# iTelescope API + Console

A small FastAPI wrapper over the iTelescope.net member portal, plus a web GUI on
top of it. Credentials come from a `.env` file - nothing is hard-coded.

## What it exposes (all read-only)

| Endpoint | What |
|---|---|
| `GET /api/health` | is it configured, known site codes |
| `GET /api/account` | points balance, plan, renewal, membership |
| `GET /api/plans` | per-scope access discount for the current plan |
| `GET /api/telescopes` | the telescope roster (from `../data/itelescope-telescopes.csv`) |
| `GET /api/weather` | safe/unsafe state for all six observatory sites |
| `GET /api/weather/{site}` | one site (SSO, UDRO, DSC, SRO, AC, EYE) |
| `GET /api/scope/{tid}/status` | reachability of a scope's own ACP control server |
| `GET /api/reservations` | legacy reservation grid + pointer to the live system |
| `GET /api/raw?path=...` | escape hatch: fetch any portal path (read-only) |

The GUI dashboard is at `/`; interactive OpenAPI docs at `/docs`.

## Run

```bash
cd api
python -m pip install -r requirements.txt
cp .env.example .env          # then edit .env with your username/password
uvicorn main:app --reload
# open http://127.0.0.1:8000/
```

## Deliberate omissions

- **Booking is not exposed.** Reservations spend real points, and the live
  booking system (`lookup.itelescope.online`) is Cloudflare-protected and needs a
  browser session. If booking is ever added it must sit behind an explicit,
  confirmed action - see the drain campaign policy in `../CAMPAIGN.md`.
- Session cookies live only in memory for the running process.

## Notes

- Auth is the portal's WebForms login (viewstate POST) captured in
  `itelescope_client.py`; the session re-authenticates automatically if it expires.
- `DataService.svc` methods are WCF (HTTP GET, JSON under a `d` key).