Giorgio Gilestro
6e7f57c6b2
Server no longer holds portfolios. Holdings live in the browser (localStorage); the server publishes an anonymous ticker_universe and a gzipped /api/universe payload identical for every authenticated user, so access patterns can't betray which tickers a user holds. AI commentary is generated ephemerally from the browser-supplied pie and the cost ledger row records no positions. Migrations 0009-0011 added the universe table and dropped positions / portfolio_snapshots / portfolios. Authentication is now e-mail OTP only. Migration 0010 dropped password_hash and email_verified (every active session is by construction proof of email control). The /signup endpoint is gone; signup and login share a single email-entry page. Email rendering is HTML+plain-text multipart with a shared brand palette (app/branding.py) asserted in sync with the CSS by a drift-detection test. LLM provider defaults to DeepSeek-direct (cheaper, api.deepseek.com) with OpenRouter as automatic fallback if DeepSeek fails. ai_log_job and indicator_summary_job now iterate the two tones (NOVICE, INTERMEDIATE) per cycle so the dashboard's tone toggle is instant; PROMPT_VERSION bumped to 6 with an educational anti-TA / anti-gambling stance baked into _CORE. NOVICE mode renders a curated glossary inline (CBOE VIX, yield curve, HY OAS, etc.) with JS-positioned tooltips that survive viewport edges and sticky bars. Model name and tokens hidden from the user UI; still recorded in StrategicLog.model and AICall for admin. Layout adds a sticky top nav, a sticky bottom markets bar (one chip per exchange with status LED + headline index + 1d change), and Phase H feedback reporting is queued in tasks/todo.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
40 lines
1.5 KiB
Python
40 lines
1.5 KiB
Python
"""email_otps — one-time codes for mandatory email verification
|
|
|
|
Revision ID: 0008
|
|
Revises: 0007
|
|
Create Date: 2026-05-16
|
|
"""
|
|
from typing import Sequence, Union
|
|
|
|
import sqlalchemy as sa
|
|
from alembic import op
|
|
|
|
|
|
revision: str = "0008"
|
|
down_revision: Union[str, None] = "0007"
|
|
branch_labels: Union[str, Sequence[str], None] = None
|
|
depends_on: Union[str, Sequence[str], None] = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
op.create_table(
|
|
"email_otps",
|
|
sa.Column("id", sa.BigInteger, primary_key=True, autoincrement=True),
|
|
sa.Column("email", sa.String(255), nullable=False),
|
|
# Argon2 hash of the 6-digit code. Storing the hash means a DB read
|
|
# alone can't recover the code.
|
|
sa.Column("code_hash", sa.String(255), nullable=False),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.Column("attempts", sa.Integer, nullable=False, server_default=sa.text("0")),
|
|
# null = unused. Set when consumed (correct submission) or marked dead
|
|
# (too many attempts / superseded by newer code for same email).
|
|
sa.Column("used_at", sa.DateTime(timezone=True)),
|
|
sa.Column("purpose", sa.String(16), nullable=False, server_default="signup"),
|
|
)
|
|
op.create_index("ix_otps_email_created", "email_otps", ["email", "created_at"])
|
|
|
|
|
|
def downgrade() -> None:
|
|
op.drop_index("ix_otps_email_created", table_name="email_otps")
|
|
op.drop_table("email_otps")
|