lekss361
94cf199276
Some checks failed
Deploy Trade-In / changes (push) Successful in 5s
Deploy / changes (push) Successful in 5s
Deploy Trade-In / build-frontend (push) Successful in 26s
Deploy Trade-In / build-backend (push) Successful in 47s
Deploy / build-frontend (push) Successful in 29s
Deploy / build-backend (push) Successful in 1m24s
Deploy Trade-In / deploy (push) Successful in 40s
Deploy / build-worker (push) Successful in 2m57s
Deploy / deploy (push) Failing after 37s
Replaces tradein.cad_buildings snapshot with live postgres_fdw foreign table reading gendesign.v_tradein_cad_buildings. Fixes /trade-in/api/v1/geocode/reverse 500 (Nominatim ban) and address_not_geocoded for cadastre addresses (e.g. Хохрякова 81).
Security (deep-review fixes):
- 100_tradein_fdw_role.sql: passwordless CREATE ROLE; password set by deploy.yml ALTER ROLE bootstrap reading GENDESIGN_FDW_PASSWORD from backend/.env.runtime (via psql :'pw' var → format %L — injection-safe).
- core/fdw.py: regex whitelist [A-Za-z0-9_-]{32,256} on password, ValueError without echoing value, try/rollback on commit.
- 060_postgres_fdw_extension.sql: connect_timeout='3' on FOREIGN SERVER + ALTER ADD/SET fallback.
- geocoder.py: _cadastral_forward_sync / _cadastral_reverse_sync wrapped in asyncio.to_thread.
- 100_*.sql: REVOKE ALL ON ALL TABLES/SEQUENCES/FUNCTIONS IN SCHEMA public; only GRANT SELECT on v_tradein_cad_buildings.
- pg_user_mappings query handles PUBLIC mapping (usename IS NULL).
Tests: 3 SQL-injection guards on ensure_fdw_user_mapping + rewritten cadastral suite.
87 lines
2.9 KiB
Python
87 lines
2.9 KiB
Python
"""Geocode endpoints — debug + frontend Suggest proxy."""
|
||
|
||
from __future__ import annotations
|
||
|
||
import logging
|
||
from typing import Annotated
|
||
|
||
from fastapi import APIRouter, Depends, HTTPException, Query
|
||
from pydantic import BaseModel
|
||
from sqlalchemy.orm import Session
|
||
|
||
from app.core.db import get_db
|
||
from app.services.geocoder import GeocodeResult, geocode, reverse_geocode, suggest
|
||
|
||
logger = logging.getLogger(__name__)
|
||
|
||
router = APIRouter()
|
||
|
||
|
||
@router.get("/lookup", response_model=GeocodeResult)
|
||
async def lookup(
|
||
address: Annotated[str, Query(min_length=3, max_length=500)],
|
||
db: Annotated[Session, Depends(get_db)],
|
||
) -> GeocodeResult:
|
||
"""Геокодинг адреса → lat/lon.
|
||
|
||
Примеры:
|
||
/api/v1/geocode/lookup?address=ул.+Малышева+30+Екатеринбург
|
||
/api/v1/geocode/lookup?address=Куйбышева+50+Екатеринбург
|
||
"""
|
||
result = await geocode(address, db)
|
||
if result is None:
|
||
raise HTTPException(status_code=404, detail=f"Address not found: {address}")
|
||
return result
|
||
|
||
|
||
class SuggestItem(BaseModel):
|
||
label: str
|
||
full_address: str
|
||
lat: float
|
||
lon: float
|
||
kind: str
|
||
|
||
|
||
class SuggestResponse(BaseModel):
|
||
items: list[SuggestItem]
|
||
|
||
|
||
@router.get("/suggest", response_model=SuggestResponse)
|
||
async def suggest_addresses(
|
||
q: Annotated[str, Query(min_length=2, max_length=200, description="Запрос для автокомплита")],
|
||
limit: Annotated[int, Query(ge=1, le=15)] = 8,
|
||
db: Annotated[Session, Depends(get_db)] = None, # type: ignore[assignment]
|
||
) -> SuggestResponse:
|
||
"""Автокомплит адресов в пределах ЕКБ.
|
||
|
||
Используется в EstimateForm для подсказок пока пользователь печатает.
|
||
Bounded viewbox = ЕКБ (lon 60.40-60.85, lat 56.65-56.95).
|
||
|
||
Пример:
|
||
/api/v1/geocode/suggest?q=Малышева
|
||
/api/v1/geocode/suggest?q=Цвиллинга # → пусто, такой улицы в ЕКБ нет
|
||
"""
|
||
items = await suggest(q, db=db, limit=limit)
|
||
return SuggestResponse(items=[
|
||
SuggestItem(
|
||
label=s.label,
|
||
full_address=s.full_address,
|
||
lat=s.lat, lon=s.lon, kind=s.kind,
|
||
) for s in items
|
||
])
|
||
|
||
|
||
@router.get("/reverse")
|
||
async def reverse(
|
||
lat: Annotated[float, Query(ge=-90, le=90)],
|
||
lon: Annotated[float, Query(ge=-180, le=180)],
|
||
db: Annotated[Session, Depends(get_db)] = None, # type: ignore[assignment]
|
||
) -> dict[str, object]:
|
||
"""Обратный геокодинг — координаты с карты → адрес (map-picker).
|
||
|
||
Пример: /api/v1/geocode/reverse?lat=56.8389&lon=60.6057
|
||
"""
|
||
address = await reverse_geocode(lat, lon, db=db)
|
||
if address is None:
|
||
raise HTTPException(status_code=404, detail="address not found for coordinates")
|
||
return {"address": address, "lat": lat, "lon": lon}
|