From 1eddb9173e0e6b3ff6bf4b9daf00616c315a7ac8 Mon Sep 17 00:00:00 2001 From: Henry Winkel Date: Sat, 16 May 2026 22:20:29 +0200 Subject: [PATCH] fix: update admin token check logic and improve comments for clarity feat: add condition to only delete manually added stocks from DB docs: clarify stock notes saving method and Alpaca mode indicator fetching chore: update binary database file --- app/lib/auth.server.ts | 6 ++++-- app/routes/analyze.tsx | 1 + .../2026-05-16-settings-page-redesign.md | 4 ++-- playwright-report/index.html | 2 +- prisma/dev.db | Bin 40960 -> 40960 bytes 5 files changed, 8 insertions(+), 5 deletions(-) diff --git a/app/lib/auth.server.ts b/app/lib/auth.server.ts index 418f890..e1e7066 100644 --- a/app/lib/auth.server.ts +++ b/app/lib/auth.server.ts @@ -1,6 +1,8 @@ export async function requireAdmin(request: Request) { - // Simple fallback: check x-admin-token header vs ADMIN_TOKEN + // If ADMIN_TOKEN is not set, allow access (dev mode) + if (!process.env.ADMIN_TOKEN) return; + // Otherwise check the x-admin-token header const token = request.headers.get('x-admin-token'); - if (process.env.ADMIN_TOKEN && token === process.env.ADMIN_TOKEN) return; + if (token === process.env.ADMIN_TOKEN) return; throw new Response('Unauthorized', { status: 401 }); } diff --git a/app/routes/analyze.tsx b/app/routes/analyze.tsx index 3492c16..3b1dbe2 100644 --- a/app/routes/analyze.tsx +++ b/app/routes/analyze.tsx @@ -354,6 +354,7 @@ export default function Analyze() { const stock = stocks.find((s) => s.id === id); if (!stock) return; + // Only delete from DB if it was manually added (db- prefix), not Alpaca positions if (id.startsWith("db-")) { try { const formData = new FormData(); diff --git a/docs/superpowers/specs/2026-05-16-settings-page-redesign.md b/docs/superpowers/specs/2026-05-16-settings-page-redesign.md index f6e3b80..b56110b 100644 --- a/docs/superpowers/specs/2026-05-16-settings-page-redesign.md +++ b/docs/superpowers/specs/2026-05-16-settings-page-redesign.md @@ -18,7 +18,7 @@ Replace the current bare-bones settings page (a flat list of JSON textareas) wit - `trading.stopLossPercent` - number - `trading.riskMethod` - string ("fixed" | "percentage" | "atr") - **Saves** via `PUT /api/admin/settings/:key` with optimistic UI update -- **Stock notes** saved via `POST /api/stocks` with ticker + notes +- **Stock notes** saved via `POST /api/stocks` with FormData: `{ ticker, notes }` - **Loading state** shown while initial fetch completes ### Layout @@ -48,7 +48,7 @@ Replace the current bare-bones settings page (a flat list of JSON textareas) wit - Pagination if >20 stocks ### System -- Alpaca mode indicator (paper/live) - read-only, derived from env +- Alpaca mode indicator (paper/live) - read-only, fetched from `/api/alpaca/account` or derived from `ALPACA_BASE_URL` env var - Admin token management - Fallback JSON textarea for any raw `AppSetting` keys not covered above diff --git a/playwright-report/index.html b/playwright-report/index.html index 0a0ddc4..88098d3 100644 --- a/playwright-report/index.html +++ b/playwright-report/index.html @@ -87,4 +87,4 @@ Error generating stack: `+l.message+`
- \ No newline at end of file + \ No newline at end of file diff --git a/prisma/dev.db b/prisma/dev.db index fce1f88528c0942713be8b11ac336a77472a23ed..eb13a26dc8eb2995d5182b62d21c369d81022ddb 100644 GIT binary patch delta 1282 zcma)6O>7%Q6yD8dV-%WK_G!h$Lp~@WOrw~ zGwa|+!2tY!Jst{5y?SVtZjeAhxf+`_#pb`h(t`j%_5_8zq%=fRjHxr9o_rO)`^JdK&al5;FsyCZQ-eIi+x!V;Fiim69KiKCc# z6nA+F`b_rl{QG4KN1TOHoG#*5@D^**c$AvNyq|O<+c;)ovxqO!X5yvORA0meU_8Wv zUCBf{C7gtPCIt?_CTIsW<3^h>PzY-^q1O+3CK>105>FU8f2~0 zIJE$#U`9Y#h)D$D;0TB>8aq368FNt6f}Tmr0PFjC+@ZvmogVgx=s;_HE1zW_=>>lU zM6#>^IMHAs1q)>d6Oh@YLSjk1PRKm)C5Z%>n?JOqOZ<^XhiU{S68iJ9O*`7Xe7b$@ zm~TNw&?+M8Nl`Ry+i`27<|m71cc-+p$c@N`+fx0}J$YRz>Wvs$pKFaS=5 z=g(YL-&p?pM4SKfL|^{;uwcctoSIXpShdqc%Y)+(F61leGfUlM3q@>L0w<2uaCO0OC{5+I{IVUtXf}v zvpx=-W9ODvGBjOGFP}bmxbeiaj;<-_KKcm_(KYn>aOUiL=-iYxr}}J zoKv~6NqZYdF4^7(%8y45T6I)KQx}qL~a``&f$G%kl4s*?tV%e+_<@*>F)Kxy_<`F0;%Pc A_W%F@ delta 954 zcmY+CO>7fK6vx+gqR{3@ikgA~wK@f~iQ-F<)}>R`Mm@dI z_kyI#v=R|uC?rBN zQj{~jSoqY=eLrIWEpA|WN4AY{`7%u3u2slL=&S@|!h!sZl&-+HB%Q>X+<-zn>}jJ1Ya1HX3i;98D(aec8P0w) zSbG>Ku|nQ$G9=TF^J@A^usw6+eHyoIz|tiV@8xU8Wgu4C}O z70}gye~~97ozMo8-p(Bd*d)kc=MjXWBa9y27=c8@#0^#)&ug4?y@qYO_1T%(>a1J; za%6n|=ee0f&d9yLhUr?P;Z|+Wp7Gq8Q@5<#lm6FpKjbE}R(e*RYu71PoAtbcWm#_a zn(3RKIX$)Ce*F8{arUcKVCxop!(Om;w%*^n*kkGX!sG~5O{R-;2Sy7=3iG-2PwzlF zSooZ=*HpiqWB;&sY@2QO_r`seKE6_%+*O#!EiHVvlr>JA|KierbdGB~h4kH(Pj}_n zmc_Q%TWWg7`dg6$#e9*<^K8RnFWCl}-(~5>=7~>6Ud0BradYX_&Ck*|n@2tXOr|}I