11 commits

Author	SHA1	Message	Date
lekss361	6507a5af64	fixup(tradein): address deep-review BLOCK findings on FDW PR ... Critical: - data/sql/100_tradein_fdw_role.sql — remove hardcoded password literal; role created LOGIN only; explicit REVOKE perimeter on all tables/sequences/functions in public; only v_tradein_cad_buildings grant remains. Password is now set by .forgejo/workflows/deploy.yml ALTER ROLE bootstrap step reading GENDESIGN_FDW_PASSWORD from backend/.env.runtime. - tradein-mvp/backend/app/core/fdw.py — strict regex whitelist on password ([A-Za-z0-9_-]{32,256}) before inlining into DDL; ValueError on mismatch (no password in error message); pg_user_mappings query corrected for PUBLIC mapping (usename IS NULL); commit wrapped in try/rollback. High: - 060_postgres_fdw_extension.sql — connect_timeout='3' added to FOREIGN SERVER; ALTER SERVER ADD/SET fallback for re-apply path. - geocoder.py — _cadastral_forward_sync / _cadastral_reverse_sync wrapped in asyncio.to_thread to avoid blocking event loop on FDW outage. Tests: - 3 new test_cadastral_reverse.py cases: SQL injection password rejected, short password rejected, valid hex password accepted with mapping creation. Old password 40473b7c... remains in git history at 698ef4f (force-push forbidden) — but the role was never created with it on prod (SQL not deployed), so abandoned. New password 72df... lives only in VPS env files and vault meta/00_credentials.md.	2026-05-24 11:50:51 +03:00
lekss361	698ef4f003	feat(tradein): postgres_fdw live read of gendesign.cad_buildings (replaces snapshot) ... Replaces tradein.cad_buildings manual snapshot (36k rows, frozen 2026-05-22) with live postgres_fdw foreign table reading gendesign.v_tradein_cad_buildings directly. Also reverts PR #492 HTTP-based cadastral.py — superseded by FDW. Architecture: - gendesign DB: new role tradein_fdw_reader + flat view v_tradein_cad_buildings (EKB-only slice of cad_buildings with lat/lon flattened from geom) - networks: gendesign-postgres added to gendesign_shared (alias); tradein-postgres added to gendesign_shared for FDW connect - tradein DB: postgres_fdw extension + FOREIGN TABLE gendesign_cad_buildings - tradein backend: startup hook creates/refreshes USER MAPPING with password from env GENDESIGN_FDW_PASSWORD (password rotation handled via restart) - geocoder.py: cadastral primary for forward + reverse + suggest; Yandex/Nominatim fallback. reverse_geocode wraps Nominatim in try/except — no more HTTPStatusError → 500. - house_metadata.py and trade_in.py admin stats switched to foreign table - DROP TABLE cad_buildings in tradein (legacy snapshot removed entirely) - import-cadastre.sh deleted (no manual sync needed) Fixes: - /trade-in/api/v1/geocode/reverse 500 (Nominatim ban → no fallback) - estimate confidence_explanation=address_not_geocoded for addresses in our cadastre (e.g. Хохрякова 81) that Nominatim doesn't return Deploy ordering: main migration 100_tradein_fdw_role.sql adds role+view first (strict deploy.yml). Tradein next deploy applies 060_postgres_fdw_extension.sql and 061_drop_legacy_cad_buildings.sql (idempotent, errors ignored). Tradein backend startup creates USER MAPPING when env var present. Verify post-deploy with: docker exec tradein-postgres psql -U tradein -d tradein -c \ "SELECT count(*) FROM gendesign_cad_buildings" # expect ~36k EKB buildings.	2026-05-24 11:13:44 +03:00
lekss361	0efd2dca1d	feat(tradein): cadastral reverse geocode via main backend cad_buildings (#492)	2026-05-24 07:31:12 +00:00
lekss361	9643979d2c	feat(tradein): Phase 3.2 — /api/v1/search endpoint + Redis cache (#479) ... POST /api/v1/search reading listings_search_mv with ~20 cross-source filters, parameterized SQL (CAST(:x AS type), psycopg v3), whitelisted ORDER BY (Pydantic Literal), Redis 5min hot cache with graceful degradation (singleton pool via lru_cache). Verified vs data/sql/050_search_optimization.sql: matview column refs (total_area, lng, house_rating, sources[], has_avito/cian/yandex), SQL injection safety, cache failure swallow, router prefix. Deep-code-reviewer: APPROVE.	2026-05-23 14:44:22 +00:00
lekss361	dbad7a626b	fix(tradein): убрать require_admin полностью — Caddy basic_auth достаточен (#474)	2026-05-23 14:21:01 +00:00
lekss361	2dd76ea5e8	feat(tradein): cian_session cookies management + admin endpoints (Wave 4 Worker A) (#457)	2026-05-23 13:22:00 +00:00
lekss361	5e3ba351a0	fix(tradein): security hotfix — C-3 config default + C-4 empty estimate persist + C-6 PDF URL allowlist (#435)	2026-05-23 09:38:23 +00:00
TradeIn Deploy	59ad41c183	feat(tradein): мониторинг ошибок через GlitchTip (#396) ... Подключаем tradein-backend к GlitchTip (Sentry-совместимый, уже на сервере). Необработанные исключения FastAPI улетают в дашборд — баг estimate-500 (#388/#389) был бы виден сразу с трейсбеком. - sentry-sdk в зависимостях. - main.py — sentry_sdk.init(), env-gated: пусто GLITCHTIP_DSN → off. - config.glitchtip_dsn + GLITCHTIP_DSN в docker-compose.prod.yml. - traces_sample_rate=0 (только ошибки), send_default_pii=False. Активация: создать проект в GlitchTip → DSN в .env.runtime.	2026-05-22 11:18:26 +05:00
TradeIn Deploy	63c96628e3	feat(tradein): прогноз срока продажи + rate-limit (#9,#16)	2026-05-21 20:12:49 +03:00
TradeIn Deploy	7adb7cff66	feat(tradein): auth на admin-эндпоинтах (#2) ... /api/v1/admin/scrape и geocode-missing закрыты X-Admin-Token. settings.admin_token (env ADMIN_TOKEN). Пусто = открыто (dev), задано = требуем заголовок. cron шлёт токен из .env.runtime.	2026-05-21 19:47:01 +03:00
lekss361	02267d0306	feat: add tradein-mvp subproject (Trade-In Estimator под /trade-in) ... - FastAPI backend: PostGIS estimator + 3 scrapers (Avito/Cian/Yandex) - Next.js 15 frontend: tradein.html mockup design, basePath=/trade-in - WeasyPrint PDF (Брусника-style 4-page report) - Address autocomplete с typo-tolerance + 6 EKB presets - Изолированный docker stack gendesign-tradein (отдельная postgres БД) - Caddy inline routes: gendsgn.ru/trade-in/* и /trade-in/api/v1/* - Forgejo Actions: .forgejo/workflows/deploy-tradein.yml (shell-based GHCR login) - Триггер только по paths: tradein-mvp/** (не пересекается с deploy.yml) - Образы: ghcr.io/lekss361/gendesign-tradein-{backend,frontend}:latest Первый запуск на сервере (вручную, один раз): - создать /opt/gendesign/tradein-mvp/.env.runtime (postgres pwd, contact email) - docker network create gendesign_shared (если нет) - docker compose -p gendesign-tradein up -d - docker compose -p gendesign exec caddy caddy reload	2026-05-21 00:25:39 +03:00