lekss361
94cf199276
Some checks failed
Deploy Trade-In / changes (push) Successful in 5s
Deploy / changes (push) Successful in 5s
Deploy Trade-In / build-frontend (push) Successful in 26s
Deploy Trade-In / build-backend (push) Successful in 47s
Deploy / build-frontend (push) Successful in 29s
Deploy / build-backend (push) Successful in 1m24s
Deploy Trade-In / deploy (push) Successful in 40s
Deploy / build-worker (push) Successful in 2m57s
Deploy / deploy (push) Failing after 37s
Replaces tradein.cad_buildings snapshot with live postgres_fdw foreign table reading gendesign.v_tradein_cad_buildings. Fixes /trade-in/api/v1/geocode/reverse 500 (Nominatim ban) and address_not_geocoded for cadastre addresses (e.g. Хохрякова 81).
Security (deep-review fixes):
- 100_tradein_fdw_role.sql: passwordless CREATE ROLE; password set by deploy.yml ALTER ROLE bootstrap reading GENDESIGN_FDW_PASSWORD from backend/.env.runtime (via psql :'pw' var → format %L — injection-safe).
- core/fdw.py: regex whitelist [A-Za-z0-9_-]{32,256} on password, ValueError without echoing value, try/rollback on commit.
- 060_postgres_fdw_extension.sql: connect_timeout='3' on FOREIGN SERVER + ALTER ADD/SET fallback.
- geocoder.py: _cadastral_forward_sync / _cadastral_reverse_sync wrapped in asyncio.to_thread.
- 100_*.sql: REVOKE ALL ON ALL TABLES/SEQUENCES/FUNCTIONS IN SCHEMA public; only GRANT SELECT on v_tradein_cad_buildings.
- pg_user_mappings query handles PUBLIC mapping (usename IS NULL).
Tests: 3 SQL-injection guards on ensure_fdw_user_mapping + rewritten cadastral suite.
112 lines
3.9 KiB
Python
112 lines
3.9 KiB
Python
import logging
|
||
import os
|
||
from collections.abc import AsyncIterator
|
||
from contextlib import asynccontextmanager
|
||
|
||
import sentry_sdk
|
||
from fastapi import FastAPI
|
||
from fastapi.middleware.cors import CORSMiddleware
|
||
from sentry_sdk.integrations.celery import CeleryIntegration
|
||
from sentry_sdk.integrations.fastapi import FastApiIntegration
|
||
from sentry_sdk.integrations.httpx import HttpxIntegration
|
||
from sentry_sdk.integrations.logging import LoggingIntegration
|
||
from sentry_sdk.integrations.sqlalchemy import SqlalchemyIntegration
|
||
from sentry_sdk.integrations.starlette import StarletteIntegration
|
||
|
||
from app.api.v1 import (
|
||
admin_cadastre,
|
||
admin_etl,
|
||
admin_jobs,
|
||
admin_leads,
|
||
admin_scrape,
|
||
admin_weight_profiles,
|
||
analytics,
|
||
concepts,
|
||
custom_pois,
|
||
landing,
|
||
parcels,
|
||
photos,
|
||
pilot,
|
||
trade_in,
|
||
users,
|
||
)
|
||
from app.core.config import settings
|
||
from app.observability.sentry_scrub import scrub_sensitive_query
|
||
|
||
logger = logging.getLogger(__name__)
|
||
|
||
# Инициализируем SDK до создания FastAPI app, чтобы все инструменты
|
||
# (middleware, маршруты) видели активный client с самого старта процесса.
|
||
# GlitchTip не поддерживает profiling — profiles_sample_rate=0.0.
|
||
if settings.glitchtip_dsn:
|
||
sentry_sdk.init(
|
||
dsn=settings.glitchtip_dsn,
|
||
environment=settings.environment,
|
||
release=os.getenv("GIT_SHA") or os.getenv("SENTRY_RELEASE") or "unknown",
|
||
traces_sample_rate=settings.glitchtip_traces_sample_rate,
|
||
profiles_sample_rate=0.0,
|
||
send_default_pii=False,
|
||
before_send_transaction=scrub_sensitive_query,
|
||
integrations=[
|
||
StarletteIntegration(),
|
||
FastApiIntegration(),
|
||
CeleryIntegration(monitor_beat_tasks=True),
|
||
SqlalchemyIntegration(),
|
||
HttpxIntegration(),
|
||
LoggingIntegration(level=logging.INFO, event_level=logging.ERROR),
|
||
],
|
||
)
|
||
logger.info(
|
||
"GlitchTip SDK initialised (env=%s, traces=%.2f)",
|
||
settings.environment,
|
||
settings.glitchtip_traces_sample_rate,
|
||
)
|
||
|
||
|
||
@asynccontextmanager
|
||
async def lifespan(app: FastAPI) -> AsyncIterator[None]:
|
||
yield
|
||
|
||
|
||
app = FastAPI(title="GenDesign API", version="0.1.0", lifespan=lifespan)
|
||
|
||
app.add_middleware(
|
||
CORSMiddleware,
|
||
allow_origins=settings.cors_origins,
|
||
allow_credentials=True,
|
||
allow_methods=["*"],
|
||
allow_headers=["*"],
|
||
)
|
||
|
||
app.include_router(concepts.router, prefix="/api/v1/concepts", tags=["concepts"])
|
||
app.include_router(parcels.router, prefix="/api/v1/parcels", tags=["parcels"])
|
||
app.include_router(analytics.router, prefix="/api/v1/analytics", tags=["analytics"])
|
||
app.include_router(admin_scrape.router, prefix="/api/v1/admin/scrape", tags=["admin"])
|
||
app.include_router(admin_jobs.router, prefix="/api/v1/admin/jobs", tags=["admin"])
|
||
app.include_router(admin_leads.router, prefix="/api/v1/admin/leads", tags=["admin"])
|
||
app.include_router(
|
||
admin_weight_profiles.router,
|
||
prefix="/api/v1/admin/site-finder/weight-profiles",
|
||
tags=["admin", "site-finder"],
|
||
)
|
||
app.include_router(photos.router, prefix="/api/v1/photos", tags=["photos"])
|
||
app.include_router(custom_pois.router, prefix="/api/v1/custom-pois", tags=["custom-pois"])
|
||
app.include_router(
|
||
admin_cadastre.router,
|
||
prefix="/api/v1/admin/cadastre",
|
||
tags=["admin", "cadastre"],
|
||
)
|
||
app.include_router(
|
||
admin_etl.router,
|
||
prefix="/api/v1/admin/etl",
|
||
tags=["admin", "etl"],
|
||
)
|
||
app.include_router(trade_in.router, prefix="/api/v1/trade-in", tags=["trade-in"])
|
||
app.include_router(landing.router, prefix="/api/v1", tags=["landing"])
|
||
app.include_router(pilot.router, prefix="/api/v1/pilot", tags=["pilot"])
|
||
app.include_router(users.router, prefix="/api/v1", tags=["users"])
|
||
|
||
|
||
@app.get("/health")
|
||
async def health() -> dict[str, str]:
|
||
return {"status": "ok", "environment": settings.environment}
|