refactor: reuse market symbol normalization

app/ARCHITECTURE.md

@@ -30,6 +30,9 @@ background scheduler
   `backend/application.py` and `backend/bootstrap/`.
 - `backend/http/` owns common authentication, request IDs, responses, static delivery, and
   error normalization. Feature-specific transport handlers live beside their feature.
+  Exact POST endpoints that only delegate to one of those handlers use the explicit maps in
+  `backend/application.py`; endpoints with path parameters, body handling, or special error
+  semantics remain visible control flow in `RequestHandler`.
 - `backend/features/<feature>/` owns the mechanically moved service, repository, HTTP, agent,
   or deterministic calculation code for that product area.
 - `backend/data/` owns provider construction, source policy, provenance, units, freshness,

app/backend/application.py

@@ -507,6 +507,40 @@ class DashboardService(
 SERVICE = DashboardService()
 
 
+PUBLIC_POST_HANDLERS = {
+    "/api/auth/register": "auth_register",
+    "/api/auth/login": "auth_login",
+}
+
+AUTHENTICATED_POST_HANDLERS = {
+    "/api/auth/logout": "auth_logout",
+    "/api/account/birth-profile": "save_birth_profile",
+    "/api/account/password": "change_password",
+    "/api/alerts": "save_alert",
+    "/api/trades": "save_trade_entry",
+    "/api/assistant/chat": "stream_assistant_chat",
+    "/api/admin/settings": "save_system_settings",
+    "/api/admin/settings/test": "test_system_llm_settings",
+    "/api/admin/membership": "save_membership",
+    "/api/admin/refresh": "start_background_refresh",
+    "/api/watchlist": "save_watchlist",
+    "/api/notes": "save_note",
+    "/api/reasons": "save_reason",
+    "/api/seat-aliases": "save_seat_alias",
+    "/api/heaven/sector-phases": "save_sector_phase_override",
+    "/api/backfill": "backfill_data",
+    "/api/screener/sync": "sync_screener_data",
+    "/api/screener/compile": "compile_screener_strategy",
+    "/api/screener/strategies": "save_screener_strategy",
+    "/api/screener/run": "run_screener",
+    "/api/screener/tracking/refresh": "refresh_screener_tracking",
+    "/api/mentors/chat": "stream_mentor_chat",
+    "/api/heaven/hexagram": "heaven_hexagram",
+    "/api/heaven/personal": "heaven_personal",
+    "/api/heaven/interpret": "heaven_interpret",
+}
+
+
 class RequestHandler(
     AccountHttpMixin,
     SystemHttpMixin,
@@ -522,6 +556,13 @@ class RequestHandler(
     application_service = SERVICE
     route_registry = ROUTES
 
+    def _dispatch_named_handler(self, path: str, handlers: dict[str, str]) -> bool:
+        handler_name = handlers.get(path)
+        if handler_name is None:
+            return False
+        getattr(self, handler_name)()
+        return True
+
     def do_GET(self) -> None:
         parsed = urlparse(self.path)
         if parsed.path == "/api/health":
@@ -864,24 +905,13 @@ class RequestHandler(
 
     def do_POST(self) -> None:
         parsed = urlparse(self.path)
-        if parsed.path == "/api/auth/register":
-            self.auth_register()
-            return
-        if parsed.path == "/api/auth/login":
-            self.auth_login()
+        if self._dispatch_named_handler(parsed.path, PUBLIC_POST_HANDLERS):
             return
         if not self.require_auth() or not self.require_csrf():
             return
         if not self.require_access("POST", parsed.path):
             return
-        if parsed.path == "/api/auth/logout":
-            self.auth_logout()
-            return
-        if parsed.path == "/api/account/birth-profile":
-            self.save_birth_profile()
-            return
-        if parsed.path == "/api/account/password":
-            self.change_password()
+        if self._dispatch_named_handler(parsed.path, AUTHENTICATED_POST_HANDLERS):
             return
         alert_read_match = re.fullmatch(r"/api/alerts/(\d+)/read", parsed.path)
         if alert_read_match:
@@ -895,57 +925,6 @@ class RequestHandler(
                 {"ok": True, **SERVICE.mark_all_alerts_read(str(body.get("as_of") or ""))}
             )
             return
-        if parsed.path == "/api/alerts":
-            self.save_alert()
-            return
-        if parsed.path == "/api/trades":
-            self.save_trade_entry()
-            return
-        if parsed.path == "/api/assistant/chat":
-            self.stream_assistant_chat()
-            return
-        if parsed.path == "/api/admin/settings":
-            self.save_system_settings()
-            return
-        if parsed.path == "/api/admin/settings/test":
-            self.test_system_llm_settings()
-            return
-        if parsed.path == "/api/admin/membership":
-            self.save_membership()
-            return
-        if parsed.path == "/api/admin/refresh":
-            self.start_background_refresh()
-            return
-        if parsed.path == "/api/watchlist":
-            self.save_watchlist()
-            return
-        if parsed.path == "/api/notes":
-            self.save_note()
-            return
-        if parsed.path == "/api/reasons":
-            self.save_reason()
-            return
-        if parsed.path == "/api/seat-aliases":
-            self.save_seat_alias()
-            return
-        if parsed.path == "/api/heaven/sector-phases":
-            self.save_sector_phase_override()
-            return
-        if parsed.path == "/api/backfill":
-            self.backfill_data()
-            return
-        if parsed.path == "/api/screener/sync":
-            self.sync_screener_data()
-            return
-        if parsed.path == "/api/screener/compile":
-            self.compile_screener_strategy()
-            return
-        if parsed.path == "/api/screener/strategies":
-            self.save_screener_strategy()
-            return
-        if parsed.path == "/api/screener/run":
-            self.run_screener()
-            return
         if parsed.path == "/api/screener/tracking":
             try:
                 result = SERVICE.add_screener_tracking(self.read_json_body())
@@ -953,9 +932,6 @@ class RequestHandler(
             except (ValueError, json.JSONDecodeError) as exc:
                 self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
             return
-        if parsed.path == "/api/screener/tracking/refresh":
-            self.refresh_screener_tracking()
-            return
         if parsed.path == "/api/mentors/preferences":
             try:
                 result = SERVICE.save_mentor_preferences(self.read_json_body())
@@ -963,18 +939,6 @@ class RequestHandler(
             except (ValueError, json.JSONDecodeError) as exc:
                 self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
             return
-        if parsed.path == "/api/mentors/chat":
-            self.stream_mentor_chat()
-            return
-        if parsed.path == "/api/heaven/hexagram":
-            self.heaven_hexagram()
-            return
-        if parsed.path == "/api/heaven/personal":
-            self.heaven_personal()
-            return
-        if parsed.path == "/api/heaven/interpret":
-            self.heaven_interpret()
-            return
         self.send_json({"error": "Not found"}, HTTPStatus.NOT_FOUND)
 
     def do_DELETE(self) -> None:

app/backend/features/market/charts.py

@@ -12,6 +12,7 @@ from datetime import datetime, time as dt_time, timedelta
 from threading import Lock
 from typing import Any, ClassVar
 
+from backend.bootstrap.config import tushare_code as _stock_market_code
 from backend.data.providers.ifind_client import IfindError, IfindHttpClient
 
 
@@ -475,16 +476,6 @@ def _ifind_point(row: dict[str, Any]) -> dict[str, Any] | None:
     }
 
 
-def _stock_market_code(code: str) -> str:
-    if code.startswith(("4", "8", "9")):
-        suffix = "BJ"
-    elif code.startswith("6"):
-        suffix = "SH"
-    else:
-        suffix = "SZ"
-    return f"{code}.{suffix}"
-
-
 def _number(value: Any) -> float:
     try:
         return float(value or 0)

app/config/architecture-inventory.json

@@ -329,8 +329,8 @@
     },
     {
       "path": "backend/application.py",
-      "bytes": 49784,
-      "lines": 1165
+      "bytes": 48749,
+      "lines": 1129
     },
     {
       "path": "frontend/styles/theme.css",

app/tests/test_http_dispatch.py

@@ -0,0 +1,83 @@
+from __future__ import annotations
+
+import unittest
+
+from backend.application import (
+    AUTHENTICATED_POST_HANDLERS,
+    PUBLIC_POST_HANDLERS,
+    RequestHandler,
+)
+
+
+class HttpDispatchContractTests(unittest.TestCase):
+    @staticmethod
+    def handler(path: str, calls: list[str]) -> RequestHandler:
+        handler = RequestHandler.__new__(RequestHandler)
+        handler.path = path
+        handler.require_auth = lambda: calls.append("auth") or True
+        handler.require_csrf = lambda: calls.append("csrf") or True
+        handler.require_access = lambda method, route: (
+            calls.append(f"access:{method}:{route}") or True
+        )
+        return handler
+
+    def test_named_handlers_are_real_registered_post_routes(self) -> None:
+        all_handlers = {**PUBLIC_POST_HANDLERS, **AUTHENTICATED_POST_HANDLERS}
+        self.assertEqual(
+            set(PUBLIC_POST_HANDLERS) & set(AUTHENTICATED_POST_HANDLERS), set()
+        )
+        for path, handler_name in all_handlers.items():
+            with self.subTest(path=path):
+                route = RequestHandler.route_registry.resolve("POST", path)
+                self.assertIsNotNone(route)
+                self.assertTrue(callable(getattr(RequestHandler, handler_name)))
+                expected_access = "public" if path in PUBLIC_POST_HANDLERS else None
+                if expected_access:
+                    self.assertEqual(route.access, expected_access)
+                else:
+                    self.assertNotEqual(route.access, "public")
+
+    def test_public_post_dispatches_without_authentication(self) -> None:
+        for path, handler_name in PUBLIC_POST_HANDLERS.items():
+            with self.subTest(path=path):
+                calls: list[str] = []
+                handler = self.handler(path, calls)
+                handler.require_auth = lambda: (_ for _ in ()).throw(
+                    AssertionError("public route required authentication")
+                )
+                setattr(handler, handler_name, lambda: calls.append(handler_name))
+
+                RequestHandler.do_POST(handler)
+
+                self.assertEqual(calls, [handler_name])
+
+    def test_authenticated_post_preserves_guard_order(self) -> None:
+        for path, handler_name in AUTHENTICATED_POST_HANDLERS.items():
+            with self.subTest(path=path):
+                calls: list[str] = []
+                handler = self.handler(path, calls)
+                setattr(handler, handler_name, lambda: calls.append(handler_name))
+
+                RequestHandler.do_POST(handler)
+
+                self.assertEqual(
+                    calls,
+                    ["auth", "csrf", f"access:POST:{path}", handler_name],
+                )
+
+    def test_failed_access_never_dispatches_protected_handler(self) -> None:
+        path, handler_name = next(iter(AUTHENTICATED_POST_HANDLERS.items()))
+        calls: list[str] = []
+        handler = self.handler(path, calls)
+        handler.require_access = lambda method, route: (
+            calls.append(f"access:{method}:{route}") or False
+        )
+        setattr(handler, handler_name, lambda: calls.append(handler_name))
+
+        RequestHandler.do_POST(handler)
+
+        self.assertEqual(calls, ["auth", "csrf", f"access:POST:{path}"])
+
+
+if __name__ == "__main__":
+    unittest.main()

app/tests/test_market_symbol_normalization.py

@@ -0,0 +1,26 @@
+from __future__ import annotations
+
+import unittest
+
+from backend.bootstrap.config import tushare_code
+from backend.features.market import charts
+
+
+class MarketSymbolNormalizationTests(unittest.TestCase):
+    def test_chart_and_market_services_share_one_suffix_converter(self) -> None:
+        self.assertIs(charts._stock_market_code, tushare_code)
+
+    def test_existing_exchange_mapping_is_preserved(self) -> None:
+        cases = {
+            "000001": "000001.SZ",
+            "600000": "600000.SH",
+            "430047": "430047.BJ",
+            "830799": "830799.BJ",
+        }
+        for code, expected in cases.items():
+            with self.subTest(code=code):
+                self.assertEqual(charts._stock_market_code(code), expected)
+
+
+if __name__ == "__main__":
+    unittest.main()

app/tests/test_preservation_slice_market.py

@@ -9,6 +9,7 @@ import chart_data_provider
 import ifind_client
 import realtime_aggregator
 import tushare_client
+from backend.bootstrap import config as bootstrap_config
 from backend.data import realtime
 from backend.data.providers import ifind_client as canonical_ifind
 from backend.data.providers import tushare_client as canonical_tushare
@@ -101,6 +102,18 @@ def top_level_definitions(path: Path) -> dict[str, str]:
     }
 
 
+def function_contract(path: Path, name: str) -> tuple[str, str]:
+    tree = ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
+    function = next(
+        node for node in tree.body if isinstance(node, ast.FunctionDef) and node.name == name
+    )
+    body = ast.Module(body=function.body, type_ignores=[])
+    return (
+        ast.dump(function.args, include_attributes=False),
+        ast.dump(body, include_attributes=False),
+    )
+
+
 class MarketSliceSourceEquivalenceTests(unittest.TestCase):
     def test_market_service_methods_are_exact_original_ast(self) -> None:
         original = class_methods(ORIGINAL_ROOT / "server.py", "DashboardService")
@@ -145,10 +158,21 @@ class MarketSliceSourceEquivalenceTests(unittest.TestCase):
             top_level_definitions(ORIGINAL_ROOT / "tushare_client.py"),
             top_level_definitions(APP_ROOT / "backend/data/providers/tushare_client.py"),
         )
+        original_charts = top_level_definitions(ORIGINAL_ROOT / "chart_data_provider.py")
+        original_charts.pop("_stock_market_code")
         self.assertEqual(
-            top_level_definitions(ORIGINAL_ROOT / "chart_data_provider.py"),
+            original_charts,
             top_level_definitions(APP_ROOT / "backend/features/market/charts.py"),
         )
+        self.assertEqual(
+            function_contract(
+                ORIGINAL_ROOT / "chart_data_provider.py", "_stock_market_code"
+            ),
+            function_contract(
+                APP_ROOT / "backend/bootstrap/config.py", "tushare_code"
+            ),
+        )
+        self.assertIs(charts._stock_market_code, bootstrap_config.tushare_code)
 
     def test_relocated_frontend_preserves_original_market_runtime_and_styles(self) -> None:
         assert_frontend_runtime_matches_audited_baseline(self)

app/tools/build_api_registry.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import argparse
+import ast
 import json
 import re
 import sys
@@ -59,8 +60,32 @@ def _role(method: str, path: str) -> str:
     return required_role(method, sample)
 
 
+def _mapped_paths(text: str) -> dict[str, set[str]]:
+    paths = {method: set() for method in ("GET", "POST", "DELETE")}
+    tree = ast.parse(text)
+    for node in tree.body:
+        if not isinstance(node, ast.Assign) or len(node.targets) != 1:
+            continue
+        target = node.targets[0]
+        if not isinstance(target, ast.Name):
+            continue
+        match = re.fullmatch(
+            r"(?:PUBLIC_|AUTHENTICATED_)?(GET|POST|DELETE)_HANDLERS", target.id
+        )
+        if not match:
+            continue
+        mapping = ast.literal_eval(node.value)
+        if not isinstance(mapping, dict) or not all(
+            isinstance(path, str) and path.startswith("/api/") for path in mapping
+        ):
+            raise ValueError(f"Invalid route handler map: {target.id}")
+        paths[match.group(1)].update(mapping)
+    return paths
+
+
 def build() -> dict:
     text = (ROOT / "backend" / "application.py").read_text(encoding="utf-8")
+    mapped_paths = _mapped_paths(text)
     method_matches = list(re.finditer(r"^    def do_(GET|POST|DELETE)\(", text, re.MULTILINE))
     routes = []
     for index, match in enumerate(method_matches):
@@ -68,6 +93,7 @@ def build() -> dict:
         end = method_matches[index + 1].start() if index + 1 < len(method_matches) else len(text)
         block = text[match.start():end]
         exact_paths = set(re.findall(r'parsed\.path\s*==\s*"(/api/[^"]+)"', block))
+        exact_paths.update(mapped_paths[method])
         patterns = set(
             re.findall(
                 r're\.(?:fullmatch|match)\(\s*r?["\']([^"\']*?/api/[^"\']+)["\']\s*,\s*parsed\.path',

app/tools/build_architecture_inventory.py

@@ -37,16 +37,15 @@ def page_inventory(html: str) -> list[dict[str, str]]:
 
 
 def api_inventory(server: str) -> dict[str, list[str]]:
-    exact = sorted(set(re.findall(r'parsed\.path\s*==\s*"(/api/[^"]+)"', server)))
+    routes = json.loads(source("config/api.config.json"))["routes"]
+    exact = sorted(
+        {item["path"] for item in routes if item["match"] == "exact"}
+    )
     prefixes = sorted(
         set(re.findall(r'parsed\.path\.startswith\(\s*"(/api/[^"]+)"', server))
     )
     patterns = sorted(
-        set(
-            item
-            for item in re.findall(r'r?["\']([^"\']*?/api/[^"\']+)["\']', server)
-            if "\\d" in item or ".+" in item or "(?P" in item
-        )
+        {item["path"] for item in routes if item["match"] == "regex"}
     )
     return {"exact": exact, "prefixes": prefixes, "patterns": patterns}
 

docs/governance/code-reduction.md

@@ -19,6 +19,8 @@
 | 批次 | 边界 | 基线问题 | 目标 | 状态 |
 |---|---|---|---|---|
 | CR-01 | LLM供应商传输 | 问师、问天、复盘助手和策略编译各自构造HTTP请求、解析响应和读取错误 | 只保留`backend/llm/transport.py`一个网络出口 | 已完成 |
+| CR-02 | HTTP精确POST委托 | 27个端点重复使用“比较路径、调用无参数处理器、返回”三行分支 | 用公开/受保护两张显式映射统一委托，同时保留复杂路由的原控制流 | 已完成 |
+| CR-03 | 股票市场后缀转换 | Tushare业务与iFinD图表各保留一份完全相同的沪深京代码转换函数 | 图表复用`bootstrap/config.py::tushare_code`，只保留一份函数体 | 已完成 |
 
 ## CR-01验收口径
 
@@ -43,3 +45,47 @@
 
 回档基线为`xiaobai-preservation-complete-20260801`；本批检查点为
 `xiaobai-reduction-01-llm-transport-20260801`。
+
+## CR-02验收口径
+
+- 仅纳入没有路径参数、请求体解析或专属异常分支的精确POST端点；其余路由保持原样。
+- 公开注册/登录端点继续在鉴权前分发；受保护端点继续严格执行登录、CSRF、注册表权限、处理器。
+- 27个映射路径必须都由权威API注册表解析，处理方法必须真实存在，公开与受保护集合不得重叠。
+- API路径、功能归属、访问角色、状态码、错误正文和静态页面绕过鉴权行为保持不变。
+- API清单生成器必须结构化读取显式映射；架构清查复用API清单，不再维护第二套路由发现规则。
+
+## CR-02结果
+
+- 2个公开端点和25个受保护端点改为显式委托映射，原来的79行重复分支被43行映射、分发与调用替代；
+  `backend/application.py`净减少36行，规范化源码约减少1.0 KB。
+- 带正则路径参数、请求体读取、查询参数转换或特殊异常语义的GET、POST、DELETE端点未改动。
+- 架构清查删除了自行扫描精确/正则API路径的第二套规则，改为消费权威`api.config.json`；API注册表的
+  53个精确路径、11个正则路径、功能归属和权限均未变化。
+- 原版231项、候选315项、纯`app/`导出252项、45项Playwright通过；24个JavaScript文件、
+  API/架构注册表、Git空白检查和SQLite完整性检查通过。
+- 本批不修改前端、CSS、业务计算、数据源、数据库结构、LLM、会员规则或部署。
+
+本批基线为`xiaobai-reduction-01-llm-transport-20260801`；检查点为
+`xiaobai-reduction-02-http-dispatch-20260801`。
+
+## CR-03验收口径
+
+- 图表模块不再定义第二份市场后缀转换函数，仍保留原局部名称和两个调用点。
+- 深市、沪市、北交所的既有映射结果保持不变；不借本批修正或扩展代码规则。
+- 原图表文件除该函数外的所有顶层定义继续与原版AST逐项相等。
+- 原版`_stock_market_code`函数的参数和函数体必须与唯一共享实现AST相等，运行时别名必须指向
+  同一个函数对象。
+
+## CR-03结果
+
+- 删除`backend/features/market/charts.py`中第二份10行定义，以1行导入别名复用共享实现，生产代码
+  净减少9行；全仓后端只剩一份沪深京后缀转换函数体。
+- 未合并实时聚合、东方财富图表、iFinD和Tushare的HTTP传输；它们的缓存、错误、重试和降级语义
+  不同，仅有外形相似，证据不足以安全抽象。
+- 原有迁移期整文件相等断言被等价范围断言、共享函数AST断言和唯一对象断言替代，没有降低门禁。
+- 原版231项、候选317项、纯`app/`导出254项、45项Playwright通过；API/架构注册表、
+  24个JavaScript文件、Git空白检查和SQLite完整性检查通过。
+- 本批不修改图表请求、数据来源、缓存、时间范围、行情计算、前端、CSS、数据库或部署。
+
+本批基线为`xiaobai-reduction-02-http-dispatch-20260801`；检查点为
+`xiaobai-reduction-03-market-symbol-20260801`。