Deploy PR #13: Robinhood refresh wait for newer snapshot (11e93ece)

README.md

@@ -46,8 +46,11 @@ Copy the Grok Bot webhook URL and sender key into the Space secrets. Do **not**
 - `POST /api/chat` `{ sessionId, clientMsgId, botId, botName, text, history? }` → `{ ok, clientMsgId }` and forwards JSON to `GROK_WEBHOOK_URL`
 - `GET /api/chat?sessionId=` → `{ messages: [...] }`
 - `POST /api/chat/reply` `Authorization: Bearer ${CHAT_BRIDGE_SECRET}` `{ sessionId, clientMsgId, botId, text, status: "partial"|"final" }`
-- `GET /api/robinhood` → `{ "snapshot": null }` or `{ "snapshot": { ... } }` (no auth, `Cache-Control: no-store`)
-- `POST /api/robinhood` `Authorization: Bearer ${ROBINHOOD_BRIDGE_SECRET}` replaces the stored snapshot. If that secret is unset, `CHAT_BRIDGE_SECRET` is accepted instead.
+- `GET /api/robinhood` → `{ "snapshot": null, "refreshPending": false }` or `{ "snapshot": { ... }, "refreshPending": false }` (no auth, `Cache-Control: no-store`). When a refresh is waiting on a newer snapshot, the body also includes `refreshPending: true` and `refreshRequestedAt`.
+- `POST /api/robinhood` `Authorization: Bearer ${ROBINHOOD_BRIDGE_SECRET}` replaces the stored snapshot and clears any pending refresh. If that secret is unset, `CHAT_BRIDGE_SECRET` is accepted instead.
+- `POST /api/robinhood/refresh` (public, no auth) stores a pending refresh. Rate limit is one request per 15 seconds per IP. Same path without the `/api` prefix.
+- `GET /api/robinhood/pending-refresh` (public) → `{ "refreshPending": bool, "refreshRequestedAt"?: string }` for Chief of Staff to poll without the snapshot body.
+- `DELETE /api/robinhood/refresh` uses the same bearer as the snapshot POST and clears the pending file. A successful snapshot POST already clears it.
 
 CORS allows `https://simzy420.github.io` and localhost. Text max 8000. `sessionId` must be a UUID.
 
@@ -79,3 +82,15 @@ Content-Type: application/json
 ```
 
 Push Casey’s default individual brokerage account. Empty nickname → `"label": "Individual"`. Equity positions only in `positions`. `price` / `marketValue` of `0` or `null` means no live quote.
+
+### Phone refresh (Chief of Staff must fulfill)
+
+The phone never calls Robinhood. **Refresh** does `POST /api/robinhood/refresh`, which writes `robinhood-refresh.json` next to the snapshot:
+
+```json
+{ "requestedAt": "2026-09-28T15:04:00Z" }
+```
+
+`refreshPending` is true when that file exists and there is no snapshot yet, or `requestedAt` is later than `snapshot.updatedAt`.
+
+Chief of Staff (or a webhook) must notice the pending flag — poll `GET /api/robinhood` or `GET /api/robinhood/pending-refresh` — pull Robinhood, and `POST /api/robinhood` with a new snapshot. That POST clears the pending file. This repo does not change CoS routines. Until the push lands, the phone keeps the last snapshot and, after about 45 seconds, shows a waiting error.

main.py

@@ -119,6 +119,92 @@ def save_snapshot(snapshot: dict[str, Any]) -> None:
     tmp.replace(path)
 
 
+def refresh_file() -> Path:
+    return STORE.parent / "robinhood-refresh.json"
+
+
+def utc_stamp(moment: datetime | None = None) -> str:
+    current = moment or datetime.now(timezone.utc)
+    return current.astimezone(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def parse_utc(raw: str | None) -> datetime | None:
+    text = (raw or "").strip()
+    if not text:
+        return None
+    try:
+        parsed = datetime.fromisoformat(text.replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=timezone.utc)
+    return parsed.astimezone(timezone.utc)
+
+
+def load_refresh_request() -> str | None:
+    path = refresh_file()
+    if not path.is_file():
+        return None
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return None
+    if not isinstance(data, dict):
+        return None
+    raw = data.get("requestedAt")
+    parsed = parse_utc(raw if isinstance(raw, str) else None)
+    if parsed is None:
+        return None
+    return utc_stamp(parsed)
+
+
+def save_refresh_request(requested_at: str) -> None:
+    path = refresh_file()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp = path.with_suffix(path.suffix + ".tmp")
+    tmp.write_text(json.dumps({"requestedAt": requested_at}), encoding="utf-8")
+    tmp.replace(path)
+
+
+def clear_refresh_request() -> None:
+    path = refresh_file()
+    path.unlink(missing_ok=True)
+    path.with_suffix(path.suffix + ".tmp").unlink(missing_ok=True)
+
+
+def refresh_is_pending(snapshot: dict[str, Any] | None, requested_at: str | None) -> bool:
+    """True when a request is waiting on a snapshot that is missing or older than it."""
+    requested = parse_utc(requested_at)
+    if requested is None:
+        return False
+    if not snapshot:
+        return True
+    updated = parse_utc(str(snapshot.get("updatedAt") or ""))
+    if updated is None:
+        return True
+    return requested > updated
+
+
+def robinhood_payload() -> dict[str, Any]:
+    snapshot = load_snapshot()
+    requested_at = load_refresh_request()
+    pending = refresh_is_pending(snapshot, requested_at)
+    body: dict[str, Any] = {"snapshot": snapshot, "refreshPending": pending}
+    if pending and requested_at:
+        body["refreshRequestedAt"] = requested_at
+    return body
+
+
+# One public refresh per IP inside this window. Phone retries after the ~45s wait.
+REFRESH_INTERVAL_S = 15.0
+
+
+def client_addr(request: Request) -> str:
+    forwarded = (request.headers.get("x-forwarded-for") or "").split(",")[0].strip()
+    host = forwarded or (request.client.host if request.client else "")
+    return (host or "unknown")[:80]
+
+
 def robinhood_secret() -> str:
     """Dedicated secret wins. Otherwise reuse the chat reply secret."""
     dedicated = (os.environ.get("ROBINHOOD_BRIDGE_SECRET") or "").strip()
@@ -264,7 +350,7 @@ app.add_middleware(
     ],
     allow_origin_regex=r"http://(localhost|127\.0\.0\.1)(:\d+)?",
     allow_credentials=False,
-    allow_methods=["GET", "POST", "OPTIONS"],
+    allow_methods=["GET", "POST", "DELETE", "OPTIONS"],
     allow_headers=["Content-Type", "Authorization", "X-Webhook-Key"],
     max_age=86400,
 )
@@ -425,7 +511,7 @@ NO_STORE = {"Cache-Control": "no-store"}
 @app.get("/robinhood")
 @app.get("/api/robinhood")
 def get_robinhood() -> JSONResponse:
-    return JSONResponse({"snapshot": load_snapshot()}, headers=NO_STORE)
+    return JSONResponse(robinhood_payload(), headers=NO_STORE)
 
 
 @app.post("/robinhood")
@@ -447,9 +533,46 @@ async def post_robinhood(request: Request, authorization: str | None = Header(de
         raise HTTPException(400, "Invalid Robinhood snapshot.") from exc
     snapshot = normalize_snapshot(body)
     save_snapshot(snapshot)
+    clear_refresh_request()
     return JSONResponse({"ok": True, "updatedAt": snapshot["updatedAt"]}, headers=NO_STORE)
 
 
+@app.post("/robinhood/refresh")
+@app.post("/api/robinhood/refresh")
+def post_robinhood_refresh(request: Request) -> JSONResponse:
+    """Public. Phone asks Chief of Staff to pull Robinhood; it never calls Robinhood itself."""
+    if rate_limited(f"robinhood:refresh:{client_addr(request)}", max_n=1, window_s=REFRESH_INTERVAL_S):
+        raise HTTPException(429, "A refresh was just requested. Wait a few seconds.")
+    requested_at = utc_stamp()
+    save_refresh_request(requested_at)
+    return JSONResponse(
+        {"ok": True, "requestedAt": requested_at, "refreshPending": True},
+        headers=NO_STORE,
+    )
+
+
+@app.delete("/robinhood/refresh")
+@app.delete("/api/robinhood/refresh")
+def delete_robinhood_refresh(authorization: str | None = Header(default=None)) -> JSONResponse:
+    secret = robinhood_secret()
+    if not secret:
+        raise HTTPException(500, "Space is missing ROBINHOOD_BRIDGE_SECRET (or CHAT_BRIDGE_SECRET).")
+    if not bearer_ok(authorization, secret):
+        raise HTTPException(401, "Unauthorized.")
+    clear_refresh_request()
+    return JSONResponse({"ok": True, "refreshPending": False}, headers=NO_STORE)
+
+
+@app.get("/robinhood/pending-refresh")
+@app.get("/api/robinhood/pending-refresh")
+def get_robinhood_pending() -> JSONResponse:
+    payload = robinhood_payload()
+    body: dict[str, Any] = {"refreshPending": payload["refreshPending"]}
+    if "refreshRequestedAt" in payload:
+        body["refreshRequestedAt"] = payload["refreshRequestedAt"]
+    return JSONResponse(body, headers=NO_STORE)
+
+
 @app.exception_handler(HTTPException)
 async def http_error(_request: Request, exc: HTTPException) -> JSONResponse:
     detail = exc.detail if isinstance(exc.detail, str) else json.dumps(exc.detail)

test_robinhood.py

@@ -1,10 +1,11 @@
+import json
 import os
 import unittest
 import uuid
 
 from fastapi.testclient import TestClient
 
-from main import RATE, app, snapshot_file
+from main import RATE, app, refresh_file, snapshot_file
 
 
 SAMPLE = {
@@ -37,29 +38,30 @@ class RobinhoodBridgeTest(unittest.TestCase):
         os.environ.pop("ROBINHOOD_BRIDGE_SECRET", None)
         os.environ["CHAT_BRIDGE_SECRET"] = "chat-secret-value"
         RATE.clear()
-        path = snapshot_file()
-        if path.exists():
-            path.unlink()
-        tmp = path.with_suffix(path.suffix + ".tmp")
-        if tmp.exists():
-            tmp.unlink()
+        self._wipe_files()
         self.client = TestClient(app)
 
     def tearDown(self) -> None:
         self.client.close()
-        path = snapshot_file()
-        if path.exists():
-            path.unlink()
+        self._wipe_files()
         for key, value in self._env.items():
             if value is None:
                 os.environ.pop(key, None)
             else:
                 os.environ[key] = value
 
+    def _wipe_files(self) -> None:
+        for path in (snapshot_file(), refresh_file()):
+            if path.exists():
+                path.unlink()
+            tmp = path.with_suffix(path.suffix + ".tmp")
+            if tmp.exists():
+                tmp.unlink()
+
     def test_get_empty_snapshot_is_public(self) -> None:
         res = self.client.get("/api/robinhood")
         self.assertEqual(res.status_code, 200)
-        self.assertEqual(res.json(), {"snapshot": None})
+        self.assertEqual(res.json(), {"snapshot": None, "refreshPending": False})
         self.assertEqual(res.headers.get("cache-control"), "no-store")
 
     def test_post_requires_bearer_and_masks_account(self) -> None:
@@ -147,6 +149,117 @@ class RobinhoodBridgeTest(unittest.TestCase):
         self.assertEqual(polled.status_code, 200)
         self.assertEqual(polled.json()["messages"][-1]["text"], "ok")
 
+    def test_refresh_request_is_public_and_rate_limited_per_ip(self) -> None:
+        os.environ.pop("ROBINHOOD_BRIDGE_SECRET", None)
+        os.environ.pop("CHAT_BRIDGE_SECRET", None)
+        first = self.client.post("/api/robinhood/refresh", headers={"X-Forwarded-For": "203.0.113.10"})
+        self.assertEqual(first.status_code, 200)
+        body = first.json()
+        self.assertTrue(body["ok"])
+        self.assertTrue(body["refreshPending"])
+        self.assertRegex(body["requestedAt"], r"^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$")
+        self.assertEqual(first.headers.get("cache-control"), "no-store")
+        stored = json.loads(refresh_file().read_text(encoding="utf-8"))
+        self.assertEqual(stored, {"requestedAt": body["requestedAt"]})
+
+        again = self.client.post("/api/robinhood/refresh", headers={"X-Forwarded-For": "203.0.113.10"})
+        self.assertEqual(again.status_code, 429)
+
+        other = self.client.post("/robinhood/refresh", headers={"X-Forwarded-For": "203.0.113.11"})
+        self.assertEqual(other.status_code, 200)
+
+    def test_refresh_pending_until_snapshot_is_newer(self) -> None:
+        headers = {"Authorization": "Bearer chat-secret-value"}
+        old = dict(SAMPLE)
+        old["updatedAt"] = "2020-01-01T00:00:00Z"
+        self.client.post("/api/robinhood", json=old, headers=headers)
+        asked = self.client.post("/api/robinhood/refresh", headers={"X-Forwarded-For": "203.0.113.12"})
+        requested_at = asked.json()["requestedAt"]
+
+        got = self.client.get("/api/robinhood")
+        body = got.json()
+        self.assertEqual(got.headers.get("cache-control"), "no-store")
+        self.assertTrue(body["refreshPending"])
+        self.assertEqual(body["refreshRequestedAt"], requested_at)
+        self.assertEqual(body["snapshot"]["updatedAt"], "2020-01-01T00:00:00Z")
+
+        pending = self.client.get("/api/robinhood/pending-refresh")
+        self.assertEqual(pending.status_code, 200)
+        self.assertEqual(
+            pending.json(),
+            {"refreshPending": True, "refreshRequestedAt": requested_at},
+        )
+        alias = self.client.get("/robinhood/pending-refresh")
+        self.assertEqual(alias.json()["refreshPending"], True)
+
+    def test_pending_flag_is_false_when_snapshot_is_already_newer(self) -> None:
+        headers = {"Authorization": "Bearer chat-secret-value"}
+        future = dict(SAMPLE)
+        future["updatedAt"] = "2099-01-01T00:00:00Z"
+        self.client.post("/api/robinhood", json=future, headers=headers)
+        self.client.post("/api/robinhood/refresh", headers={"X-Forwarded-For": "203.0.113.13"})
+        body = self.client.get("/api/robinhood").json()
+        self.assertFalse(body["refreshPending"])
+        self.assertNotIn("refreshRequestedAt", body)
+        self.assertTrue(refresh_file().is_file())
+        self.assertEqual(self.client.get("/api/robinhood/pending-refresh").json(), {"refreshPending": False})
+
+    def test_snapshot_post_clears_pending_refresh(self) -> None:
+        self.client.post("/api/robinhood/refresh", headers={"X-Forwarded-For": "203.0.113.14"})
+        self.assertTrue(refresh_file().is_file())
+        denied = self.client.post("/api/robinhood", json=SAMPLE)
+        self.assertEqual(denied.status_code, 401)
+        self.assertTrue(self.client.get("/api/robinhood").json()["refreshPending"])
+
+        res = self.client.post(
+            "/api/robinhood",
+            json=SAMPLE,
+            headers={"Authorization": "Bearer chat-secret-value"},
+        )
+        self.assertEqual(res.status_code, 200)
+        self.assertFalse(refresh_file().exists())
+        body = self.client.get("/api/robinhood").json()
+        self.assertFalse(body["refreshPending"])
+        self.assertNotIn("refreshRequestedAt", body)
+        self.assertEqual(self.client.get("/robinhood/pending-refresh").json(), {"refreshPending": False})
+
+    def test_delete_refresh_requires_snapshot_bearer(self) -> None:
+        self.client.post("/api/robinhood/refresh", headers={"X-Forwarded-For": "203.0.113.15"})
+        denied = self.client.delete("/api/robinhood/refresh")
+        self.assertEqual(denied.status_code, 401)
+        self.assertTrue(refresh_file().is_file())
+
+        os.environ["ROBINHOOD_BRIDGE_SECRET"] = "rh-secret-value"
+        chat = self.client.delete(
+            "/api/robinhood/refresh",
+            headers={"Authorization": "Bearer chat-secret-value"},
+        )
+        self.assertEqual(chat.status_code, 401)
+        self.assertTrue(refresh_file().is_file())
+
+        ok = self.client.delete(
+            "/robinhood/refresh",
+            headers={"Authorization": "Bearer rh-secret-value"},
+        )
+        self.assertEqual(ok.status_code, 200)
+        self.assertEqual(ok.json(), {"ok": True, "refreshPending": False})
+        self.assertFalse(refresh_file().exists())
+        self.assertFalse(self.client.get("/api/robinhood").json()["refreshPending"])
+
+    def test_refresh_cors_allows_phone_origin(self) -> None:
+        res = self.client.options(
+            "/api/robinhood/refresh",
+            headers={
+                "Origin": "https://simzy420.github.io",
+                "Access-Control-Request-Method": "POST",
+            },
+        )
+        self.assertIn(res.status_code, (200, 204))
+        self.assertEqual(res.headers.get("access-control-allow-origin"), "https://simzy420.github.io")
+        allow = res.headers.get("access-control-allow-methods", "")
+        self.assertIn("POST", allow)
+        self.assertIn("DELETE", allow)
+
 
 if __name__ == "__main__":
     unittest.main()