order button

README.md

@@ -9,10 +9,12 @@ RMC, construction materials, …) are browsable with search, manufacturer / type
 size filters, pagination, and a detail view per item.
 
 Users can optionally create an account and build a **personal inventory**: items
-from the catalog are added to their own list with a quantity and notes. The
-catalog itself stays immutable read-only reference data; personal inventories
-live in PostgreSQL and reference catalog items by `class_name` only, so the
-dataset can be replaced wholesale without touching user data.
+from the catalog are added to their own list with a quantity and notes. Logged-in
+users can also place **orders** for any catalog item; orders go onto a public
+board that every visitor can see. The catalog itself stays immutable read-only
+reference data; personal inventories and orders live in PostgreSQL and reference
+catalog items by `class_name` only, so the dataset can be replaced wholesale
+without touching user data.
 
 ## Stack
 
@@ -144,8 +146,18 @@ item's catalog details, quantity, quality (when applicable), owner username and
 last update. Private rows
 never appear there and inventory notes are never exposed.
 
-Clicking an item name in either **My Inventory** or **Available** opens the same
-catalog detail view used by the catalog grid.
+The **Orders** tab (backed by `GET /api/v1/orders`) is also public. A logged-in
+user clicks any item to open its detail view, then fills in the **Request this
+item** form there with a quantity, optional notes, and — for mineable
+commodities — an optional quality. Setting up the order publishes the request
+on the public board.
+Orders show the item, quantity, quality, notes, requesting username, status
+(`open`/`fulfilled`) and last update. Notes on orders are public by design;
+inventory notes remain private. Only the owner can edit, mark fulfilled/reopen,
+or remove their own order.
+
+Clicking an item name in **My Inventory**, **Available** or **Orders** opens the
+same catalog detail view used by the catalog grid.
 
 ### Security: read before exposing this publicly
 
@@ -186,7 +198,7 @@ curl -fsS -b cookies.txt http://localhost:8080/api/v1/me/inventory
 cd trade-hub/backend
 python3 -m venv .venv
 .venv/bin/pip install -r requirements.txt -r requirements-dev.txt
-.venv/bin/python -m pytest tests/ -q          # 65 tests, no database needed
+.venv/bin/python -m pytest tests/ -q          # 83 tests, no database needed
 DATA_DIR=./data/samples .venv/bin/uvicorn main:app --port 8000
 ```
 
@@ -229,12 +241,19 @@ PATCH  /api/v1/me/inventory/{class_name}   {quantity?, notes?, visibility?, qual
 DELETE /api/v1/me/inventory/{class_name}
 
 GET    /api/v1/available?category=&search=&sort=&page=&page_size=
+
+GET    /api/v1/orders?category=&search=&status=&sort=&page=&page_size=
+POST   /api/v1/orders              {class_name, quantity?, notes?, quality?}
+PATCH  /api/v1/orders/{id}         {quantity?, notes?, status?, quality?}
+DELETE /api/v1/orders/{id}
 ```
 
 `/api/v1/me/*` requires a valid session cookie and returns `401` otherwise.
-`/api/v1/available` is public and read-only; it accepts `sort=name|category|quantity|updated`
-(default `updated`). Catalog `category` values are `ships`, `ship-items`,
-`fps-items` and `commodities`.
+`/api/v1/available` and `GET /api/v1/orders` are public and read-only. Both
+accept `sort=name|category|quantity|updated` (default `updated`); orders also
+accept `status=open|fulfilled`. Creating or changing an order requires a
+session; only its owner may update or delete it. Catalog `category` values are
+`ships`, `ship-items`, `fps-items` and `commodities`.
 
 ### Configuration