8 Commits

Include renames

Author	SHA1	Message	Date
asepharyana	05a3bc7471	fix: audit round 4 — XSS in HTML report export, SSRF webhook guard, body limit ... - ToHTML() now html.EscapeString on ticker, generated_at, section name/body, citations (stored/LLM content can't inject script into exported file) - Discord destination webhook_url restricted to discord.com/discordapp.com hosts (SSRF guard: server POSTs alert cards; no private IPs or arbitrary hosts) - Router middleware caps POST/PUT/PATCH bodies at 1 MiB (MaxBytesReader) - TestDestinations updated: non-discord host must 422, uses realistic discord.com webhook URL	2026-09-16 14:43:56 +07:00
asepharyana	1ec860f9be	fix: audit round 3 — IDOR report-scoping, auth rate-limit, briefing chat scoping, DailyVolumes dedup, N+1 list routines, FE export/ask error handling ... - IDOR: interrogate without report_id now scoped to user_key (LatestReportForUser); regression test TestInterrogateIDORScoped - auth: signup/login per-IP rate limit 10/60s (new internal/api/ratelimit.go) + test - chat unscoped grounding: build caller's own briefing instead of global LatestBriefing - DailyVolumes: dedupe by bar date (snapshot rows hold 30-day windows) — fixes volume-anomaly skew - GetDestination: direct (id,user_key) query instead of listing all - ListRoutines: single LastRunsByRoutine query instead of N+1 RunHistory - FE: exportMd/ask/HTML/PDF export now surface errors; alerts create clears channels	2026-09-16 14:12:32 +07:00
asepharyana	07ece10474	fix: audit round 2 — session cookie Secure kondisional, logout clear cookie, IDOR report owner-scoping (migrasi 0008), health force login-gate, SSE stream login-gate, FE: Gate undefined-flicker, auth-expired global redirect, X-User-Key demo dihapus, error handling alerts/routines/watchlist, chart label, encodeURIComponent, Screener onMount	2026-09-15 23:19:56 +07:00
asepharyana	96be4d0922	fix: version commit dibaca live per-request + CI polling anti-stale 20x15s	2026-09-15 22:19:53 +07:00
asepharyana	79f42dfefa	feat: default watchlist semua, login-gate fitur, CI anti-stale via /api/version	2026-09-15 22:12:09 +07:00
asepharyana	1881e7c6b1	feat: Google OAuth login + server sessions (user_key u:<sub>)	2026-09-15 16:29:57 +07:00
asepharyana	21e8568108	feat: CI + Nix deploy + prod sectors-hackaton.asepharyana.my.id ... - Backend serve web dist (WEB_DIST_DIR + SPA fallback, /api 404 JSON) - flake.nix: single flowsight derivation (go 1.25 + pnpm build) - deploy/flowsight.service: systemd on :4022 via bws-exec - .github/workflows/ci.yml: go test + tsc gate, nix build, attic, SSH deploy	2026-09-15 14:45:23 +07:00
asepharyana	8c184ccae1	feat: add Citations and WatchlistChat components, integrate with API ... - Implemented Citations component to display citation data. - Created WatchlistDrawer and ChatSidebar components for managing watchlists and AI chat functionality. - Integrated API calls for watchlist management and chat interactions. - Updated index.tsx to include new components in the main application layout. - Added API client in lib/api.ts for structured API interactions. - Developed Alerts, Dashboard, Portfolio, Routines, Screener, and Report pages with relevant data fetching and UI components. - Introduced styles in tokens.css for consistent theming across the application. - Configured TypeScript and Vite for project setup and development.	2026-09-15 12:36:48 +07:00