Add 'fiscal/' from commit '102ba84500dbd9655a0471288c3e278652593ca9'

git-subtree-dir: fiscal
git-subtree-mainline: d95165fc8f
git-subtree-split: 102ba84500

fiscal/central/app/main.py

@@ -0,0 +1,65 @@
+"""FastAPI application factory."""
+
+import logging
+import sys
+from collections.abc import Callable
+
+from fastapi import FastAPI, HTTPException, Request
+from fastapi.staticfiles import StaticFiles
+from .config import settings
+from .db import SessionLocal, database_is_available
+from .api import router
+from .agent_distribution import router as agent_distribution_router
+from .control_api import router as control_api_router
+from .web import router as web_router
+from .version import GTI_FISCAL_VERSION
+
+logging.basicConfig(level=getattr(logging, settings.log_level.upper(), logging.INFO))
+logger = logging.getLogger("gti_fiscal_hub")
+
+
+def create_app(database_probe: Callable[[], bool] = database_is_available, session_factory=SessionLocal, bootstrap_token: str | None = None) -> FastAPI:
+    app = FastAPI(title="GTI Fiscal Hub", version=GTI_FISCAL_VERSION)
+    if settings.environment == "production" and settings.agent_dev_token:
+        raise RuntimeError("AGENT_DEV_TOKEN must not be set when APP_ENV=production (register real Agents with central/scripts/register_agent.py)")
+    logger.info("starting GTI Fiscal Hub (environment=%s)", settings.environment)
+
+    @app.middleware("http")
+    async def add_security_headers(request: Request, call_next):
+        response = await call_next(request)
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["X-Frame-Options"] = "SAMEORIGIN"
+        response.headers["X-XSS-Protection"] = "1; mode=block"
+        response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
+        if getattr(settings, "web_cookie_secure", False):
+            response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+        return response
+
+    @app.get("/health")
+    def health() -> dict[str, str]:
+        if not database_probe():
+            logger.warning("health check failed: postgres unavailable")
+            raise HTTPException(status_code=503, detail="postgres unavailable")
+        return {"status": "ok"}
+
+    @app.get("/version")
+    def version() -> dict[str, str]:
+        from .classification import DECISION_VERSION, ENGINE_VERSION
+        from .version import API_COMPAT_MAJOR_MINOR, GTI_FISCAL_VERSION
+        return {"version": GTI_FISCAL_VERSION, "api_compat": API_COMPAT_MAJOR_MINOR, "engine_version": ENGINE_VERSION, "decision_version": DECISION_VERSION}
+
+    app.include_router(router(session_factory, settings.agent_dev_token if bootstrap_token is None else bootstrap_token))
+    app.include_router(control_api_router(session_factory))
+    app.include_router(agent_distribution_router(session_factory))
+    app.include_router(web_router(session_factory))
+    if settings.official_refresh_enabled and session_factory is SessionLocal and "pytest" not in sys.modules:
+        @app.on_event("startup")
+        def _start_official_refresh():
+            from .datasets.updater import start_scheduler
+            start_scheduler(session_factory)
+
+    app.mount("/static", StaticFiles(directory="central/static"), name="static")
+    return app
+
+
+app = create_app()