Enforce allow-list schema for account preferences write (BFP-4644)

.apigen-state

@@ -1,9 +1,9 @@
 {
   "version": "1",
   "algorithm": "sha256",
-  "generated_at": "2026-03-26T16:48:24.691481Z",
+  "generated_at": "2026-07-03T00:00:00.000000Z",
   "spec_files": {
-    "resources/account-data-api.yaml": "9739df11b0d8c26bc3eea5135e524b7e1ade4192867569896a817bed380aaff0",
+    "resources/account-data-api.yaml": "ca145d50d48e0f3709130af89cf0feb3416c36adbd54b5ad40740f55217f94af",
     "resources/auth-api.yaml": "01e54ca1a13d2d6307e0d3a9ea38f816902521e7c85998f0f21a1353cc54fb76",
     "resources/bluefin-api.yaml": "fa46dd3fa556baa1d81567b9d21ea81e948dd0e596bfdc368e0eb1e8fdad3fe1",
     "resources/common.yaml": "71dc565fccebcc9e71b49b48448d2583903aec7e2d16ef1d69972b50f2e4250f",
@@ -14,5 +14,5 @@
     "resources/vera-api.yaml": "f4c51b5f6614dd4e3b9f5f1f01f945e06d9090849530ecb916ad4ae18d8f61a0",
     "resources/websocket-api.yaml": "c2c51ceea701bff0b7e911e9afdb0addeb4d7f173b2a25b996d13f5462cb535b"
   },
-  "combined_hash": "f62934225656afb7209eb2f7582f9a72120d1cee6149c4fa6c1b1dcd2e772fcb"
+  "combined_hash": "4cd30de0eebb653543aed47a5a8f1167f29f0fee206b25065ff2f44146c91f59"
 }

python/sdk/config.yaml

@@ -2,4 +2,4 @@ additionalProperties:
   library: asyncio
   generateSourceCodeOnly: true
   useOneOfDiscriminatorLookup: true
-  packageVersion: 1.17.0
+  packageVersion: 1.18.0

python/sdk/pyproject.toml

@@ -21,7 +21,7 @@ description = "Python Boilerplate contains all the boilerplate you need to creat
 name = "bluefin_pro_sdk"
 readme = "README.rst"
 requires-python = ">=3.9.2,<3.14.0"
-version = "1.17.0"
+version = "1.18.0"
 
 [[project.authors]]
 email = "audreyr@example.com"

resources/account-data-api.yaml

@@ -359,20 +359,36 @@ components:
 
     UpdateAccountPreferenceRequest:
       type: object
-      additionalProperties: true
+      # Strict allow-list: unknown fields are rejected with 400 (mass-assignment fix).
+      # This is a full replace - always send the complete object.
+      additionalProperties: false
       properties:
-        language:
-          type: string
-          description: User preferred language.
-          example: en
-        theme:
-          type: string
-          description: User preferred theme.
-          example: dark
-        market:
+        favorites:
           type: array
           items:
-            $ref: "#/components/schemas/AccountMarketPreference"
+            type: string
+          description: |
+            Favorite market symbols. Send the full array each time;
+            to remove a favorite, send the array without it.
+          example:
+            - BTC-PERP
+            - SUI-PERP
+        functionBarMode:
+          type: string
+          enum:
+            - all
+            - Popular
+            - Favorites
+          description: |
+            Function bar display mode. Note the mixed casing: `all` is
+            lowercase while `Popular` and `Favorites` are capitalized.
+          example: Favorites
+        onboardingCompleted:
+          type: boolean
+          description: Whether the user has completed onboarding.
+        termsAccepted:
+          type: boolean
+          description: Whether the user has accepted the terms of service.
 
     AccountPreference:
       type: object

rust/Cargo.toml

@@ -9,7 +9,7 @@ sha2 = "0.10.9"
 
 [dependencies.bluefin_api]
 path = "gen/bluefin_api"
-version = "1.17.0"
+version = "1.18.0"
 
 [dependencies.ed25519-dalek]
 features = ["rand_core"]
@@ -93,7 +93,7 @@ keywords = [
 license = "Unlicense"
 name = "bluefin-pro"
 repository = "https://github.com/fireflyprotocol/pro-sdk"
-version = "1.17.0"
+version = "1.18.0"
 
 [workspace]
 members = [

rust/examples/account-preferences.rs

@@ -1,5 +1,6 @@
 use bluefin_api::apis::account_data_api::{get_account_preferences, put_account_preferences};
 use bluefin_api::apis::configuration::Configuration;
+use bluefin_api::models::update_account_preference_request::FunctionBarMode;
 use bluefin_api::models::LoginRequest;
 use bluefin_api::models::{AccountPreference, UpdateAccountPreferenceRequest};
 use bluefin_pro::prelude::*;
@@ -62,10 +63,12 @@ async fn main() -> Result<()> {
     println!("{account:#?}");
 
     println!("Updating preferences...");
+    // Full replace: always send the complete object. Unknown fields are rejected with 400.
     let preference = UpdateAccountPreferenceRequest {
-        language: Some("en".into()),
-        theme: Some("dark".into()),
-        market: None,
+        favorites: Some(vec!["BTC-PERP".into(), "SUI-PERP".into()]),
+        function_bar_mode: Some(FunctionBarMode::Favorites),
+        onboarding_completed: Some(true),
+        terms_accepted: Some(true),
     };
     send_update_request(&auth_token, preference).await?;
 

ts/sdk/package.json

@@ -56,5 +56,5 @@
     "prepare": "npm run build"
   },
   "types": "./dist/index.d.ts",
-  "version": "2.0.0"
+  "version": "2.1.0"
 }