improve signed reads, crypto hardening, and scraper transport

app/api/positions.py

@@ -35,7 +35,9 @@ from app.database import get_db
 from app.models import BotTrade, Subscription, iso_utc
 from app.services.crypto import decrypt_api_key
 from app.services.price_store import price_store
-from app.services.signed_request import verify_signed_request, verify_signed_request_any
+from app.services.signed_request import (
+    SignedReadCreds, signed_read_creds,
+    verify_signed_request, verify_signed_request_any)
 
 router = APIRouter()
 logger = logging.getLogger(__name__)
@@ -144,8 +146,7 @@ def _enrich(trade: BotTrade) -> OpenPosition:
 @router.get("/positions/open", response_model=OpenPositionsResponse)
 async def get_open_positions(
     wallet: str = Query(..., description="Wallet address (lower-cased internally)"),
-    ts: int = Query(..., description="Signed timestamp (ms)"),
-    sig: str = Query(..., description="EIP-191 signature"),
+    creds: SignedReadCreds = Depends(signed_read_creds),
     db: AsyncSession = Depends(get_db),
 ):
     """Live open positions for the wallet, with mark-to-market PnL."""
@@ -153,8 +154,8 @@ async def get_open_positions(
     verify_signed_request_any(
         actions=[ACTION_VIEW_POSITIONS, ACTION_VIEW_USER],
         wallet=wallet,
-        timestamp_ms=ts,
-        signature=sig,
+        timestamp_ms=creds.ts,
+        signature=creds.sig,
         body=None,
         allow_replay=True,
     )
@@ -177,8 +178,7 @@ async def get_open_positions(
 @router.get("/positions/today", response_model=TodayStatsResponse)
 async def get_today_stats(
     wallet: str = Query(...),
-    ts: int = Query(..., description="Signed timestamp (ms)"),
-    sig: str = Query(..., description="EIP-191 signature"),
+    creds: SignedReadCreds = Depends(signed_read_creds),
     db: AsyncSession = Depends(get_db),
 ):
     """Today's realized P&L (since UTC midnight) + open count.
@@ -190,8 +190,8 @@ async def get_today_stats(
     verify_signed_request_any(
         actions=[ACTION_VIEW_POSITIONS, ACTION_VIEW_USER],
         wallet=wallet,
-        timestamp_ms=ts,
-        signature=sig,
+        timestamp_ms=creds.ts,
+        signature=creds.sig,
         body=None,
         allow_replay=True,
     )
@@ -453,8 +453,7 @@ class HLPositionsResponse(BaseModel):
 @router.get("/positions/hl/{wallet}", response_model=HLPositionsResponse)
 async def list_hl_positions_endpoint(
     wallet: str,
-    ts: int = Query(..., description="Signed timestamp (ms)"),
-    sig: str = Query(..., description="EIP-191 signature"),
+    creds: SignedReadCreds = Depends(signed_read_creds),
 ):
     """Read the wallet's CURRENT Hyperliquid open positions, annotated with
     'already adopted' flag. Used by the Adopt picker on the frontend.
@@ -469,8 +468,8 @@ async def list_hl_positions_endpoint(
     verify_signed_request_any(
         actions=[ACTION_VIEW_POSITIONS, ACTION_VIEW_USER],
         wallet=wallet,
-        timestamp_ms=ts,
-        signature=sig,
+        timestamp_ms=creds.ts,
+        signature=creds.sig,
         body=None,
         allow_replay=True,
     )