iDjdZddlZddlmZddlmZmZddlmZddl m Z m Z ddl m Z mZmZmZddlmZmZmZdd lmZdd lmZmZed efd Zed eZdededzdefdZedededededededfdedededededef dZ e!ddZ"dS)uz TD Slope params server. Endpoint: POST /params Request body (application/x-www-form-urlencoded), deliberately mirroring LicenseValidator.mqh's _LV_DoValidate() request shape so the MT5-side code can reuse the exact same WebRequest()/HMAC-construction pattern it already has, just pointed at a different URL with one extra field: k = license key m = machine ID (same SHA-256 fingerprint the license check uses) t = unix timestamp (GMT) b = build string (compiled EA filename + compile date) sym = the symbol as reported by MQL5's _Symbol on the EA's chart s = HMAC-SHA256(secret, "k|m|t|b|sym") — note the trailing |sym compared to the license endpoint's "k|m|t|b"; the field is appended, not inserted, to keep this easy to reason about as "license signing logic plus one more field" rather than a divergent scheme. Response body (application/json): { "code": "OK" | "NOT_AVAILABLE" | "UNKNOWN_SYMBOL" | "INVALID" | "EXPIRED" | "COOLDOWN" | "INACTIVE" | "BAD_SIGNATURE" | "TIMESTAMP_SKEW" | "MALFORMED_REQUEST", "ts": , "params": "", "sig": "" } The "params" field is deliberately sent as a JSON-encoded STRING (an escaped blob) rather than a nested JSON object. This means the MT5 client only needs a trivial flat-key parser for the OUTER envelope (4 fixed top-level string/number fields — about as complex as the existing pipe-delimited license response), and can verify the signature by hashing the exact literal text of that inner string after un-escaping it, with no risk of a canonicalization mismatch between Python's json.dumps and a hand-written MQL5 JSON serializer ever needing to agree byte-for-byte. Parsing the INNER json (the actual params) into real values is a separate, slightly bigger problem the EA needs a small JSON parser for regardless — that's expected and fine, since the params blob itself needs to become real input values either way. code values reuse the SAME vocabulary as LicenseValidator.mqh's existing codes (INVALID/EXPIRED/COOLDOWN/INACTIVE) for license-related failures, so the EA can reuse its existing _LV_ShowError()-style alert handling rather than inventing a second, parallel error-handling path. N)asynccontextmanager)FastAPIForm) JSONResponse)PARAMS_SHARED_SECRETMAX_TIMESTAMP_SKEW_SECONDS)hmac_sha256_hexverify_hmac_hexcurrent_unix_tstimestamp_in_skew) license_store init_pool close_pool)resolver)get_current_or_upcoming_paramssymbol_has_any_dataappcdKtd{VdWVtd{VdS)N)rr)rs /wd/td-params-server/main.pylifespanr@sQ ++ EEEE ,,zTD Slope Params Server)titlercode params_docreturnct}|tj|ddnd}tt|d|d|}t ||||dS)N),:T) separators sort_keys|)rtsparamssig)r jsondumpsr rr)rrr# params_stringr%s r_signed_responser)Ms   B  ! :*EEEE  .40N0N"0N0N}0N0N O OC #     rz/params.kmtbsymsc K t|}n #t$rtddcYSwxYw|r|r|stddSt|tstddS|d|d|d|d| }t t ||stddStj||d{V}|j dkrt|j dStj |} t| stddSt| } | tddStd | S) NMALFORMED_REQUESTTIMESTAMP_SKEWr" BAD_SIGNATURE) license_key machine_idVALIDUNKNOWN_SYMBOL NOT_AVAILABLEOK)int ValueErrorr)r rr rr checkrrresolverr) r*r+r,r-r.r/ client_ts expected_msglic canonicaldocs r get_paramsrC_s;FF ;;; 3T:::::; ;A;S; 3T::: Y(B C C8 0$777++!++a++!++c++L /q A A7666#a@@@ @ @ @ @ @ @C x7$/// %%I y ) )8 0$777 ( 3 3C {666 D# & &&s 11z/healthzc(KdtdS)Nok)statusr#)r rrhealthzrHs/"3"3 4 44r)#__doc__r& contextlibrfastapirrfastapi.responsesrconfigrr crypto_utilsr r r r license_checkr rrsymbol_resolverr params_storerrrrstrdictr)postrCgetrHrGrrrVs&00d ******!!!!!!!!******CCCCCCCC]]]]]]]]]]]]>>>>>>>>>>$$$$$$LLLLLLLLg,x@@@3D4KL$) T#YY T#YY T#YY T#YYtCyy T#YY )')' )' )' )' )' )'  )')')')'X55555r