feat(funds): implement fund ledger system and wallet management#236
feat(funds): implement fund ledger system and wallet management#236
Conversation
Comprehensive fund management system including: - Database migration for FundLedger model. - FundManager service for handling deposits, withdrawals, and balance tracking. - Integration with CapitalManager and ExecutionHandler for fund-aware trading. - New UI components for Add Funds, Fund Statement Table, and a dedicated Funds Tab in User Profile. - Performance optimizations in AutoTradingPage and ProfilePage.
🤖 Automated PR Quality CheckValidated PR structure, code complexity, and trading safety patterns. Reviewers have been notified. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| """Add virtual funds to paper trading account""" | ||
| try: | ||
| result = fund_manager.add_paper_funds(current_user.id, amount, db, description) | ||
| return result |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
General approach: Do not expose raw exception messages (or derived text like stack traces) in HTTP responses. Instead, log the full exception server‑side and return a generic, user‑safe error message and optionally a stable error code. Internally, service methods should not return raw str(e) to API layers; they should either raise suitable application exceptions or return generic error fields without implementation details.
Best concrete fix here, without changing existing behavior structure:
-
In
FundManagementService.add_paper_funds, change theexceptblock so that:- It still rolls back the transaction and logs the detailed error (including
e) using the existing logger. - But instead of returning
{"success": False, "error": str(e)}, it returns a generic error message, e.g.{"success": False, "error": "Failed to add paper funds. Please try again later."}. This preserves the response shape (success+errorstring) so existing callers don’t break, but removes sensitive details.
- It still rolls back the transaction and logs the detailed error (including
-
In the router’s
/funds/add-paper-fundsendpoint, the current pattern of catching exceptions and raisingHTTPException(status_code=500, detail=str(e))can also leakstr(e)if something fails before reaching the service or if the service raises instead of returning an error dict. Change thatHTTPExceptiondetail to a generic message, e.g."Internal server error while adding funds". Logging already captures the detailed error.
These two changes ensure that neither direct exceptions nor service-returned errors expose internal exception text to clients, while leaving overall control flow and result structure intact.
Specific edits:
- File
services/trading_execution/fund_manager.py, withinFundManagementService.add_paper_funds, lines 155–158. - File
router/trading_execution_router.py, withinadd_paper_fundsroute, lines 1914–1916.
No new methods or imports are required beyond what’s already present; we continue using the existing logger instances.
| @@ -1913,7 +1913,11 @@ | ||
| return result | ||
| except Exception as e: | ||
| logger.error(f"Error adding funds: {e}") | ||
| raise HTTPException(status_code=500, detail=str(e)) | ||
| # Do not expose internal exception details to the client | ||
| raise HTTPException( | ||
| status_code=500, | ||
| detail="Internal server error while adding funds." | ||
| ) | ||
|
|
||
| @router.get("/funds/statement") | ||
| async def get_fund_statement( |
| @@ -155,7 +155,11 @@ | ||
| except Exception as e: | ||
| db.rollback() | ||
| logger.error(f"❌ Error adding paper funds: {e}") | ||
| return {"success": False, "error": str(e)} | ||
| # Return a generic error message to avoid exposing internal details | ||
| return { | ||
| "success": False, | ||
| "error": "Failed to add paper funds. Please try again later." | ||
| } | ||
|
|
||
| def block_margin(self, user_id: int, amount: float, trading_mode: str, reference_id: str, db: Session) -> bool: | ||
| """Block margin for a new trade""" |
✅ Deploy Preview for resplendent-shortbread-e830d3 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
2 participants
Comprehensive fund management system including: