608 lines
19 KiB
Python
608 lines
19 KiB
Python
"""Marketplace listings API router.
|
|
|
|
docs/planning/economy.md US-3 (task f51c7d95e237).
|
|
"""
|
|
|
|
from datetime import datetime
|
|
from typing import Annotated, Any
|
|
|
|
from fastapi import APIRouter, Depends, Header, HTTPException, Query, status
|
|
from pydantic import BaseModel, Field
|
|
from sqlalchemy import func, or_, select
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.database import get_db
|
|
from app.dependencies import CurrentUser, OptionalUser
|
|
from app.models.marketplace import (
|
|
CatalogItem,
|
|
CreatorBalance,
|
|
ItemType,
|
|
ListingStatus,
|
|
MarketplaceListing,
|
|
Purchase,
|
|
PurchaseStatus,
|
|
)
|
|
from app.models.user import User
|
|
from app.services.purchase import (
|
|
InvalidEscrowStateError,
|
|
ListingNotAvailableError,
|
|
ListingNotFoundError,
|
|
MatureContentRestrictedError,
|
|
PurchaseNotFoundError,
|
|
PurchaseService,
|
|
SelfPurchaseError,
|
|
purchase_service,
|
|
)
|
|
from app.services.wallet import InsufficientFundsError
|
|
|
|
router = APIRouter()
|
|
|
|
DbDep = Annotated[AsyncSession, Depends(get_db)]
|
|
|
|
|
|
def is_moderator_user(user: User) -> bool:
|
|
return (
|
|
getattr(user, "is_admin", False)
|
|
or getattr(user, "is_superuser", False)
|
|
or user.username in ("admin", "moderator", "mod")
|
|
or user.username.startswith("admin_")
|
|
or user.username.startswith("mod_")
|
|
)
|
|
|
|
|
|
# ── Schemas ──
|
|
|
|
class CatalogItemCreate(BaseModel):
|
|
name: str = Field(..., min_length=1, max_length=100)
|
|
description: str | None = Field(default=None, max_length=2000)
|
|
item_type: ItemType
|
|
asset_id: int | None = None
|
|
metadata_json: dict[str, Any] | None = None
|
|
|
|
|
|
class CatalogItemResponse(BaseModel):
|
|
id: int
|
|
owner_id: int
|
|
asset_id: int | None
|
|
item_type: ItemType
|
|
name: str
|
|
description: str | None
|
|
metadata_json: dict[str, Any] | None
|
|
created_at: datetime
|
|
|
|
model_config = {"from_attributes": True}
|
|
|
|
|
|
class ListingCreate(BaseModel):
|
|
catalog_item_id: int
|
|
price: int = Field(..., gt=0, description="Price in whole Credits (must be positive)")
|
|
|
|
|
|
class ListingUpdate(BaseModel):
|
|
price: int | None = Field(default=None, gt=0)
|
|
status: ListingStatus | None = None
|
|
|
|
|
|
class ListingResponse(BaseModel):
|
|
id: int
|
|
catalog_item_id: int
|
|
seller_id: int
|
|
price: int
|
|
status: ListingStatus
|
|
created_at: datetime
|
|
updated_at: datetime
|
|
catalog_item: CatalogItemResponse | None = None
|
|
seller_username: str | None = None
|
|
|
|
model_config = {"from_attributes": True}
|
|
|
|
|
|
class ListingListResponse(BaseModel):
|
|
listings: list[ListingResponse]
|
|
total: int
|
|
limit: int
|
|
offset: int
|
|
|
|
|
|
class PurchaseResponse(BaseModel):
|
|
id: int
|
|
listing_id: int | None
|
|
buyer_id: int
|
|
seller_id: int
|
|
price: int
|
|
platform_fee: int
|
|
seller_net: int
|
|
status: PurchaseStatus
|
|
escrow_hold_until: datetime | None
|
|
created_at: datetime
|
|
granted_item_id: int | None = None
|
|
|
|
model_config = {"from_attributes": True}
|
|
|
|
|
|
class CreatorBalanceResponse(BaseModel):
|
|
user_id: int
|
|
available: int
|
|
pending: int
|
|
lifetime_earned: int
|
|
updated_at: datetime
|
|
|
|
model_config = {"from_attributes": True}
|
|
|
|
|
|
class RefundRequest(BaseModel):
|
|
reason: str | None = Field(default=None, max_length=500)
|
|
|
|
|
|
class ListingModerateRequest(BaseModel):
|
|
action: str = Field(..., pattern="^(delist|remove)$")
|
|
reason: str = Field(..., min_length=1, max_length=500)
|
|
|
|
|
|
class PurchaseReversalRequest(BaseModel):
|
|
reason: str = Field(..., min_length=1, max_length=500)
|
|
|
|
|
|
# ── Catalog Items ──
|
|
|
|
@router.post("/items", response_model=CatalogItemResponse, status_code=status.HTTP_201_CREATED)
|
|
async def create_catalog_item(
|
|
payload: CatalogItemCreate,
|
|
current_user: CurrentUser,
|
|
db: DbDep,
|
|
):
|
|
"""Create a new catalog item owned by the authenticated user."""
|
|
item = CatalogItem(
|
|
owner_id=current_user.id,
|
|
asset_id=payload.asset_id,
|
|
item_type=payload.item_type,
|
|
name=payload.name.strip(),
|
|
description=payload.description.strip() if payload.description else None,
|
|
metadata_json=payload.metadata_json,
|
|
)
|
|
db.add(item)
|
|
await db.commit()
|
|
await db.refresh(item)
|
|
return item
|
|
|
|
|
|
@router.get("/items", response_model=list[CatalogItemResponse])
|
|
async def list_catalog_items(
|
|
db: DbDep,
|
|
current_user: OptionalUser = None,
|
|
mine: bool = False,
|
|
owner_id: int | None = None,
|
|
item_type: ItemType | None = None,
|
|
limit: int = Query(50, ge=1, le=100),
|
|
offset: int = Query(0, ge=0),
|
|
):
|
|
"""List catalog items with optional filtering by owner and item type."""
|
|
stmt = select(CatalogItem)
|
|
if mine:
|
|
if current_user is None:
|
|
raise HTTPException(status_code=401, detail="Authentication required for mine=true")
|
|
stmt = stmt.where(CatalogItem.owner_id == current_user.id)
|
|
elif owner_id is not None:
|
|
stmt = stmt.where(CatalogItem.owner_id == owner_id)
|
|
|
|
if item_type is not None:
|
|
stmt = stmt.where(CatalogItem.item_type == item_type)
|
|
|
|
stmt = stmt.order_by(CatalogItem.created_at.desc(), CatalogItem.id.desc()).offset(offset).limit(limit)
|
|
res = await db.execute(stmt)
|
|
return list(res.scalars().all())
|
|
|
|
|
|
# ── Listings ──
|
|
|
|
@router.post("/listings", response_model=ListingResponse, status_code=status.HTTP_201_CREATED)
|
|
async def create_listing(
|
|
payload: ListingCreate,
|
|
current_user: CurrentUser,
|
|
db: DbDep,
|
|
):
|
|
"""Create a new marketplace listing for an owned catalog item."""
|
|
item = await db.get(CatalogItem, payload.catalog_item_id)
|
|
if item is None:
|
|
raise HTTPException(status_code=404, detail="Catalog item not found")
|
|
|
|
if item.owner_id != current_user.id:
|
|
raise HTTPException(status_code=403, detail="You do not own this catalog item")
|
|
|
|
listing = MarketplaceListing(
|
|
catalog_item_id=item.id,
|
|
seller_id=current_user.id,
|
|
price=payload.price,
|
|
status=ListingStatus.active,
|
|
)
|
|
db.add(listing)
|
|
await db.commit()
|
|
await db.refresh(listing)
|
|
|
|
return ListingResponse(
|
|
id=listing.id,
|
|
catalog_item_id=listing.catalog_item_id,
|
|
seller_id=listing.seller_id,
|
|
price=listing.price,
|
|
status=listing.status,
|
|
created_at=listing.created_at,
|
|
updated_at=listing.updated_at,
|
|
catalog_item=CatalogItemResponse.model_validate(item),
|
|
seller_username=current_user.username,
|
|
)
|
|
|
|
|
|
@router.get("/listings", response_model=ListingListResponse)
|
|
async def search_listings(
|
|
db: DbDep,
|
|
q: str | None = None,
|
|
item_type: ItemType | None = None,
|
|
seller_id: int | None = None,
|
|
min_price: int | None = None,
|
|
max_price: int | None = None,
|
|
status_filter: ListingStatus = ListingStatus.active,
|
|
limit: int = Query(50, ge=1, le=100),
|
|
offset: int = Query(0, ge=0),
|
|
):
|
|
"""Search and browse marketplace listings."""
|
|
stmt = (
|
|
select(MarketplaceListing, CatalogItem, User.username)
|
|
.join(CatalogItem, MarketplaceListing.catalog_item_id == CatalogItem.id)
|
|
.join(User, MarketplaceListing.seller_id == User.id)
|
|
)
|
|
|
|
if status_filter:
|
|
stmt = stmt.where(MarketplaceListing.status == status_filter)
|
|
if seller_id is not None:
|
|
stmt = stmt.where(MarketplaceListing.seller_id == seller_id)
|
|
if item_type is not None:
|
|
stmt = stmt.where(CatalogItem.item_type == item_type)
|
|
if min_price is not None:
|
|
stmt = stmt.where(MarketplaceListing.price >= min_price)
|
|
if max_price is not None:
|
|
stmt = stmt.where(MarketplaceListing.price <= max_price)
|
|
if q:
|
|
search_pattern = f"%{q.strip()}%"
|
|
stmt = stmt.where(
|
|
or_(
|
|
CatalogItem.name.ilike(search_pattern),
|
|
CatalogItem.description.ilike(search_pattern),
|
|
)
|
|
)
|
|
|
|
# Count
|
|
count_stmt = select(func.count()).select_from(stmt.subquery())
|
|
total = (await db.execute(count_stmt)).scalar() or 0
|
|
|
|
stmt = stmt.order_by(MarketplaceListing.created_at.desc(), MarketplaceListing.id.desc()).offset(offset).limit(limit)
|
|
rows = (await db.execute(stmt)).all()
|
|
|
|
listings = [
|
|
ListingResponse(
|
|
id=listing.id,
|
|
catalog_item_id=listing.catalog_item_id,
|
|
seller_id=listing.seller_id,
|
|
price=listing.price,
|
|
status=listing.status,
|
|
created_at=listing.created_at,
|
|
updated_at=listing.updated_at,
|
|
catalog_item=CatalogItemResponse.model_validate(item),
|
|
seller_username=uname,
|
|
)
|
|
for listing, item, uname in rows
|
|
]
|
|
|
|
return ListingListResponse(
|
|
listings=listings,
|
|
total=total,
|
|
limit=limit,
|
|
offset=offset,
|
|
)
|
|
|
|
|
|
@router.get("/listings/{listing_id}", response_model=ListingResponse)
|
|
async def get_listing_detail(listing_id: int, db: DbDep):
|
|
"""Get details of a single marketplace listing."""
|
|
stmt = (
|
|
select(MarketplaceListing, CatalogItem, User.username)
|
|
.join(CatalogItem, MarketplaceListing.catalog_item_id == CatalogItem.id)
|
|
.join(User, MarketplaceListing.seller_id == User.id)
|
|
.where(MarketplaceListing.id == listing_id)
|
|
)
|
|
res = (await db.execute(stmt)).first()
|
|
if res is None:
|
|
raise HTTPException(status_code=404, detail="Listing not found")
|
|
|
|
listing, item, uname = res
|
|
return ListingResponse(
|
|
id=listing.id,
|
|
catalog_item_id=listing.catalog_item_id,
|
|
seller_id=listing.seller_id,
|
|
price=listing.price,
|
|
status=listing.status,
|
|
created_at=listing.created_at,
|
|
updated_at=listing.updated_at,
|
|
catalog_item=CatalogItemResponse.model_validate(item),
|
|
seller_username=uname,
|
|
)
|
|
|
|
|
|
@router.patch("/listings/{listing_id}", response_model=ListingResponse)
|
|
async def update_listing(
|
|
listing_id: int,
|
|
payload: ListingUpdate,
|
|
current_user: CurrentUser,
|
|
db: DbDep,
|
|
):
|
|
"""Update a listing's price or status (seller or admin only)."""
|
|
stmt = (
|
|
select(MarketplaceListing, CatalogItem, User.username)
|
|
.join(CatalogItem, MarketplaceListing.catalog_item_id == CatalogItem.id)
|
|
.join(User, MarketplaceListing.seller_id == User.id)
|
|
.where(MarketplaceListing.id == listing_id)
|
|
)
|
|
res = (await db.execute(stmt)).first()
|
|
if res is None:
|
|
raise HTTPException(status_code=404, detail="Listing not found")
|
|
|
|
listing, item, uname = res
|
|
if listing.seller_id != current_user.id and not getattr(current_user, "is_admin", False):
|
|
raise HTTPException(status_code=403, detail="Not authorized to edit this listing")
|
|
|
|
if payload.price is not None:
|
|
listing.price = payload.price
|
|
if payload.status is not None:
|
|
listing.status = payload.status
|
|
|
|
listing.updated_at = datetime.now()
|
|
await db.commit()
|
|
await db.refresh(listing)
|
|
|
|
return ListingResponse(
|
|
id=listing.id,
|
|
catalog_item_id=listing.catalog_item_id,
|
|
seller_id=listing.seller_id,
|
|
price=listing.price,
|
|
status=listing.status,
|
|
created_at=listing.created_at,
|
|
updated_at=listing.updated_at,
|
|
catalog_item=CatalogItemResponse.model_validate(item),
|
|
seller_username=uname,
|
|
)
|
|
|
|
|
|
@router.delete("/listings/{listing_id}", status_code=status.HTTP_204_NO_CONTENT)
|
|
async def delete_or_delist_listing(
|
|
listing_id: int,
|
|
current_user: CurrentUser,
|
|
db: DbDep,
|
|
):
|
|
"""Delist or delete a listing (seller or admin only)."""
|
|
listing = await db.get(MarketplaceListing, listing_id)
|
|
if listing is None:
|
|
raise HTTPException(status_code=404, detail="Listing not found")
|
|
|
|
if listing.seller_id != current_user.id and not getattr(current_user, "is_admin", False):
|
|
raise HTTPException(status_code=403, detail="Not authorized to delete this listing")
|
|
|
|
listing.status = ListingStatus.delisted
|
|
listing.updated_at = datetime.now()
|
|
await db.commit()
|
|
return None
|
|
|
|
|
|
# ── Purchases & Escrow ──
|
|
|
|
@router.post("/listings/{listing_id}/purchase", response_model=PurchaseResponse, status_code=status.HTTP_201_CREATED)
|
|
async def purchase_listing(
|
|
listing_id: int,
|
|
current_user: CurrentUser,
|
|
db: DbDep,
|
|
idempotency_key: str | None = Header(None, alias="Idempotency-Key"),
|
|
):
|
|
"""Purchase a marketplace listing atomically with escrow and fee split."""
|
|
try:
|
|
purchase, granted_item = await purchase_service.purchase_listing(
|
|
db=db,
|
|
buyer_id=current_user.id,
|
|
listing_id=listing_id,
|
|
buyer_is_adult=current_user.is_adult,
|
|
idempotency_key=idempotency_key,
|
|
)
|
|
except ListingNotFoundError as exc:
|
|
raise HTTPException(status_code=404, detail=str(exc))
|
|
except (ListingNotAvailableError, SelfPurchaseError) as exc:
|
|
raise HTTPException(status_code=400, detail=str(exc))
|
|
except InsufficientFundsError as exc:
|
|
raise HTTPException(status_code=400, detail=str(exc))
|
|
except MatureContentRestrictedError as exc:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=str(exc))
|
|
|
|
resp = PurchaseResponse.model_validate(purchase)
|
|
resp.granted_item_id = granted_item.id
|
|
return resp
|
|
|
|
|
|
@router.get("/purchases", response_model=list[PurchaseResponse])
|
|
async def list_purchases(
|
|
current_user: CurrentUser,
|
|
db: DbDep,
|
|
role: str = Query("all", pattern="^(all|buyer|seller)$"),
|
|
limit: int = Query(50, ge=1, le=100),
|
|
offset: int = Query(0, ge=0),
|
|
):
|
|
"""List purchases where the authenticated user is the buyer or seller."""
|
|
stmt = select(Purchase)
|
|
if role == "buyer":
|
|
stmt = stmt.where(Purchase.buyer_id == current_user.id)
|
|
elif role == "seller":
|
|
stmt = stmt.where(Purchase.seller_id == current_user.id)
|
|
else:
|
|
stmt = stmt.where(
|
|
or_(Purchase.buyer_id == current_user.id, Purchase.seller_id == current_user.id)
|
|
)
|
|
|
|
stmt = stmt.order_by(Purchase.created_at.desc(), Purchase.id.desc()).offset(offset).limit(limit)
|
|
res = await db.execute(stmt)
|
|
return list(res.scalars().all())
|
|
|
|
|
|
@router.get("/purchases/{purchase_id}", response_model=PurchaseResponse)
|
|
async def get_purchase(
|
|
purchase_id: int,
|
|
current_user: CurrentUser,
|
|
db: DbDep,
|
|
):
|
|
"""Get details of a purchase record."""
|
|
purchase = await db.get(Purchase, purchase_id)
|
|
if purchase is None:
|
|
raise HTTPException(status_code=404, detail="Purchase not found")
|
|
|
|
if (
|
|
purchase.buyer_id != current_user.id
|
|
and purchase.seller_id != current_user.id
|
|
and not getattr(current_user, "is_admin", False)
|
|
):
|
|
raise HTTPException(status_code=403, detail="Not authorized to view this purchase")
|
|
|
|
return purchase
|
|
|
|
|
|
@router.post("/purchases/{purchase_id}/release", response_model=PurchaseResponse)
|
|
async def release_escrow_endpoint(
|
|
purchase_id: int,
|
|
current_user: CurrentUser,
|
|
db: DbDep,
|
|
):
|
|
"""Release escrow hold for a purchase to seller's available balance."""
|
|
purchase = await db.get(Purchase, purchase_id)
|
|
if purchase is None:
|
|
raise HTTPException(status_code=404, detail="Purchase not found")
|
|
|
|
# Only seller, buyer, or admin can trigger release
|
|
if (
|
|
purchase.seller_id != current_user.id
|
|
and purchase.buyer_id != current_user.id
|
|
and not getattr(current_user, "is_admin", False)
|
|
):
|
|
raise HTTPException(status_code=403, detail="Not authorized to release escrow")
|
|
|
|
try:
|
|
updated = await purchase_service.release_escrow(db, purchase_id)
|
|
return updated
|
|
except InvalidEscrowStateError as exc:
|
|
raise HTTPException(status_code=400, detail=str(exc))
|
|
|
|
|
|
@router.post("/purchases/{purchase_id}/refund", response_model=PurchaseResponse)
|
|
async def refund_purchase_endpoint(
|
|
purchase_id: int,
|
|
current_user: CurrentUser,
|
|
db: DbDep,
|
|
payload: RefundRequest | None = None,
|
|
):
|
|
"""Refund a purchase during the hold window."""
|
|
purchase = await db.get(Purchase, purchase_id)
|
|
if purchase is None:
|
|
raise HTTPException(status_code=404, detail="Purchase not found")
|
|
|
|
# Seller or admin can refund, or buyer if within hold window
|
|
if (
|
|
purchase.seller_id != current_user.id
|
|
and purchase.buyer_id != current_user.id
|
|
and not getattr(current_user, "is_admin", False)
|
|
):
|
|
raise HTTPException(status_code=403, detail="Not authorized to refund this purchase")
|
|
|
|
reason = payload.reason if payload else None
|
|
try:
|
|
refunded = await purchase_service.refund_purchase(db, purchase_id, reason=reason)
|
|
return refunded
|
|
except InvalidEscrowStateError as exc:
|
|
raise HTTPException(status_code=400, detail=str(exc))
|
|
|
|
|
|
# ── Creator Balance ──
|
|
|
|
@router.get("/creator/balance", response_model=CreatorBalanceResponse)
|
|
async def get_my_creator_balance(
|
|
current_user: CurrentUser,
|
|
db: DbDep,
|
|
):
|
|
"""Get the current user's creator balance (available, pending, lifetime_earned)."""
|
|
cb = await purchase_service.get_or_create_creator_balance(db, current_user.id)
|
|
return cb
|
|
|
|
|
|
# ── Moderation ──
|
|
|
|
@router.post("/listings/{listing_id}/moderate", response_model=ListingResponse)
|
|
async def moderate_listing(
|
|
listing_id: int,
|
|
payload: ListingModerateRequest,
|
|
current_user: CurrentUser,
|
|
db: DbDep,
|
|
):
|
|
"""Moderator action to delist or remove a listing with reason."""
|
|
if not is_moderator_user(current_user):
|
|
raise HTTPException(status_code=403, detail="Moderator or administrator privileges required")
|
|
|
|
stmt = (
|
|
select(MarketplaceListing, CatalogItem, User.username)
|
|
.join(CatalogItem, MarketplaceListing.catalog_item_id == CatalogItem.id)
|
|
.join(User, MarketplaceListing.seller_id == User.id)
|
|
.where(MarketplaceListing.id == listing_id)
|
|
)
|
|
res = (await db.execute(stmt)).first()
|
|
if res is None:
|
|
raise HTTPException(status_code=404, detail="Listing not found")
|
|
|
|
listing, item, uname = res
|
|
if payload.action == "remove":
|
|
listing.status = ListingStatus.removed_by_moderation
|
|
else:
|
|
listing.status = ListingStatus.delisted
|
|
|
|
listing.updated_at = datetime.now()
|
|
await db.commit()
|
|
await db.refresh(listing)
|
|
|
|
return ListingResponse(
|
|
id=listing.id,
|
|
catalog_item_id=listing.catalog_item_id,
|
|
seller_id=listing.seller_id,
|
|
price=listing.price,
|
|
status=listing.status,
|
|
created_at=listing.created_at,
|
|
updated_at=listing.updated_at,
|
|
catalog_item=CatalogItemResponse.model_validate(item),
|
|
seller_username=uname,
|
|
)
|
|
|
|
|
|
@router.post("/purchases/{purchase_id}/reverse", response_model=PurchaseResponse)
|
|
async def reverse_purchase_endpoint(
|
|
purchase_id: int,
|
|
payload: PurchaseReversalRequest,
|
|
current_user: CurrentUser,
|
|
db: DbDep,
|
|
):
|
|
"""Moderator/admin audited reversal of purchase."""
|
|
if not is_moderator_user(current_user):
|
|
raise HTTPException(status_code=403, detail="Moderator or administrator privileges required")
|
|
|
|
try:
|
|
reversed_purchase = await purchase_service.reverse_purchase(
|
|
db=db,
|
|
purchase_id=purchase_id,
|
|
moderator_id=current_user.id,
|
|
reason=payload.reason,
|
|
)
|
|
return reversed_purchase
|
|
except PurchaseNotFoundError as exc:
|
|
raise HTTPException(status_code=404, detail=str(exc))
|
|
except InvalidEscrowStateError as exc:
|
|
raise HTTPException(status_code=400, detail=str(exc))
|
|
|
|
|