Adds the unauthenticated surface that's needed to invite outsiders:
- Landing (/) — dual-purpose root: dashboard for logged-in users,
landing for everyone else. New maybe_current_user soft-auth helper
in app/auth.py supports it without disturbing the per-route
require_token deps on /news, /log, /upload, /settings.
- About, Pricing, Disclaimer, Terms, Privacy — own router
(app/routers/public.py), no auth dep, shared public_base layout
(brand link, thin nav, footer with legal links + ICO ref + date).
- Editorial positioning: news aggregator with a macro brain; tagline
"Understand markets. Don't gamble on them."; anti-trading-as-gambling
stance carried through About and Landing.
Legal pass following an independent lawyer-style review:
- Privacy: explicit UK-GDPR Art. 6 lawful-basis section; Art. 22
automated-decision line; explicit consent for sessionStorage sync
key (PECR); 30-day IP-log retention; Art. 21 objection right;
Children clause; Art. 33/34 breach-notification clause;
international-transfer mechanism (IDTA + UK Addendum). ICO
registration ZC098928 surfaced at the top.
- Pricing: paid-card AI-portfolio-analysis bullet rewritten to remove
advice-shaped wording ("what would invalidate the posture" gone);
added italic carve-out citing FSMA / FCA COBS.
- Disclaimer: separate EU/EEA carve-out + MAR 596/2014 Art. 3(1)(34)
commentator safe-harbour; "qualifies the Terms" line; hallucination
wording fixed.
- Terms: cl.4 explicit AI-training prohibition + harassment line;
cl.5 CCR 2013 14-day cancellation; cl.7 softened AI copyright
claim under CDPA s.9(3) ambiguity; cl.8 proportionate suspension +
pro-rata refund for paid users; cl.10 CRA 2015 Pt 1 statutory-rights
carve-out from the liability cap; cl.11 right to close account on
material change; cl.12 non-exclusive jurisdiction + UK consumer
local courts.
Code-side enforcement of the Privacy claim:
- openrouter.py: outbound OpenRouter calls now carry
X-OR-Allow-Training: false. DeepSeek doesn't expose a per-request
flag; the Privacy page discloses this caveat verbatim.
Apex domain prep:
- branding.APP_URL flipped to https://read.markets (was app.). DNS for
the apex already resolves; pending operator NPM step is a cert that
covers the bare apex + a 301 from app.read.markets. No hard-coded
subdomain references remain in code (verified with grep).
Nav + chrome:
- app dropdown gains Pricing / Terms / Privacy / Disclaimer links.
- login.html gains a small legal-links footer for the
highest-leverage moment to surface them.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
159 lines
5.3 KiB
Python
159 lines
5.3 KiB
Python
"""HTML page routes — server-rendered Jinja2 with HTMX-driven partial refresh."""
|
|
from __future__ import annotations
|
|
|
|
from datetime import date, datetime, timezone
|
|
|
|
from fastapi import APIRouter, Depends, Request
|
|
from fastapi.responses import HTMLResponse, RedirectResponse
|
|
from sqlalchemy import desc, func, select
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.auth import CurrentUser, maybe_current_user, require_auth, require_token
|
|
from app.config import get_settings, load_groups
|
|
from app.db import get_session
|
|
from app.models import Referral, StrategicLog, User
|
|
from app.services.access import paid_status
|
|
from app.services.referral_service import assign_code_if_missing
|
|
from app.templates_env import templates
|
|
|
|
# Router-level auth removed in favour of per-route deps so that `/` can be
|
|
# dual-purpose: logged-in users see the dashboard, logged-out visitors see
|
|
# the landing page.
|
|
router = APIRouter()
|
|
|
|
|
|
@router.get("/", response_class=HTMLResponse)
|
|
async def root_page(
|
|
request: Request,
|
|
cu: CurrentUser | None = Depends(maybe_current_user),
|
|
):
|
|
"""Dual-purpose root: dashboard when authenticated, landing otherwise."""
|
|
if cu is None:
|
|
return templates.TemplateResponse(
|
|
request, "landing.html", {"cu": None},
|
|
)
|
|
s = get_settings()
|
|
groups = load_groups(s.BASELINE_TOML, s.PORTFOLIO_TOML)
|
|
return templates.TemplateResponse(
|
|
request,
|
|
"dashboard.html",
|
|
{"groups": list(groups.keys()), "anchor": s.CASSANDRA_ANCHOR_DATE, "cu": cu},
|
|
)
|
|
|
|
|
|
@router.get(
|
|
"/news",
|
|
response_class=HTMLResponse,
|
|
dependencies=[Depends(require_token)],
|
|
)
|
|
async def news_page(request: Request):
|
|
return templates.TemplateResponse(request, "news.html", {})
|
|
|
|
|
|
@router.get("/upload", dependencies=[Depends(require_token)])
|
|
async def upload_page(request: Request):
|
|
"""Legacy bookmark — the import widget now lives in /settings."""
|
|
return RedirectResponse(url="/settings#import", status_code=302)
|
|
|
|
|
|
async def _resolve_log_date(session: AsyncSession, day: str | None) -> date:
|
|
"""If `day` is YYYY-MM-DD use it; else fall back to the date of the most
|
|
recent generated log; else today."""
|
|
if day:
|
|
try:
|
|
return datetime.strptime(day, "%Y-%m-%d").date()
|
|
except ValueError:
|
|
pass
|
|
latest = (await session.execute(
|
|
select(StrategicLog.generated_at)
|
|
.order_by(desc(StrategicLog.generated_at))
|
|
.limit(1)
|
|
)).scalar_one_or_none()
|
|
if latest is not None:
|
|
return latest.date() if hasattr(latest, "date") else latest
|
|
return datetime.now(timezone.utc).date()
|
|
|
|
|
|
def _log_page_context(target: date) -> dict:
|
|
s = get_settings()
|
|
return {
|
|
"selected_iso": target.isoformat(),
|
|
"selected_month": target.strftime("%Y-%m"),
|
|
"current_tone": s.CASSANDRA_TONE.upper(),
|
|
"current_analysis": s.CASSANDRA_ANALYSIS.upper(),
|
|
}
|
|
|
|
|
|
@router.get(
|
|
"/log",
|
|
response_class=HTMLResponse,
|
|
dependencies=[Depends(require_token)],
|
|
)
|
|
async def log_page(
|
|
request: Request,
|
|
session: AsyncSession = Depends(get_session),
|
|
):
|
|
target = await _resolve_log_date(session, None)
|
|
return templates.TemplateResponse(request, "log.html", _log_page_context(target))
|
|
|
|
|
|
@router.get(
|
|
"/log/{day}",
|
|
response_class=HTMLResponse,
|
|
dependencies=[Depends(require_token)],
|
|
)
|
|
async def log_page_day(
|
|
request: Request,
|
|
day: str,
|
|
session: AsyncSession = Depends(get_session),
|
|
):
|
|
target = await _resolve_log_date(session, day)
|
|
return templates.TemplateResponse(request, "log.html", _log_page_context(target))
|
|
|
|
|
|
@router.get("/settings", response_class=HTMLResponse)
|
|
async def settings_page(
|
|
request: Request,
|
|
session: AsyncSession = Depends(get_session),
|
|
principal: CurrentUser = Depends(require_auth),
|
|
):
|
|
"""Per-user settings. Currently shows email, tier, and the referral
|
|
block (own code + invite link + counts of pending/converted
|
|
referrals). The Credit / Paddle pieces land in D.3."""
|
|
user = principal.user
|
|
if user is None:
|
|
# Bearer-token admin path — no per-user settings to show.
|
|
return templates.TemplateResponse(
|
|
request, "settings.html",
|
|
{"user": None, "invite_url": None,
|
|
"pending_count": 0, "converted_count": 0},
|
|
)
|
|
|
|
# Lazily assign a referral code on first visit.
|
|
user = await assign_code_if_missing(session, user)
|
|
|
|
# Stats: how many people have signed up with their code so far, and
|
|
# how many of those converted (paid). D.3 will fill `converted_at`.
|
|
pending_count = (await session.execute(
|
|
select(func.count(Referral.id))
|
|
.where(Referral.referrer_user_id == user.id)
|
|
.where(Referral.converted_at.is_(None))
|
|
)).scalar() or 0
|
|
converted_count = (await session.execute(
|
|
select(func.count(Referral.id))
|
|
.where(Referral.referrer_user_id == user.id)
|
|
.where(Referral.converted_at.is_not(None))
|
|
)).scalar() or 0
|
|
|
|
invite_url = str(request.url_for("login_page")) + f"?ref={user.referral_code}"
|
|
|
|
return templates.TemplateResponse(
|
|
request, "settings.html",
|
|
{
|
|
"user": user,
|
|
"invite_url": invite_url,
|
|
"pending_count": int(pending_count),
|
|
"converted_count": int(converted_count),
|
|
"paid": paid_status(user),
|
|
},
|
|
)
|