v0.13.0 — Authentication system

Complete authentication system across Go backend, React frontend, and PostgreSQL.

Backend (dashboard_backend/)

• JWT access tokens (8h) + refresh tokens (30d) via SPREADARA_JWT_SECRET
• users table with invite-based activation flow (no self-registration)
• requireAuth middleware with role-based access: admin / trader / viewer
• Role-restricted endpoints: config, calibration run, backtest run → admin only; all others → any authenticated user; /api/v5/status and /api/snapshot remain public
• Auth routes: POST /api/auth/login, /refresh, /logout, /accept-invite
• Admin routes: GET/POST /api/admin/users, DELETE /api/admin/users/:id
• Startup seeds first admin from SPREADARA_ADMIN_EMAIL if no users exist; logs invite URL to stdout
• Invite emails via Resend REST API (SPREADARA_RESEND_API_KEY, SPREADARA_APP_URL)
• Auth is opt-in: when SPREADARA_JWT_SECRET is unset all routes pass through (dev/internal mode)
• 9 new tests: login success/fail, user enumeration resistance, missing/valid/expired token, admin-only 403, invite flow, refresh token

Frontend (dashboard/)

• auth.ts: in-memory token store (not localStorage), setTokens, refreshTokens, logout
• Login.tsx: split layout — animated live candlestick SVG on left, sign-in form on right
• AcceptInvite.tsx: password setup with strength validation (min 8, uppercase, digit)
• AdminUsers.tsx: user table with invite modal and delete; admin-only sidebar entry
• All API calls now send Authorization: Bearer header with automatic 401 → refresh → retry
• Protected routes redirect to /login when unauthenticated; /admin/users requires admin role
• Sidebar gains Users link (admin only), Sign out button, and current user email display

New environment variables

SPREADARA_JWT_SECRET=<random 32+ char string>
SPREADARA_RESEND_API_KEY=<from resend.com>
SPREADARA_APP_URL=https://app.spreadara.com
SPREADARA_ADMIN_EMAIL=admin@spreadara.com

v0.12.1 — chore: remove redundant comments

Removed comments added during the moderate/low audit fix pass that restated what the code already says — section dividers, what-the-function-does docstrings, and variable restatements. Kept non-obvious rationale, safety-critical path explanations, and platform-specific quirks (OKX 51400 idempotent cancel, WebSocket absolute URL requirement, SSRF guard, fill-ring lag on flatten sizing, read-only rate-limit check).

v0.12.0 — fix: WSL dashboard connectivity, event dedup, version strings

Vite proxy config for WSL2 development (all /api and /ws traffic proxied through Vite dev server). WS URL derives from window.location when VITE_WS_BASE is empty. System Events panel deduplicates consecutive identical entries into a single (×N) row. Version strings updated to v0.12.0.

v0.11.9 — fix(preflight): DSN connection string for postgres check, snap log demotion

Preflight postgres check passes DSN via PGDATABASE (password out of ps aux). Per-snapshot snap mid= log demoted from info to debug (was flooding production logs at ~1 Hz).

v0.11.8 — fix: moderate and low audit fixes

18 moderate and low audit fixes: order/cancel rate bucket separation, daily-loss circuit-breaker halt, persistent cancel failure escalation, live position query on flatten, simdjson reusable padded buffer, FlatBufferBuilder member (hot path alloc elimination), subscribe-error handling, WS ping timer at handshake, ACK timeout watchdog, Go WS frame caps, alert body size limit, SSRF webhook validation, atomic config write, bounded log tail, preflight PG password safety, WS reconnect backoff with jitter, frontend runtime validators. 8 new tests added.

v0.11.7 — fix: 9 critical audit fixes

9 critical audit fixes: risk check enforced on submit thread, halt re-check before place, shutdown producer ordering, startup preflight cancel/flatten, MPSC ring buffer mutex, volatility atomic publish, public WS keepalive ping, OKX signer + HTTP 451 tests, frontend data staleness indicator.

v0.11.6 — chore: add copyright headers to all source files

Copyright headers added to all C++, Go, and TypeScript source files.

v0.11.5 — chore: change license to All Rights Reserved (proprietary)

License changed to All Rights Reserved. Proprietary and confidential.

v0.11.4 — chore: gofmt alignment fixes

Go source files reformatted with gofmt; struct-tag alignment cleaned up.

v0.11.3 — chore: remove redundant comments across codebase

Removed redundant, obvious, and migration-history comments codebase-wide. Kept only non-obvious rationale, algorithmic decisions, and platform quirk annotations.