Giorgio Gilestro
f1903e1e61
Adds the unauthenticated surface that's needed to invite outsiders:
- Landing (/) — dual-purpose root: dashboard for logged-in users,
landing for everyone else. New maybe_current_user soft-auth helper
in app/auth.py supports it without disturbing the per-route
require_token deps on /news, /log, /upload, /settings.
- About, Pricing, Disclaimer, Terms, Privacy — own router
(app/routers/public.py), no auth dep, shared public_base layout
(brand link, thin nav, footer with legal links + ICO ref + date).
- Editorial positioning: news aggregator with a macro brain; tagline
"Understand markets. Don't gamble on them."; anti-trading-as-gambling
stance carried through About and Landing.
Legal pass following an independent lawyer-style review:
- Privacy: explicit UK-GDPR Art. 6 lawful-basis section; Art. 22
automated-decision line; explicit consent for sessionStorage sync
key (PECR); 30-day IP-log retention; Art. 21 objection right;
Children clause; Art. 33/34 breach-notification clause;
international-transfer mechanism (IDTA + UK Addendum). ICO
registration ZC098928 surfaced at the top.
- Pricing: paid-card AI-portfolio-analysis bullet rewritten to remove
advice-shaped wording ("what would invalidate the posture" gone);
added italic carve-out citing FSMA / FCA COBS.
- Disclaimer: separate EU/EEA carve-out + MAR 596/2014 Art. 3(1)(34)
commentator safe-harbour; "qualifies the Terms" line; hallucination
wording fixed.
- Terms: cl.4 explicit AI-training prohibition + harassment line;
cl.5 CCR 2013 14-day cancellation; cl.7 softened AI copyright
claim under CDPA s.9(3) ambiguity; cl.8 proportionate suspension +
pro-rata refund for paid users; cl.10 CRA 2015 Pt 1 statutory-rights
carve-out from the liability cap; cl.11 right to close account on
material change; cl.12 non-exclusive jurisdiction + UK consumer
local courts.
Code-side enforcement of the Privacy claim:
- openrouter.py: outbound OpenRouter calls now carry
X-OR-Allow-Training: false. DeepSeek doesn't expose a per-request
flag; the Privacy page discloses this caveat verbatim.
Apex domain prep:
- branding.APP_URL flipped to https://read.markets (was app.). DNS for
the apex already resolves; pending operator NPM step is a cert that
covers the bare apex + a 301 from app.read.markets. No hard-coded
subdomain references remain in code (verified with grep).
Nav + chrome:
- app dropdown gains Pricing / Terms / Privacy / Disclaimer links.
- login.html gains a small legal-links footer for the
highest-leverage moment to surface them.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
77 lines
2.6 KiB
Python
77 lines
2.6 KiB
Python
"""Shared Jinja2 environment with custom filters for the dashboard.
|
|
Imported by both routers/pages.py and routers/api.py so the filters are
|
|
registered exactly once."""
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
from fastapi.templating import Jinja2Templates
|
|
from markupsafe import Markup, escape
|
|
|
|
from app import branding
|
|
from app.services.glossary import wrap_glossary
|
|
|
|
|
|
TEMPLATE_DIR = Path(__file__).resolve().parent / "templates"
|
|
|
|
|
|
def _fmt_price(v: float | None) -> str:
|
|
"""Format a price in a way that's readable in dense terminal tables.
|
|
Avoids scientific notation for large round numbers (FTSE 25,962, not 2.596e+04)
|
|
and keeps enough precision for FX rates like 0.8725 EUR/GBP."""
|
|
if v is None:
|
|
return "—"
|
|
av = abs(v)
|
|
if av >= 1000:
|
|
return f"{v:,.2f}"
|
|
if av >= 10:
|
|
return f"{v:.2f}"
|
|
if av >= 1:
|
|
return f"{v:.4f}"
|
|
return f"{v:.4f}"
|
|
|
|
|
|
def _fmt_signed(v: float | None, decimals: int = 2) -> str:
|
|
if v is None:
|
|
return "—"
|
|
return f"{v:+,.{decimals}f}"
|
|
|
|
|
|
def _fmt_money(v: float | None) -> str:
|
|
if v is None:
|
|
return "—"
|
|
return f"{v:,.2f}"
|
|
|
|
|
|
def _glossary_filter(value, tone: str | None = None):
|
|
"""Wrap glossary terms in NOVICE-mode AI content. Returns Markup so
|
|
Jinja won't re-escape the inserted <span> tags. Plain-text inputs are
|
|
HTML-escaped first; already-Markup inputs (e.g. log.content_html) are
|
|
treated as HTML and passed through wrap_glossary unchanged."""
|
|
if value is None:
|
|
return Markup("")
|
|
if isinstance(value, Markup):
|
|
html = str(value)
|
|
else:
|
|
html = str(escape(value))
|
|
if (tone or "").upper() != "NOVICE":
|
|
return Markup(html)
|
|
return Markup(wrap_glossary(html, tone=tone))
|
|
|
|
|
|
templates = Jinja2Templates(directory=str(TEMPLATE_DIR))
|
|
templates.env.filters["price"] = _fmt_price
|
|
templates.env.filters["signed"] = _fmt_signed
|
|
templates.env.filters["money"] = _fmt_money
|
|
templates.env.filters["glossary"] = _glossary_filter
|
|
|
|
# Brand globals — every template that prints a product name should pull
|
|
# from these so a future rename is a one-liner in `app/branding.py`.
|
|
templates.env.globals["BRAND_NAME"] = branding.BRAND_NAME
|
|
templates.env.globals["BRAND_SHORT"] = branding.BRAND_SHORT
|
|
templates.env.globals["SITE_URL"] = branding.SITE_URL
|
|
templates.env.globals["APP_URL"] = branding.APP_URL
|
|
templates.env.globals["TAGLINE"] = branding.TAGLINE
|
|
templates.env.globals["LEGAL_OPERATOR"] = branding.LEGAL_OPERATOR
|
|
templates.env.globals["OPERATOR_EMAIL"] = branding.OPERATOR_EMAIL
|
|
templates.env.globals["OPERATOR_JURISDICTION"] = branding.OPERATOR_JURISDICTION
|