fix: audit round 2 — session cookie Secure kondisional, logout clear cookie, IDOR report owner-scoping (migrasi 0008), health force login-gate, SSE stream login-gate, FE: Gate undefined-flicker, auth-expired global redirect, X-User-Key demo dihapus, error handling alerts/routines/watchlist, chart label, encodeURIComponent, Screener onMount

2026-09-15 23:19:56 +07:00
parent 96be4d0922
commit 07ece10474
24 changed files with 160 additions and 91 deletions
@@ -81,23 +81,23 @@ func Load() Config {
 		}
 	}
 	return Config{
-		Port:              getenv("PORT", "8080"),
-		SectorsAPIKey:     os.Getenv("SECTORS_API_KEY"),
-		SectorsBaseURL:    getenv("SECTORS_BASE_URL", "https://api.sectors.app/v2/"),
-		DBPath:            getenv("DB_PATH", "data/flowsight.db"),
-		RedisURL:          os.Getenv("REDIS_URL"),
-		DemoUserKey:       getenv("DEMO_USER_KEY", "demo"),
-		LLMBaseURL:        os.Getenv("LLM_BASE_URL"),
-		LLMAPIKey:         os.Getenv("LLM_API_KEY"),
-		LLMTriage:         getenv("LLM_MODEL_TRIAGE", "gpt-4o-mini"),
-		LLMSynth:          getenv("LLM_MODEL_SYNTH", "gpt-4o"),
-		TelegramBotToken:  os.Getenv("TELEGRAM_BOT_TOKEN"),
-		TelegramChatID:    os.Getenv("TELEGRAM_CHAT_ID"),
-		DiscordWebhookURL: os.Getenv("DISCORD_WEBHOOK_URL"),
-		CreditCapPerCycle: getenvInt("CREDIT_CAP_PER_CYCLE", 120),
-		Watchlist:         tickers,
-		StaticDir:         os.Getenv("WEB_DIST_DIR"),
-		GoogleClientID:    os.Getenv("GOOGLE_CLIENT_ID"),
+		Port:               getenv("PORT", "8080"),
+		SectorsAPIKey:      os.Getenv("SECTORS_API_KEY"),
+		SectorsBaseURL:     getenv("SECTORS_BASE_URL", "https://api.sectors.app/v2/"),
+		DBPath:             getenv("DB_PATH", "data/flowsight.db"),
+		RedisURL:           os.Getenv("REDIS_URL"),
+		DemoUserKey:        getenv("DEMO_USER_KEY", "demo"),
+		LLMBaseURL:         os.Getenv("LLM_BASE_URL"),
+		LLMAPIKey:          os.Getenv("LLM_API_KEY"),
+		LLMTriage:          getenv("LLM_MODEL_TRIAGE", "gpt-4o-mini"),
+		LLMSynth:           getenv("LLM_MODEL_SYNTH", "gpt-4o"),
+		TelegramBotToken:   os.Getenv("TELEGRAM_BOT_TOKEN"),
+		TelegramChatID:     os.Getenv("TELEGRAM_CHAT_ID"),
+		DiscordWebhookURL:  os.Getenv("DISCORD_WEBHOOK_URL"),
+		CreditCapPerCycle:  getenvInt("CREDIT_CAP_PER_CYCLE", 120),
+		Watchlist:          tickers,
+		StaticDir:          os.Getenv("WEB_DIST_DIR"),
+		GoogleClientID:     os.Getenv("GOOGLE_CLIENT_ID"),
 		GoogleClientSecret: os.Getenv("GOOGLE_CLIENT_SECRET"),
 		GoogleRedirectURL:  os.Getenv("GOOGLE_REDIRECT_URL"),
 	}