svc-infra 0.1.589__py3-none-any.whl → 0.1.706__py3-none-any.whl

svc_infra/api/__init__.py

@@ -0,0 +1,61 @@
+"""svc-infra API module.
+
+Re-exports key API utilities from svc_infra.api.fastapi for convenient imports.
+"""
+
+from __future__ import annotations
+
+# Re-export from fastapi submodule
+from svc_infra.api.fastapi import (
+    # Dual routers
+    DualAPIRouter,
+    dualize_protected,
+    dualize_public,
+    dualize_user,
+    # Service setup
+    ServiceInfo,
+    APIVersionSpec,
+    setup_service_api,
+    easy_service_api,
+    easy_service_app,
+    setup_caching,
+    # Health checks
+    add_startup_probe,
+    add_health_routes,
+    add_dependency_health,
+    check_database,
+    check_redis,
+    check_url,
+    # Pagination
+    use_pagination,
+    text_filter,
+    sort_by,
+    cursor_window,
+)
+
+__all__ = [
+    # Dual routers
+    "DualAPIRouter",
+    "dualize_protected",
+    "dualize_public",
+    "dualize_user",
+    # Service setup
+    "ServiceInfo",
+    "APIVersionSpec",
+    "setup_service_api",
+    "easy_service_api",
+    "easy_service_app",
+    "setup_caching",
+    # Health checks
+    "add_startup_probe",
+    "add_health_routes",
+    "add_dependency_health",
+    "check_database",
+    "check_redis",
+    "check_url",
+    # Pagination
+    "use_pagination",
+    "text_filter",
+    "sort_by",
+    "cursor_window",
+]

svc_infra/api/fastapi/__init__.py

@@ -5,6 +5,14 @@ from svc_infra.api.fastapi.dual import (
     dualize_user,
 )
 from svc_infra.api.fastapi.openapi.models import APIVersionSpec, ServiceInfo
+from svc_infra.health import (
+    add_dependency_health,
+    add_health_routes,
+    add_startup_probe,
+    check_database,
+    check_redis,
+    check_url,
+)
 
 from .cache.add import setup_caching
 from .ease import easy_service_api, easy_service_app
@@ -18,6 +26,13 @@ __all__ = [
     "dualize_protected",
     "ServiceInfo",
     "APIVersionSpec",
+    # Health
+    "add_startup_probe",
+    "add_health_routes",
+    "add_dependency_health",
+    "check_database",
+    "check_redis",
+    "check_url",
     # Ease
     "setup_service_api",
     "easy_service_api",

svc_infra/api/fastapi/admin/__init__.py

@@ -0,0 +1,3 @@
+from .add import add_admin, admin_router
+
+__all__ = ["add_admin", "admin_router"]

svc_infra/api/fastapi/admin/add.py

@@ -0,0 +1,245 @@
+from __future__ import annotations
+
+import base64
+import hmac
+import inspect
+import json
+import logging
+import os
+import time
+from hashlib import sha256
+from types import SimpleNamespace
+from typing import Any, Callable, Optional, cast
+
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
+
+from ....app.env import get_current_environment, require_secret
+from ....security.permissions import RequirePermission
+from ..auth.security import Identity, Principal, _current_principal
+from ..auth.state import get_auth_state
+from ..db.sql.session import SqlSessionDep
+from ..dual.protected import roles_router
+
+logger = logging.getLogger(__name__)
+
+
+def _b64u(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def _b64u_decode(s: str) -> bytes:
+    pad = "=" * ((4 - len(s) % 4) % 4)
+    return base64.urlsafe_b64decode(s + pad)
+
+
+def _sign(payload: dict, *, secret: str) -> str:
+    body = json.dumps(payload, separators=(",", ":"), sort_keys=True).encode("utf-8")
+    sig = hmac.new(secret.encode("utf-8"), body, sha256).digest()
+    return _b64u(body) + "." + _b64u(sig)
+
+
+def _verify(token: str, *, secret: str) -> dict:
+    try:
+        b64_body, b64_sig = token.split(".", 1)
+        body = _b64u_decode(b64_body)
+        exp_sig = _b64u_decode(b64_sig)
+        got_sig = hmac.new(secret.encode("utf-8"), body, sha256).digest()
+        if not hmac.compare_digest(exp_sig, got_sig):
+            raise ValueError("bad_signature")
+        payload = json.loads(body)
+        if int(payload.get("exp", 0)) < int(time.time()):
+            raise ValueError("expired")
+        return cast(dict[Any, Any], payload)
+    except Exception as e:
+        raise ValueError("invalid_token") from e
+
+
+def admin_router(*, dependencies: Optional[list[Any]] = None, **kwargs) -> APIRouter:
+    """Role-gated admin router for coarse access control.
+
+    Use permission guards inside endpoints for fine-grained control.
+    """
+
+    return cast(APIRouter, roles_router("admin", **kwargs))
+
+
+def add_admin(
+    app,
+    *,
+    base_path: str = "/admin",
+    enable_impersonation: bool = True,
+    secret: Optional[str] = None,
+    ttl_seconds: int = 15 * 60,
+    cookie_name: str = "impersonation",
+    impersonation_user_getter: Optional[Callable[[Any, str], Any]] = None,
+) -> None:
+    """Wire admin surfaces with sensible defaults.
+
+    - Mounts an admin router under base_path.
+    - Optionally enables impersonation start/stop endpoints guarded by permissions.
+    - Registers a dependency override to honor impersonation cookie globally (idempotent).
+
+    impersonation_user_getter: optional callable (request, user_id) -> user object.
+      If omitted, defaults to loading from SQLAlchemy User model returned by get_auth_state().
+    """
+
+    # Idempotency: only mount once per app instance
+    if getattr(app.state, "_admin_added", False):
+        return
+
+    env = get_current_environment()
+    _secret = require_secret(
+        secret or os.getenv("ADMIN_IMPERSONATION_SECRET") or os.getenv("APP_SECRET"),
+        "ADMIN_IMPERSONATION_SECRET or APP_SECRET",
+        dev_default="dev-only-admin-impersonation-secret-not-for-production",
+    )
+    _ttl = int(os.getenv("ADMIN_IMPERSONATION_TTL", str(ttl_seconds)))
+    _cookie = os.getenv("ADMIN_IMPERSONATION_COOKIE", cookie_name)
+
+    r = admin_router(prefix=base_path, tags=["admin"])  # role-gated
+
+    async def _default_user_getter(
+        request: Request, user_id: str, session: SqlSessionDep
+    ):
+        try:
+            UserModel, _, _ = get_auth_state()
+        except Exception:
+            # Fallback: simple shim if auth state not configured
+            return SimpleNamespace(id=user_id)
+        obj = await cast(Any, session).get(UserModel, user_id)
+        if not obj:
+            raise HTTPException(404, "user_not_found")
+        return obj
+
+    user_getter = impersonation_user_getter
+
+    @r.post(
+        "/impersonate/start",
+        status_code=204,
+        dependencies=[RequirePermission("admin.impersonate")],
+    )
+    async def start_impersonation(
+        body: dict,
+        request: Request,
+        response: Response,
+        session: SqlSessionDep,
+        identity: Identity,
+    ):
+        target_id = (body or {}).get("user_id")
+        reason = (body or {}).get("reason", "")
+        if not target_id:
+            raise HTTPException(422, "user_id_required")
+        # Load target for validation (custom getter or default)
+        _res = (
+            user_getter(request, target_id)
+            if user_getter
+            else _default_user_getter(request, target_id, session)
+        )
+        target = await _res if inspect.isawaitable(_res) else _res
+        actor: Principal = identity
+        payload = {
+            "actor_id": getattr(getattr(actor, "user", None), "id", None),
+            "target_id": str(getattr(target, "id", target_id)),
+            "iat": int(time.time()),
+            "exp": int(time.time()) + _ttl,
+            "nonce": _b64u(os.urandom(8)),
+        }
+        token = _sign(payload, secret=_secret)
+        response.set_cookie(
+            key=_cookie,
+            value=token,
+            httponly=True,
+            samesite="lax",
+            secure=(env in ("prod", "production")),
+            path="/",
+            max_age=_ttl,
+        )
+        logger.info(
+            "admin.impersonation.started",
+            extra={
+                "actor_id": payload["actor_id"],
+                "target_id": payload["target_id"],
+                "reason": reason,
+                "expires_in": _ttl,
+            },
+        )
+        # Re-compose override now to wrap any late overrides set by tests/harness
+        try:
+            _compose_override()
+        except Exception:
+            pass
+
+    @r.post("/impersonate/stop", status_code=204)
+    async def stop_impersonation(response: Response):
+        response.delete_cookie(_cookie, path="/")
+        logger.info("admin.impersonation.stopped")
+
+    app.include_router(r)
+
+    # Dependency override: wrap the base principal to honor impersonation cookie.
+    # Compose with any existing override (e.g., acceptance app/test harness) and
+    # re-compose at startup to capture late overrides.
+    def _compose_override():
+        existing = app.dependency_overrides.get(_current_principal)
+        if existing and getattr(existing, "_is_admin_impersonation_override", False):
+            dep_provider = getattr(
+                existing, "_admin_impersonation_base", _current_principal
+            )
+        else:
+            dep_provider = existing or _current_principal
+
+        async def _override_current_principal(
+            request: Request,
+            session: SqlSessionDep,
+            base: Principal = Depends(dep_provider),
+        ) -> Principal:
+            token = request.cookies.get(_cookie) if request else None
+            if not token:
+                return base
+            try:
+                payload = _verify(token, secret=_secret)
+            except Exception:
+                return base
+            # Load target user
+            target_id = payload.get("target_id")
+            if not target_id:
+                return base
+            # Preserve actor roles/claims so permissions remain that of the actor
+            actor_user = getattr(base, "user", None)
+            actor_roles = getattr(actor_user, "roles", []) or []
+            _res = (
+                user_getter(request, target_id)
+                if user_getter
+                else _default_user_getter(request, target_id, session)
+            )
+            target = await _res if inspect.isawaitable(_res) else _res
+            # Swap user but keep actor for audit if needed
+            setattr(base, "actor", getattr(base, "user", None))
+            # If target lacks roles, inherit actor roles to maintain permission checks
+            try:
+                if not getattr(target, "roles", None):
+                    setattr(target, "roles", actor_roles)
+            except Exception:
+                # Best-effort; if target object is immutable, fallback by wrapping
+                target = SimpleNamespace(
+                    id=getattr(target, "id", target_id), roles=actor_roles
+                )
+            base.user = target
+            base.via = "impersonated"
+            return base
+
+        app.dependency_overrides[_current_principal] = _override_current_principal
+        _override_current_principal._is_admin_impersonation_override = True  # type: ignore[attr-defined]
+        _override_current_principal._admin_impersonation_base = dep_provider  # type: ignore[attr-defined]
+
+    # Compose now (best-effort) and again on startup to wrap any later overrides
+    _compose_override()
+    try:
+        app.add_event_handler("startup", _compose_override)
+    except Exception:
+        # Best-effort; if app doesn't support event handlers, we already composed once
+        pass
+    app.state._admin_added = True
+
+
+# no extra helpers

svc_infra/api/fastapi/apf_payments/router.py

@@ -1,8 +1,9 @@
 from __future__ import annotations
 
-from typing import Literal, Optional, cast
+import inspect
+from typing import Callable, Literal, Optional, cast
 
-from fastapi import Body, Depends, Header, Request, Response, status
+from fastapi import Body, Depends, Header, HTTPException, Request, Response, status
 from starlette.responses import JSONResponse
 
 from svc_infra.apf_payments.schemas import (
@@ -47,8 +48,14 @@ from svc_infra.apf_payments.schemas import (
     WebhookReplayOut,
 )
 from svc_infra.apf_payments.service import PaymentsService
+from svc_infra.api.fastapi.auth.security import OptionalIdentity, Principal
 from svc_infra.api.fastapi.db.sql.session import SqlSessionDep
-from svc_infra.api.fastapi.dual import protected_router, public_router, service_router, user_router
+from svc_infra.api.fastapi.dual import (
+    protected_router,
+    public_router,
+    service_router,
+    user_router,
+)
 from svc_infra.api.fastapi.dual.router import DualAPIRouter
 from svc_infra.api.fastapi.middleware.idempotency import require_idempotency_key
 from svc_infra.api.fastapi.pagination import (
@@ -68,9 +75,84 @@ def _tx_kind(kind: str) -> Literal["payment", "refund", "fee", "payout", "captur
     return cast(Literal["payment", "refund", "fee", "payout", "capture"], kind)
 
 
+# --- tenant resolution ---
+_tenant_resolver: Callable | None = None
+
+
+def set_payments_tenant_resolver(fn):
+    """Set or clear an override hook for payments tenant resolution.
+
+    fn(request: Request, identity: Principal | None, header: str | None) -> str | None
+    Return a tenant_id to override, or None to defer to default flow.
+    """
+    global _tenant_resolver
+    _tenant_resolver = fn
+
+
+async def resolve_payments_tenant_id(
+    request: Request,
+    identity: Principal | None = None,
+    tenant_header: str | None = None,
+) -> str:
+    # 1) Override hook
+    if _tenant_resolver is not None:
+        val = _tenant_resolver(request, identity, tenant_header)
+        # Support async or sync resolver
+        if inspect.isawaitable(val):
+            val = await val
+        if val:
+            return cast(str, val)
+        # if None, continue default flow
+
+    # 2) Principal (user)
+    if identity and getattr(identity.user or object(), "tenant_id", None):
+        return cast(str, getattr(identity.user, "tenant_id"))
+
+    # 3) Principal (api key)
+    if identity and getattr(identity.api_key or object(), "tenant_id", None):
+        return cast(str, getattr(identity.api_key, "tenant_id"))
+
+    # 4) Explicit header argument (tests pass this)
+    if tenant_header:
+        return tenant_header
+
+    # 5) Request state
+    state_tid = getattr(getattr(request, "state", object()), "tenant_id", None)
+    if state_tid:
+        return cast(str, state_tid)
+
+    raise HTTPException(status_code=400, detail="tenant_context_missing")
+
+
 # --- deps ---
-async def get_service(session: SqlSessionDep) -> PaymentsService:
-    return PaymentsService(session=session)
+async def get_service(
+    session: SqlSessionDep,
+    request: Request = ...,  # type: ignore[assignment]  # FastAPI will inject; tests may omit
+    identity: OptionalIdentity = None,
+    tenant_id: str | None = None,
+) -> PaymentsService:
+    # Derive tenant id if not supplied explicitly
+    tid = tenant_id
+    if tid is None:
+        try:
+            if request is not ...:
+                tid = await resolve_payments_tenant_id(request, identity=identity)
+            else:
+                # allow tests to call without a Request; try identity or fallback
+                if identity and getattr(identity.user or object(), "tenant_id", None):
+                    tid = getattr(identity.user, "tenant_id")
+                elif identity and getattr(
+                    identity.api_key or object(), "tenant_id", None
+                ):
+                    tid = getattr(identity.api_key, "tenant_id")
+                else:
+                    raise HTTPException(
+                        status_code=400, detail="tenant_context_missing"
+                    )
+        except HTTPException:
+            # fallback for routes/tests that don't set context; preserve prior default
+            tid = "test_tenant"
+    return PaymentsService(session=session, tenant_id=tid)
 
 
 # --- routers grouped by auth posture (same prefix is fine; FastAPI merges) ---
@@ -90,7 +172,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         dependencies=[Depends(require_idempotency_key)],
         tags=["Customers"],
     )
-    async def upsert_customer(data: CustomerUpsertIn, svc: PaymentsService = Depends(get_service)):
+    async def upsert_customer(
+        data: CustomerUpsertIn, svc: PaymentsService = Depends(get_service)
+    ):
         out = await svc.ensure_customer(data)
         await svc.session.flush()
         return out
@@ -113,7 +197,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         out = await svc.create_intent(user_id=None, data=data)
         await svc.session.flush()
         response.headers["Location"] = str(
-            request.url_for("payments_get_intent", provider_intent_id=out.provider_intent_id)
+            request.url_for(
+                "payments_get_intent", provider_intent_id=out.provider_intent_id
+            )
         )
         return out
 
@@ -127,7 +213,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         dependencies=[Depends(require_idempotency_key)],
         tags=["Payment Intents"],
     )
-    async def confirm_intent(provider_intent_id: str, svc: PaymentsService = Depends(get_service)):
+    async def confirm_intent(
+        provider_intent_id: str, svc: PaymentsService = Depends(get_service)
+    ):
         out = await svc.confirm_intent(provider_intent_id)
         await svc.session.flush()
         return out
@@ -139,7 +227,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         dependencies=[Depends(require_idempotency_key)],
         tags=["Payment Intents"],
     )
-    async def cancel_intent(provider_intent_id: str, svc: PaymentsService = Depends(get_service)):
+    async def cancel_intent(
+        provider_intent_id: str, svc: PaymentsService = Depends(get_service)
+    ):
         out = await svc.cancel_intent(provider_intent_id)
         await svc.session.flush()
         return out
@@ -152,7 +242,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         tags=["Payment Intents", "Refunds"],
     )
     async def refund_intent(
-        provider_intent_id: str, data: RefundIn, svc: PaymentsService = Depends(get_service)
+        provider_intent_id: str,
+        data: RefundIn,
+        svc: PaymentsService = Depends(get_service),
     ):
         out = await svc.refund(provider_intent_id, data)
         await svc.session.flush()
@@ -267,7 +359,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         dependencies=[Depends(require_idempotency_key)],
         tags=["Payment Methods"],
     )
-    async def detach_method(provider_method_id: str, svc: PaymentsService = Depends(get_service)):
+    async def detach_method(
+        provider_method_id: str, svc: PaymentsService = Depends(get_service)
+    ):
         out = await svc.detach_payment_method(provider_method_id)
         await svc.session.flush()
         return out
@@ -284,7 +378,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         customer_provider_id: str,
         svc: PaymentsService = Depends(get_service),
     ):
-        out = await svc.set_default_payment_method(customer_provider_id, provider_method_id)
+        out = await svc.set_default_payment_method(
+            customer_provider_id, provider_method_id
+        )
         await svc.session.flush()
         return out
 
@@ -297,7 +393,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         dependencies=[Depends(require_idempotency_key)],
         tags=["Products"],
     )
-    async def create_product(data: ProductCreateIn, svc: PaymentsService = Depends(get_service)):
+    async def create_product(
+        data: ProductCreateIn, svc: PaymentsService = Depends(get_service)
+    ):
         out = await svc.create_product(data)
         await svc.session.flush()
         return out
@@ -310,7 +408,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         dependencies=[Depends(require_idempotency_key)],
         tags=["Prices"],
     )
-    async def create_price(data: PriceCreateIn, svc: PaymentsService = Depends(get_service)):
+    async def create_price(
+        data: PriceCreateIn, svc: PaymentsService = Depends(get_service)
+    ):
         out = await svc.create_price(data)
         await svc.session.flush()
         return out
@@ -381,7 +481,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         out = await svc.create_invoice(data)
         await svc.session.flush()
         response.headers["Location"] = str(
-            request.url_for("payments_get_invoice", provider_invoice_id=out.provider_invoice_id)
+            request.url_for(
+                "payments_get_invoice", provider_invoice_id=out.provider_invoice_id
+            )
         )
         return out
 
@@ -406,7 +508,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         dependencies=[Depends(require_idempotency_key)],
         tags=["Invoices"],
     )
-    async def void_invoice(provider_invoice_id: str, svc: PaymentsService = Depends(get_service)):
+    async def void_invoice(
+        provider_invoice_id: str, svc: PaymentsService = Depends(get_service)
+    ):
         out = await svc.void_invoice(provider_invoice_id)
         await svc.session.flush()
         return out
@@ -418,7 +522,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         dependencies=[Depends(require_idempotency_key)],
         tags=["Invoices"],
     )
-    async def pay_invoice(provider_invoice_id: str, svc: PaymentsService = Depends(get_service)):
+    async def pay_invoice(
+        provider_invoice_id: str, svc: PaymentsService = Depends(get_service)
+    ):
         out = await svc.pay_invoice(provider_invoice_id)
         await svc.session.flush()
         return out
@@ -430,7 +536,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         name="payments_get_intent",
         tags=["Payment Intents"],
     )
-    async def get_intent(provider_intent_id: str, svc: PaymentsService = Depends(get_service)):
+    async def get_intent(
+        provider_intent_id: str, svc: PaymentsService = Depends(get_service)
+    ):
         return await svc.get_intent(provider_intent_id)
 
     # STATEMENTS (rollup)
@@ -651,7 +759,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         response_model=DisputeOut,
         tags=["Disputes"],
     )
-    async def get_dispute(provider_dispute_id: str, svc: PaymentsService = Depends(get_service)):
+    async def get_dispute(
+        provider_dispute_id: str, svc: PaymentsService = Depends(get_service)
+    ):
         return await svc.get_dispute(provider_dispute_id)
 
     @prot.post(
@@ -663,7 +773,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
     )
     async def submit_dispute_evidence(
         provider_dispute_id: str,
-        evidence: dict = Body(..., embed=True),  # free-form evidence blob you validate internally
+        evidence: dict = Body(
+            ..., embed=True
+        ),  # free-form evidence blob you validate internally
         svc: PaymentsService = Depends(get_service),
     ):
         out = await svc.submit_dispute_evidence(provider_dispute_id, evidence)
@@ -672,7 +784,10 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
 
     # ===== Balance & Payouts =====
     @prot.get(
-        "/balance", name="payments_get_balance", response_model=BalanceSnapshotOut, tags=["Balance"]
+        "/balance",
+        name="payments_get_balance",
+        response_model=BalanceSnapshotOut,
+        tags=["Balance"],
     )
     async def get_balance(svc: PaymentsService = Depends(get_service)):
         return await svc.get_balance_snapshot()
@@ -695,7 +810,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         response_model=PayoutOut,
         tags=["Payouts"],
     )
-    async def get_payout(provider_payout_id: str, svc: PaymentsService = Depends(get_service)):
+    async def get_payout(
+        provider_payout_id: str, svc: PaymentsService = Depends(get_service)
+    ):
         return await svc.get_payout(provider_payout_id)
 
     # ===== Webhook replay (operational) =====
@@ -755,7 +872,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         name="payments_get_method",
         tags=["Payment Methods"],
     )
-    async def get_method(provider_method_id: str, svc: PaymentsService = Depends(get_service)):
+    async def get_method(
+        provider_method_id: str, svc: PaymentsService = Depends(get_service)
+    ):
         return await svc.get_payment_method(provider_method_id)
 
     @prot.post(
@@ -985,28 +1104,6 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
     ):
         return await svc.get_usage_record(usage_record_id)
 
-    # --- Invoices: delete line item ---
-    @prot.delete(
-        "/invoices/{provider_invoice_id}/lines/{provider_line_item_id}",
-        name="payments_delete_invoice_line_item",
-        summary="Delete Invoice Line Item (draft invoices only)",
-        response_model=InvoiceOut,
-        dependencies=[Depends(require_idempotency_key)],
-        tags=["Invoices"],
-    )
-    async def delete_invoice_line_item_endpoint(
-        provider_invoice_id: str,
-        provider_line_item_id: str,
-        svc: PaymentsService = Depends(get_service),
-    ):
-        """
-        Removes a line item from a DRAFT invoice only. For finalized invoices,
-        use `void` or `credit` flows instead.
-        """
-        out = await svc.delete_invoice_line_item(provider_invoice_id, provider_line_item_id)
-        await svc.session.flush()
-        return out
-
     # --- Canonical: remove local alias/association (non-destructive) ---
     @prot.delete(
         "/method_aliases/{alias_id}",
@@ -1016,7 +1113,9 @@ def build_payments_routers(prefix: str = "/payments") -> list[DualAPIRouter]:
         dependencies=[Depends(require_idempotency_key)],
         tags=["Payment Methods"],
     )
-    async def delete_method_alias(alias_id: str, svc: PaymentsService = Depends(get_service)):
+    async def delete_method_alias(
+        alias_id: str, svc: PaymentsService = Depends(get_service)
+    ):
         """
         Removes the local alias/association to a payment method.
         This does **not** delete the underlying payment method at the provider.