3 files changed, 41 insertions, 17 deletions
diff --git a/services/api/src/trading_api/routers/orders.py b/services/api/src/trading_api/routers/orders.py
index c69dc10..b664e2a 100644
--- a/services/api/src/trading_api/routers/orders.py
+++ b/services/api/src/trading_api/routers/orders.py
@@ -2,17 +2,23 @@
 
 import logging
 
-from fastapi import APIRouter, HTTPException, Request
-from shared.sa_models import OrderRow, SignalRow
+from fastapi import APIRouter, HTTPException, Query, Request
+from slowapi import Limiter
+from slowapi.util import get_remote_address
 from sqlalchemy import select
+from sqlalchemy.exc import OperationalError
+
+from shared.sa_models import OrderRow, SignalRow
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter()
+limiter = Limiter(key_func=get_remote_address)
 
 
 @router.get("/")
-async def get_orders(request: Request, limit: int = 50):
+@limiter.limit("60/minute")
+async def get_orders(request: Request, limit: int = Query(50, ge=1, le=1000)):
     """Get recent orders."""
     try:
         db = request.app.state.db
@@ -35,13 +41,17 @@ async def get_orders(request: Request, limit: int = 50):
                 }
                 for r in rows
             ]
+    except OperationalError as exc:
+        logger.error("Database error fetching orders: %s", exc)
+        raise HTTPException(status_code=503, detail="Database unavailable") from exc
     except Exception as exc:
-        logger.error("Failed to get orders: %s", exc)
-        raise HTTPException(status_code=500, detail="Failed to retrieve orders")
+        logger.error("Failed to get orders: %s", exc, exc_info=True)
+        raise HTTPException(status_code=500, detail="Failed to retrieve orders") from exc
 
 
 @router.get("/signals")
-async def get_signals(request: Request, limit: int = 50):
+@limiter.limit("60/minute")
+async def get_signals(request: Request, limit: int = Query(50, ge=1, le=1000)):
     """Get recent signals."""
     try:
         db = request.app.state.db
@@ -62,6 +72,9 @@ async def get_signals(request: Request, limit: int = 50):
                 }
                 for r in rows
             ]
+    except OperationalError as exc:
+        logger.error("Database error fetching signals: %s", exc)
+        raise HTTPException(status_code=503, detail="Database unavailable") from exc
     except Exception as exc:
-        logger.error("Failed to get signals: %s", exc)
-        raise HTTPException(status_code=500, detail="Failed to retrieve signals")
+        logger.error("Failed to get signals: %s", exc, exc_info=True)
+        raise HTTPException(status_code=500, detail="Failed to retrieve signals") from exc
diff --git a/services/api/src/trading_api/routers/portfolio.py b/services/api/src/trading_api/routers/portfolio.py
index d76d85d..56bee7c 100644
--- a/services/api/src/trading_api/routers/portfolio.py
+++ b/services/api/src/trading_api/routers/portfolio.py
@@ -2,9 +2,11 @@
 
 import logging
 
-from fastapi import APIRouter, HTTPException, Request
-from shared.sa_models import PositionRow
+from fastapi import APIRouter, HTTPException, Query, Request
 from sqlalchemy import select
+from sqlalchemy.exc import OperationalError
+
+from shared.sa_models import PositionRow
 
 logger = logging.getLogger(__name__)
 
@@ -29,13 +31,16 @@ async def get_positions(request: Request):
                 }
                 for r in rows
             ]
+    except OperationalError as exc:
+        logger.error("Database error fetching positions: %s", exc)
+        raise HTTPException(status_code=503, detail="Database unavailable") from exc
     except Exception as exc:
-        logger.error("Failed to get positions: %s", exc)
-        raise HTTPException(status_code=500, detail="Failed to retrieve positions")
+        logger.error("Failed to get positions: %s", exc, exc_info=True)
+        raise HTTPException(status_code=500, detail="Failed to retrieve positions") from exc
 
 
 @router.get("/snapshots")
-async def get_snapshots(request: Request, days: int = 30):
+async def get_snapshots(request: Request, days: int = Query(30, ge=1, le=365)):
     """Get portfolio snapshots for the last N days."""
     try:
         db = request.app.state.db
@@ -49,6 +54,9 @@ async def get_snapshots(request: Request, days: int = 30):
             }
             for s in snapshots
         ]
+    except OperationalError as exc:
+        logger.error("Database error fetching snapshots: %s", exc)
+        raise HTTPException(status_code=503, detail="Database unavailable") from exc
     except Exception as exc:
-        logger.error("Failed to get snapshots: %s", exc)
-        raise HTTPException(status_code=500, detail="Failed to retrieve snapshots")
+        logger.error("Failed to get snapshots: %s", exc, exc_info=True)
+        raise HTTPException(status_code=500, detail="Failed to retrieve snapshots") from exc
diff --git a/services/api/src/trading_api/routers/strategies.py b/services/api/src/trading_api/routers/strategies.py
index 7ddd54e..157094c 100644
--- a/services/api/src/trading_api/routers/strategies.py
+++ b/services/api/src/trading_api/routers/strategies.py
@@ -42,6 +42,9 @@ async def list_strategies():
             }
             for s in strategies
         ]
+    except (ImportError, FileNotFoundError) as exc:
+        logger.error("Strategy loading error: %s", exc)
+        raise HTTPException(status_code=503, detail="Strategy engine unavailable") from exc
     except Exception as exc:
-        logger.error("Failed to list strategies: %s", exc)
-        raise HTTPException(status_code=500, detail="Failed to list strategies")
+        logger.error("Failed to list strategies: %s", exc, exc_info=True)
+        raise HTTPException(status_code=500, detail="Failed to list strategies") from exc