Decouple all cross-app service calls to HTTP endpoints

Replace every direct cross-app services.* call with HTTP-based
communication: call_action() for writes, fetch_data() for reads.
Each app now registers only its own domain service.

Infrastructure:
- shared/infrastructure/actions.py — POST client for /internal/actions/
- shared/infrastructure/data_client.py — GET client for /internal/data/
- shared/contracts/dtos.py — dto_to_dict/dto_from_dict serialization

Action endpoints (writes):
- events: 8 handlers (ticket adjust, claim/confirm, toggle, adopt)
- market: 2 handlers (create/soft-delete marketplace)
- cart: 1 handler (adopt cart for user)

Data endpoints (reads):
- blog: 4 (post-by-slug/id, posts-by-ids, search-posts)
- events: 10 (pending entries/tickets, entries/tickets for page/order,
  entry-ids, associated-entries, calendars, visible-entries-for-period)
- market: 1 (marketplaces-for-container)
- cart: 1 (cart-summary)

Service registration cleanup:
- blog→blog+federation, events→calendar+federation,
  market→market+federation, cart→cart only,
  federation→federation only, account→nothing
- Stubs reduced to minimal StubFederationService

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cart/app.py

@@ -16,6 +16,8 @@ from bp import (
     register_cart_global,
     register_orders,
     register_fragments,
+    register_actions,
+    register_data,
 )
 from bp.cart.services import (
     get_cart,
@@ -135,6 +137,8 @@ def create_app() -> "Quart":
     app.jinja_env.globals["cart_delete_url"] = lambda product_id: f"/delete/{product_id}/"
 
     app.register_blueprint(register_fragments())
+    app.register_blueprint(register_actions())
+    app.register_blueprint(register_data())
 
     # --- Page slug hydration (follows events/market app pattern) ---
 
@@ -152,10 +156,15 @@ def create_app() -> "Quart":
 
     @app.before_request
     async def hydrate_page():
+        from shared.infrastructure.data_client import fetch_data
+        from shared.contracts.dtos import PostDTO, dto_from_dict
         slug = getattr(g, "page_slug", None)
         if not slug:
             return
-        post = await services.blog.get_post_by_slug(g.s, slug)
+        raw = await fetch_data("blog", "post-by-slug", params={"slug": slug})
+        if not raw:
+            abort(404)
+        post = dto_from_dict(PostDTO, raw)
         if not post or not post.is_page:
             abort(404)
         g.page_post = post

cart/bp/__init__.py

@@ -4,3 +4,5 @@ from .cart.global_routes import register as register_cart_global
 from .order.routes import register as register_order
 from .orders.routes import register as register_orders
 from .fragments import register_fragments
+from .actions import register_actions
+from .data import register_data

cart/bp/actions/__init__.py

@@ -0,0 +1 @@
+from .routes import register as register_actions

cart/bp/actions/routes.py

@@ -0,0 +1,42 @@
+"""Cart app action endpoints.
+
+Exposes write operations at ``/internal/actions/<action_name>`` for
+cross-app callers (login handler) via the internal action client.
+"""
+from __future__ import annotations
+
+from quart import Blueprint, g, jsonify, request
+
+from shared.infrastructure.actions import ACTION_HEADER
+from shared.services.registry import services
+
+
+def register() -> Blueprint:
+    bp = Blueprint("actions", __name__, url_prefix="/internal/actions")
+
+    @bp.before_request
+    async def _require_action_header():
+        if not request.headers.get(ACTION_HEADER):
+            return jsonify({"error": "forbidden"}), 403
+
+    _handlers: dict[str, object] = {}
+
+    @bp.post("/<action_name>")
+    async def handle_action(action_name: str):
+        handler = _handlers.get(action_name)
+        if handler is None:
+            return jsonify({"error": "unknown action"}), 404
+        result = await handler()
+        return jsonify(result)
+
+    # --- adopt-cart-for-user ---
+    async def _adopt_cart():
+        data = await request.get_json()
+        await services.cart.adopt_cart_for_user(
+            g.s, data["user_id"], data["session_id"],
+        )
+        return {"ok": True}
+
+    _handlers["adopt-cart-for-user"] = _adopt_cart
+
+    return bp

cart/bp/cart/global_routes.py

@@ -8,7 +8,7 @@ from sqlalchemy import select
 from shared.models.market import CartItem
 from shared.models.order import Order
 from shared.models.market_place import MarketPlace
-from shared.services.registry import services
+from shared.infrastructure.actions import call_action
 from .services import (
     current_cart_identity,
     get_cart,
@@ -91,13 +91,12 @@ def register(url_prefix: str) -> Blueprint:
         tt_raw = (form.get("ticket_type_id") or "").strip()
         ticket_type_id = int(tt_raw) if tt_raw else None
 
-        await services.calendar.adjust_ticket_quantity(
-            g.s, entry_id, count,
-            user_id=ident["user_id"],
-            session_id=ident["session_id"],
-            ticket_type_id=ticket_type_id,
-        )
-        await g.s.flush()
+        await call_action("events", "adjust-ticket-quantity", payload={
+            "entry_id": entry_id, "count": count,
+            "user_id": ident["user_id"],
+            "session_id": ident["session_id"],
+            "ticket_type_id": ticket_type_id,
+        })
 
         resp = await make_response("", 200)
         resp.headers["HX-Refresh"] = "true"
@@ -256,13 +255,17 @@ def register(url_prefix: str) -> Blueprint:
 
         # Resolve page/market slugs so product links render correctly
         if order.page_config:
-            post = await services.blog.get_post_by_id(g.s, order.page_config.container_id)
+            from shared.infrastructure.data_client import fetch_data
+            from shared.contracts.dtos import CalendarEntryDTO, TicketDTO, dto_from_dict
+            post = await fetch_data("blog", "post-by-id",
+                                    params={"id": order.page_config.container_id},
+                                    required=False)
             if post:
-                g.page_slug = post.slug
+                g.page_slug = post["slug"]
                 result = await g.s.execute(
                     select(MarketPlace).where(
                         MarketPlace.container_type == "page",
-                        MarketPlace.container_id == post.id,
+                        MarketPlace.container_id == post["id"],
                         MarketPlace.deleted_at.is_(None),
                     ).limit(1)
                 )
@@ -278,8 +281,14 @@ def register(url_prefix: str) -> Blueprint:
 
         status = (order.status or "pending").lower()
 
-        calendar_entries = await services.calendar.get_entries_for_order(g.s, order.id)
-        order_tickets = await services.calendar.get_tickets_for_order(g.s, order.id)
+        from shared.infrastructure.data_client import fetch_data
+        from shared.contracts.dtos import CalendarEntryDTO, TicketDTO, dto_from_dict
+        raw_entries = await fetch_data("events", "entries-for-order",
+                                       params={"order_id": order.id}, required=False) or []
+        calendar_entries = [dto_from_dict(CalendarEntryDTO, e) for e in raw_entries]
+        raw_tickets = await fetch_data("events", "tickets-for-order",
+                                       params={"order_id": order.id}, required=False) or []
+        order_tickets = [dto_from_dict(TicketDTO, t) for t in raw_tickets]
         await g.s.flush()
 
         html = await render_template(

cart/bp/cart/services/calendar_cart.py

@@ -2,7 +2,8 @@ from __future__ import annotations
 
 from decimal import Decimal
 
-from shared.services.registry import services
+from shared.infrastructure.data_client import fetch_data
+from shared.contracts.dtos import CalendarEntryDTO, TicketDTO, dto_from_dict
 from .identity import current_cart_identity
 
 
@@ -12,11 +13,13 @@ async def get_calendar_cart_entries(session):
     current cart identity (user or anonymous session).
     """
     ident = current_cart_identity()
-    return await services.calendar.pending_entries(
-        session,
-        user_id=ident["user_id"],
-        session_id=ident["session_id"],
-    )
+    params = {}
+    if ident["user_id"] is not None:
+        params["user_id"] = ident["user_id"]
+    if ident["session_id"] is not None:
+        params["session_id"] = ident["session_id"]
+    raw = await fetch_data("events", "pending-entries", params=params, required=False) or []
+    return [dto_from_dict(CalendarEntryDTO, e) for e in raw]
 
 
 def calendar_total(entries) -> Decimal:
@@ -33,11 +36,13 @@ def calendar_total(entries) -> Decimal:
 async def get_ticket_cart_entries(session):
     """Return all reserved tickets (as TicketDTOs) for the current identity."""
     ident = current_cart_identity()
-    return await services.calendar.pending_tickets(
-        session,
-        user_id=ident["user_id"],
-        session_id=ident["session_id"],
-    )
+    params = {}
+    if ident["user_id"] is not None:
+        params["user_id"] = ident["user_id"]
+    if ident["session_id"] is not None:
+        params["session_id"] = ident["session_id"]
+    raw = await fetch_data("events", "pending-tickets", params=params, required=False) or []
+    return [dto_from_dict(TicketDTO, t) for t in raw]
 
 
 def ticket_total(tickets) -> Decimal:

cart/bp/cart/services/check_sumup_status.py

@@ -1,6 +1,6 @@
 from shared.browser.app.payments.sumup import get_checkout as sumup_get_checkout
 from shared.events import emit_activity
-from shared.services.registry import services
+from shared.infrastructure.actions import call_action
 from .clear_cart_for_order import clear_cart_for_order
 
 
@@ -14,10 +14,13 @@ async def check_sumup_status(session, order):
     if sumup_status == "PAID":
         if order.status != "paid":
             order.status = "paid"
-            await services.calendar.confirm_entries_for_order(
-                session, order.id, order.user_id, order.session_id
-            )
-            await services.calendar.confirm_tickets_for_order(session, order.id)
+            await call_action("events", "confirm-entries-for-order", payload={
+                "order_id": order.id, "user_id": order.user_id,
+                "session_id": order.session_id,
+            })
+            await call_action("events", "confirm-tickets-for-order", payload={
+                "order_id": order.id,
+            })
 
             # Clear cart only after payment is confirmed
             page_post_id = page_config.container_id if page_config else None

cart/bp/cart/services/checkout.py

@@ -14,7 +14,7 @@ from shared.models.market_place import MarketPlace
 from shared.config import config
 from shared.contracts.dtos import CalendarEntryDTO
 from shared.events import emit_activity
-from shared.services.registry import services
+from shared.infrastructure.actions import call_action
 
 
 async def find_or_create_cart_item(
@@ -156,15 +156,17 @@ async def create_order_from_cart(
         )
         session.add(oi)
 
-    # Mark pending calendar entries as "ordered" via calendar service
-    await services.calendar.claim_entries_for_order(
-        session, order.id, user_id, session_id, page_post_id
-    )
+    # Mark pending calendar entries as "ordered" via events action endpoint
+    await call_action("events", "claim-entries-for-order", payload={
+        "order_id": order.id, "user_id": user_id,
+        "session_id": session_id, "page_post_id": page_post_id,
+    })
 
     # Claim reserved tickets for this order
-    await services.calendar.claim_tickets_for_order(
-        session, order.id, user_id, session_id, page_post_id
-    )
+    await call_action("events", "claim-tickets-for-order", payload={
+        "order_id": order.id, "user_id": user_id,
+        "session_id": session_id, "page_post_id": page_post_id,
+    })
 
     await emit_activity(
         session,

cart/bp/cart/services/page_cart.py

@@ -15,7 +15,8 @@ from sqlalchemy.orm import selectinload
 from shared.models.market import CartItem
 from shared.models.market_place import MarketPlace
 from shared.models.page_config import PageConfig
-from shared.services.registry import services
+from shared.infrastructure.data_client import fetch_data
+from shared.contracts.dtos import CalendarEntryDTO, TicketDTO, PostDTO, dto_from_dict
 from .identity import current_cart_identity
 
 
@@ -50,21 +51,25 @@ async def get_cart_for_page(session, post_id: int) -> list[CartItem]:
 async def get_calendar_entries_for_page(session, post_id: int):
     """Return pending calendar entries (DTOs) scoped to a specific page."""
     ident = current_cart_identity()
-    return await services.calendar.entries_for_page(
-        session, post_id,
-        user_id=ident["user_id"],
-        session_id=ident["session_id"],
-    )
+    params = {"page_id": post_id}
+    if ident["user_id"] is not None:
+        params["user_id"] = ident["user_id"]
+    if ident["session_id"] is not None:
+        params["session_id"] = ident["session_id"]
+    raw = await fetch_data("events", "entries-for-page", params=params, required=False) or []
+    return [dto_from_dict(CalendarEntryDTO, e) for e in raw]
 
 
 async def get_tickets_for_page(session, post_id: int):
     """Return reserved tickets (DTOs) scoped to a specific page."""
     ident = current_cart_identity()
-    return await services.calendar.tickets_for_page(
-        session, post_id,
-        user_id=ident["user_id"],
-        session_id=ident["session_id"],
-    )
+    params = {"page_id": post_id}
+    if ident["user_id"] is not None:
+        params["user_id"] = ident["user_id"]
+    if ident["session_id"] is not None:
+        params["session_id"] = ident["session_id"]
+    raw = await fetch_data("events", "tickets-for-page", params=params, required=False) or []
+    return [dto_from_dict(TicketDTO, t) for t in raw]
 
 
 async def get_cart_grouped_by_page(session) -> list[dict]:
@@ -167,7 +172,11 @@ async def get_cart_grouped_by_page(session) -> list[dict]:
     configs_by_post: dict[int, PageConfig] = {}
 
     if post_ids:
-        for p in await services.blog.get_posts_by_ids(session, post_ids):
+        raw_posts = await fetch_data("blog", "posts-by-ids",
+                                     params={"ids": ",".join(str(i) for i in post_ids)},
+                                     required=False) or []
+        for raw_p in raw_posts:
+            p = dto_from_dict(PostDTO, raw_p)
             posts_by_id[p.id] = p
 
         pc_result = await session.execute(

cart/bp/data/__init__.py

@@ -0,0 +1 @@
+from .routes import register as register_data

cart/bp/data/routes.py

@@ -0,0 +1,45 @@
+"""Cart app data endpoints.
+
+Exposes read-only JSON queries at ``/internal/data/<query_name>`` for
+cross-app callers via the internal data client.
+"""
+from __future__ import annotations
+
+from quart import Blueprint, g, jsonify, request
+
+from shared.infrastructure.data_client import DATA_HEADER
+from shared.contracts.dtos import dto_to_dict
+from shared.services.registry import services
+
+
+def register() -> Blueprint:
+    bp = Blueprint("data", __name__, url_prefix="/internal/data")
+
+    @bp.before_request
+    async def _require_data_header():
+        if not request.headers.get(DATA_HEADER):
+            return jsonify({"error": "forbidden"}), 403
+
+    _handlers: dict[str, object] = {}
+
+    @bp.get("/<query_name>")
+    async def handle_query(query_name: str):
+        handler = _handlers.get(query_name)
+        if handler is None:
+            return jsonify({"error": "unknown query"}), 404
+        result = await handler()
+        return jsonify(result)
+
+    # --- cart-summary ---
+    async def _cart_summary():
+        user_id = request.args.get("user_id", type=int)
+        session_id = request.args.get("session_id")
+        page_slug = request.args.get("page_slug")
+        summary = await services.cart.cart_summary(
+            g.s, user_id=user_id, session_id=session_id, page_slug=page_slug,
+        )
+        return dto_to_dict(summary)
+
+    _handlers["cart-summary"] = _cart_summary
+
+    return bp

cart/services/__init__.py

@@ -6,23 +6,9 @@ def register_domain_services() -> None:
     """Register services for the cart app.
 
     Cart owns: Order, OrderItem.
-    Standard deployment registers all 4 services as real DB impls
-    (shared DB). For composable deployments, swap non-owned services
-    with stubs from shared.services.stubs.
+    Cross-app calls go over HTTP via call_action() / fetch_data().
     """
     from shared.services.registry import services
-    from shared.services.blog_impl import SqlBlogService
-    from shared.services.calendar_impl import SqlCalendarService
-    from shared.services.market_impl import SqlMarketService
     from shared.services.cart_impl import SqlCartService
 
     services.cart = SqlCartService()
-    if not services.has("blog"):
-        services.blog = SqlBlogService()
-    if not services.has("calendar"):
-        services.calendar = SqlCalendarService()
-    if not services.has("market"):
-        services.market = SqlMarketService()
-    if not services.has("federation"):
-        from shared.services.federation_impl import SqlFederationService
-        services.federation = SqlFederationService()