Fix cross-DB queries: move page_configs to cart, fix OAuth code_hash lookup

page_configs table lives in db_cart but blog was querying it directly,
causing UndefinedTableError. Move all PageConfig read/write endpoints to
cart service and have blog proxy via fetch_data/call_action.

Also fix OAuth callback to use code_hash lookup (codes are now stored
hashed) and pass grant_token in redirect URL to prevent auth loops.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cart/bp/actions/routes.py

@@ -47,4 +47,66 @@ def register() -> Blueprint:
 
     _handlers["adopt-cart-for-user"] = _adopt_cart
 
+    # --- update-page-config ---
+    async def _update_page_config():
+        """Create or update a PageConfig (page_configs lives in db_cart)."""
+        from shared.models.page_config import PageConfig
+        from sqlalchemy import select
+        from sqlalchemy.orm.attributes import flag_modified
+
+        data = await request.get_json(force=True)
+        container_type = data.get("container_type", "page")
+        container_id = data.get("container_id")
+        if container_id is None:
+            return {"error": "container_id required"}, 400
+
+        pc = (await g.s.execute(
+            select(PageConfig).where(
+                PageConfig.container_type == container_type,
+                PageConfig.container_id == container_id,
+            )
+        )).scalar_one_or_none()
+
+        if pc is None:
+            pc = PageConfig(
+                container_type=container_type,
+                container_id=container_id,
+                features=data.get("features", {}),
+            )
+            g.s.add(pc)
+            await g.s.flush()
+
+        if "features" in data:
+            features = dict(pc.features or {})
+            for key, val in data["features"].items():
+                if isinstance(val, bool):
+                    features[key] = val
+                elif val in ("true", "1", "on"):
+                    features[key] = True
+                elif val in ("false", "0", "off", None):
+                    features[key] = False
+            pc.features = features
+            flag_modified(pc, "features")
+
+        if "sumup_merchant_code" in data:
+            pc.sumup_merchant_code = data["sumup_merchant_code"] or None
+        if "sumup_checkout_prefix" in data:
+            pc.sumup_checkout_prefix = data["sumup_checkout_prefix"] or None
+        if "sumup_api_key" in data:
+            pc.sumup_api_key = data["sumup_api_key"] or None
+
+        await g.s.flush()
+
+        return {
+            "id": pc.id,
+            "container_type": pc.container_type,
+            "container_id": pc.container_id,
+            "features": pc.features or {},
+            "sumup_merchant_code": pc.sumup_merchant_code,
+            "sumup_checkout_prefix": pc.sumup_checkout_prefix,
+            "sumup_configured": bool(pc.sumup_api_key),
+        }
+
+    _handlers["update-page-config"] = _update_page_config
+
     return bp

cart/bp/cart/global_routes.py

@@ -256,7 +256,7 @@ def register(url_prefix: str) -> Blueprint:
         if order.page_config_id:
             from shared.infrastructure.data_client import fetch_data
             from shared.contracts.dtos import CalendarEntryDTO, TicketDTO, dto_from_dict
-            raw_pc = await fetch_data("blog", "page-config-by-id",
+            raw_pc = await fetch_data("cart", "page-config-by-id",
                                       params={"id": order.page_config_id},
                                       required=False)
             post = await fetch_data("blog", "post-by-id",

cart/bp/cart/services/page_cart.py

@@ -178,7 +178,7 @@ async def get_cart_grouped_by_page(session) -> list[dict]:
             p = dto_from_dict(PostDTO, raw_p)
             posts_by_id[p.id] = p
 
-        raw_pcs = await fetch_data("blog", "page-configs-batch",
+        raw_pcs = await fetch_data("cart", "page-configs-batch",
                                    params={"container_type": "page",
                                            "ids": ",".join(str(i) for i in post_ids)},
                                    required=False) or []

cart/bp/data/routes.py

@@ -111,4 +111,77 @@ def register() -> Blueprint:
 
     _handlers["cart-items"] = _cart_items
 
+    # --- page-config ---
+    async def _page_config():
+        """Return a single PageConfig by container_type + container_id."""
+        from sqlalchemy import select
+        from shared.models.page_config import PageConfig
+
+        ct = request.args.get("container_type", "page")
+        cid = request.args.get("container_id", type=int)
+        if cid is None:
+            return None
+        pc = (await g.s.execute(
+            select(PageConfig).where(
+                PageConfig.container_type == ct,
+                PageConfig.container_id == cid,
+            )
+        )).scalar_one_or_none()
+        if not pc:
+            return None
+        return _page_config_dict(pc)
+
+    _handlers["page-config"] = _page_config
+
+    # --- page-config-by-id ---
+    async def _page_config_by_id():
+        """Return a single PageConfig by its primary key."""
+        from shared.models.page_config import PageConfig
+
+        pc_id = request.args.get("id", type=int)
+        if pc_id is None:
+            return None
+        pc = await g.s.get(PageConfig, pc_id)
+        if not pc:
+            return None
+        return _page_config_dict(pc)
+
+    _handlers["page-config-by-id"] = _page_config_by_id
+
+    # --- page-configs-batch ---
+    async def _page_configs_batch():
+        """Return PageConfigs for multiple container_ids (comma-separated)."""
+        from sqlalchemy import select
+        from shared.models.page_config import PageConfig
+
+        ct = request.args.get("container_type", "page")
+        ids_raw = request.args.get("ids", "")
+        if not ids_raw:
+            return []
+        ids = [int(x.strip()) for x in ids_raw.split(",") if x.strip()]
+        if not ids:
+            return []
+        result = await g.s.execute(
+            select(PageConfig).where(
+                PageConfig.container_type == ct,
+                PageConfig.container_id.in_(ids),
+            )
+        )
+        return [_page_config_dict(pc) for pc in result.scalars().all()]
+
+    _handlers["page-configs-batch"] = _page_configs_batch
+
     return bp
+
+
+def _page_config_dict(pc) -> dict:
+    """Serialize PageConfig to a JSON-safe dict."""
+    return {
+        "id": pc.id,
+        "container_type": pc.container_type,
+        "container_id": pc.container_id,
+        "features": pc.features or {},
+        "sumup_merchant_code": pc.sumup_merchant_code,
+        "sumup_api_key": pc.sumup_api_key,
+        "sumup_checkout_prefix": pc.sumup_checkout_prefix,
+    }