaTables client `mainsequence-metatable>=0.1.26,<0.2`, which is imported
 as `metatables`. SDK 8 and earlier are not supported; install a 1.x
 `ms-markets` release when maintaining an SDK 8 project. See
 [ADR 0043](https://mainsequence-projects.github.io/MainSequenceMarkets/ADR/0043-sdk-9-metatables-client-hard-cut/)
@@ -501,9 +501,9 @@ Runtime dependencies are declared in
 [pyproject.toml](https://github.com/mainsequence-projects/MainSequenceMarkets/blob/main/pyproject.toml).
 The core stack starts with:
 
-- `mainsequence>=9.0.5,<10` for identity, login, Git source context,
+- `mainsequence>=9.0.19,<10` for identity, login, Git source context,
   CodeRepository, jobs, and agents
-- `mainsequence-metatable>=0.1.18,<0.2` (import `metatables`) for MetaTables,
+- `mainsequence-metatable>=0.1.26,<0.2` (import `metatables`) for MetaTables,
   time-index table updaters, governed compiled SQL, and application-owned
   Alembic migrations
 - `SQLAlchemy` for market-domain ORM models

{ms_markets-2.2.5.dev15 → ms_markets-2.2.6.dev16}/README.md

@@ -107,8 +107,8 @@ Recommended entry points:
 
 ## Quick Start
 
-`ms-markets` 2.x requires Python 3.13, Main Sequence SDK `>=9.0.5,<10`, and
-the MetaTables client `mainsequence-metatable>=0.1.18,<0.2`, which is imported
+`ms-markets` 2.x requires Python 3.13, Main Sequence SDK `>=9.0.19,<10`, and
+the MetaTables client `mainsequence-metatable>=0.1.26,<0.2`, which is imported
 as `metatables`. SDK 8 and earlier are not supported; install a 1.x
 `ms-markets` release when maintaining an SDK 8 project. See
 [ADR 0043](https://mainsequence-projects.github.io/MainSequenceMarkets/ADR/0043-sdk-9-metatables-client-hard-cut/)
@@ -224,9 +224,9 @@ Runtime dependencies are declared in
 [pyproject.toml](https://github.com/mainsequence-projects/MainSequenceMarkets/blob/main/pyproject.toml).
 The core stack starts with:
 
-- `mainsequence>=9.0.5,<10` for identity, login, Git source context,
+- `mainsequence>=9.0.19,<10` for identity, login, Git source context,
   CodeRepository, jobs, and agents
-- `mainsequence-metatable>=0.1.18,<0.2` (import `metatables`) for MetaTables,
+- `mainsequence-metatable>=0.1.26,<0.2` (import `metatables`) for MetaTables,
   time-index table updaters, governed compiled SQL, and application-owned
   Alembic migrations
 - `SQLAlchemy` for market-domain ORM models

{ms_markets-2.2.5.dev15 → ms_markets-2.2.6.dev16}/docs/ADR/0043-sdk-9-metatables-client-hard-cut.md

@@ -15,6 +15,12 @@ provider reference `migrations:migration` below is replaced by
 Amended by [ADR 0045](0045-squashed-initial-schema-and-namespaced-packages.md): the revision IDs and applied history it keeps unchanged are
 replaced by one `0018_initial_schema` revision in 2.1.0.
 
+Amended in 2.2.6: the platform does not inject `request.state.user`. The
+application installs the SDK request identity with
+`install_request_identity(app)` in `create_app()`, which sets
+`request.state.user` after verifying the caller; see
+[the FastAPI documentation](../fast_api/v1/index.md).
+
 ## Context
 
 Main Sequence SDK 9 no longer contains MetaTables. Table resources, the

{ms_markets-2.2.5.dev15 → ms_markets-2.2.6.dev16}/docs/fast_api/v1/index.md

@@ -123,6 +123,9 @@ frontend/API debugging. Its **Markets: Full Stack** configuration runs
 origin. The development wrapper admits ports 3010 and 5173 for both `localhost` and `127.0.0.1`;
 the deployed `api.main:app` surface is not mutated. The launcher leaves
 `MSM_AUTO_REGISTER_NAMESPACE` unset in accordance with the local runtime bootstrap contract.
+Locally, request identity checks every request's `Authorization: Bearer` token against
+`MAINSEQUENCE_ENDPOINT/api/v1/users/me/`, so the frontend must send the signed-in user's token;
+a request without one receives `401`.
 
 ## Platform Deployment
 
@@ -164,17 +167,22 @@ push alone as deployment success.
 
 Runtime dependencies must be resolvable from the backend build environment.
 The published `ms-markets` 2.x package therefore declares
-`mainsequence>=9.0.5,<10` and `mainsequence-metatable>=0.1.18,<0.2` without
+`mainsequence>=9.0.19,<10` and `mainsequence-metatable>=0.1.26,<0.2` without
 exact patch pins. The lower bounds enforce the SDK 9 and MetaTables client
-extraction hard cut, while the project lock and exported runtime requirements
+extraction hard cut and the SDK request identity that the platform's current
+caller assertions require (SDK 9.0.18 and later), while the project lock and exported runtime requirements
 select the exact releases validated for this repository. Do not replace the
 published dependencies with machine-local `[tool.uv.sources]` path overrides.
 
-The SDK 9 request identity contract applies to authenticated routes: handlers
-read the platform-injected `request.state.user` (canonical `uid` and optional
-`username`). The Index routes derive their actor from that state and treat a
-request without it as anonymous; route code does not parse authentication
-headers or bind SDK request-header context variables.
+`create_app()` installs the SDK request identity with
+`install_request_identity(app)`; the platform launcher refuses to serve an
+application without it. It authenticates every request before its handler: a
+hosted request by the gateway's signed caller assertion, a local request by its
+Bearer token. Handlers read the verified caller from `request.state.user` (a
+`RequestUserIdentity` with the canonical `uid`, `team_uids` and
+`is_organization_admin`) or `User.get_logged_user()`. The Index routes derive
+their actor, including its Teams, from that identity; route code does not parse
+authentication headers or bind SDK request-header context variables.
 
 ## API Discoverability
 

{ms_markets-2.2.5.dev15 → ms_markets-2.2.6.dev16}/docs/getting-started.md

@@ -1,7 +1,7 @@
 # Getting Started
 
-`ms-markets` 2.x requires Python 3.13, Main Sequence SDK `>=9.0.5,<10`, and
-the MetaTables client `mainsequence-metatable>=0.1.18,<0.2` (imported as
+`ms-markets` 2.x requires Python 3.13, Main Sequence SDK `>=9.0.19,<10`, and
+the MetaTables client `mainsequence-metatable>=0.1.26,<0.2` (imported as
 `metatables`). It cannot run against an SDK 8 or earlier contract and does not
 provide compatibility aliases or a mixed-version mode. Install a 1.x
 `ms-markets` release when maintaining an SDK 8 project.

{ms_markets-2.2.5.dev15 → ms_markets-2.2.6.dev16}/docs/knowledge/msm/platform/metatable_migrations.md

@@ -110,8 +110,8 @@ history is the Alembic revision graph plus the provider's version table.
 
 ## Client Requirement
 
-The implementation requires `mainsequence-metatable>=0.1.18,<0.2` with
-`mainsequence>=9.0.5,<10`. The client exposes `AlembicMetaTableMigration`,
+The implementation requires `mainsequence-metatable>=0.1.26,<0.2` with
+`mainsequence>=9.0.19,<10`. The client exposes `AlembicMetaTableMigration`,
 `AlembicVersionMetaTable`, application-owned Alembic execution, and the command
 shape where
 `metatables --local migrations upgrade --provider msm_migrations:migration head`

{ms_markets-2.2.5.dev15 → ms_markets-2.2.6.dev16}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-markets"
-version = "2.2.5.dev15"
+version = "2.2.6.dev16"
 description = "Financial markets ORM, engines, and application management extensions for Main Sequence."
 readme = "README.md"
 requires-python = ">=3.13,<3.14"
@@ -36,8 +36,8 @@ dependencies = [
   "alembic>=1.18.4",
   "cachetools",
   "fastapi>=0.136.3",
-  "mainsequence>=9.0.5,<10",
-  "mainsequence-metatable>=0.1.18,<0.2",
+  "mainsequence>=9.0.19,<10",
+  "mainsequence-metatable>=0.1.26,<0.2",
   "numpy",
   "pandas",
   "pip>=26.1.1",

{ms_markets-2.2.5.dev15 → ms_markets-2.2.6.dev16}/src/msm/services/indices/actors.py

@@ -8,13 +8,22 @@ from .contracts import IndexActor
 
 
 def actor_from_user(user: Any) -> IndexActor:
+    """Build the actor from a request identity or an SDK `User`.
+
+    A request identity carries `team_uids`; an SDK `User` lists its
+    `organization_teams`.
+    """
+
     user_uid = getattr(user, "uid", None)
     if user_uid in (None, ""):
         raise RuntimeError("Authenticated platform user has no UID")
+    teams = getattr(user, "team_uids", None)
+    if teams is None:
+        teams = getattr(user, "organization_teams", None)
     team_uids = tuple(
         sorted(
             str(uid)
-            for team in (getattr(user, "organization_teams", None) or ())
+            for team in (teams or ())
             if (uid := team if isinstance(team, str) else getattr(team, "uid", None))
             not in (None, "")
         )

ms_markets-2.2.6.dev16/tests/conftest.py

@@ -0,0 +1,132 @@
+from __future__ import annotations
+
+import os
+import time
+
+import jwt
+import pytest
+from cryptography.hazmat.primitives.asymmetric import ed25519
+from mainsequence.server.caller_assertions import (
+    ASSERTION_TYPE,
+    AuthenticatedCaller,
+    CallerAssertionVerifier,
+)
+
+OFFLINE_RUNTIME_DATA_SOURCE_UID = "00000000-0000-0000-0000-000000000001"
+TEST_CALLER_UID = "5f0c7a52-3b1e-4d7a-9c2e-1a4b6d8e0f13"
+
+
+class GatewayCallerAssertions(CallerAssertionVerifier):
+    """Stand in for the platform gateway that signs every hosted request.
+
+    `create_app()` installs SDK request identity, which refuses a request without
+    a valid caller assertion. This verifier signs one for `TEST_CALLER_UID` when a
+    request carries none, so tests reach their handlers as an authenticated
+    caller, and verifies any assertion a test sends through the SDK unchanged.
+    """
+
+    _KEY_ID = "ms-markets-tests"
+
+    def __init__(self) -> None:
+        self._signing_key = ed25519.Ed25519PrivateKey.generate()
+        public = jwt.algorithms.OKPAlgorithm.to_jwk(
+            self._signing_key.public_key(), as_dict=True
+        )
+        keys = {
+            "keys": [
+                {
+                    "kid": self._KEY_ID,
+                    "alg": "EdDSA",
+                    "use": "sig",
+                    **{name: public[name] for name in ("kty", "crv", "x")},
+                }
+            ]
+        }
+        super().__init__(
+            issuer="https://platform.ms-markets.test",
+            jwks_url="https://platform.ms-markets.test/fastapi/caller-keys/",
+            release_uid="0d7e2f6a-6c1b-4e8f-9a3d-2b5c7e9f1a04",
+            environment_uid="8a1f3c5e-7b9d-4f2a-8c6e-0d2f4a6b8c15",
+            fetch_jwks=lambda: keys,
+        )
+
+    def sign(self, user_uid: str = TEST_CALLER_UID, **claims: object) -> str:
+        """Sign a caller assertion as the platform does; `claims` override its claims."""
+
+        now = int(time.time())
+        payload = {
+            "iss": self.issuer,
+            "aud": f"urn:mainsequence:fapi:{self.release_uid}",
+            "sub": user_uid,
+            "resource_release_uid": self.release_uid,
+            "organization_environment_uid": self.environment_uid,
+            "iat": now,
+            "nbf": now,
+            "exp": now + 120,
+            "team_uids": [],
+            "is_organization_admin": False,
+            **claims,
+        }
+        return jwt.encode(
+            payload,
+            self._signing_key,
+            algorithm="EdDSA",
+            headers={"kid": self._KEY_ID, "typ": ASSERTION_TYPE},
+        )
+
+    def verify(self, assertion: str) -> AuthenticatedCaller:
+        return super().verify(assertion or self.sign())
+
+
+GATEWAY_CALLER_ASSERTIONS = GatewayCallerAssertions()
+
+
+def pytest_configure(config: pytest.Config) -> None:
+    # Runs before any test module imports `apps.v1.main`, whose `create_app()`
+    # selects the caller-authentication mode and verifier when it installs
+    # request identity.
+    os.environ["MAINSEQUENCE_CALLER_AUTH_MODE"] = "assertion"
+    CallerAssertionVerifier.from_environment = classmethod(  # type: ignore[method-assign]
+        lambda cls, **_: GATEWAY_CALLER_ASSERTIONS
+    )
+
+
+@pytest.fixture
+def caller_assertions() -> GatewayCallerAssertions:
+    """Sign caller assertions the API under test accepts."""
+
+    return GATEWAY_CALLER_ASSERTIONS
+
+
+@pytest.fixture
+def offline_postgresql_runtime(monkeypatch):
+    """Serve a hosted PostgreSQL MetaTables runtime without resolving or calling an API.
+
+    When a repository context leaves `data_source_uid` as `None`, as product code
+    does, or no `dialect=` is passed, `metatables.compiled_sql.v1` reads the
+    DataSource UID and the SQL dialect together from the Environment-selected
+    API runtime through `RuntimeContext.require_data_source_uid()` and
+    `RuntimeContext.require_sql_dialect()`. This fixture answers
+    `get_runtime_context()` offline with a runtime that satisfies both checks,
+    so statement tests compile through the same automatic path.
+    """
+
+    import metatables.runtime_context
+    from metatables.runtime_contract import RuntimeContext
+
+    runtime = RuntimeContext(
+        git_source=None,
+        dialect="postgresql",
+        paramstyle="pyformat",
+        data_source={"uid": OFFLINE_RUNTIME_DATA_SOURCE_UID},
+        default_schema="public",
+    )
+    assert runtime.require_data_source_uid() == OFFLINE_RUNTIME_DATA_SOURCE_UID
+    assert runtime.require_sql_dialect() == ("postgresql", "pyformat")
+
+    def get_runtime_context() -> RuntimeContext:
+        runtime.require_data_source_uid()
+        return runtime
+
+    monkeypatch.setattr(metatables.runtime_context, "get_runtime_context", get_runtime_context)
+    return runtime

ms_markets-2.2.6.dev16/tests/msm/fastapi/v1/test_request_identity.py

@@ -0,0 +1,50 @@
+from __future__ import annotations
+
+import pytest
+from fastapi.testclient import TestClient
+from mainsequence.server.caller_assertions import ASSERTION_HEADER
+from mainsequence.server.fastapi import install_request_identity
+
+from apps.v1.main import app, create_app
+from msm.services.indices import IndexActor
+
+USER_UID = "9b4d2f8e-1a3c-4e5b-8d7f-6c0a2e4b6d35"
+TEAM_UID = "3c9e1f7a-5b2d-4e8c-a6f0-7d1b3e5a9c24"
+
+
+def test_create_app_installs_request_identity_once() -> None:
+    with pytest.raises(RuntimeError, match="already installed"):
+        install_request_identity(create_app())
+
+
+def test_request_with_an_invalid_caller_assertion_is_refused() -> None:
+    response = TestClient(app).get("/health", headers={ASSERTION_HEADER: "not-an-assertion"})
+
+    assert response.status_code == 401
+
+
+def test_request_with_another_releases_assertion_is_refused(caller_assertions) -> None:
+    assertion = caller_assertions.sign(aud="urn:mainsequence:fapi:another-release")
+
+    response = TestClient(app).get("/health", headers={ASSERTION_HEADER: assertion})
+
+    assert response.status_code == 401
+
+
+def test_index_routes_act_for_the_verified_caller(monkeypatch, caller_assertions) -> None:
+    received: list[IndexActor | None] = []
+
+    def list_index_datasets(*, uid, actor, include_empty):
+        received.append(actor)
+        return []
+
+    monkeypatch.setattr("apps.v1.routers.indices.list_index_datasets", list_index_datasets)
+    assertion = caller_assertions.sign(USER_UID, team_uids=[TEAM_UID])
+
+    response = TestClient(app).get(
+        "/api/v1/index/any-index/datasets/",
+        headers={ASSERTION_HEADER: assertion},
+    )
+
+    assert response.status_code == 200
+    assert received == [IndexActor(user_uid=USER_UID, team_uids=(TEAM_UID,))]

{ms_markets-2.2.5.dev15 → ms_markets-2.2.6.dev16}/tests/msm/test_package_metadata.py

@@ -28,8 +28,9 @@ def test_package_metadata_enforces_sdk_9_floor_without_exact_patch_pin() -> None
     assert Version("8.99.0") not in requirement.specifier
     assert Version("9.0.0") not in requirement.specifier
     assert Version("9.0.1") not in requirement.specifier
-    assert Version("9.0.4") not in requirement.specifier
-    assert Version("9.0.5") in requirement.specifier
+    assert Version("9.0.5") not in requirement.specifier
+    assert Version("9.0.18") not in requirement.specifier
+    assert Version("9.0.19") in requirement.specifier
     assert Version("9.99.0") in requirement.specifier
     assert Version("10.0.0") not in requirement.specifier
     assert all(specifier.operator != "==" for specifier in requirement.specifier)
@@ -38,8 +39,8 @@ def test_package_metadata_enforces_sdk_9_floor_without_exact_patch_pin() -> None
 def test_package_metadata_requires_extracted_metatables_client() -> None:
     requirement = _requirement("mainsequence-metatable")
 
-    assert Version("0.1.17") not in requirement.specifier
-    assert Version("0.1.18") in requirement.specifier
+    assert Version("0.1.25") not in requirement.specifier
+    assert Version("0.1.26") in requirement.specifier
     assert Version("0.1.99") in requirement.specifier
     assert Version("0.2.0") not in requirement.specifier
     assert all(specifier.operator != "==" for specifier in requirement.specifier)

ms_markets-2.2.5.dev15/tests/conftest.py

@@ -1,39 +0,0 @@
-from __future__ import annotations
-
-import pytest
-
-OFFLINE_RUNTIME_DATA_SOURCE_UID = "00000000-0000-0000-0000-000000000001"
-
-
-@pytest.fixture
-def offline_postgresql_runtime(monkeypatch):
-    """Serve a hosted PostgreSQL MetaTables runtime without resolving or calling an API.
-
-    When a repository context leaves `data_source_uid` as `None`, as product code
-    does, or no `dialect=` is passed, `metatables.compiled_sql.v1` reads the
-    DataSource UID and the SQL dialect together from the Environment-selected
-    API runtime through `RuntimeContext.require_data_source_uid()` and
-    `RuntimeContext.require_sql_dialect()`. This fixture answers
-    `get_runtime_context()` offline with a runtime that satisfies both checks,
-    so statement tests compile through the same automatic path.
-    """
-
-    import metatables.runtime_context
-    from metatables.runtime_contract import RuntimeContext
-
-    runtime = RuntimeContext(
-        git_source=None,
-        dialect="postgresql",
-        paramstyle="pyformat",
-        data_source={"uid": OFFLINE_RUNTIME_DATA_SOURCE_UID},
-        default_schema="public",
-    )
-    assert runtime.require_data_source_uid() == OFFLINE_RUNTIME_DATA_SOURCE_UID
-    assert runtime.require_sql_dialect() == ("postgresql", "pyformat")
-
-    def get_runtime_context() -> RuntimeContext:
-        runtime.require_data_source_uid()
-        return runtime
-
-    monkeypatch.setattr(metatables.runtime_context, "get_runtime_context", get_runtime_context)
-    return runtime