v3.0.17

Signed-off-by: Dinger <[email protected]>

Author: quantdinger-lab

VERSION

@@ -1 +1 @@
-3.0.15
+3.0.17

backend_api_python/app/_version.py

@@ -5,4 +5,4 @@
 CI). Do **not** edit by hand — run the bump script instead.
 """
 
-APP_VERSION = "3.0.15"
+APP_VERSION = "3.0.17"

backend_api_python/app/routes/auth.py

@@ -108,6 +108,15 @@ def _get_user_agent() -> str:
     return request.headers.get('User-Agent', '')[:500]
 
 
+def _userinfo_must_change_initial_password(user_id: int) -> bool:
+    """Whether the UI should prompt the user to change their bootstrap password."""
+    try:
+        from app.services.user_service import get_user_service
+        return get_user_service().must_change_initial_password(int(user_id))
+    except Exception:
+        return False
+
+
 # =============================================================================
 # Security Config Endpoint
 # =============================================================================
@@ -249,8 +258,15 @@ def login():
         security.record_login_attempt(username, 'account', True, ip_address, user_agent)
         security.clear_login_attempts(ip_address, 'ip')
         security.clear_login_attempts(username, 'account')
-        security.log_security_event('login_success', user.get('id'), ip_address, user_agent)
-        
+        from app.services.login_notify import notify_successful_login
+        notify_successful_login(
+            user_id=int(user.get('id') or user_id),
+            action='login_success',
+            ip_address=ip_address,
+            user_agent=user_agent,
+            extra_details={'method': 'password'},
+        )
+
         # Build user info for frontend
         userinfo = {
             'id': user.get('id') or user.get('user_id', 1),
@@ -261,7 +277,8 @@ def login():
             'role': {
                 'id': user.get('role', 'admin'),
                 'permissions': _get_permissions(user.get('role', 'admin'))
-            }
+            },
+            'must_change_initial_password': _userinfo_must_change_initial_password(user_id),
         }
 
         return jsonify({
@@ -455,9 +472,15 @@ def login_with_code():
         except Exception as e:
             logger.error(f"Failed to update last_login_at for user_id={user.get('id')}: {e}")
 
-        # Log login
-        security.log_security_event('login_via_code', user['id'], ip_address, user_agent)
-        
+        from app.services.login_notify import notify_successful_login
+        notify_successful_login(
+            user_id=int(user['id']),
+            action='login_via_code',
+            ip_address=ip_address,
+            user_agent=user_agent,
+            extra_details={'method': 'email_code', 'is_new_user': bool(is_new_user)},
+        )
+
         return jsonify({
             'code': 1,
             'msg': 'Login successful' + (' (new account created)' if is_new_user else ''),
@@ -993,10 +1016,15 @@ def oauth_google_callback():
             token_version=new_token_version
         )
 
-        # Log OAuth login
-        security.log_security_event('oauth_login', user_result['id'], ip_address, user_agent,
-                                   {'provider': 'google'})
-        
+        from app.services.login_notify import notify_successful_login
+        notify_successful_login(
+            user_id=int(user_result['id']),
+            action='oauth_login',
+            ip_address=ip_address,
+            user_agent=user_agent,
+            extra_details={'provider': 'google', 'method': 'oauth'},
+        )
+
         # Redirect to frontend with token
         return redirect(_build_frontend_login_redirect(frontend_url, oauth_token=token))
 
@@ -1085,10 +1113,15 @@ def oauth_github_callback():
             token_version=new_token_version
         )
 
-        # Log OAuth login
-        security.log_security_event('oauth_login', user_result['id'], ip_address, user_agent,
-                                   {'provider': 'github'})
-        
+        from app.services.login_notify import notify_successful_login
+        notify_successful_login(
+            user_id=int(user_result['id']),
+            action='oauth_login',
+            ip_address=ip_address,
+            user_agent=user_agent,
+            extra_details={'provider': 'github', 'method': 'oauth'},
+        )
+
         # Redirect to frontend with token
         return redirect(_build_frontend_login_redirect(frontend_url, oauth_token=token))
 
@@ -1128,11 +1161,12 @@ def get_user_info():
                 logger.warning(f"Failed to get user from database: {e}")
 
         if user_data:
+            uid = user_data.get('id')
             return jsonify({
                 'code': 1,
                 'msg': 'Success',
                 'data': {
-                    'id': user_data.get('id'),
+                    'id': uid,
                     'username': user_data.get('username'),
                     'nickname': user_data.get('nickname', 'User'),
                     'email': user_data.get('email'),
@@ -1141,7 +1175,8 @@ def get_user_info():
                     'role': {
                         'id': user_data.get('role', 'user'),
                         'permissions': _get_permissions(user_data.get('role', 'user'))
-                    }
+                    },
+                    'must_change_initial_password': _userinfo_must_change_initial_password(uid),
                 }
             })
 

backend_api_python/app/routes/backtest.py

@@ -176,13 +176,6 @@ def run_backtest():
         # Extract params - use current user's ID
         user_id = g.user_id
         indicator_code = data.get('indicatorCode', '')
-        is_safe_code, unsafe_reason = validate_code_safety(indicator_code or '')
-        if not is_safe_code:
-            return jsonify({
-                'code': 0,
-                'msg': f'Unsafe indicator code: {unsafe_reason}',
-                'data': None
-            }), 400
         indicator_id = data.get('indicatorId')
         symbol = (data.get('symbol') or '').strip()
         market = (data.get('market') or '').strip()
@@ -229,6 +222,14 @@ def run_backtest():
                 'msg': 'Missing required parameters',
                 'data': None
             }), 400
+
+        is_safe_code, unsafe_reason = validate_code_safety(indicator_code or '')
+        if not is_safe_code:
+            return jsonify({
+                'code': 0,
+                'msg': f'Unsafe indicator code: {unsafe_reason}',
+                'data': None
+            }), 400
 
         # 转换日期
         # 开始日期：当天的 00:00:00

backend_api_python/app/routes/indicator.py

@@ -340,7 +340,14 @@ def _indicator_hint_to_text(hint_code: str, params: Dict[str, Any] | None = None
     if hint_code == "MISSING_OUTPUT":
         return "缺少 output 字典。" if is_zh else "Missing output dictionary."
     if hint_code == "MISSING_BUY_SELL_COLUMNS":
-        return "缺少 df['buy'] 或 df['sell'] 信号列。" if is_zh else "Missing df['buy'] or df['sell'] signal columns."
+        return (
+            "缺少执行信号列：请提供四路 open_long/close_long/open_short/close_short，"
+            "或两路 buy/sell。"
+            if is_zh
+            else
+            "Missing execution columns: provide four-way open_long/close_long/open_short/close_short "
+            "or two-way buy/sell."
+        )
     if hint_code == "MISSING_DF_COPY":
         return "缺少 df = df.copy()。" if is_zh else "Missing df = df.copy()."
     if hint_code == "MISSING_INDICATOR_NAME":
@@ -539,6 +546,16 @@ def save_indicator():
         if not code or not str(code).strip():
             return jsonify({"code": 0, "msg": "code is required", "data": None}), 400
 
+        from app.utils.safe_exec import validate_code_safety
+
+        is_safe_code, unsafe_reason = validate_code_safety(code)
+        if not is_safe_code:
+            return jsonify({
+                "code": 0,
+                "msg": f"Unsafe indicator code: {unsafe_reason}",
+                "data": None,
+            }), 400
+
         # Local dev UX: if name/description not provided, derive from code variables.
         if not name or not description:
             meta = _extract_indicator_meta_from_code(code)
@@ -902,6 +919,7 @@ def _err_stream():
 - Environment: browser-side Pyodide–style sandbox **or** API verify sandbox: **no network**, no file I/O, no subprocess.
 - **`pd` and `np` are already available.** Do **not** write `import pandas` / `import numpy`. Avoid any `import` unless unavoidable; never import `os`, `sys`, `requests`, `socket`, `subprocess`, `threading`, `sqlite3`, `multiprocessing`, or other I/O/network modules.
 - Do **not** use: `eval`, `exec`, `compile`, `open`, `__import__`, `getattr`/`setattr`/`delattr` on untrusted names, `globals`, `vars`, `dir`, or meta-programming to escape the sandbox. `locals()` is allowed if needed to assemble `output` (backtest/verify allow it); avoid `globals()`.
+- Allowed imports only: `numpy`, `pandas`, `math`, `json`, `datetime`, `time`, `collections`, `functools`, `itertools`, `statistics`, `decimal`, `fractions`, `copy`. **Never** `import operator`.
 - Work **vectorized** with pandas on `df` where possible; avoid O(n) Python loops over every row for core series (rolling/ewm/shift are preferred).
 
 # Series vs ndarray contract (critical — common AI bug source)
@@ -940,20 +958,25 @@ def _err_stream():
 
 # Backtest contract (strict)
 
-The backtest engine reads **boolean** columns on `df`:
+**Preferred (platform default): four-way execution columns**
 
-- `df['buy']` — True on bars where a **new** long entry signal is allowed (edge-triggered).
-- `df['sell']` — True on bars where a **new** exit / short entry signal is allowed (per product semantics).
+- `df['open_long']`, `df['close_long']`, `df['open_short']`, `df['close_short']` — all bool, length `len(df)`.
+- Use an `edge(s)` helper: `s & ~s.shift(1).fillna(False)` on each raw condition.
+- On trend flip bars you MAY set both `close_*` and opposing `open_*` true (flip_mode R2); for tp/sl-only exits use `close_*` alone without mixing tp/sl into `buy`/`sell`.
+- Declare contract header comments: `# signal_form: four_way`, `# exit_owner: engine|indicator`, `# flip_mode: R1|R2`.
+- See `docs/SIGNAL_EXECUTION_STANDARD_CN.md`.
 
-Rules:
+**Legacy two-way** (simple crossover only):
+
+- `df['buy']` / `df['sell']` — edge-triggered; `tradeDirection both` maps buy→open long (flip short first), sell→open short (flip long first). Do **not** use buy/sell for “close only” exits when `both` — use four-way `close_*`.
+
+Rules (both forms):
 
 - Same **index and length** as `df`; dtype boolean (use `.astype(bool)` after fillna).
-- **Edge-trigger (mandatory)** unless the user explicitly asks for repeated signals on consecutive bars:
-  - `raw_buy = (...condition...)`
-  - `buy = raw_buy.fillna(False) & (~raw_buy.shift(1).fillna(False))`
-  - Same pattern for `raw_sell` / `sell`.
-- Signals represent **confirmation on bar close**; the engine fills on the **next bar open** (live-like). Do not implement intrabar lookahead (e.g. do not use the same bar’s `high` to validate a signal that assumes you bought at that bar’s `open` unless the user clearly wants that research mode).
+- **Edge-trigger (mandatory)** unless the user explicitly asks for repeated signals on consecutive bars.
+- Signals represent **confirmation on bar close**; the engine fills on the **next bar open** (live-like). Do not implement intrabar lookahead unless the user clearly wants research mode.
 - Fill NaN from indicators before comparisons; replace division-by-zero (`replace(0, np.nan)` then fill).
+- If you use four-way columns, you do **not** need `df['buy']`/`df['sell']` unless `output['signals']` chart markers require them (markers can use open_long/open_short only).
 
 # Chart output: `output` dict (strict)
 
@@ -1007,6 +1030,8 @@ def _err_stream():
 - `trailingStopPct`, `trailingActivationPct`: float **0–1**.
 - `tradeDirection`: exactly `long`, `short`, or `both`.
 
+**`tradeDirection both` execution semantics:** `df['buy']` → open long (close short first if short); `df['sell']` → open short (close long first if long). Do not document `buy` as a separate close-short column. If the strategy uses in-code tp/sl on `high`/`low` touches, prefer **not** also setting `trailingEnabled true` unless the user explicitly wants engine trailing — see `docs/STRATEGY_DEV_GUIDE.md`.
+
 **Do not** put `leverage` in `@strategy`; users set leverage in the IDE backtest panel.
 
 **Do not** emit `signalTiming`; the product fixes fills to next bar open.
@@ -1035,58 +1060,21 @@ def _err_stream():
 """
 
     def _template_code() -> str:
-        # Fallback template that follows the project expectations.
-        header = (
-            f"my_indicator_name = \"Custom Indicator\"\n"
-            f"my_indicator_description = \"{(prompt or '').replace('\n', ' ')[:200]}\"\n\n"
-        )
-        body = (
-            "# ===== Strategy defaults (single source of truth) =====\n"
-            "# @strategy stopLossPct 0.03            # Hard stop-loss (3%)\n"
-            "# @strategy takeProfitPct 0.06          # Take-profit (6%)\n"
-            "# @strategy entryPct 1.0                # Use 100% of available capital per entry\n"
-            "# @strategy trailingEnabled false       # Set true to enable trailing stop\n"
-            "# @strategy trailingStopPct 0.02        # Trailing distance (2%)\n"
-            "# @strategy trailingActivationPct 0.03  # Activate trailing after +3% in profit\n"
-            "# @strategy tradeDirection long         # long | short | both\n\n"
-            "# ===== Indicator parameters =====\n"
-            "# @param rsi_len int 14 RSI period\n\n"
-            "rsi_len = params.get('rsi_len', 14)\n"
-            "df = df.copy()\n\n"
-            "# Example: robust RSI with edge-triggered buy/sell (no position management, no TP/SL on chart)\n"
-            "delta = df['close'].diff()\n"
-            "gain = delta.clip(lower=0)\n"
-            "loss = (-delta).clip(lower=0)\n"
-            "# Wilder-style smoothing (stable and avoids early NaN explosion)\n"
-            "avg_gain = gain.ewm(alpha=1/rsi_len, adjust=False).mean()\n"
-            "avg_loss = loss.ewm(alpha=1/rsi_len, adjust=False).mean()\n"
-            "rs = avg_gain / avg_loss.replace(0, np.nan)\n"
-            "rsi = 100 - (100 / (1 + rs))\n"
-            "rsi = rsi.fillna(50)\n\n"
-            "# Raw conditions (avoid overly strict filters)\n"
-            "raw_buy = (rsi < 30)\n"
-            "raw_sell = (rsi > 70)\n"
-            "# One-shot signals\n"
-            "buy = (raw_buy.fillna(False) & (~raw_buy.shift(1).fillna(False))).astype(bool)\n"
-            "sell = (raw_sell.fillna(False) & (~raw_sell.shift(1).fillna(False))).astype(bool)\n"
-            "df['buy'] = buy\n"
-            "df['sell'] = sell\n\n"
-            "buy_marks = [df['low'].iloc[i] * 0.995 if bool(df['buy'].iloc[i]) else None for i in range(len(df))]\n"
-            "sell_marks = [df['high'].iloc[i] * 1.005 if bool(df['sell'].iloc[i]) else None for i in range(len(df))]\n\n"
-            "output = {\n"
-            "  'name': my_indicator_name,\n"
-            "  'plots': [\n"
-            "    {'name': 'RSI(14)', 'data': rsi.tolist(), 'color': '#faad14', 'overlay': False}\n"
-            "  ],\n"
-            "  'signals': [\n"
-            "    {'type': 'buy', 'text': 'B', 'data': buy_marks, 'color': '#00E676'},\n"
-            "    {'type': 'sell', 'text': 'S', 'data': sell_marks, 'color': '#FF5252'}\n"
-            "  ]\n"
-            "}\n"
+        from app.services.indicator_default_template import build_default_indicator_template
+
+        desc = (prompt or "").replace("\n", " ")[:200]
+        if not desc:
+            desc = (
+                "双均线四路信号模板：边缘触发 + 引擎风控。"
+                "详见 SIGNAL_EXECUTION_STANDARD_CN.md"
+            )
+        code = build_default_indicator_template(
+            name="Custom Indicator",
+            description=desc,
         )
         if existing:
-            header = "# Existing code was provided as context.\n" + header
-        return header + body
+            code = "# Existing code was provided as context.\n" + code
+        return code
 
     def _generate_code_via_llm() -> str:
         """Use unified LLMService to support all configured providers (OpenRouter, OpenAI, Grok, etc.)."""
@@ -1115,7 +1103,7 @@ def _generate_code_via_llm() -> str:
                 + existing.strip()
                 + "\n```\n\n# Change request:\n\n"
                 + prompt
-                + "\n\nReturn one full replacement script: same QuantDinger rules (my_indicator_name/description, df = df.copy(), declared @param values must be read via params.get(...), df['buy']/df['sell'], output dict, list lengths == len(df)). "
+                + "\n\nReturn one full replacement script: same QuantDinger rules (my_indicator_name/description, df = df.copy(), declared @param values must be read via params.get(...), four-way OR buy/sell execution columns, output dict, list lengths == len(df)). "
                 "Python only — no markdown, no prose outside the code."
             )
 
@@ -1368,6 +1356,32 @@ def stream():
     )
 
 
+@indicator_bp.route("/defaultTemplate", methods=["GET"])
+@login_required
+def get_default_indicator_template():
+    """
+    Return the platform default indicator starter (four-way, contract v1).
+
+    GET /api/indicator/defaultTemplate
+    Optional query: name=...&description=...
+    """
+    from app.services.indicator_default_template import build_default_indicator_template
+
+    args = request.args or {}
+    name = (args.get("name") or "").strip() or "策略模板（四路信号）"
+    description = (args.get("description") or "").strip() or (
+        "双均线金叉/死叉：四路显式信号 + 边缘触发 + 引擎风控。"
+    )
+    code = build_default_indicator_template(name=name, description=description)
+    return jsonify(
+        {
+            "code": 1,
+            "msg": "success",
+            "data": {"code": code, "name": name, "description": description},
+        }
+    )
+
+
 @indicator_bp.route("/codeQualityHints", methods=["POST"])
 @login_required
 def code_quality_hints():