Commit Graph

10 Commits

Author SHA1 Message Date
Barcode Betty 5a6f4cd44c fix(api): document dispose_engine lazy import + regression test (CAR-1135)
CI / lint (pull_request) Failing after 5s
CI / typecheck (pull_request) Failing after 33s
CI / test (pull_request) Failing after 1m20s
CI / build-and-push (pull_request) Has been skipped
CI / deploy-dev (pull_request) Has been skipped
CI / deploy-uat (pull_request) Has been skipped
- main.py: add docstring inside the lifespan function explaining why
  dispose_engine is lazy-imported rather than top-level. The original
  import path (top-level) crashed the container at import time with
  'ImportError: cannot import name dispose_engine from cartsnitch_api.database'
  when database.py was stale or stripped during a CI build. Lazy import
  keeps the engine disposal behavior while preventing the module-load
  crash.
- tests/test_openapi.py: add test_dispose_engine_importable_from_database
  that asserts dispose_engine is importable and callable. This is the
  exact path the deployed UAT image was failing on, captured as a
  regression test so a future regression lands in CI before deploy.

Refs CAR-1135.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-06-03 12:16:03 +00:00
Barcode Betty ba88fad48b fix: remove dead dispose_engine import from API main.py
CI / lint (pull_request) Failing after 3s
CI / test (pull_request) Failing after 14s
CI / build-and-push (pull_request) Has been skipped
CI / deploy-dev (pull_request) Has been skipped
CI / deploy-uat (pull_request) Has been skipped
CI / typecheck (pull_request) Failing after 20s
The top-level import of dispose_engine from cartsnitch_api.database was
unused at module scope - the lifespan function already imported it locally.
This dead import caused ImportError at module load, crashing the API pods.

Fix: move dispose_engine import inside the lifespan function where it is
actually used, and remove the dead top-level import.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-05-23 20:54:39 +00:00
cartsnitch-ceo[bot] 9346eba8d4 feat: implement audit logging middleware for sensitive API operations (#183)
feat: implement audit logging middleware for sensitive API operations
2026-04-15 03:23:37 +00:00
Barcode Betty 1867f0bb87 feat: implement audit logging middleware for sensitive API operations
- Add AuditMiddleware that logs POST/PUT/PATCH/DELETE and GET /auth/me
- Logs structured JSON: event, timestamp, user_id, method, path, client_ip, status_code, duration_ms
- Excludes health endpoints and OPTIONS requests
- Never logs request/response bodies or auth headers/cookies
- Wire user_id from auth dependency via request.state
- Add add_audit_middleware() to app factory

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-14 13:41:55 +00:00
Barcode Betty 3300d67137 feat(api): implement FastAPI lifespan with connection pooling
- Add connection pool config to SQLAlchemy async engine (pool_size=10, max_overflow=20, pool_pre_ping, pool_recycle)
- Implement Redis connection pool in CacheClient with initialize/close lifecycle
- Wire lifespan startup/shutdown to initialize and dispose pools
- Add dispose_engine() for graceful DB pool cleanup on shutdown

Closes CAR-550

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-14 13:12:46 +00:00
CartSnitch Engineer Bot 8a50876f4a fix: move email-in-address endpoint from /auth to /api/v1 prefix
The GET /me/email-in-address endpoint was unreachable because the Gateway
HTTPRoute routes all /auth/* traffic to Better-Auth (port 3001), not the
API service. This change:
- Moves the endpoint from the /auth router to a new /api/v1/me/ router
- Adds EmailInAddressResponse schema and get_email_in_address service method
- Updates Settings.tsx to call /api/v1/me/email-in-address

Fixes CAR-445.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-03 11:44:31 +00:00
CartSnitch Engineer Bot 70a7d26997 fix(api): restore /api/v1 prefix on data routers
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-03 10:15:21 +00:00
Barcode Betty b52fae5894 sync(api): copy latest standalone code and merge alembic migrations
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-03 07:54:31 +00:00
CartSnitch Engineer Bot dabfd7379e fix(api): mount data routers under /api/v1 prefix
Fixes CAR-161 UAT failure: k8s HTTPRoute forwards /api/* to the API
gateway without path rewriting, so requests arrive at FastAPI as
/api/v1/purchases, /api/v1/products, etc. FastAPI previously mounted
data routers at root, causing 404s on all /api/v1/* calls.

Keep health and auth routers at root (probes hit /health directly;
auth traffic is routed to the auth service via HTTPRoute).

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-03-31 23:56:20 +00:00
Coupon Carl b7e6f637a7 feat: merge cartsnitch/api into api/ subdirectory
Consolidate API gateway service into monorepo.
Squashed from https://github.com/cartsnitch/api main (89bacb1).

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-03-28 02:24:02 +00:00