Implement adjudicated DO items across backend, frontend, deploy
From the ROADMAP adjudication (12 of 13 DO items; D2 is a commit action). Backend: - B3: pytest suite (auth, entity CRUD, rollup) + dev deps + pytest config - B4: cap document uploads at TEN31_MAX_UPLOAD_SIZE (default 50MB), stream- checked with partial-file cleanup, 413 on overflow - B7: type AuditLog.detail as dict|list|str|None to match the JSON column - B10: index foreign-key columns (migration a7b8c9d0e1f2 + index=True) - B11: cli delete-user logs file-removal errors instead of swallowing them Frontend: - F2: distinguish "server unreachable" from "logged out"; retry prompt - F4: confirm before destructive holdings-replace on import; step progress - F6: expandable audit-log detail with full JSON - F7: empty-state on the Investments page - F8: shared role helpers (WRITER_ROLES/canEditRound/isApprover), used by EntitiesList, AuditLog, Import, ValuationWorkflow Deploy: - D5: run tsc --noEmit before packaging (build script) - D6: TEN31_LOG_LEVEL env var (defaults to info) Verified: 8/8 backend tests pass; alembic upgrades to head with 13 FK indexes; upload limit rejects oversized + cleans up; frontend tsc + vite build clean; dev server serves and proxies to the API.
This commit is contained in:
Jonathan Kirkwood
+225
-7
@@ -1,4 +1,4 @@
|
||||
"""CLI commands for Ten31Portal."""
|
||||
"""CLI commands for Ten31Portal (also driven by the StartOS service Actions)."""
|
||||
|
||||
import argparse
|
||||
import sys
|
||||
@@ -8,7 +8,21 @@ from sqlmodel import Session, select
|
||||
from ten31portal.auth import hash_password
|
||||
from ten31portal.database import engine
|
||||
from ten31portal.db_init import run_migrations
|
||||
from ten31portal.models import User, UserRole
|
||||
from ten31portal.models import (
|
||||
AuditLog, CapitalAccountStatement, Document, EntityAccess, User, UserRole,
|
||||
ValuationRound,
|
||||
)
|
||||
|
||||
|
||||
def _find_user(session: Session, username: str | None, email: str | None) -> User | None:
|
||||
"""Look a user up by username (preferred) or email."""
|
||||
if username:
|
||||
u = session.exec(select(User).where(User.username == username)).first()
|
||||
if u:
|
||||
return u
|
||||
if email:
|
||||
return session.exec(select(User).where(User.email == email)).first()
|
||||
return None
|
||||
|
||||
|
||||
def create_user(args: argparse.Namespace) -> None:
|
||||
@@ -16,8 +30,10 @@ def create_user(args: argparse.Namespace) -> None:
|
||||
run_migrations()
|
||||
|
||||
with Session(engine) as session:
|
||||
existing = session.exec(select(User).where(User.email == args.email)).first()
|
||||
if existing:
|
||||
if session.exec(select(User).where(User.username == args.username)).first():
|
||||
print(f"Error: user with username {args.username} already exists.", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
if args.email and session.exec(select(User).where(User.email == args.email)).first():
|
||||
print(f"Error: user with email {args.email} already exists.", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
@@ -29,13 +45,179 @@ def create_user(args: argparse.Namespace) -> None:
|
||||
|
||||
user = User(
|
||||
name=args.name,
|
||||
email=args.email,
|
||||
username=args.username,
|
||||
email=args.email or None,
|
||||
password_hash=hash_password(args.password),
|
||||
role=role,
|
||||
is_service_admin=bool(getattr(args, "service_admin", False)),
|
||||
)
|
||||
session.add(user)
|
||||
session.commit()
|
||||
print(f"Created user: {user.name} ({user.email}) with role {user.role.value}")
|
||||
print(f"Created user: {user.name} ({user.username}) with role {user.role.value}")
|
||||
|
||||
|
||||
def reset_password(args: argparse.Namespace) -> None:
|
||||
"""Reset a user's password (and re-enable their login)."""
|
||||
run_migrations()
|
||||
|
||||
with Session(engine) as session:
|
||||
user = _find_user(session, args.username, args.email)
|
||||
if user is None:
|
||||
who = args.username or args.email
|
||||
print(f"Error: no user found for '{who}'.", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
user.password_hash = hash_password(args.password)
|
||||
user.login_enabled = True
|
||||
session.add(user)
|
||||
session.commit()
|
||||
print(f"Password reset for {user.name} ({user.username}).")
|
||||
|
||||
|
||||
def list_users(args: argparse.Namespace) -> None:
|
||||
"""Print all user accounts."""
|
||||
run_migrations()
|
||||
|
||||
with Session(engine) as session:
|
||||
users = session.exec(select(User).order_by(User.role, User.name)).all() # type: ignore[arg-type]
|
||||
if not users:
|
||||
print("No users.")
|
||||
return
|
||||
print(f"{'USERNAME':<20} {'NAME':<24} {'ROLE':<14} {'STATUS':<10} EMAIL")
|
||||
print("-" * 84)
|
||||
for u in users:
|
||||
status = "active" if u.is_active else "disabled"
|
||||
tag = " [SERVICE ADMIN]" if u.is_service_admin else ""
|
||||
print(f"{u.username:<20} {u.name:<24} {u.role.value:<14} {status:<10} {u.email or '-'}{tag}")
|
||||
print(f"\n{len(users)} user(s). The Service Admin cannot be deleted.")
|
||||
|
||||
|
||||
def delete_user(args: argparse.Namespace) -> None:
|
||||
"""Delete a user account and its dependent rows. The Service Admin is protected."""
|
||||
run_migrations()
|
||||
|
||||
from ten31portal import storage
|
||||
|
||||
with Session(engine) as session:
|
||||
user = _find_user(session, args.username, args.email)
|
||||
if user is None:
|
||||
who = args.username or args.email
|
||||
print(f"Error: no user found for '{who}'.", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
if user.is_service_admin:
|
||||
print(f"Error: '{user.username}' is the Service Admin and cannot be deleted.", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
uid = user.id
|
||||
|
||||
# Entity-access grants and capital-account statements are this user's own data.
|
||||
for acc in session.exec(select(EntityAccess).where(EntityAccess.user_id == uid)).all():
|
||||
session.delete(acc)
|
||||
for stmt in session.exec(
|
||||
select(CapitalAccountStatement).where(CapitalAccountStatement.investor_user_id == uid)
|
||||
).all():
|
||||
session.delete(stmt)
|
||||
|
||||
# Documents addressed privately to this investor are removed (file + row); documents
|
||||
# they uploaded stay, with the uploader cleared.
|
||||
for doc in session.exec(select(Document).where(Document.investor_user_id == uid)).all():
|
||||
try:
|
||||
storage.delete_file(doc.storage_path)
|
||||
except OSError as exc:
|
||||
# Don't abort the whole deletion, but surface it — a swallowed disk/permission
|
||||
# error would silently orphan the file on the data volume.
|
||||
print(f"Warning: could not delete file {doc.storage_path}: {exc}", file=sys.stderr)
|
||||
session.delete(doc)
|
||||
for doc in session.exec(select(Document).where(Document.uploaded_by == uid)).all():
|
||||
doc.uploaded_by = None
|
||||
session.add(doc)
|
||||
|
||||
# Preserve history/rounds by clearing the references to this user.
|
||||
for rnd in session.exec(
|
||||
select(ValuationRound).where(
|
||||
(ValuationRound.submitted_by == uid) | (ValuationRound.approved_by == uid)
|
||||
)
|
||||
).all():
|
||||
if rnd.submitted_by == uid:
|
||||
rnd.submitted_by = None
|
||||
if rnd.approved_by == uid:
|
||||
rnd.approved_by = None
|
||||
session.add(rnd)
|
||||
for log in session.exec(select(AuditLog).where(AuditLog.actor_user_id == uid)).all():
|
||||
log.actor_user_id = None
|
||||
session.add(log)
|
||||
|
||||
# Detach any linked sub-accounts so they log in on their own again.
|
||||
for sub in session.exec(select(User).where(User.primary_account_id == uid)).all():
|
||||
sub.primary_account_id = None
|
||||
session.add(sub)
|
||||
|
||||
name, username = user.name, user.username
|
||||
session.delete(user)
|
||||
session.commit()
|
||||
print(f"Deleted user {name} ({username}).")
|
||||
|
||||
|
||||
def dedupe_holdings(args: argparse.Namespace) -> None:
|
||||
"""Remove duplicate holdings/positions left by old double-imports (fixes inflated Invested)."""
|
||||
run_migrations()
|
||||
from ten31portal.models import Entity
|
||||
from ten31portal.routers.import_router import dedupe_entity
|
||||
|
||||
with Session(engine) as session:
|
||||
if args.entity_id:
|
||||
entities = [e for e in [session.get(Entity, args.entity_id)] if e]
|
||||
else:
|
||||
entities = session.exec(select(Entity).order_by(Entity.name)).all() # type: ignore[arg-type]
|
||||
total_h = total_p = 0
|
||||
for ent in entities:
|
||||
res = dedupe_entity(ent.id, session)
|
||||
if res["removed_holdings"] or res["removed_positions"]:
|
||||
print(f"{ent.name}: removed {res['removed_holdings']} holding(s), "
|
||||
f"{res['removed_positions']} position(s)")
|
||||
total_h += res["removed_holdings"]
|
||||
total_p += res["removed_positions"]
|
||||
session.commit()
|
||||
if total_h or total_p:
|
||||
print(f"\nDone. Removed {total_h} duplicate holding(s) and {total_p} position(s).")
|
||||
else:
|
||||
print("No duplicates found — nothing to clean up.")
|
||||
|
||||
|
||||
def reset_holdings(args: argparse.Namespace) -> None:
|
||||
"""Clear a fund's holdings/positions/rounds so it can be re-imported from scratch."""
|
||||
run_migrations()
|
||||
from ten31portal.models import Entity
|
||||
from ten31portal.routers.import_router import reset_entity_holdings
|
||||
|
||||
with Session(engine) as session:
|
||||
entity = None
|
||||
if args.entity_id:
|
||||
entity = session.get(Entity, args.entity_id)
|
||||
elif args.name:
|
||||
entity = session.exec(select(Entity).where(Entity.name == args.name)).first()
|
||||
if entity is None:
|
||||
print(f"Error: no fund found for '{args.name or args.entity_id}'. "
|
||||
f"Check the exact name with list-funds.", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
res = reset_entity_holdings(entity.id, session)
|
||||
session.commit()
|
||||
print(f"Cleared {entity.name}: removed {res['holdings']} holding(s), "
|
||||
f"{res['positions']} position(s), {res['rounds']} round(s). "
|
||||
f"Re-import the fund's NAV to repopulate it.")
|
||||
|
||||
|
||||
def list_funds(args: argparse.Namespace) -> None:
|
||||
"""Print every entity's id and name (so the exact name is known for reset-holdings)."""
|
||||
run_migrations()
|
||||
from ten31portal.models import Entity
|
||||
|
||||
with Session(engine) as session:
|
||||
entities = session.exec(select(Entity).order_by(Entity.name)).all() # type: ignore[arg-type]
|
||||
if not entities:
|
||||
print("No funds yet.")
|
||||
return
|
||||
for e in entities:
|
||||
print(f"[{e.id}] {e.name} ({e.type.value})")
|
||||
|
||||
|
||||
def main() -> None:
|
||||
@@ -44,13 +226,49 @@ def main() -> None:
|
||||
|
||||
create = sub.add_parser("create-user", help="Provision a new user")
|
||||
create.add_argument("--name", required=True)
|
||||
create.add_argument("--email", required=True)
|
||||
create.add_argument("--username", required=True)
|
||||
create.add_argument("--email", required=False, default=None)
|
||||
create.add_argument("--role", required=True, choices=[r.value for r in UserRole])
|
||||
create.add_argument("--password", required=True)
|
||||
create.add_argument("--service-admin", action="store_true",
|
||||
help="Mark as the protected built-in Service Admin")
|
||||
|
||||
reset = sub.add_parser("reset-password", help="Reset a user's password")
|
||||
reset.add_argument("--username", required=False, default=None)
|
||||
reset.add_argument("--email", required=False, default=None)
|
||||
reset.add_argument("--password", required=True)
|
||||
|
||||
sub.add_parser("list-users", help="List all user accounts")
|
||||
|
||||
delete = sub.add_parser("delete-user", help="Delete a user (not the Service Admin)")
|
||||
delete.add_argument("--username", required=False, default=None)
|
||||
delete.add_argument("--email", required=False, default=None)
|
||||
|
||||
dedupe = sub.add_parser("dedupe-holdings", help="Remove duplicate holdings/positions")
|
||||
dedupe.add_argument("--entity-id", type=int, required=False, default=None,
|
||||
help="Limit to one entity; omit to clean all")
|
||||
|
||||
sub.add_parser("list-funds", help="List entities (funds/SPVs) with their ids")
|
||||
|
||||
reset = sub.add_parser("reset-holdings", help="Clear a fund's holdings to re-import fresh")
|
||||
reset.add_argument("--name", required=False, default=None, help="Exact fund name")
|
||||
reset.add_argument("--entity-id", type=int, required=False, default=None)
|
||||
|
||||
args = parser.parse_args()
|
||||
if args.command == "create-user":
|
||||
create_user(args)
|
||||
elif args.command == "reset-password":
|
||||
reset_password(args)
|
||||
elif args.command == "list-users":
|
||||
list_users(args)
|
||||
elif args.command == "delete-user":
|
||||
delete_user(args)
|
||||
elif args.command == "dedupe-holdings":
|
||||
dedupe_holdings(args)
|
||||
elif args.command == "list-funds":
|
||||
list_funds(args)
|
||||
elif args.command == "reset-holdings":
|
||||
reset_holdings(args)
|
||||
else:
|
||||
parser.print_help()
|
||||
|
||||
|
||||
Reference in New Issue
Block a user