Jonathan Kirkwood
ae967494bd
The external fund_administrator role (relabeled Administrator) now signs
into the full admin interface, fenced to the funds and SPVs granted to
it via EntityAccess:
- Partners, capital accounts, documents (upload and delete), entity
edits, and eNAV imports for its own funds only; no fund creation,
valuation sign-off, audit log, or investor view.
- Scoped user management: sees and manages only investors tied to its
funds; creates investor accounts only; updates preserve grants on
funds outside its scope.
- New DELETE /api/users/{id} (in-app Delete user button) with the
cascade cleanup factored out of the CLI; Service Admin and self are
protected, and an Administrator can only delete an investor who
belongs solely to its funds.
- Internal fund_admin relabeled 'Staff (all funds)' and dropped from
the create picker to end the two-similar-names confusion.
- Version badge removed from the UI (sidebar and portal header); the
build version now logs to the browser console instead.
- deploy/.startos (signing key) added to .gitignore.
121 lines
4.2 KiB
Python
121 lines
4.2 KiB
Python
"""Position CRUD endpoints."""
|
|
|
|
import math
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException
|
|
from sqlmodel import Session, select
|
|
|
|
from ten31portal.audit import record_audit
|
|
from ten31portal.auth import (
|
|
check_administrator_scope, require_internal_or_administrator, require_writer,
|
|
)
|
|
from ten31portal.database import get_session
|
|
from ten31portal.models import Holding, Position, Valuation, ValuationRound, RoundStatus, User
|
|
from ten31portal.schemas import PositionCreate, PositionResponse, PositionUpdate
|
|
|
|
router = APIRouter(tags=["positions"])
|
|
|
|
|
|
def _dollars_to_cents(dollars: float) -> int:
|
|
"""Convert dollar amount to integer cents, rounding to nearest cent."""
|
|
return round(dollars * 100)
|
|
|
|
|
|
@router.get("/api/holdings/{holding_id}/positions")
|
|
def list_positions(
|
|
holding_id: int,
|
|
user: User = Depends(require_internal_or_administrator),
|
|
session: Session = Depends(get_session),
|
|
) -> list[PositionResponse]:
|
|
holding = session.get(Holding, holding_id)
|
|
if holding is None:
|
|
raise HTTPException(status_code=404, detail="Holding not found")
|
|
check_administrator_scope(user, holding.entity_id, session)
|
|
rows = session.exec(select(Position).where(Position.holding_id == holding_id)).all()
|
|
return [PositionResponse.model_validate(r, from_attributes=True) for r in rows]
|
|
|
|
|
|
@router.post("/api/holdings/{holding_id}/positions", status_code=201)
|
|
def create_position(
|
|
holding_id: int,
|
|
body: PositionCreate,
|
|
user: User = Depends(require_writer),
|
|
session: Session = Depends(get_session),
|
|
) -> PositionResponse:
|
|
holding = session.get(Holding, holding_id)
|
|
if holding is None:
|
|
raise HTTPException(status_code=404, detail="Holding not found")
|
|
position = Position(
|
|
holding_id=holding_id,
|
|
security_name=body.security_name,
|
|
investment_date=body.investment_date,
|
|
shares=body.shares,
|
|
cost_cents=_dollars_to_cents(body.cost_dollars),
|
|
)
|
|
session.add(position)
|
|
session.flush()
|
|
record_audit(session, user.id, "create", "position", position.id, {
|
|
"holding_id": holding_id,
|
|
"security_name": body.security_name,
|
|
"cost_dollars": body.cost_dollars,
|
|
})
|
|
session.commit()
|
|
session.refresh(position)
|
|
return PositionResponse.model_validate(position, from_attributes=True)
|
|
|
|
|
|
@router.patch("/api/positions/{position_id}")
|
|
def update_position(
|
|
position_id: int,
|
|
body: PositionUpdate,
|
|
user: User = Depends(require_writer),
|
|
session: Session = Depends(get_session),
|
|
) -> PositionResponse:
|
|
position = session.get(Position, position_id)
|
|
if position is None:
|
|
raise HTTPException(status_code=404, detail="Position not found")
|
|
changes = body.model_dump(exclude_unset=True)
|
|
if "cost_dollars" in changes:
|
|
position.cost_cents = _dollars_to_cents(changes.pop("cost_dollars"))
|
|
for key, val in changes.items():
|
|
setattr(position, key, val)
|
|
session.add(position)
|
|
session.flush()
|
|
record_audit(session, user.id, "update", "position", position.id, body.model_dump(exclude_unset=True))
|
|
session.commit()
|
|
session.refresh(position)
|
|
return PositionResponse.model_validate(position, from_attributes=True)
|
|
|
|
|
|
@router.delete("/api/positions/{position_id}")
|
|
def delete_position(
|
|
position_id: int,
|
|
user: User = Depends(require_writer),
|
|
session: Session = Depends(get_session),
|
|
) -> dict[str, str]:
|
|
position = session.get(Position, position_id)
|
|
if position is None:
|
|
raise HTTPException(status_code=404, detail="Position not found")
|
|
|
|
# Refuse if any approved valuation references this position
|
|
approved_vals = session.exec(
|
|
select(Valuation)
|
|
.join(ValuationRound)
|
|
.where(
|
|
Valuation.position_id == position_id,
|
|
ValuationRound.status == RoundStatus.approved,
|
|
)
|
|
).all()
|
|
if approved_vals:
|
|
raise HTTPException(
|
|
status_code=409,
|
|
detail="Cannot delete position referenced by an approved valuation round.",
|
|
)
|
|
|
|
record_audit(session, user.id, "delete", "position", position.id, {
|
|
"security_name": position.security_name,
|
|
})
|
|
session.delete(position)
|
|
session.commit()
|
|
return {"status": "deleted"}
|