# IDRS API

Python (FastAPI + SQLite) server that mirrors the live idrs-api endpoints, with a login-protected admin panel to manage the data.

- `GET /api/getTokenInfo` → token list (position ASC, `decimals` int, `is_live` bool)
- `GET /api/version/android` → version record
- `GET /img/<filename>` → uploaded token icons
- `/admin` → sqladmin panel (login-protected): manage tokens, version, upload icons

## Setup

```
python3.12 -m venv venv
./venv/bin/pip install -r requirements.txt
cp .env.example .env   # set ADMIN_USERNAME / ADMIN_PASSWORD
```

## Run

```
./run.sh            # http://127.0.0.1:8000  (admin at /admin)
```

`run.sh` loads `.env`. First run seeds the DB from `tokenList.json` and `versionAndroid.json` (idrs.db is created here; override path via `IDRS_DB_PATH`).

## Notes

- **Auth:** single admin, credentials from `ADMIN_USERNAME`/`ADMIN_PASSWORD` env. If they're unset, login is refused and a warning is logged (fail closed). Session secret is auto-generated on first run and stored in `.session_secret`. The public API endpoints stay unauthenticated.
- **Version rule:** `acceptableVersion` ≤ `latestVersion` is enforced in the panel; below `acceptableVersion` the Android app force-updates, below `latestVersion` it prompts.
- **Icons:** upload PNGs in the admin panel (Icons page); `iconUrl` auto-points to `/img/<filename>`.
- No on-chain integration, no audit trail — data is entered manually.