refactor: migrate vendor APIs to token-based context and consolidate architecture
## Vendor-in-Token Architecture (Complete Migration) - Migrate all vendor API endpoints from require_vendor_context() to token_vendor_id - Update permission dependencies to extract vendor from JWT token - Add vendor exceptions: VendorAccessDeniedException, VendorOwnerOnlyException, InsufficientVendorPermissionsException - Shop endpoints retain require_vendor_context() for URL-based detection - Add AUTH-004 architecture rule enforcing vendor context patterns - Fix marketplace router missing /marketplace prefix ## Exception Pattern Fixes (API-003/API-004) - Services raise domain exceptions, endpoints let them bubble up - Add code_quality and content_page exception modules - Move business logic from endpoints to services (admin, auth, content_page) - Fix exception handling in admin, shop, and vendor endpoints ## Tailwind CSS Consolidation - Consolidate CSS to per-area files (admin, vendor, shop, platform) - Remove shared/cdn-fallback.html and shared/css/tailwind.min.css - Update all templates to use area-specific Tailwind output files - Remove Node.js config (package.json, postcss.config.js, tailwind.config.js) ## Documentation & Cleanup - Update vendor-in-token-architecture.md with completed migration status - Update architecture-rules.md with new rules - Move migration docs to docs/development/migration/ - Remove duplicate/obsolete documentation files - Merge pytest.ini settings into pyproject.toml 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
@@ -3,17 +3,21 @@
|
||||
Shop Shopping Cart API (Public)
|
||||
|
||||
Public endpoints for managing shopping cart in shop frontend.
|
||||
Uses vendor from request.state (injected by VendorContextMiddleware).
|
||||
Uses vendor from middleware context (VendorContextMiddleware).
|
||||
No authentication required - uses session ID for cart tracking.
|
||||
|
||||
Vendor Context: require_vendor_context() - detects vendor from URL/subdomain/domain
|
||||
"""
|
||||
|
||||
import logging
|
||||
|
||||
from fastapi import APIRouter, Body, Depends, HTTPException, Path, Request
|
||||
from fastapi import APIRouter, Body, Depends, Path
|
||||
from sqlalchemy.orm import Session
|
||||
|
||||
from app.core.database import get_db
|
||||
from app.services.cart_service import cart_service
|
||||
from middleware.vendor_context import require_vendor_context
|
||||
from models.database.vendor import Vendor
|
||||
from models.schema.cart import (
|
||||
AddToCartRequest,
|
||||
CartOperationResponse,
|
||||
@@ -31,30 +35,21 @@ logger = logging.getLogger(__name__)
|
||||
# ============================================================================
|
||||
|
||||
|
||||
@router.get("/cart/{session_id}", response_model=CartResponse)
|
||||
@router.get("/cart/{session_id}", response_model=CartResponse) # public
|
||||
def get_cart(
|
||||
request: Request,
|
||||
session_id: str = Path(..., description="Shopping session ID"),
|
||||
vendor: Vendor = Depends(require_vendor_context()),
|
||||
db: Session = Depends(get_db),
|
||||
) -> CartResponse:
|
||||
"""
|
||||
Get shopping cart contents for current vendor.
|
||||
|
||||
Vendor is automatically determined from request context.
|
||||
Vendor is automatically determined from request context (URL/subdomain/domain).
|
||||
No authentication required - uses session ID for cart tracking.
|
||||
|
||||
Path Parameters:
|
||||
- session_id: Unique session identifier for the cart
|
||||
"""
|
||||
# Get vendor from middleware
|
||||
vendor = getattr(request.state, "vendor", None)
|
||||
|
||||
if not vendor:
|
||||
raise HTTPException(
|
||||
status_code=404,
|
||||
detail="Vendor not found. Please access via vendor domain/subdomain/path.",
|
||||
)
|
||||
|
||||
logger.info(
|
||||
f"[SHOP_API] get_cart for session {session_id}, vendor {vendor.id}",
|
||||
extra={
|
||||
@@ -79,17 +74,17 @@ def get_cart(
|
||||
return CartResponse.from_service_dict(cart)
|
||||
|
||||
|
||||
@router.post("/cart/{session_id}/items", response_model=CartOperationResponse)
|
||||
@router.post("/cart/{session_id}/items", response_model=CartOperationResponse) # public
|
||||
def add_to_cart(
|
||||
request: Request,
|
||||
session_id: str = Path(..., description="Shopping session ID"),
|
||||
cart_data: AddToCartRequest = Body(...),
|
||||
vendor: Vendor = Depends(require_vendor_context()),
|
||||
db: Session = Depends(get_db),
|
||||
) -> CartOperationResponse:
|
||||
"""
|
||||
Add product to cart for current vendor.
|
||||
|
||||
Vendor is automatically determined from request context.
|
||||
Vendor is automatically determined from request context (URL/subdomain/domain).
|
||||
No authentication required - uses session ID.
|
||||
|
||||
Path Parameters:
|
||||
@@ -99,15 +94,6 @@ def add_to_cart(
|
||||
- product_id: ID of product to add
|
||||
- quantity: Quantity to add (default: 1)
|
||||
"""
|
||||
# Get vendor from middleware
|
||||
vendor = getattr(request.state, "vendor", None)
|
||||
|
||||
if not vendor:
|
||||
raise HTTPException(
|
||||
status_code=404,
|
||||
detail="Vendor not found. Please access via vendor domain/subdomain/path.",
|
||||
)
|
||||
|
||||
logger.info(
|
||||
f"[SHOP_API] add_to_cart: product {cart_data.product_id}, qty {cart_data.quantity}, session {session_id}",
|
||||
extra={
|
||||
@@ -140,18 +126,18 @@ def add_to_cart(
|
||||
|
||||
@router.put(
|
||||
"/cart/{session_id}/items/{product_id}", response_model=CartOperationResponse
|
||||
)
|
||||
) # public
|
||||
def update_cart_item(
|
||||
request: Request,
|
||||
session_id: str = Path(..., description="Shopping session ID"),
|
||||
product_id: int = Path(..., description="Product ID", gt=0),
|
||||
cart_data: UpdateCartItemRequest = Body(...),
|
||||
vendor: Vendor = Depends(require_vendor_context()),
|
||||
db: Session = Depends(get_db),
|
||||
) -> CartOperationResponse:
|
||||
"""
|
||||
Update cart item quantity for current vendor.
|
||||
|
||||
Vendor is automatically determined from request context.
|
||||
Vendor is automatically determined from request context (URL/subdomain/domain).
|
||||
No authentication required - uses session ID.
|
||||
|
||||
Path Parameters:
|
||||
@@ -161,15 +147,6 @@ def update_cart_item(
|
||||
Request Body:
|
||||
- quantity: New quantity (must be >= 1)
|
||||
"""
|
||||
# Get vendor from middleware
|
||||
vendor = getattr(request.state, "vendor", None)
|
||||
|
||||
if not vendor:
|
||||
raise HTTPException(
|
||||
status_code=404,
|
||||
detail="Vendor not found. Please access via vendor domain/subdomain/path.",
|
||||
)
|
||||
|
||||
logger.debug(
|
||||
f"[SHOP_API] update_cart_item: product {product_id}, qty {cart_data.quantity}",
|
||||
extra={
|
||||
@@ -194,32 +171,23 @@ def update_cart_item(
|
||||
|
||||
@router.delete(
|
||||
"/cart/{session_id}/items/{product_id}", response_model=CartOperationResponse
|
||||
)
|
||||
) # public
|
||||
def remove_from_cart(
|
||||
request: Request,
|
||||
session_id: str = Path(..., description="Shopping session ID"),
|
||||
product_id: int = Path(..., description="Product ID", gt=0),
|
||||
vendor: Vendor = Depends(require_vendor_context()),
|
||||
db: Session = Depends(get_db),
|
||||
) -> CartOperationResponse:
|
||||
"""
|
||||
Remove item from cart for current vendor.
|
||||
|
||||
Vendor is automatically determined from request context.
|
||||
Vendor is automatically determined from request context (URL/subdomain/domain).
|
||||
No authentication required - uses session ID.
|
||||
|
||||
Path Parameters:
|
||||
- session_id: Unique session identifier for the cart
|
||||
- product_id: ID of product to remove
|
||||
"""
|
||||
# Get vendor from middleware
|
||||
vendor = getattr(request.state, "vendor", None)
|
||||
|
||||
if not vendor:
|
||||
raise HTTPException(
|
||||
status_code=404,
|
||||
detail="Vendor not found. Please access via vendor domain/subdomain/path.",
|
||||
)
|
||||
|
||||
logger.debug(
|
||||
f"[SHOP_API] remove_from_cart: product {product_id}",
|
||||
extra={
|
||||
@@ -237,30 +205,21 @@ def remove_from_cart(
|
||||
return CartOperationResponse(**result)
|
||||
|
||||
|
||||
@router.delete("/cart/{session_id}", response_model=ClearCartResponse)
|
||||
@router.delete("/cart/{session_id}", response_model=ClearCartResponse) # public
|
||||
def clear_cart(
|
||||
request: Request,
|
||||
session_id: str = Path(..., description="Shopping session ID"),
|
||||
vendor: Vendor = Depends(require_vendor_context()),
|
||||
db: Session = Depends(get_db),
|
||||
) -> ClearCartResponse:
|
||||
"""
|
||||
Clear all items from cart for current vendor.
|
||||
|
||||
Vendor is automatically determined from request context.
|
||||
Vendor is automatically determined from request context (URL/subdomain/domain).
|
||||
No authentication required - uses session ID.
|
||||
|
||||
Path Parameters:
|
||||
- session_id: Unique session identifier for the cart
|
||||
"""
|
||||
# Get vendor from middleware
|
||||
vendor = getattr(request.state, "vendor", None)
|
||||
|
||||
if not vendor:
|
||||
raise HTTPException(
|
||||
status_code=404,
|
||||
detail="Vendor not found. Please access via vendor domain/subdomain/path.",
|
||||
)
|
||||
|
||||
logger.debug(
|
||||
f"[SHOP_API] clear_cart for session {session_id}",
|
||||
extra={
|
||||
|
||||
Reference in New Issue
Block a user