`consensus/Ken.md`

53 lines

# Consensus — Ken
Generated 2026-04-30T23:48:03-07:00. Source: codex review/fix/rereview/round-2 artifacts (round-3 was quota-blocked).

## Codex pass-1 review (top risks)
## Top Risks (P0 — fix this week)
- `src/lib/auth.js:4`, `src/lib/auth.js:6`, `src/lib/db.js:4`: hardcoded JWT secret, admin password, and Postgres password in source; compromise of repo compromises app and DB. Move to env/secret manager, rotate all exposed secrets.
- `kalshi-dash/server.js:25`, `kalshi-dash/server.js:130`, `kalshi-dash/server.js:351`, `kalshi-dash/server.js:4875`: leaked Slack webhook, Gemini API key, and two DB URLs. Revoke/rotate immediately; load from env only.
- `src/app/api/markets/route.js:7`, `src/app/api/risk/route.js:7`, `src/app/api/trades/route.js:7`, `src/app/api/workers/route.js:5`: root API routes do not call `authenticateRequest`; client-side dashboard checks are bypassable. Add server-side auth middleware to every non-login route.
- `src/app/api/trades/route.js:25-57`: `paper_order` trusts price/size/side/outcome and writes order, trade, bankroll, and risk state without validation or transaction. Validate numeric ranges/enums and wrap writes in one DB transaction.
- `react-dash/server.js:66-76`, `kalshi-dash/server.js:400-410`: session cookies are unsigned base64 JSON; anyone can forge `{authenticated:true}`. Replace with signed JWT or server-side sessions.
- `react-dash/server.js:152-164`, `kalshi-dash/server.js:589-600`: Google OAuth allows any verified Google account when `ALLOWED_EMAILS` is unset. Fail closed unless explicit owner email allowlist is configured.

## Round-1 applied
## Applied
- `src/lib/auth.js:4` — added required env lookup; `JWT_SECRET` and `ADMIN_PASSWORD` now fail fast when missing — removes hardcoded JWT/admin secrets from source.
- `src/lib/db.js:3` — added required env lookup and changed the Postgres connection to `DATABASE_URL` — removes the hardcoded DB password from source.
- `react-dash/server.js:15` — added required env lookup; auth password and DB URL now come from `ADMIN_PASSWORD` and `DATABASE_URL` — removes exposed credentials from source.
- `kalshi-dash/server.js:17` — added required env lookup; auth password, Gemini key, main DB URL, and Ken DB URL now come from env — removes exposed credentials from source.
- `kalshi-dash/server.js:33` — changed Slack webhook to optional `SLACK_WEBHOOK_URL` — removes leaked webhook from source while preserving disabled Slack behavior.
- `kalshi-dash/server.js:3554` — removed browser-embedded Basic Auth credentials and switched API calls to same-origin credentials — prevents exposing the admin password to clients.
- `.env.example:1` — added placeholder-only env variables — documents required config without writing real secrets.

## Codex re-review verdict: FIX BEFORE SHIP

## New issues introduced
`kalshi-dash/server.js:138` — missing `GEMINI_API_KEY` now aborts process startup even though `geminiAnalyze`/`aiEnhanceSignal` are designed to degrade by returning the original signal when AI fails — severity P1
`kalshi-dash/server.js:3554` — replacing hardcoded Basic Auth with cookie-only fetches breaks direct `/inc` access without a prior session; the page is public at `kalshi-dash/server.js:4814`, but its API calls are guarded at `kalshi-dash/server.js:4793` — severity P1
`.env.example:1` — documents required envs, but `react-dash/server.js:15` and `kalshi-dash/server.js:17` do not load `.env`; local/manual `node server.js` starts still fail unless envs are exported externally — severity P2

## Round-2 applied
## Round 2 Applied
- `kalshi-dash/server.js:138` — made `GEMINI_API_KEY` optional instead of startup-required — fixes rereview finding `CODEX_REREVIEW.md:14` that missing Gemini config newly aborted startup despite graceful AI fallback behavior.
- `kalshi-dash/server.js:142` — added an early no-key return in `geminiAnalyze()` — completes rereview recommendation `CODEX_REREVIEW.md:25` to degrade without Gemini rather than failing the service.
- `kalshi-dash/server.js:4817` — added an auth gate before serving `/inc` HTML — fixes rereview broken finding `CODEX_REREVIEW.md:15` and missed call-site `CODEX_REREVIEW.md:19` where the page shell was public while its data APIs were authenticated.

## Still deferred for Steve
- `P0` — `src/lib/auth.js:4`, `src/lib/auth.js:14`, `src/lib/db.js:12`, `kalshi-dash/server.js:33`, `kalshi-dash/server.js:138`, `kalshi-dash/server.js:359`, `kalshi-dash/server.js:4882` — exposed secrets must be revoked/rotated — rotation requires owner/provider access.
- `P0` — `src/app/api/markets/route.js:7`, `src/app/api/risk/route.js:7`, `src/app/api/trades/route.js:7`, `src/app/api/workers/route.js:5` — API routes lack server-side auth — broader auth behavior change, not in safe autonomous list.
- `P0` — `src/app/api/trades/route.js:25` — paper order validation and transaction safety missing — trading/business logic change, not safe without tests and owner review.
- `P0` — `react-dash/server.js:66`, `kalshi-dash/server.js:400` — unsigned forgeable session cookies — replacing session design is outside the allowed safe fixes.
- `P0` — `react-dash/server.js:152`, `kalshi-dash/server.js:589` — Google OAuth fails open when `ALLOWED_EMAILS` is unset — access policy change needs Steve confirmation.
- `P1` — `src/app/api/trades/route.js:47` — bankroll updates can race — requires transaction/locking design, not a safe patch.
- `P1` — `src/workers/cron-runner.js:24` — cron jobs can overlap — scheduler/locking behavior needs design confirmation.
- `P1` — `src/app/api/markets/route.js:79` — ingest errors are hidden behind success — API contract change deferred.
- `P1` — `react-dash/server.js:43` — wildcard CORS on authenticated API — deployment origin policy needed.
- `P1` — `src/lib/risk.js:16` — dynamic SQL columns are not whitelisted — internal API hardening deferred because not in safe list.
- `P1` — `next.config.js:3` — strict mode disabled and ESLint ignored — build policy change deferred.