fix security, backtests, and live trading

Author: Henry

backend_api_python/README.md

@@ -68,7 +68,7 @@ cp env.example .env
 At minimum, replace these values before a shared or production deployment:
 
 ```dotenv
-SECRET_KEY=<independent-random-value-at-least-32-bytes>
+SECRET_KEY=<independent-random-value-at-least-10-bytes-32-plus-recommended>
 CREDENTIAL_ENCRYPTION_KEY=<independent-random-value-at-least-32-bytes>
 ADMIN_USER=<initial-admin-name>
 ADMIN_PASSWORD=<strong-initial-password>

backend_api_python/app/commands/worker_health.py

@@ -18,7 +18,10 @@ def main() -> None:
     credential_key = str(os.getenv("CREDENTIAL_ENCRYPTION_KEY") or "").strip()
     session_key = str(os.getenv("SECRET_KEY") or "").strip()
     if args.role in {"trading", "scheduler"} and not credential_key:
-        if not session_key or session_key == "quantdinger-secret-key-change-me":
+        if (
+            len(session_key.encode("utf-8")) < 10
+            or session_key == "quantdinger-secret-key-change-me"
+        ):
             sys.exit(1)
 
     with get_db_connection() as db:

backend_api_python/app/config/settings.py

@@ -1,6 +1,15 @@
 """Application settings."""
 import os
 
+
+_INSECURE_SECRET_KEYS = {
+    "quantdinger-secret-key-change-me",
+}
+# Compatibility floor for installations upgraded from releases that used
+# shorter session keys. New deployments should still generate 32 random bytes.
+_MIN_SECRET_KEY_BYTES = 10
+
+
 class MetaConfig(type):
 
     @property
@@ -25,7 +34,17 @@ def VERSION(cls):
 
     @property
     def SECRET_KEY(cls):
-        return os.getenv('SECRET_KEY', 'quantdinger-secret-key-change-me')
+        secret = (os.getenv('SECRET_KEY') or '').strip()
+        if not secret or secret in _INSECURE_SECRET_KEYS:
+            raise RuntimeError(
+                'SECRET_KEY must be set to a unique random value. Generate one with: '
+                'python -c "import secrets; print(secrets.token_hex(32))"'
+            )
+        if len(secret.encode('utf-8')) < _MIN_SECRET_KEY_BYTES:
+            raise RuntimeError(
+                f'SECRET_KEY must contain at least {_MIN_SECRET_KEY_BYTES} bytes'
+            )
+        return secret
 
     @property
     def ADMIN_USER(cls):

backend_api_python/app/routes/backtest_center.py

@@ -8,6 +8,7 @@
 import math
 import random
 from typing import Any
+from uuid import uuid4
 
 from flask import g, jsonify, request
 
@@ -19,6 +20,7 @@
     parse_rate,
 )
 from app.services.backtest_limits import BacktestRangeLimitError
+from app.services.billing_service import get_billing_service
 from app.services.script_source import get_script_source_service
 from app.services.strategy_v2 import (
     FactorResearchRepository,
@@ -80,7 +82,7 @@ def _source(payload: dict[str, Any], user_id: int) -> tuple[str, int | None, int
     return code, source_id, strategy_id, strategy_name
 
 
-def _run(payload: dict[str, Any], user_id: int, *, persist: bool) -> tuple[int | None, dict[str, Any]]:
+def _prepare_run(payload: dict[str, Any], user_id: int) -> dict[str, Any]:
     code, source_id, strategy_id, strategy_name = _source(payload, user_id)
     start_raw = str(payload.get("startDate") or "").strip()
     end_raw = str(payload.get("endDate") or "").strip()
@@ -89,36 +91,131 @@ def _run(payload: dict[str, Any], user_id: int, *, persist: bool) -> tuple[int |
     start_date = datetime.strptime(start_raw, "%Y-%m-%d")
     end_date = datetime.strptime(end_raw, "%Y-%m-%d").replace(hour=23, minute=59, second=59)
     leverage_enabled = bool(payload.get("leverageEnabled", False))
-    return get_strategy_backtest_service().run(
+    return {
+        "user_id": user_id,
+        "code": code,
+        "start_date": start_date,
+        "end_date": end_date,
+        "initial_capital": float(payload.get("initialCapital") or 10_000),
+        "leverage_enabled": leverage_enabled,
+        "leverage": float(payload.get("leverage") or 1),
+        "commission": parse_rate(payload.get("commission"), default=default_commission_if_missing(None)),
+        "slippage": parse_rate(payload.get("slippage"), default=default_slippage_if_missing(None)),
+        "params": dict(payload.get("params") or {}),
+        "strategy_id": strategy_id,
+        "source_id": source_id,
+        "strategy_name": strategy_name,
+    }
+
+
+def _run_prepared(prepared: dict[str, Any], *, persist: bool) -> tuple[int | None, dict[str, Any]]:
+    return get_strategy_backtest_service().run(**prepared, persist=persist)
+
+
+def _run(payload: dict[str, Any], user_id: int, *, persist: bool) -> tuple[int | None, dict[str, Any]]:
+    return _run_prepared(_prepare_run(payload, user_id), persist=persist)
+
+
+def _consume_backtest_credits(user_id: int) -> tuple[Any, dict[str, Any]]:
+    """Charge one backtest run and return a response-safe billing snapshot."""
+    billing = get_billing_service()
+    enabled = bool(billing.is_billing_enabled())
+    cost = max(0, int(billing.get_feature_cost("backtest") or 0))
+    reference_id = f"backtest:{uuid4().hex}"
+    charge = {
+        "enabled": enabled,
+        "cost": cost,
+        "charged": 0,
+        "remaining": float(billing.get_user_credits(user_id)),
+        "referenceId": reference_id,
+    }
+    if not enabled or cost <= 0:
+        return billing, charge
+
+    success, message = billing.check_and_consume(
+        user_id=user_id,
+        feature="backtest",
+        reference_id=reference_id,
+    )
+    if not success:
+        current = float(billing.get_user_credits(user_id))
+        if str(message).startswith("insufficient_credits:"):
+            return billing, {
+                **charge,
+                "error": "insufficient_credits",
+                "current": current,
+                "required": cost,
+                "shortage": max(0, cost - current),
+            }
+        return billing, {**charge, "error": "billing_error", "message": str(message)}
+
+    charge["charged"] = cost
+    charge["remaining"] = float(billing.get_user_credits(user_id))
+    return billing, charge
+
+
+def _refund_backtest_credits(billing: Any, user_id: int, charge: dict[str, Any]) -> None:
+    cost = int(charge.get("charged") or 0)
+    if not billing or cost <= 0:
+        return
+    refunded, message = billing.add_credits(
         user_id=user_id,
-        code=code,
-        start_date=start_date,
-        end_date=end_date,
-        initial_capital=float(payload.get("initialCapital") or 10_000),
-        leverage_enabled=leverage_enabled,
-        leverage=float(payload.get("leverage") or 1),
-        commission=parse_rate(payload.get("commission"), default=default_commission_if_missing(None)),
-        slippage=parse_rate(payload.get("slippage"), default=default_slippage_if_missing(None)),
-        params=dict(payload.get("params") or {}),
-        persist=persist,
-        strategy_id=strategy_id,
-        source_id=source_id,
-        strategy_name=strategy_name,
+        amount=cost,
+        action="refund",
+        remark="Automatic refund: backtest execution failed",
+        reference_id=str(charge.get("referenceId") or ""),
     )
+    if not refunded:
+        logger.error("Backtest credit refund failed for user %s: %s", user_id, message)
 
 
 @backtest_center_blp.route("/run", methods=["POST"])
 @login_required
 def run_strategy_backtest():
+    billing = None
+    charge: dict[str, Any] = {}
+    user_id = int(g.user_id)
     try:
         payload = request.get_json(silent=True) or {}
-        run_id, result = _run(payload, int(g.user_id), persist=bool(payload.get("persist", True)))
-        return jsonify({"code": 1, "msg": "success", "data": {**result, "runId": run_id}})
+        prepared = _prepare_run(payload, user_id)
+        billing, charge = _consume_backtest_credits(user_id)
+        if charge.get("error") == "insufficient_credits":
+            return jsonify({
+                "code": 0,
+                "msg": "insufficient_credits",
+                "data": {
+                    "error_type": "INSUFFICIENT_CREDITS",
+                    "feature": "backtest",
+                    "current": charge["current"],
+                    "required": charge["required"],
+                    "shortage": charge["shortage"],
+                },
+            }), 402
+        if charge.get("error"):
+            return jsonify({
+                "code": 0,
+                "msg": charge.get("message") or "Failed to deduct credits",
+                "data": {"error_type": "BILLING_ERROR", "feature": "backtest"},
+            }), 500
+
+        run_id, result = _run_prepared(prepared, persist=bool(payload.get("persist", True)))
+        billing_data = {
+            key: charge.get(key)
+            for key in ("enabled", "cost", "charged", "remaining")
+        }
+        return jsonify({
+            "code": 1,
+            "msg": "success",
+            "data": {**result, "runId": run_id, "billing": billing_data},
+        })
     except BacktestRangeLimitError as exc:
+        _refund_backtest_credits(billing, user_id, charge)
         return jsonify({"code": 0, "msg": str(exc), "data": exc.details}), 400
     except ValueError as exc:
+        _refund_backtest_credits(billing, user_id, charge)
         return jsonify({"code": 0, "msg": str(exc), "data": None}), 400
     except Exception as exc:
+        _refund_backtest_credits(billing, user_id, charge)
         logger.exception("Strategy backtest failed")
         return jsonify({"code": 0, "msg": str(exc), "data": None}), 500
 
@@ -343,9 +440,14 @@ def _candidates(space: dict[str, list[Any]], *, method: str, limit: int) -> list
 
 def _metrics(result: dict[str, Any]) -> dict[str, float]:
     raw = result.get("metrics") if isinstance(result.get("metrics"), dict) else result
+    annual_return = raw.get("annualReturn")
+    if annual_return is None:
+        annual_return = raw.get("annualizedReturn")
+    if annual_return is None:
+        annual_return = raw.get("annual_return")
     return {
         "totalReturn": _number(raw.get("totalReturn", raw.get("total_return"))),
-        "annualReturn": _number(raw.get("annualReturn", raw.get("annual_return"))),
+        "annualReturn": _number(annual_return),
         "maxDrawdown": _number(raw.get("maxDrawdown", raw.get("max_drawdown"))),
         "sharpeRatio": _number(raw.get("sharpeRatio", raw.get("sharpe_ratio"))),
         "winRate": _number(raw.get("winRate", raw.get("win_rate"))),

backend_api_python/app/routes/settings.py

@@ -269,8 +269,8 @@
                 'key': 'SECRET_KEY',
                 'label': 'Secret Key',
                 'type': 'password',
-                'default': 'quantdinger-secret-key-change-me',
-                'description': 'JWT signing secret key. MUST change in production for security'
+                'default': '',
+                'description': 'Required JWT signing key (minimum 10 bytes for legacy compatibility; 32+ random bytes recommended)'
             },
             {
                 'key': 'ADMIN_USER',
@@ -1605,6 +1605,13 @@
                 'default': '30',
                 'description': 'How often the background worker re-scans pending/paid orders against on-chain data.'
             },
+            {
+                'key': 'BILLING_COST_BACKTEST',
+                'label': 'Backtest Cost',
+                'type': 'number',
+                'default': '30',
+                'description': 'Credits charged for each strategy backtest run'
+            },
             {
                 'key': 'BILLING_COST_AI_ANALYSIS',
                 'label': 'AI Analysis Cost (per symbol)',

backend_api_python/app/routes/strategy.py

@@ -17,6 +17,7 @@
     SCRIPT_STRATEGY_SYSTEM_PROMPT,
 )
 from app.services.strategy import redact_strategy_row
+from app.services.strategy_daily_pnl import load_strategy_daily_metrics
 from app.services.strategy_runtime.health import load_runtime_health
 from app.services.strategy_v2 import compile_strategy_v2
 from app.utils.auth import login_required
@@ -51,7 +52,7 @@ def _strategy(strategy_id: int):
     return get_strategy_service().get_strategy(int(strategy_id), user_id=int(g.user_id))
 
 
-def _attach_runtime_health(rows):
+def _attach_runtime_health(rows, *, user_id: int | None = None, client_timezone: str = ""):
     items = [dict(row) for row in (rows or [])]
     statuses = {
         int(row.get("id") or 0): str(row.get("status") or "")
@@ -61,14 +62,28 @@ def _attach_runtime_health(rows):
     health = load_runtime_health(statuses, strategy_statuses=statuses)
     for row in items:
         row["runtime_health"] = health.get(int(row.get("id") or 0), {})
+    if user_id is not None:
+        metrics = load_strategy_daily_metrics(
+            items,
+            user_id=int(user_id),
+            client_timezone=str(client_timezone or ""),
+        )
+        for row in items:
+            row.update(metrics.get(int(row.get("id") or 0), {}))
     return items
 
 
 @strategy_blp.route("/strategies", methods=["GET"])
 @login_required
 def list_strategies():
-    rows = get_strategy_service().list_strategies(user_id=int(g.user_id))
-    return _ok([redact_strategy_row(row) for row in _attach_runtime_health(rows)])
+    user_id = int(g.user_id)
+    rows = get_strategy_service().list_strategies(user_id=user_id)
+    enriched = _attach_runtime_health(
+        rows,
+        user_id=user_id,
+        client_timezone=request.headers.get("X-App-Timezone", ""),
+    )
+    return _ok([redact_strategy_row(row) for row in enriched])
 
 
 @strategy_blp.route("/strategies/<int:strategy_id>", methods=["GET"])
@@ -77,7 +92,11 @@ def get_strategy(strategy_id: int):
     row = _strategy(strategy_id)
     if not row:
         return _error("strategyV2.strategyNotFound", 404)
-    return _ok(redact_strategy_row(_attach_runtime_health([row])[0]))
+    return _ok(redact_strategy_row(_attach_runtime_health(
+        [row],
+        user_id=int(g.user_id),
+        client_timezone=request.headers.get("X-App-Timezone", ""),
+    )[0]))
 
 
 @strategy_blp.route("/strategies", methods=["POST"])

backend_api_python/app/services/billing_config.py

@@ -6,6 +6,7 @@
 
 DEFAULT_BILLING_CONFIG = {
     "enabled": False,
+    "cost_backtest": 30,
     "cost_ai_analysis": 10,
     "cost_ai_code_gen": 30,
     "cost_ai_indicator_to_strategy": 30,
@@ -16,6 +17,7 @@
 }
 
 FEATURE_NAMES = {
+    "backtest": "Strategy Backtest",
     "ai_analysis": "AI Analysis",
     "ai_code_gen": "AI Code Generation",
     "ai_indicator_to_strategy": "AI Indicator to Strategy",