Method getTraderFromQuery

api/server.go:604–634

getTraderFromQuery resolves a trader from the ?trader_id= query parameter, strictly scoped to the authenticated caller. Ownership is always enforced against the caller's own trader list in the store. We deliberately never fall back to the global in-memory trader map (TraderManager holds every accou

(c *gin.Context)

// freshly-registered user with no traders of their own could otherwise pass any
// other account's trader_id and read its balance, positions and AI decisions.
func (s *Server) getTraderFromQuery(c *gin.Context) (*manager.TraderManager, string, error) {
	userID := c.GetString("user_id")
	traderID := c.Query("trader_id")

	// Ensure user's traders are loaded into memory.
	if err := s.traderManager.LoadUserTradersFromStore(s.store, userID); err != nil {
		logger.Infof("⚠️ Failed to load traders for user %s: %v", userID, err)
	}

	// Resolve strictly from the caller's own trader list.
	userTraders, err := s.store.Trader().List(userID)
	if err != nil {
		return nil, "", fmt.Errorf("failed to load traders for this account: %w", err)
	}
	if len(userTraders) == 0 {
		return nil, "", fmt.Errorf("No available traders")
	}

	if traderID == "" {
		// No trader_id specified — default to the caller's first trader.
		return s.traderManager, userTraders[0].ID, nil
	}

	// A trader_id was supplied — it must belong to the caller.
	for _, t := range userTraders {
		if t.ID == traderID {
			return s.traderManager, traderID, nil
		}
	}
	return nil, "", fmt.Errorf("trader not found for this account")
}

// authMiddleware JWT authentication middleware
func (s *Server) authMiddleware() gin.HandlerFunc {