lekss361
94cf199276
Some checks failed
Deploy Trade-In / changes (push) Successful in 5s
Deploy / changes (push) Successful in 5s
Deploy Trade-In / build-frontend (push) Successful in 26s
Deploy Trade-In / build-backend (push) Successful in 47s
Deploy / build-frontend (push) Successful in 29s
Deploy / build-backend (push) Successful in 1m24s
Deploy Trade-In / deploy (push) Successful in 40s
Deploy / build-worker (push) Successful in 2m57s
Deploy / deploy (push) Failing after 37s
Replaces tradein.cad_buildings snapshot with live postgres_fdw foreign table reading gendesign.v_tradein_cad_buildings. Fixes /trade-in/api/v1/geocode/reverse 500 (Nominatim ban) and address_not_geocoded for cadastre addresses (e.g. Хохрякова 81).
Security (deep-review fixes):
- 100_tradein_fdw_role.sql: passwordless CREATE ROLE; password set by deploy.yml ALTER ROLE bootstrap reading GENDESIGN_FDW_PASSWORD from backend/.env.runtime (via psql :'pw' var → format %L — injection-safe).
- core/fdw.py: regex whitelist [A-Za-z0-9_-]{32,256} on password, ValueError without echoing value, try/rollback on commit.
- 060_postgres_fdw_extension.sql: connect_timeout='3' on FOREIGN SERVER + ALTER ADD/SET fallback.
- geocoder.py: _cadastral_forward_sync / _cadastral_reverse_sync wrapped in asyncio.to_thread.
- 100_*.sql: REVOKE ALL ON ALL TABLES/SEQUENCES/FUNCTIONS IN SCHEMA public; only GRANT SELECT on v_tradein_cad_buildings.
- pg_user_mappings query handles PUBLIC mapping (usename IS NULL).
Tests: 3 SQL-injection guards on ensure_fdw_user_mapping + rewritten cadastral suite.
96 lines
3.4 KiB
Python
96 lines
3.4 KiB
Python
"""Trade-In MVP — FastAPI entry point.
|
|
|
|
Standalone версия, выделена из основного gendesign repo для локальной разработки.
|
|
Только trade-in фича; никаких других роутеров (concepts/parcels/analytics/etc) нет.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import asyncio
|
|
import logging
|
|
from collections.abc import AsyncGenerator
|
|
from contextlib import asynccontextmanager
|
|
|
|
import sentry_sdk
|
|
from fastapi import FastAPI
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
|
|
from app.api.v1 import admin, brand, geocode, search, trade_in
|
|
from app.core.config import settings
|
|
from app.core.db import SessionLocal
|
|
from app.core.fdw import ensure_fdw_user_mapping
|
|
from app.core.ratelimit import RateLimitMiddleware
|
|
from app.services.scheduler import scheduler_loop
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
logging.basicConfig(
|
|
level=logging.INFO,
|
|
format="%(asctime)s %(levelname)s %(name)s: %(message)s",
|
|
)
|
|
|
|
# Мониторинг ошибок — GlitchTip (Sentry-совместимый, #396).
|
|
# DSN из env GLITCHTIP_DSN; пусто (dev) → мониторинг не инициализируется.
|
|
if settings.glitchtip_dsn:
|
|
sentry_sdk.init(
|
|
dsn=settings.glitchtip_dsn,
|
|
environment=settings.environment,
|
|
traces_sample_rate=0.0, # только ошибки, без performance-трейсов
|
|
send_default_pii=False, # не шлём client_name / client_phone в отчёты
|
|
)
|
|
logging.getLogger("app.main").info("GlitchTip monitoring enabled")
|
|
|
|
|
|
@asynccontextmanager
|
|
async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
|
|
# FDW bootstrap: create/refresh USER MAPPING for gendesign_remote postgres_fdw server.
|
|
# Best-effort: failure does not abort startup, just logs.
|
|
try:
|
|
with SessionLocal() as db:
|
|
ensure_fdw_user_mapping(db)
|
|
except Exception:
|
|
logger.exception(
|
|
"FDW user mapping bootstrap failed — cadastral queries may fail"
|
|
)
|
|
|
|
# Startup: launch scheduler background task
|
|
scheduler_task = asyncio.create_task(scheduler_loop())
|
|
logger.info("FastAPI lifespan: scheduler task spawned")
|
|
yield
|
|
# Shutdown: cancel scheduler
|
|
scheduler_task.cancel()
|
|
try:
|
|
await scheduler_task
|
|
except asyncio.CancelledError:
|
|
pass
|
|
logger.info("FastAPI lifespan: scheduler cancelled cleanly")
|
|
|
|
|
|
app = FastAPI(
|
|
title="Trade-In MVP API",
|
|
description="Оценка вторичного жилья (выкупная стоимость) — копия trade-in feature из gendesign", # noqa: E501
|
|
version="0.1.0",
|
|
lifespan=lifespan,
|
|
)
|
|
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=settings.cors_origins,
|
|
allow_credentials=True,
|
|
allow_methods=["*"],
|
|
allow_headers=["*"],
|
|
)
|
|
# Rate-limit публичного API (per-IP sliding window) — защита от абуза.
|
|
app.add_middleware(RateLimitMiddleware)
|
|
|
|
|
|
@app.get("/health")
|
|
def health() -> dict[str, str]:
|
|
return {"status": "ok", "environment": settings.environment}
|
|
|
|
|
|
app.include_router(geocode.router, prefix="/api/v1/geocode", tags=["geocode"])
|
|
app.include_router(admin.router, prefix="/api/v1/admin", tags=["admin"])
|
|
app.include_router(brand.router, prefix="/api/v1/brand", tags=["brand"])
|
|
app.include_router(trade_in.router, prefix="/api/v1/trade-in", tags=["trade-in"])
|
|
app.include_router(search.router, prefix="/api/v1", tags=["search"])
|