[FEATURE] Implement Binance authenticated order execution - closes #85

[Ibrahim-3d]

Summary

Implements the 4 stubbed NotImplementedError methods in BinanceExchange using HMAC-SHA256 signed requests.

Changes

• Modified: app/pt_exchanges.py — BinanceExchange._sign(), _signed_request(), place_order(), get_balance(), get_order_status(), cancel_order()
• New: app/test_binance_exchange.py — 23 tests (all mocked, no real credentials)

API endpoints

Method	Endpoint	Notes
place_order	POST /api/v3/order	Market + limit; order_id returned as SYMBOL:ID
get_balance	GET /api/v3/account	Returns non-zero balances only
get_order_status	GET /api/v3/order	Requires SYMBOL:ID format
cancel_order	DELETE /api/v3/order	Returns False on error -2011 (already filled)

Signature verified against Binance official documentation test vector.

Test plan

• 23 unit tests pass (all mocked)
• HMAC-SHA256 signature verified against Binance docs reference
• Missing credentials raises RuntimeError
• API error responses raise RuntimeError with error code
• place_order adds SYMBOL: prefix for downstream lookup

Closes #85

[Ibrahim-3d]

Manual Testing Guide — PR #92: Binance Authenticated Order Execution

Prerequisites

git fetch fork && git checkout feat/85-binance-order-execution
cd app
pip install python-binance  # or equivalent Binance SDK

1. Run unit tests (mock-based, no live keys needed)

python -m pytest test_binance_order*.py -v 2>/dev/null || python -m pytest -k "binance" -v

Expected: All tests pass without real API keys.

2. Smoke test — import and instantiate (offline)

python -c "
from pt_binance_orders import BinanceOrderExecutor  # adjust class name if needed
print('import ok')
# Should not attempt network connection at import or instantiation
exec = BinanceOrderExecutor(api_key='test', api_secret='test', testnet=True)
print('instantiation ok')
"

3. Live test (optional — needs Binance testnet keys)

If you have Binance testnet credentials:

python -c "
from pt_binance_orders import BinanceOrderExecutor
exec = BinanceOrderExecutor(
    api_key='YOUR_TESTNET_KEY',
    api_secret='YOUR_TESTNET_SECRET',
    testnet=True
)
# Place a small test order on testnet
result = exec.place_market_order('BTCUSDT', side='BUY', quantity=0.001)
print('order result:', result)
"

Expected on testnet: Order placed and returned with an order ID.

Rollback

git checkout main -- app/pt_binance_orders.py

[Ibrahim-3d]

Please hold this before merging. The Binance order code was sending raw float quantities/prices without symbol-aware rounding, which would get rejected by Binance with their cryptic -1013 filter error on most real pairs. Adding LOT_SIZE/PRICE_FILTER/MIN_NOTIONAL handling first so live orders actually go through. Update coming.

[Ibrahim-3d]

LOT_SIZE / PRICE_FILTER / MIN_NOTIONAL handling is in. BinanceExchange now pulls each symbol's filters from /api/v3/exchangeInfo on first use and caches them, rounds the quantity DOWN to the LOT_SIZE step and the price DOWN to the PRICE_FILTER tick (never up, so we can't accidentally overshoot what the user asked for), and rejects the order locally with a clear message if it would fail minQty or minNotional. Also handles both the legacy MIN_NOTIONAL filter name and the renamed NOTIONAL one (Binance switched in 2023), so older and newer pairs both work. Added 5 new tests covering rounding, rejection, and caching - 28 total passing now.

[Ibrahim-3d]

@copilot review

[Ibrahim-3d]

Round 4 - Full Binance Spot REST coverage per docs

Pushed 4dd1e3... (or whatever the new commit hash is - see PR commits tab). This round closes the remaining follow-up items I called out earlier so this PR delivers the complete Binance Spot REST surface needed before #96 can route live orders here.

What landed

Auth + transport

• testnet=True constructor flag switches REST base to testnet.binance.vision and WS base to stream.testnet.binance.vision/ws. Production stays default.
• recv_window kwarg (1..60000ms per docs) auto-injected into every signed request.
• sync_time() hits GET /api/v3/time once on first signed call, caches the local-vs-server offset, and on a -1021 response resyncs + retries exactly once before raising BinanceTimestampError. No more silent clock-skew failures.
• HTTP 429 / 418 now raise BinanceRateLimitError(status_code, retry_after) honouring the Retry-After header so the trader loop can back off instead of earning a longer ban. X-MBX-USED-WEIGHT-* and X-MBX-ORDER-COUNT-* headers captured to last_rate_limit_headers for monitoring.

Order types

• place_order now supports every Binance spot type: MARKET, LIMIT, STOP_LOSS, STOP_LOSS_LIMIT, TAKE_PROFIT, TAKE_PROFIT_LIMIT, LIMIT_MAKER.
• New kwargs: order_type, stop_price, time_in_force, iceberg_qty, quote_order_qty, client_order_id, trailing_delta.
• Per-type required-field validation so callers get a clean ValueError instead of Binance's -1102 / -1106.
• Legacy (symbol, side, amount[, price]) form still auto-derives MARKET / LIMIT - existing callers unchanged.

OCO

• place_oco_order targets the modern POST /api/v3/orderList/oco with the aboveType / belowType schema (Binance retired the flat /order/oco shape in 2024).
• cancel_order_list deletes the whole list via DELETE /api/v3/orderList.

User-data stream (listenKey)

• create_listen_key / keepalive_listen_key / close_listen_key cover the POST / PUT / DELETE /api/v3/userDataStream lifecycle via a new _public_request helper (API-key header, no signature - matches docs).
• user_data_stream_url returns the right wss:// URL for prod or testnet so the WS consumer (out of scope here) can drop in.

Hooks for the broker selector (#96)

• test_connection() returns bool by probing /api/v3/account, swallowing exceptions - safe to call from the Tk thread for the per-broker "Test connection" button.
• get_masked_api_key() returns ****<last4> for the per-broker UI row.

Tests

66 unit tests, all mock-based, no real Binance credentials. CI is green. Local run:

```
python -m pytest app/test_binance_exchange.py -v
=== 66 passed ===
```

New test classes added on top of the existing 28:

• TestBinanceTestnet - URL switching, recv_window clamping
• TestBinanceServerTimeSync - offset application, -1021 retry success + persistent-failure paths
• TestBinanceRateLimit - 429/418 raise behaviour, header capture
• TestBinanceExtendedOrderTypes - all new types, validation errors
• TestBinanceOCO - place + cancel, missing-id and missing-creds guards
• TestBinanceListenKey - create/keepalive/close, WS URL prod vs testnet
• TestBinanceBrokerSelectorHelpers - test_connection() and get_masked_api_key() for [ARCH] User-facing broker selector and trading-mode indicator #96

Docs followed

Cross-referenced the official Binance Spot API docs (developers.binance.com + binance/binance-spot-api-docs on GitHub) for every endpoint shape, parameter, error code, and rate-limit behaviour. The HMAC implementation matches the reference vector from the docs (test_sign_matches_reference asserts the exact c8db5...6b71 digest from the published curl example).

Still out of scope for this PR

• WebSocket consumer thread + executionReport / outboundAccountPosition decoding - that's a separate PR once the broker selector in [ARCH] User-facing broker selector and trading-mode indicator #96 is wired up.
• The actual Settings-tab UI from [ARCH] User-facing broker selector and trading-mode indicator #96 (selector radio group, status-bar widget, mode-switch modal).
• Migration of legacy hard-coded Robinhood call sites to the abstraction layer.

This PR remains the Binance REST foundation; #96 will consume it.