App Lifecycle

App Lifecycle

Abstract

backend/app.py constructs a single global Flask app, applies security-minded defaults (body size, CORS allowlist), registers free and Pro routes, and exposes a module __main__ for local development. There is no multi-app factory pattern today — import app for WSGI (gunicorn) or run the module for the built-in server.

Conceptual model

Rendering…

Interface surface

Process entry

make run
# equivalent
python -m backend.app

Environment:

debug=False always on the dev runner.

Health

GET / and GET /health are the same handler. AXIS Settings probes /health. Payload includes compile-cache diagnostics:

{
  "status": "healthy",
  "service": "pynescript-pro-api",
  "version": "1.0.0",
  "timestamp": 0,
  "websocket": true,
  "features": {
    "alerts": true,
    "alert_webhooks": true,
    "warm_compile": true,
    "default_run_mode": "auto",
    "script_runner": false,
    "script_runner_scheduler": false
  },
  "compile": {
    "has_numba": true,
    "disk_cache_enabled": true,
    "prewarm_enabled": true,
    "default_mode": "auto"
  },
  "endpoints": { "…": "…" }
}

version here is the API service label (1.0.0), not the hoox-pyne package version.

Hard limits

• MAX_CONTENT_LENGTH = 5 * 1024 * 1024 — reject oversized bodies before JSON parse fills memory (audit 2026-07-05 / S1).
• Free compute is optionally gated by backend/middleware/free_limits.py when FREE_TIER_LIMITS is truthy (default off): max bars (FREE_MAX_BARS, 5000), script chars (FREE_MAX_SCRIPT_CHARS, 256 KiB), per-IP rate (FREE_RATE_LIMIT / FREE_RATE_WINDOW_SEC, 60 / 60s), concurrency (FREE_MAX_CONCURRENT, 4). Chart/mock data sources only. Production compose sets FREE_TIER_LIMITS=1.
• CORS methods: GET, POST, OPTIONS, HEAD.
• Allow headers: Content-Type, Authorization, X-Admin-Token, Accept.
• supports_credentials=False.

Localhost regex used in the default origin list:

^https?://(?:localhost|127\.0\.0\.1)(?::\d+)?$

Free CORS prefixes (/, /health, /run, /compile, /lsp/, /ws/) reflect the request Origin even when it is not in ALLOWED_ORIGINS so AXIS VPS UI → local pyne preflight succeeds.

Same-origin / no Origin header (curl, server-to-server) remains usable under flask-cors behavior.

Blueprints

app.register_blueprint(preview_bp)   # url_prefix=/preview
app.register_blueprint(backtest_bp)  # url_prefix=/backtest
app.register_blueprint(lsp_bp)       # url_prefix=/lsp
app.register_blueprint(git_oauth_bp) # /api/git/oauth/*

Preview + backtest live in backend/api/preview.py. Optional flask-sock registers WS /ws/run when installed.

Error handlers

Both return JSON with status: "error".

Internals

Recommended production: gunicorn/uvicorn-class WSGI with multiple workers; for multi-worker key consistency prefer SQLite/Redis stores over the default in-memory/file singleton assumptions — see auth.

Invariants and edge cases

1. Import side effects: creating app configures CORS immediately from env.
2. Body too large → Flask 413 before route logic (not custom JSON).
3. Unknown fields on schema-validated routes → UNKNOWN_FIELDS 400 (/run, auth); preview routes currently use looser get_json() (schemas exist but are not always applied in handlers).
4. Dev bind default is loopback — set HOST=0.0.0.0 only when intentional.

Worked example — smoke test

curl -s http://127.0.0.1:5002/health | jq '.status, .features.default_run_mode'
# "healthy"
# "auto"

Failure modes

See also

• Auth and keys
• Run endpoint
• Docker / CI