shopping-cli 3.0.2__tar.gz → 3.1.0__tar.gz

{shopping_cli-3.0.2/shopping_cli.egg-info → shopping_cli-3.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: shopping-cli
-Version: 3.0.2
+Version: 3.1.0
 Summary: Standalone local-commerce AI consultation marketplace runtime
 License:                                  Apache License
                                    Version 2.0, January 2004

{shopping_cli-3.0.2 → shopping_cli-3.1.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "shopping-cli"
-version = "3.0.2"
+version = "3.1.0"
 description = "Standalone local-commerce AI consultation marketplace runtime"
 readme = "README.md"
 requires-python = ">=3.11"

{shopping_cli-3.0.2 → shopping_cli-3.1.0}/shopping_cli/__init__.py

@@ -1,3 +1,3 @@
 """Standalone shopping-cli consultation runtime."""
 
-VERSION = "3.0.2"
+VERSION = "3.1.0"

{shopping_cli-3.0.2 → shopping_cli-3.1.0}/shopping_cli/agents/merchant_daemon.py

@@ -180,11 +180,15 @@ class _PidFileLock:
 
     def __enter__(self) -> "_PidFileLock":
         self.lock_path.parent.mkdir(parents=True, exist_ok=True)
+        # 审查 P3-03：与日志/stop 文件对齐 0600（此前 0644）；os.open 的
+        # mode 只在新建时生效，已存在的遗留文件也显式 chmod（同
+        # _open_log_append 的 P2-07 模式）。
         self._fd = os.open(
             str(self.lock_path),
             os.O_RDWR | os.O_CREAT,
-            0o644,
+            0o600,
         )
+        os.chmod(self.lock_path, 0o600)
         if fcntl is not None:
             try:
                 fcntl.flock(self._fd, fcntl.LOCK_EX)

{shopping_cli-3.0.2 → shopping_cli-3.1.0}/shopping_cli/api/fastapi_routes.py

@@ -226,12 +226,21 @@ def register_fastapi_routes(app: Any, db_path: str | Path) -> None:
         return _update_product(db_path, sku, api_auth.payload_with_auth(payload, authorization))
 
     @app.get("/v1/merchant/listings/projections")
-    def merchant_listing_projections(merchant_id: str = "") -> dict[str, Any]:
-        return _list_listing_projections(db_path, {"merchant_id": merchant_id})
+    def merchant_listing_projections(
+        merchant_id: str = "",
+        authorization: str = AUTHORIZATION_HEADER,
+    ) -> dict[str, Any]:
+        # 审查 P2-B：handoff_destination 仅向所属商户本人开放（owner 判定在 handler）
+        return _list_listing_projections(
+            db_path, {"merchant_id": merchant_id}, api_auth.payload_with_auth({}, authorization)
+        )
 
     @app.get("/v1/merchant/listings/{sku}/projection")
-    def merchant_listing_projection(sku: str) -> dict[str, Any]:
-        return _get_listing_projection(db_path, sku)
+    def merchant_listing_projection(
+        sku: str,
+        authorization: str = AUTHORIZATION_HEADER,
+    ) -> dict[str, Any]:
+        return _get_listing_projection(db_path, sku, api_auth.payload_with_auth({}, authorization))
 
     @app.post("/v1/merchant/erp/sync")
     def merchant_erp_sync(

{shopping_cli-3.0.2 → shopping_cli-3.1.0}/shopping_cli/api/handlers/catalog.py

@@ -29,7 +29,6 @@ from .common import (
 )
 from shopping_cli.core import catalog_views
 
-
 def health(db_path: str | Path) -> dict[str, Any]:
     profile = deployment_profile_from()
     checks: dict[str, Any] = production_config_checks()
@@ -320,6 +319,7 @@ def create_product(
             tags=payload.get("tags") or [],
             description=str(payload.get("description") or ""),
             delivery_attributes=payload.get("delivery_attributes") or [],
+            handoff_destination=str(payload.get("handoff_destination") or ""),
         )
         return {"ok": True, "product": product}
 
@@ -346,6 +346,9 @@ def update_product(
             tags=payload.get("tags") if "tags" in payload else None,
             description=payload.get("description"),
             delivery_attributes=payload.get("delivery_attributes") if "delivery_attributes" in payload else None,
+            handoff_destination=payload.get("handoff_destination")
+            if "handoff_destination" in payload
+            else None,
         )
         return {"ok": True, "product": product}
 

{shopping_cli-3.0.2 → shopping_cli-3.1.0}/shopping_cli/api/handlers/listings_projection.py

@@ -5,6 +5,10 @@
 
 公开读免鉴权（沿用 products 现状）；发布动作只经 CLI 不进 API（评审：
 写面保持 push-first 单向，API 不暴露发布副作用）。
+
+handoff_destination 是商家私有成交入口（审查 P2-B）：匿名/非本人读一律
+剥离；仅持商品所属商户本人有效 token 的调用保留（kiwi merchant agent
+发布/成交取数路径）。
 """
 
 from __future__ import annotations
@@ -12,6 +16,7 @@ from __future__ import annotations
 from pathlib import Path
 from typing import Any
 
+from shopping_cli.api.handlers.catalog import _owner_merchant_from_payload
 from shopping_cli.core.errors import NotFoundError, ValidationError
 from shopping_cli.db.session import db_session
 from shopping_cli.listings.projection import (
@@ -21,15 +26,28 @@ from shopping_cli.listings.projection import (
 )
 
 
-def list_listing_projections(db_path: str | Path, query: dict[str, Any]) -> dict[str, Any]:
-    """GET /v1/merchant/listings/projections —— 可发布投影（public-only）。"""
+def list_listing_projections(
+    db_path: str | Path, query: dict[str, Any], payload: dict[str, Any] | None = None
+) -> dict[str, Any]:
+    """GET /v1/merchant/listings/projections —— 可发布投影（public-only）。
+
+    必须带 ``merchant_id`` 过滤（审查 P3-01：无过滤的匿名枚举会暴露全部
+    商家的可发布投影）；匿名或 token 不属于该商户本人时剥离
+    handoff_destination（审查 P2-B）。
+    """
     merchant_id = str(query.get("merchant_id") or "").strip()
+    if not merchant_id:
+        raise ValidationError("merchant_id is required")
     with db_session(db_path) as conn:
+        owner = _owner_merchant_from_payload(conn, payload)
         projections = list_publishable_listings(conn, merchant_id=merchant_id)
+        if not (owner and owner == merchant_id):
+            for projection in projections:
+                projection.pop("handoff_destination", None)
         return {"ok": True, "results": projections, "count": len(projections)}
 
 
-def get_listing_projection(db_path: str | Path, sku: str) -> dict[str, Any]:
+def get_listing_projection(db_path: str | Path, sku: str, payload: dict[str, Any] | None = None) -> dict[str, Any]:
     """GET /v1/merchant/listings/{sku}/projection —— 单条投影。"""
     sku = str(sku).strip()
     if not sku:
@@ -39,4 +57,8 @@ def get_listing_projection(db_path: str | Path, sku: str) -> dict[str, Any]:
             projection = project_product_listing(conn, sku)
         except ProjectionError as exc:
             raise NotFoundError(str(exc)) from exc
+        owner = _owner_merchant_from_payload(conn, payload)
+        row = conn.execute("select merchant_id from products where sku = ?", (sku,)).fetchone()
+        if not (owner and row is not None and owner == str(row["merchant_id"] or "")):
+            projection.pop("handoff_destination", None)
         return {"ok": True, "projection": projection}

{shopping_cli-3.0.2 → shopping_cli-3.1.0}/shopping_cli/api/route_table.py

@@ -88,16 +88,18 @@ def _get_product(db_path: str | Path, sku: str, payload: dict[str, Any] | None =
     return catalog_handlers.get_product(db_path, sku, payload)
 
 
-def _list_listing_projections(db_path: str | Path, query: dict[str, Any]) -> dict[str, Any]:
-    return listings_projection_handlers.list_listing_projections(db_path, query)
+def _list_listing_projections(
+    db_path: str | Path, query: dict[str, Any], payload: dict[str, Any] | None = None
+) -> dict[str, Any]:
+    return listings_projection_handlers.list_listing_projections(db_path, query, payload)
 
 
 def _sync_erp(db_path: str | Path, payload: dict[str, Any]) -> dict[str, Any]:
     return erp_handlers.sync_erp(db_path, payload)
 
 
-def _get_listing_projection(db_path: str | Path, sku: str) -> dict[str, Any]:
-    return listings_projection_handlers.get_listing_projection(db_path, sku)
+def _get_listing_projection(db_path: str | Path, sku: str, payload: dict[str, Any] | None = None) -> dict[str, Any]:
+    return listings_projection_handlers.get_listing_projection(db_path, sku, payload)
 
 
 def _search_products(db_path: str | Path, query: dict[str, Any], payload: dict[str, Any] | None = None) -> dict[str, Any]:
@@ -402,12 +404,12 @@ _ROUTE_TABLE: tuple[RouteEntry, ...] = (
     RouteEntry(
         {"GET"},
         "/v1/merchant/listings/projections",
-        lambda db_path, payload, query, **kw: _list_listing_projections(db_path, query or {}),
+        lambda db_path, payload, query, **kw: _list_listing_projections(db_path, query or {}, payload),
     ),
     RouteEntry(
         {"GET"},
         "/v1/merchant/listings/{sku}/projection",
-        lambda db_path, payload, query, sku: _get_listing_projection(db_path, sku),
+        lambda db_path, payload, query, sku: _get_listing_projection(db_path, sku, payload),
     ),
     RouteEntry(
         {"POST"},

{shopping_cli-3.0.2 → shopping_cli-3.1.0}/shopping_cli/core/catalog.py

@@ -6,6 +6,7 @@ import math
 import re
 import sqlite3
 from typing import Any, Mapping
+from urllib.parse import urlparse
 
 from shopping_cli.core.errors import ConflictError, NotFoundError, ValidationError
 from shopping_cli.core.harness import append_audit_event
@@ -114,6 +115,27 @@ def _whole_int(value: Any, message: str) -> int:
 
 # safe_non_negative_int / safe_non_negative_float are imported from core.limits
 
+# 审查 P2-A：可无 ``://`` 出现的危险伪 scheme，一律拒绝（opaque 放行见下）。
+_BLOCKED_HANDOFF_SCHEMES = frozenset({"javascript", "data", "file", "vbscript", "blob"})
+
+
+def _validate_handoff_destination(value: str) -> None:
+    """handoff_destination 形态校验（审查 P2-A）。
+
+    空值允许；值呈现 URL 形态（含 ``://``）必须是合法 http/https origin，
+    拒绝其他一切 scheme；``javascript:``/``data:`` 等危险伪 scheme 即使
+    无 ``://`` 也拒绝；纯 opaque 引用串（chat-id、文档引用等）原样允许。
+    """
+    if not value:
+        return
+    parsed = urlparse(value)
+    scheme = parsed.scheme.lower()
+    if "://" in value:
+        if scheme not in ("http", "https") or not parsed.hostname:
+            raise ValidationError("handoff destination URL must be a valid http(s) origin")
+    elif scheme in _BLOCKED_HANDOFF_SCHEMES:
+        raise ValidationError(f"handoff destination scheme is not allowed: {scheme}")
+
 
 def _audit_catalog(conn: sqlite3.Connection, merchant_id: str, event: str, details: dict) -> None:
     """catalog 写操作审计（conversation_id=''——非会话域事件）。
@@ -329,6 +351,7 @@ def create_product(
     category = bounded_text(category, "product category", MAX_SHORT_TEXT_CHARS)
     currency = bounded_text(currency, "currency", 16)
     handoff_destination = bounded_text(handoff_destination, "handoff destination", MAX_PERSISTED_TEXT_CHARS)
+    _validate_handoff_destination(handoff_destination)
     if not merchant_id:
         raise ValidationError("merchant id is required")
     if not sku:
@@ -405,6 +428,7 @@ def update_product(
         handoff_destination = bounded_text(
             handoff_destination, "handoff destination", MAX_PERSISTED_TEXT_CHARS
         )
+        _validate_handoff_destination(handoff_destination)
     if price is not None:
         price = _price_with_precision(price, "--price must be finite")
     if stock is not None:
@@ -606,6 +630,7 @@ def _product_summary_from_search_row(row: sqlite3.Row) -> dict[str, Any]:
         "currency": row["currency"],
         "stock": _safe_non_negative_int(row["stock"]),
         "delivery_attributes": decode_json(row["delivery_attributes_json"], []),
+        "handoff_destination": row["handoff_destination"] or "",
         "merchant": merchant,
         "delivery": merchant["delivery"],
         "warnings": product_warnings(row, merchant),

{shopping_cli-3.0.2 → shopping_cli-3.1.0}/shopping_cli/core/catalog_views.py

@@ -21,10 +21,15 @@ def public_product_summary(product: dict[str, Any]) -> dict[str, Any]:
     出网精确 stock，可逐 SKU 枚举全平台库存）。需要精确库存的商家走
     merchant_product_summary（handler 层 owner 鉴权门）。
 
+    handoff_destination 是商家私有成交入口（谈判达成后由商家 Agent 点对点
+    交给买家），公开/匿名投影一律剥离（审查 P2-B），同款纪律参照
+    public_merchant_summary 剥离 contact；认证商家读走 merchant_product_summary。
+
     对已投影数据幂等：含 ``stock`` 时替换为 availability_hint；不含则保留
     已有 hint（审查 P1-02：幂等回放响应二次投影不丢失 in_stock）。
     """
     summary = dict(product)
+    summary.pop("handoff_destination", None)
     if "stock" in summary:
         stock = summary.pop("stock", None)
         summary["availability_hint"] = (

{shopping_cli-3.0.2 → shopping_cli-3.1.0}/shopping_cli/db/migrations.py

@@ -10,7 +10,7 @@ from typing import Callable
 
 from shopping_cli.core.tokens import is_sha256_digest, token_digest, token_prefix, token_suffix
 
-CURRENT_SCHEMA_VERSION = 22
+CURRENT_SCHEMA_VERSION = 23
 
 
 @dataclass(frozen=True)
@@ -386,6 +386,62 @@ def migration_022_product_handoff_destination(conn: sqlite3.Connection) -> None:
     ensure_column(conn, "products", "handoff_destination", "text not null default ''")
 
 
+def migration_023_remove_scheme_a_stub_merchants(conn: sqlite3.Connection) -> None:
+    """方案A 窗口期 stub 商家行清理（审查 P3-02）。
+
+    已拆除的方案A ``_ensure_merchant_exists``（5ad9ec8 移除）曾插入
+    ``name == id``、无任何 api_tokens 行的 stub 商家：这些行无法认证，却挡
+    ``POST /merchants`` 同 id 重建（ConflictError）。删除无 token 且名下无
+    业务行的 stub；仍有 products/policies/delivery_rules/conversations 行的
+    跳过并记 audit_events——外键无 ON DELETE CASCADE，不静默丢业务数据。
+    """
+    child_tables = ("products", "policies", "delivery_rules", "conversations")
+    rows = conn.execute(
+        """
+        select id from merchants
+        where name = id
+          and not exists (
+              select 1 from api_tokens where api_tokens.merchant_id = merchants.id
+          )
+        """
+    ).fetchall()
+    now = datetime.now().replace(microsecond=0).isoformat()
+    for row in rows:
+        merchant_id = str(row["id"])
+        dependents = {
+            table: int(
+                conn.execute(
+                    f"select count(*) from {table} where merchant_id = ?", (merchant_id,)
+                ).fetchone()[0]
+            )
+            for table in child_tables
+        }
+        dependents = {table: count for table, count in dependents.items() if count}
+        if dependents:
+            conn.execute(
+                """
+                insert into audit_events(conversation_id, actor, event, details_json, created_at)
+                values ('', 'system', 'stub_merchant_retained', ?, ?)
+                """,
+                (
+                    json.dumps(
+                        {
+                            "event_type": "stub_merchant_retained",
+                            "merchant_id": merchant_id,
+                            "dependents": dependents,
+                            "reason": "scheme_a_stub_with_business_rows",
+                            "source": "migration_023_remove_scheme_a_stub_merchants",
+                        },
+                        ensure_ascii=False,
+                        sort_keys=True,
+                    ),
+                    now,
+                ),
+            )
+            continue
+        conn.execute("delete from merchants where id = ?", (merchant_id,))
+
+
 MIGRATIONS: tuple[Migration, ...] = (
     Migration(1, "conversation_next_actor", migration_001_conversation_next_actor),
     Migration(2, "agent_runtime_columns", migration_002_agent_runtime_columns),
@@ -402,6 +458,7 @@ MIGRATIONS: tuple[Migration, ...] = (
     Migration(20, "buyer_ledger_buyer_dimension", migration_020_buyer_ledger_buyer_dimension),
     Migration(21, "channel_ingress_stale_marker", migration_021_channel_ingress_stale_marker),
     Migration(22, "product_handoff_destination", migration_022_product_handoff_destination),
+    Migration(23, "remove_scheme_a_stub_merchants", migration_023_remove_scheme_a_stub_merchants),
 )
 
 

{shopping_cli-3.0.2 → shopping_cli-3.1.0/shopping_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: shopping-cli
-Version: 3.0.2
+Version: 3.1.0
 Summary: Standalone local-commerce AI consultation marketplace runtime
 License:                                  Apache License
                                    Version 2.0, January 2004

{shopping_cli-3.0.2 → shopping_cli-3.1.0}/shopping_cli/services/tokens.py

@@ -2,8 +2,8 @@
 
 from __future__ import annotations
 
-import secrets
 import os
+import secrets
 from datetime import datetime, timedelta
 from typing import Any