lux/broker
2
0
Fork 0
mirror of https://github.com/luxfi/broker.git synced 2026-09-24 00:25:18 +00:00
Code Issues Packages Projects Releases Wiki Activity
145 Commits 1 Branch 51 Tags
main
Commit Graph
23 Commits
Author SHA1 Message Date
zeekay d95bbdfc03 fix: gofmt -s across repo (CI format check) 2026-06-02 11:37:59 -07:00
zeekay 6981a9a08d fix: generic test emails 2026-04-16 22:08:09 -07:00
zeekay 788166713a security: fix IDOR, SSRF, HMAC replay, JWT iss/aud, SOR injection 
CRITICAL:
- Account ownership middleware on all /accounts/{provider}/{accountId}/* routes
- Deposit/withdraw: verify account belongs to authenticated user

HIGH:
- Webhook SSRF: HTTPS required, reject private IPs, loopback, link-local, internal hosts
- HMAC replay: reject signatures with |now - timestamp| > 5 minutes
- JWT: validate iss matches IAM endpoint, aud contains expected audience
- SOR: build accounts map server-side from resolver, ignore client input

All 43 packages pass. Zero failures.
 2026-04-07 19:52:17 -07:00
zeekay bf09f371b2 fix: red team findings — 5 critical + 3 high from Alpaca sign-off review 
C1: queryCountryInfos endpoint typo (-1 suffix removed)
C2: ValidateTIF wired into CreateOrder (was dead code)
C3: GetFixedIncomeQuote returns honest error (Moment ToS required)
C4: Agreement signing uses real client IP (was 0.0.0.0)
C5: Overnight trading uses America/New_York timezone (was UTC-4)
H1: Background asset sync goroutine (1-hour ticker)
H2: ACATS disclosure API endpoint
H3: Crypto $200K aggregate limit on split plans
 2026-04-06 15:53:47 -07:00
zeekay b219edd2c9 security: fix all critical/high findings from red team review 
- Strip 9 identity headers at start of every request (prevents injection via direct pod access)
- Remove X-Account-Id fast path and fallback headers from frontend handlers (fixes IDOR)
- Add gRPC auth interceptor with IAM JWKS validation
- Fix RBAC role splitting (comma-separated X-User-Roles)
- Move webhook endpoint outside auth middleware
- Fatal on empty SSN_HMAC_KEY in production
- Remove dead admin store code
- Remove duplicate CORS handler from compliance router
- Fix writeErr JSON injection (use json.Marshal)
- Propagate isAdmin + roles claims from JWT
 2026-04-03 14:13:17 -07:00
zeekay f29020297f feat: add IAM JWKS validation to auth middleware 
Middleware now validates Bearer tokens against IAM JWKS endpoint
(IAM_ENDPOINT/.well-known/jwks). Extracts sub, owner, email claims
and sets X-User-Id, X-Org-Id, X-User-Email headers.

Also accepts gateway-propagated headers (X-User-Id) for deployments
behind Hanzo Gateway. One auth path: IAM only.
 2026-04-03 13:56:14 -07:00
zeekay 4df5223100 refactor: remove internal auth, use IAM via gateway only 
All authentication now goes through Hanzo Gateway → IAM JWKS.
The broker reads identity from gateway-propagated headers
(X-User-Id, X-Org-Id, X-User-Email, X-User-Roles) and never
validates JWTs or API keys internally.

- Remove auth.Store, auth.APIKey, API key middleware
- Remove admin.Middleware from compliance router
- Remove /auth/login and /auth/verify endpoints
- RBAC reads X-User-Roles header from gateway
- Reviewer identity from X-User-Id header
- /healthz remains unauthenticated
- Rename super_admin → superadmin
 2026-04-03 13:40:51 -07:00
zeekay 445d25465a fix: accept X-User-Id header and X-Account-Id fast path for per-user account scoping 
resolveUserID now checks X-User-Id first (set by ATS injectAuthHeaders)
before falling back to X-Gateway-User-Id and X-Hanzo-User-Id.

resolveUserAccounts short-circuits on X-Account-Id + optional
X-Account-Provider headers, skipping the ListAccounts call when the
caller already knows the sub-account.
 2026-03-31 16:16:36 -07:00
zeekay 43d96a28e9 fix: bump compliance to v0.2.0, simplify CI 2026-03-30 20:39:35 -07:00
zeekay 32ee53d6f5 fix: remove hardcoded WL origins — CORS from CORS_ALLOWED_ORIGINS env var 2026-03-30 18:43:13 -07:00
zeekay 5de9cbe333 feat: add options trading — Alpaca Level 3 multi-leg support 
- OptionsProvider interface (7 methods): chain, expirations, quote,
  single-leg orders, multi-leg orders, exercise, positions
- Alpaca implementation: order_class "mleg", ratio_qty, position_intent
- Fix 3 critical bugs: mleg class, ratio_qty field, position_intent
- Add DoNotExercise + SetOptionsApprovalLevel endpoints
- HTTP handlers: 10 new routes under /v1/options/*
- Security: OCC symbol validation, input sanitization, audit logging
- Tests: 16 provider + handler tests passing
 2026-03-30 15:25:47 -07:00
zeekay 9ece9df4f9 chore: remove Dockerfile + cloudbuild — Go module consumed by ATS, not deployed standalone 2025-12-24 18:42:36 -07:00
zeekay 4532862f22 fix: use query-param format for crypto bars (sandbox single path 404s) 
Same issue as snapshots — Alpaca sandbox returns 404 for
/v1beta3/crypto/us/{sym}/bars but works with
/v1beta3/crypto/us/bars?symbols={sym}. Also handle the wrapped
response format {"bars":{"BTC/USD":[...]}} vs stock {"bars":[...]}.
 2025-12-24 00:57:08 -07:00
zeekay c3a7a1172b test: boost coverage — accounts resolver, frontend API, funding (+820 lines) 2025-12-20 12:46:39 -07:00
zeekay 664e1496aa security: fix all critical findings from red team review 
- JWT signature comparison now uses hmac.Equal (timing-safe)
- Password hashing upgraded to 100k iterations (PBKDF2-like)
- Remove hardcoded JWT secret fallback (random generated if unset)
- Remove BROKER_DEV_MODE auth bypass entirely
- Password comparison uses subtle.ConstantTimeCompare
- Remove wildcard CORS from SSE endpoint
- Update all tests to use API key auth instead of dev mode bypass
 2025-12-24 10:56:15 -07:00
zeekay 8d03ec839b test: add frontend exchange API tests 2025-12-24 20:51:08 -07:00
zeekay 4935ed6910 feat: add account resolver and frontend exchange API 
Generic user→provider account resolution (replaces Alpaca-specific
mapping). Frontend-friendly /v1/exchange/* endpoints: assets with
type mapping, crypto prices, charts, orders, positions, portfolio.
All provider-agnostic — routes through resolver + registry.
 2025-12-24 09:57:48 -07:00
zeekay f33d284d76 test: add comprehensive tests for API, audit, funding, marketdata 
Integration tests for all HTTP endpoints (healthz, providers, risk,
audit, accounts). Unit tests for audit log (record, query, stats,
export, hooks, concurrency). Funding service tests. Market data feed
tests (BBO, multi-provider, subscribe, spread bps, concurrency).
Fix Dockerfile healthcheck endpoint (/health → /healthz).
Add version-aware Makefile with test-race and docker-push targets.
 2025-12-22 11:15:22 -08:00
zeekay 7f7ac4b0a6 refactor: extract KYC/compliance to luxfi/compliance module 
Remove KYC, application, and onboarding code from broker — now lives
in the standalone luxfi/compliance module. Broker remains a pure
trading router with admin auth, settlement, and multi-provider SOR.
Wire admin user config in main. Update LLM.md.
 2025-12-18 16:07:33 -08:00
zeekay f897cd1f9c feat: complete Alpaca Broker API — 100% endpoint coverage 
Security fixes:
- Fix auth bypass: empty API key now returns 401 (unless BROKER_DEV_MODE=true)
- Fix risk engine recording $0 for all orders (now calculates qty*price)
- Fix hardcoded compliance fields in CreateAccount (pass-through from request)

P0 Trading Core:
- ReplaceOrder (PATCH), CancelAllOrders, GetPosition, ClosePosition, CloseAllPositions
- ListOrdersFiltered with status/limit/after/until/direction/nested params
- Extended CreateOrderRequest: trailing stops, bracket orders, extended hours

P1-P5 Complete API via composable interfaces:
- AccountManager: UpdateAccount, CloseAccount, GetAccountActivities
- DocumentManager: Upload, List, Get, Download documents
- JournalManager: Create, List, Get, Delete, Batch, ReverseBatch journals
- TransferExtended: CancelTransfer, DeleteACH, recipient bank CRUD
- CryptoDataProvider: GetCryptoBars/Quotes/Trades/Snapshots
- EventStreamer: SSE streaming for trade/account/transfer/journal events
- PortfolioAnalyzer: GetPortfolioHistory
- WatchlistManager: Full CRUD with asset management

Architecture: 8 optional capability interfaces on single Provider abstraction.
Providers implement what they support; router detects via type assertion.

Market data fixes:
- Crypto symbols now route to /v1beta3/crypto/us/ (not /v2/stocks/)
- GetBars pagination via next_page_token loop
 2025-10-22 10:40:22 -07:00
zeekay 6cc523855a feat: payment processor integration via hanzo/commerce 
- Add hanzo/commerce v1.36.5 for Braintree, MPC payment processors
- Create pkg/funding service wrapping commerce processor registry
- Add deposit/withdraw/webhook endpoints under /v1/fund/
- Register Braintree processor with env-var config in brokerd
- Remove /api prefix from routes (subdomain routing in production)
- White-label: all config via env vars, multi-tenant ready
 2025-08-02 12:30:00 +00:00
zeekay 0cd9e839a5 fix: add localhost:3001 to CORS allowed origins for CEX frontend 2025-08-01 16:15:37 -07:00
zeekay 007cfd475d feat: federated broker with 16 providers, smart order routing, institutional trading 
Providers: Alpaca, IBKR, BitGo, FalconX, Finix, SFOX, Coinbase, Binance,
Kraken, Gemini, Fireblocks, Circle, Tradier, Polygon, CurrencyCloud, LMAX

Features: fee-aware SOR, order splitting, pre-trade risk, audit logging,
consolidated market data, SSE streaming, auth middleware
 2025-05-29 05:29:54 -05:00