`Ken/review.md`

37 lines

## Snapshot
- Weather/prediction-market trading dashboard and workers for Polymarket/Kalshi-style signals.
- Stack: JavaScript, Next.js 14, React/Vite, Node HTTP servers, PostgreSQL via `pg`.
- How it's run: pm2 for root Next app + cron worker; side dashboards via manual Node/Vite unclear.
- Status: stale: latest real source timestamp Mar 2026; no git repo.

## Top Risks (P0 — fix this week)
- `src/lib/auth.js:4`, `src/lib/auth.js:6`, `src/lib/db.js:4`: hardcoded JWT secret, admin password, and Postgres password in source; compromise of repo compromises app and DB. Move to env/secret manager, rotate all exposed secrets.
- `kalshi-dash/server.js:25`, `kalshi-dash/server.js:130`, `kalshi-dash/server.js:351`, `kalshi-dash/server.js:4875`: leaked Slack webhook, Gemini API key, and two DB URLs. Revoke/rotate immediately; load from env only.
- `src/app/api/markets/route.js:7`, `src/app/api/risk/route.js:7`, `src/app/api/trades/route.js:7`, `src/app/api/workers/route.js:5`: root API routes do not call `authenticateRequest`; client-side dashboard checks are bypassable. Add server-side auth middleware to every non-login route.
- `src/app/api/trades/route.js:25-57`: `paper_order` trusts price/size/side/outcome and writes order, trade, bankroll, and risk state without validation or transaction. Validate numeric ranges/enums and wrap writes in one DB transaction.
- `react-dash/server.js:66-76`, `kalshi-dash/server.js:400-410`: session cookies are unsigned base64 JSON; anyone can forge `{authenticated:true}`. Replace with signed JWT or server-side sessions.
- `react-dash/server.js:152-164`, `kalshi-dash/server.js:589-600`: Google OAuth allows any verified Google account when `ALLOWED_EMAILS` is unset. Fail closed unless explicit owner email allowlist is configured.

## Notable Issues (P1 — fix this month)
- `src/app/api/trades/route.js:47-54`, `src/app/api/trades/route.js:86-91`: bankroll updates read latest balance then insert new balance outside a lock; concurrent orders corrupt balances. Use serializable transaction or ledger-only derived balance.
- `src/workers/cron-runner.js:24-35`: cron jobs fire without overlap locks or awaiting prior runs; slow ingest/prediction jobs can run concurrently. Add advisory locks or in-process guards.
- `src/app/api/markets/route.js:79-88`: per-market ingest errors are logged then hidden behind a successful response. Return failed IDs/counts and alert on nonzero failures.
- `react-dash/server.js:43-45`, `react-dash/server.js:610-617`: wildcard CORS on authenticated API server. Restrict origins; include credentials policy intentionally.
- `src/lib/risk.js:16-24`: dynamic SQL column names from object keys are not whitelisted. Currently internal, but unsafe if reused; restrict allowed columns.
- `next.config.js:3-4`: React strict mode disabled and ESLint ignored during builds. This lets regressions ship silently; re-enable after fixing current violations.
- Tests: none observed.

## Polish (P2 — when convenient)
- `.gitignore:1`: only ignores `node_modules`; add `.env*`, build outputs, logs, `.DS_Store`.
- `ecosystem.config.js:7`, `ecosystem.config.js:19`: hardcoded `/root/Projects/Bertha` does not match current project path/name. Make cwd deploy-specific or document it.
- `kalshi-dash/server.js`: 9k-line mixed server, scraper, auth, trading brain, and static server is a maintainability hazard. Split by route/domain before further feature work.

## Strengths
- SQL values are generally parameterized, reducing obvious SQL injection in normal query paths.
- Risk controls exist conceptually: kill switch, paper mode, exposure, drawdown, daily loss.
- Cron/process separation via pm2 is a reasonable deployment shape for a solo-operated service.

## Open questions for the owner
- Is any of this internet-exposed, especially ports `7800`, `7809`, or `7810`?
- Are Kalshi/Polymarket credentials in `risk_state.config` live production keys?
- Which dashboard is canonical: root Next, `react-dash`, or `kalshi-dash`?