Files
Evil0ctal e5316e580d feat(core): foundation contracts and toolchain
Python 3.12 + uv. Establishes the shared contracts every other module
imports, authored as one piece so parallel work has a fixed target.

- core/types.py    stable enums; these are wire identifiers and are never
                   translated (docs/design/14-i18n.md)
- core/errors.py   17 error codes with HTTP mapping and a non-retryable set.
                   UpstreamChanged carries the missing field path so "the
                   platform changed shape" stays distinguishable from rate
                   limiting - V4 conflated them and the change never got
                   reported
- core/crypto.py   AES-256-GCM with the record id as AAD, so a blob cannot be
                   moved between rows. Refuses to derive a key from a short or
                   missing DTK_SECRET_KEY rather than falling back to a default
- core/logging.py  redaction in the processor chain, not at call sites: a call
                   site that forgets is exactly how V4 leaked a live session
                   cookie
- core/config.py   33 runtime settings across four scopes; the SSRF allowlist
                   and CORS origins are `sensitive`. CORS defaults to empty
                   rather than '*', which would hand API keys to any site
- models/content.py normalized contract. Ids are strings (aweme_id exceeds the
                   JS safe integer range); absent metrics are None, never 0

Verified against the real dependency set: wreq 0.12.1 reproduces a genuine
Chrome JA4 (t13d1516h2_8daaf6152771_d8a2da3f94cd) and Chrome149/Firefox151
emulation profiles exist, matching the design's assumption.

Test fixtures run only through `docker compose -p dtk-test`, torn down with
`down -v`, so no loose containers are left behind.
2026-09-07 04:28:51 -07:00

38 lines
966 B
YAML

# Test-only orchestration. Always run through:
# docker compose -p dtk-test -f docker/compose.test.yml <cmd>
# and tear down with `down -v` so no stray containers or volumes survive.
name: dtk-test
services:
postgres:
image: timescale/timescaledb-ha:pg17
environment:
POSTGRES_DB: dtk_test
POSTGRES_USER: dtk
POSTGRES_PASSWORD: dtk_test_password
POSTGRES_HOST_AUTH_METHOD: scram-sha-256
ports:
- "127.0.0.1:55432:5432"
tmpfs:
- /var/lib/postgresql/data
healthcheck:
test: ["CMD-SHELL", "pg_isready -U dtk -d dtk_test"]
interval: 2s
timeout: 3s
retries: 30
labels:
dtk.role: test-fixture
redis:
image: redis:8-alpine
command: redis-server --save "" --appendonly no
ports:
- "127.0.0.1:56379:6379"
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 2s
timeout: 3s
retries: 30
labels:
dtk.role: test-fixture