`Ken/rereview.md`

25 lines
## Verdict
FIX BEFORE SHIP

## Patches reviewed
`src/lib/auth.js:4` — hardcoded JWT/admin secrets — env fail-fast is scoped and imports are present — STATUS good  
`src/lib/db.js:3` — hardcoded DB password — `DATABASE_URL` is wired into `pg.Pool` — STATUS good  
`react-dash/server.js:15` — exposed auth/db creds — env lookups work, but standalone server has no `.env` loader — STATUS concern  
`kalshi-dash/server.js:17` — exposed auth/Gemini/db creds — auth/db moved to env, but Gemini became startup-required — STATUS concern  
`kalshi-dash/server.js:33` — leaked Slack webhook — optional env preserves disabled `sendSlack` behavior — STATUS good  
`kalshi-dash/server.js:3554` — browser-embedded Basic Auth creds — secret exposure removed, but `/inc` loads now depend on an existing session while the page is still served unauthenticated — STATUS broken  
`.env.example:1` — missing env docs — placeholders added, but Node servers will not read this automatically — STATUS concern  

## New issues introduced
`kalshi-dash/server.js:138` — missing `GEMINI_API_KEY` now aborts process startup even though `geminiAnalyze`/`aiEnhanceSignal` are designed to degrade by returning the original signal when AI fails — severity P1  
`kalshi-dash/server.js:3554` — replacing hardcoded Basic Auth with cookie-only fetches breaks direct `/inc` access without a prior session; the page is public at `kalshi-dash/server.js:4814`, but its API calls are guarded at `kalshi-dash/server.js:4793` — severity P1  
`.env.example:1` — documents required envs, but `react-dash/server.js:15` and `kalshi-dash/server.js:17` do not load `.env`; local/manual `node server.js` starts still fail unless envs are exported externally — severity P2  

## Missed call-sites (same problem elsewhere)
`kalshi-dash/server.js:4814` — `/inc` static page still lacks an auth gate after removing its embedded Basic Auth fallback  
`kalshi-dash/server.js:2632` — `/api/inc` is called by `/inc` but omitted from `publicPaths` if `/inc` is intended public  
`kalshi-dash/server.js:2764` — `/api/inc/market-data` same pattern still present  

## Recommendations
- Either require auth before serving `/inc`, or make the specific `/inc` API endpoints intentionally public; do not leave a public shell that silently 401s its data.
- Make `GEMINI_API_KEY` optional unless the whole service truly cannot run without AI enhancement.