Add #![deny(clippy::unwrap_used, clippy::expect_used)] to 11 crates that
were missing it, and standardize 3 existing crates to deny both lints.
Test code is exempted via #![cfg_attr(test, allow(...))].
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The rate limiter trusted the client-controlled X-Forwarded-For header
to identify clients. An attacker could rotate this header value on every
request to bypass rate limits entirely.
Now uses ConnectInfo<SocketAddr> (the actual TCP connection address) as
the rate limiting key. Server is configured with
into_make_service_with_connect_info to populate this.
X-Forwarded-For and X-Real-Ip headers are no longer consulted.
Falls back to "unknown" if ConnectInfo is unavailable (tests).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
from_checkpoint was creating fresh models with random weights and setting
is_trained=true, allowing trading on noise. Now validates checkpoint exists
and does NOT set is_trained=true when weights are random.
Mamba2 predict errors are now wrapped as MLError::InferenceError so the
fallback manager can degrade model health. Both TFT and Mamba2 predict
refuse to run on untrained models, and is_ready() reflects trained state.
Also fixes TFT input_dim mismatch (16 vs 5+10+16=31).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add VALID_TOPICS whitelist to WS handler, reject unknown topic subscriptions
- Add per-connection rate limit (50 topic changes/min) and max 20 subscriptions
- Remove wildcard "*" subscription (security risk)
- Add tracing::info! audit logging to all 8 mutation handlers
- Add 30s AbortController timeout to frontend API calls
- Fix clippy: rename _claims → claims in handlers that now use it
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add validate_backtest(): strategy_name, symbols format, date range,
initial_capital checks with 6 unit tests
- Add model_type validation against known types (dqn, ppo, tft, mamba2)
with 1 integration test
- Add error banner to ConfigDashboard for failed config fetch
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Token-bucket rate limiter (no new dependencies) with three tiers:
- Auth routes: 10 req/min, burst 5 (brute-force protection)
- Trading/read routes: 200 req/min, burst 20
- Compute routes (backtest/training/tune): 30 req/min, burst 5
Includes background cleanup task for stale entries and 7 unit tests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add X-Request-Id middleware with UUID v4 generation and header propagation
- Convert 6 dashboard routes to React.lazy() with Suspense for code splitting
- Add inline validation errors to OrderForm (symbol, quantity, price)
- Add date range + symbol validation to BacktestingDashboard form
- Fix !Send future issue: use .instrument(span) instead of span.entered()
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix all 98 clippy warnings (0 remaining with -D warnings)
- Add 30s default gRPC timeout on all channels via Endpoint::timeout()
- Replace readiness probe is_some() with actual gRPC health check (returns 503 when degraded)
- Add responsive Tailwind breakpoints to all 5 dashboard pages
- Add ComponentErrorBoundary for crash-prone chart components
- Log JWT validation errors at debug level instead of silently discarding
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Require JWT_SECRET >= 32 characters at startup (prevents weak secrets)
- Add SECURITY comment documenting auth.rs login as dev-only stub
- Add symbol input validation in OrderForm: uppercase, alphanumeric
with dots/hyphens/underscores, max 20 chars, visual error state
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Respond to WebSocket Ping frames with Pong for keepalive detection
- Refactor WS handler to share sender between broadcast and recv tasks
via Arc<Mutex> (required for pong responses from recv task)
- Add vite production build config: source maps, manual chunk splitting
for vendor/charts/query bundles
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Backend:
- Fail fast on empty JWT_SECRET at startup
- Restrict CORS to explicit methods (GET/POST/PUT/DELETE/OPTIONS) and
headers (Authorization, Content-Type) instead of Any
- Add 1MB request body size limit (DefaultBodyLimit)
- Add gRPC status mappings: DeadlineExceeded->408, Cancelled->499,
AlreadyExists->409, ResourceExhausted->429, Unavailable->503
Frontend:
- Guard ErrorBoundary console.error behind import.meta.env.DEV
- Read VITE_API_URL and VITE_WS_URL from env vars with fallbacks
- Add max reconnect attempts (50) to WebSocket manager
- Tune React Query: staleTime 10s, refetchInterval 15s,
disable refetchOnWindowFocus to prevent thundering herd
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Axum 0.7 uses :id path param syntax, not {id} (which is 0.8+).
The {id} routes silently returned 404 at runtime with no compile error.
Also adds comprehensive handler tests across all 6 remaining route
modules (ml, training, backtesting, performance, config, tune) covering
auth gating, no-service errors, and body validation — 37 new tests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Trading tests (7): auth gating, no-service 500, order body validation, cancel/account paths
Risk tests (5): auth gating, no-service 500, emergency stop body validation
Total: 61 tests (up from 49)
Also adds web-dashboard/.env.example for production deployment configuration.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Replace redundant closures with function references in correlation.rs
- Use unwrap_or_default() instead of unwrap_or_else(T::new)
- Allow clippy::infinite_loop on intentional reconnect/heartbeat loops
- Allow clippy::empty_structs_with_brackets in generated proto code
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace placeholder futures with actual gRPC streaming client calls for
market data, order updates, risk alerts, and metrics. Each bridge
reconnects with exponential backoff on disconnection.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace 6 stub handlers returning fake JSON with real gRPC proxies:
- training.rs: list_jobs→ListTrainingJobs, start_job→StartTraining, cancel_job→StopTraining
- tune.rs: start_tune→StartTuningJob, get_status/get_best→GetTuningJobStatus, stop_tune→StopTuningJob
Add ml_training proto module and MlTrainingServiceClient factory.
All 24/24 web-gateway REST endpoints now proxy to real gRPC services.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
All production code already uses safe patterns. This enforces the same
safety standard as ml, risk, common, data, and all service crates.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- trading_engine: replace 20 drop(Copy) with let _ = (drop on Copy is no-op)
- data: remove 4 unnecessary crate::error:: qualifications
- ml: remove stale #[allow] attribute on inference.rs
- web-gateway: allow dead_code on stub route body fields
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Replace impl Trait params with concrete types or named generics
- Rename shadowed variables (tx/ch/inner → unique names per scope)
- Add -> ! return type on infinite reconnect/heartbeat loops
- Replace wildcard enum match with explicit tonic::Code variants
- Use drop() on #[must_use] broadcast send results
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
New web-gateway crate with:
- JWT auth middleware with claims extraction
- REST routes proxying to gRPC: trading, risk, ML, training, backtesting,
performance, config, and hyperparameter tuning
- Proto compilation from shared tli/proto definitions
- AppState with lazy gRPC channels and WebSocket broadcast
- Axum server with CORS, tracing, and graceful shutdown
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
