Adds opt-in client-side-encrypted portfolio sync (paid). Browser
PBKDF2(PIN) → AES-GCM, server HKDF(pepper, user_id) outer wrap;
server stores opaque bytes only. Sliding-window rate limit on GET.
- new portfolio_sync table (migration 0015)
- POST/GET/DELETE /api/portfolio/sync + /status
- app/services/portfolio_sync.py crypto + rate limit
- app/routers/sync.py paid-gated
- app/static/js/portfolio-sync.js WebCrypto wrapper
- settings page: enable/disable + PIN modal
- PORTFOLIO_SYNC_PEPPER setting (warn on startup if missing)
Settings + import rework:
- /upload merged into /settings#import (legacy route 302s)
- drop CSV → auto-parse → preview → Import only / Import & sync
- nav slimmed to Dashboard / News / Log
- Settings + Logout moved to a user dropdown
- brand logo links to /
Collateral fixes:
- settings 500: re-fetch User in current session before mutating
referral_code (assign_code_if_missing was refreshing a User
loaded in the auth dep's now-closed session)
- csv_import: distinct error for unfunded T212 pies (all qty=0)
- db.py: drop pool_pre_ping (aiomysql 0.3.2 incompat); pin
isolation_level=READ COMMITTED to avoid gap-lock deadlocks
- alembic env: disable_existing_loggers=False so in-process
migrations don't silence uvicorn's loggers
- docker-compose.override.yml: dev-only volume mount + --reload
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
104 lines
4.1 KiB
HTML
104 lines
4.1 KiB
HTML
{% extends "base.html" %}
|
|
{% block title %}{{ BRAND_NAME }} · Import Portfolio{% endblock %}
|
|
|
|
{% block main %}
|
|
<section class="panel" style="grid-column: 1 / -1; max-width: 760px; margin: 0 auto;">
|
|
<div class="panel-header">
|
|
<span class="title">Import portfolio (Trading 212 CSV)</span>
|
|
<span class="meta">held locally · optional encrypted cloud sync (paid)</span>
|
|
</div>
|
|
|
|
<div class="panel-body" style="padding: 18px clamp(16px, 4vw, 32px) 24px;">
|
|
<p style="color: var(--muted); font-size: 12.5px; margin: 0 0 14px; line-height: 1.6;">
|
|
Export your pie from the T212 web app
|
|
(<span class="neu">Trading 212 → Investing → Your Pie → ⋯ → Export</span>)
|
|
and drop the CSV here. Each Slice is resolved to its Yahoo ticker;
|
|
the parsed pie is kept in <em>this browser's localStorage</em>.
|
|
The server learns only which tickers exist (anonymously) so it can
|
|
fetch their prices. If you have <a href="/settings">cloud sync</a>
|
|
enabled, an <strong>encrypted</strong> copy is also pushed to the
|
|
server — only your PIN can decrypt it.
|
|
</p>
|
|
|
|
<form id="upload-form" autocomplete="off">
|
|
<div id="drop-zone" class="dz">
|
|
<input type="file" id="file-input" name="file" accept=".csv,text/csv" hidden>
|
|
<div class="dz__icon">▱</div>
|
|
<div class="dz__label">Drop a T212 pie CSV here</div>
|
|
<div class="dz__hint">or <a href="#" id="browse-link">browse</a> · max 1 MB</div>
|
|
<div class="dz__filename" id="dz-filename"></div>
|
|
</div>
|
|
|
|
<button id="submit-btn" type="submit" disabled style="margin-top:18px;">Parse</button>
|
|
</form>
|
|
|
|
<div id="result" class="result" hidden></div>
|
|
</div>
|
|
</section>
|
|
|
|
<script src="{{ url_for('static', path='/js/portfolio-sync.js') }}" defer></script>
|
|
<script src="{{ url_for('static', path='/js/portfolio.js') }}" defer></script>
|
|
<script>
|
|
(function () {
|
|
function ready(fn) {
|
|
if (document.readyState === 'loading') {
|
|
document.addEventListener('DOMContentLoaded', fn);
|
|
} else { fn(); }
|
|
}
|
|
|
|
ready(function () {
|
|
var dropZone = document.getElementById('drop-zone');
|
|
var fileInput = document.getElementById('file-input');
|
|
var browseLink = document.getElementById('browse-link');
|
|
var filenameEl = document.getElementById('dz-filename');
|
|
var submitBtn = document.getElementById('submit-btn');
|
|
var form = document.getElementById('upload-form');
|
|
var resultEl = document.getElementById('result');
|
|
|
|
function setFile(file) {
|
|
if (!file) return;
|
|
var dt = new DataTransfer();
|
|
dt.items.add(file);
|
|
fileInput.files = dt.files;
|
|
filenameEl.textContent = file.name + ' (' + Math.round(file.size / 1024) + ' KB)';
|
|
submitBtn.disabled = false;
|
|
}
|
|
|
|
browseLink.addEventListener('click', function (e) { e.preventDefault(); fileInput.click(); });
|
|
fileInput.addEventListener('change', function () {
|
|
if (fileInput.files[0]) setFile(fileInput.files[0]);
|
|
});
|
|
|
|
['dragenter', 'dragover'].forEach(function (ev) {
|
|
dropZone.addEventListener(ev, function (e) {
|
|
e.preventDefault(); e.stopPropagation();
|
|
dropZone.classList.add('dz--over');
|
|
});
|
|
});
|
|
['dragleave', 'drop'].forEach(function (ev) {
|
|
dropZone.addEventListener(ev, function (e) {
|
|
e.preventDefault(); e.stopPropagation();
|
|
dropZone.classList.remove('dz--over');
|
|
});
|
|
});
|
|
dropZone.addEventListener('drop', function (e) {
|
|
if (e.dataTransfer.files && e.dataTransfer.files[0]) setFile(e.dataTransfer.files[0]);
|
|
});
|
|
dropZone.addEventListener('click', function (e) {
|
|
if (e.target.tagName !== 'A') fileInput.click();
|
|
});
|
|
|
|
form.addEventListener('submit', async function (e) {
|
|
e.preventDefault();
|
|
if (!fileInput.files[0]) return;
|
|
submitBtn.disabled = true;
|
|
submitBtn.textContent = 'Parsing…';
|
|
// CassandraPortfolio is exposed by /static/js/portfolio.js.
|
|
var ok = await window.CassandraPortfolio.handleUpload(form, fileInput.files[0], resultEl);
|
|
submitBtn.textContent = ok ? 'Parsed' : 'Parse';
|
|
submitBtn.disabled = !ok;
|
|
});
|
|
});
|
|
})();
|
|
</script>
|
|
{% endblock %}
|