lux/broker
2
0
Fork 0
mirror of https://github.com/luxfi/broker.git synced 2026-09-24 00:25:18 +00:00
Code Issues Packages Projects Releases Wiki Activity
145 Commits 1 Branch 51 Tags
main
Commit Graph
18 Commits
Author SHA1 Message Date
zeekay d95bbdfc03 fix: gofmt -s across repo (CI format check) 2026-06-02 11:37:59 -07:00
zeekay 788166713a security: fix IDOR, SSRF, HMAC replay, JWT iss/aud, SOR injection 
CRITICAL:
- Account ownership middleware on all /accounts/{provider}/{accountId}/* routes
- Deposit/withdraw: verify account belongs to authenticated user

HIGH:
- Webhook SSRF: HTTPS required, reject private IPs, loopback, link-local, internal hosts
- HMAC replay: reject signatures with |now - timestamp| > 5 minutes
- JWT: validate iss matches IAM endpoint, aud contains expected audience
- SOR: build accounts map server-side from resolver, ignore client input

All 43 packages pass. Zero failures.
 2026-04-07 19:52:17 -07:00
zeekay bf09f371b2 fix: red team findings — 5 critical + 3 high from Alpaca sign-off review 
C1: queryCountryInfos endpoint typo (-1 suffix removed)
C2: ValidateTIF wired into CreateOrder (was dead code)
C3: GetFixedIncomeQuote returns honest error (Moment ToS required)
C4: Agreement signing uses real client IP (was 0.0.0.0)
C5: Overnight trading uses America/New_York timezone (was UTC-4)
H1: Background asset sync goroutine (1-hour ticker)
H2: ACATS disclosure API endpoint
H3: Crypto $200K aggregate limit on split plans
 2026-04-06 15:53:47 -07:00
zeekay b219edd2c9 security: fix all critical/high findings from red team review 
- Strip 9 identity headers at start of every request (prevents injection via direct pod access)
- Remove X-Account-Id fast path and fallback headers from frontend handlers (fixes IDOR)
- Add gRPC auth interceptor with IAM JWKS validation
- Fix RBAC role splitting (comma-separated X-User-Roles)
- Move webhook endpoint outside auth middleware
- Fatal on empty SSN_HMAC_KEY in production
- Remove dead admin store code
- Remove duplicate CORS handler from compliance router
- Fix writeErr JSON injection (use json.Marshal)
- Propagate isAdmin + roles claims from JWT
 2026-04-03 14:13:17 -07:00
zeekay f29020297f feat: add IAM JWKS validation to auth middleware 
Middleware now validates Bearer tokens against IAM JWKS endpoint
(IAM_ENDPOINT/.well-known/jwks). Extracts sub, owner, email claims
and sets X-User-Id, X-Org-Id, X-User-Email headers.

Also accepts gateway-propagated headers (X-User-Id) for deployments
behind Hanzo Gateway. One auth path: IAM only.
 2026-04-03 13:56:14 -07:00
zeekay 4df5223100 refactor: remove internal auth, use IAM via gateway only 
All authentication now goes through Hanzo Gateway → IAM JWKS.
The broker reads identity from gateway-propagated headers
(X-User-Id, X-Org-Id, X-User-Email, X-User-Roles) and never
validates JWTs or API keys internally.

- Remove auth.Store, auth.APIKey, API key middleware
- Remove admin.Middleware from compliance router
- Remove /auth/login and /auth/verify endpoints
- RBAC reads X-User-Roles header from gateway
- Reviewer identity from X-User-Id header
- /healthz remains unauthenticated
- Rename super_admin → superadmin
 2026-04-03 13:40:51 -07:00
zeekay 43d96a28e9 fix: bump compliance to v0.2.0, simplify CI 2026-03-30 20:39:35 -07:00
zeekay 32ee53d6f5 fix: remove hardcoded WL origins — CORS from CORS_ALLOWED_ORIGINS env var 2026-03-30 18:43:13 -07:00
zeekay 5de9cbe333 feat: add options trading — Alpaca Level 3 multi-leg support 
- OptionsProvider interface (7 methods): chain, expirations, quote,
  single-leg orders, multi-leg orders, exercise, positions
- Alpaca implementation: order_class "mleg", ratio_qty, position_intent
- Fix 3 critical bugs: mleg class, ratio_qty field, position_intent
- Add DoNotExercise + SetOptionsApprovalLevel endpoints
- HTTP handlers: 10 new routes under /v1/options/*
- Security: OCC symbol validation, input sanitization, audit logging
- Tests: 16 provider + handler tests passing
 2026-03-30 15:25:47 -07:00
zeekay 9ece9df4f9 chore: remove Dockerfile + cloudbuild — Go module consumed by ATS, not deployed standalone 2025-12-24 18:42:36 -07:00
zeekay 4532862f22 fix: use query-param format for crypto bars (sandbox single path 404s) 
Same issue as snapshots — Alpaca sandbox returns 404 for
/v1beta3/crypto/us/{sym}/bars but works with
/v1beta3/crypto/us/bars?symbols={sym}. Also handle the wrapped
response format {"bars":{"BTC/USD":[...]}} vs stock {"bars":[...]}.
 2025-12-24 00:57:08 -07:00
zeekay 664e1496aa security: fix all critical findings from red team review 
- JWT signature comparison now uses hmac.Equal (timing-safe)
- Password hashing upgraded to 100k iterations (PBKDF2-like)
- Remove hardcoded JWT secret fallback (random generated if unset)
- Remove BROKER_DEV_MODE auth bypass entirely
- Password comparison uses subtle.ConstantTimeCompare
- Remove wildcard CORS from SSE endpoint
- Update all tests to use API key auth instead of dev mode bypass
 2025-12-24 10:56:15 -07:00
zeekay 4935ed6910 feat: add account resolver and frontend exchange API 
Generic user→provider account resolution (replaces Alpaca-specific
mapping). Frontend-friendly /v1/exchange/* endpoints: assets with
type mapping, crypto prices, charts, orders, positions, portfolio.
All provider-agnostic — routes through resolver + registry.
 2025-12-24 09:57:48 -07:00
zeekay 7f7ac4b0a6 refactor: extract KYC/compliance to luxfi/compliance module 
Remove KYC, application, and onboarding code from broker — now lives
in the standalone luxfi/compliance module. Broker remains a pure
trading router with admin auth, settlement, and multi-provider SOR.
Wire admin user config in main. Update LLM.md.
 2025-12-18 16:07:33 -08:00
zeekay f897cd1f9c feat: complete Alpaca Broker API — 100% endpoint coverage 
Security fixes:
- Fix auth bypass: empty API key now returns 401 (unless BROKER_DEV_MODE=true)
- Fix risk engine recording $0 for all orders (now calculates qty*price)
- Fix hardcoded compliance fields in CreateAccount (pass-through from request)

P0 Trading Core:
- ReplaceOrder (PATCH), CancelAllOrders, GetPosition, ClosePosition, CloseAllPositions
- ListOrdersFiltered with status/limit/after/until/direction/nested params
- Extended CreateOrderRequest: trailing stops, bracket orders, extended hours

P1-P5 Complete API via composable interfaces:
- AccountManager: UpdateAccount, CloseAccount, GetAccountActivities
- DocumentManager: Upload, List, Get, Download documents
- JournalManager: Create, List, Get, Delete, Batch, ReverseBatch journals
- TransferExtended: CancelTransfer, DeleteACH, recipient bank CRUD
- CryptoDataProvider: GetCryptoBars/Quotes/Trades/Snapshots
- EventStreamer: SSE streaming for trade/account/transfer/journal events
- PortfolioAnalyzer: GetPortfolioHistory
- WatchlistManager: Full CRUD with asset management

Architecture: 8 optional capability interfaces on single Provider abstraction.
Providers implement what they support; router detects via type assertion.

Market data fixes:
- Crypto symbols now route to /v1beta3/crypto/us/ (not /v2/stocks/)
- GetBars pagination via next_page_token loop
 2025-10-22 10:40:22 -07:00
zeekay 6cc523855a feat: payment processor integration via hanzo/commerce 
- Add hanzo/commerce v1.36.5 for Braintree, MPC payment processors
- Create pkg/funding service wrapping commerce processor registry
- Add deposit/withdraw/webhook endpoints under /v1/fund/
- Register Braintree processor with env-var config in brokerd
- Remove /api prefix from routes (subdomain routing in production)
- White-label: all config via env vars, multi-tenant ready
 2025-08-02 12:30:00 +00:00
zeekay 0cd9e839a5 fix: add localhost:3001 to CORS allowed origins for CEX frontend 2025-08-01 16:15:37 -07:00
zeekay 007cfd475d feat: federated broker with 16 providers, smart order routing, institutional trading 
Providers: Alpaca, IBKR, BitGo, FalconX, Finix, SFOX, Coinbase, Binance,
Kraken, Gemini, Fireblocks, Circle, Tradier, Polygon, CurrencyCloud, LMAX

Features: fee-aware SOR, order splitting, pre-trade risk, audit logging,
consolidated market data, SSE streaming, auth middleware
 2025-05-29 05:29:54 -05:00