server.go

// Copyright 2026ff novatechflow (Alexander Alten)
// SPDX-License-Identifier: PolyForm-Shield-1.0.0
//
// polyDisplay aggregator server.
//
// Polls Polymarket + (Kraken-first, Coinbase-fallback) on its own schedule,
// caches the result, and serves ONE cheap endpoint (/api/state) plus the static
// web app. The browser therefore makes a single LAN request and never
// touches an external API, cert, rate limit, or geoblock.
//
//	go run .            # dev
//	go build -o polydisplayd .   # binary for launchd / systemd (see install.sh)
//
// Optional: CG_DEMO_KEY (CoinGecko). Watchlist: POLYDISPLAY_ASSETS in the
// process env or a .env file in the working directory (see .env.example).
package main

import (
	_ "embed"
	"encoding/json"
	"fmt"
	"io"
	"log"
	"math/rand/v2"
	"net/http"
	"net/url"
	"os"
	"sort"
	"strconv"
	"strings"
	"sync"
	"time"
)

//go:embed VERSION
var serverVersion string

/* ------------------------- config ------------------------- */

type Coin struct {
	Kind string `json:"kind,omitempty"` // empty remains crypto for existing configs
	Sym  string `json:"sym"`
	Name string `json:"name"`
	ID   string `json:"id"`           // CoinGecko id
	Bn   string `json:"bn,omitempty"` // legacy market-symbol override
}

type Config struct {
	MarketProvider string `json:"marketProvider"`
	Wallet         string `json:"wallet"`
	CandleDays     int    `json:"candleDays"`
	Port           int    `json:"port"`
	Sort           string `json:"sort"` // "az" (symbol A-Z) | "config" (as added)
	Coins          []Coin `json:"coins"`
}

const configPath = "config.json"
const envPath = ".env"

func defaultConfig() Config {
	return Config{
		MarketProvider: "auto",
		Wallet:         "",
		CandleDays:     1,
		Sort:           "trades",
	}
}

// KEY=VALUE lines. Existing process env wins. Quotes around values are stripped.
func loadEnvFile(path string) {
	b, err := os.ReadFile(path)
	if err != nil {
		return
	}
	for _, line := range strings.Split(string(b), "\n") {
		line = strings.TrimSpace(line)
		if line == "" || strings.HasPrefix(line, "#") {
			continue
		}
		k, v, ok := strings.Cut(line, "=")
		if !ok {
			continue
		}
		k = strings.TrimSpace(k)
		v = strings.Trim(strings.TrimSpace(v), `"'`)
		if k == "" || os.Getenv(k) != "" {
			continue
		}
		os.Setenv(k, v)
	}
}

// POLYDISPLAY_ASSETS=SYM:Name:id,SYM:id,...  Name may contain spaces.
// Two fields → name defaults to SYM. A legacy fourth-field market override is
// reduced to its base symbol for Kraken and Coinbase.
func parseAssets(s string) []Coin {
	var out []Coin
	for _, item := range strings.Split(s, ",") {
		item = strings.TrimSpace(item)
		if item == "" {
			continue
		}
		p := strings.SplitN(item, ":", 4)
		var c Coin
		switch len(p) {
		case 2:
			c = Coin{Sym: p[0], Name: p[0], ID: p[1]}
		case 3:
			c = Coin{Sym: p[0], Name: p[1], ID: p[2]}
		case 4:
			c = Coin{Sym: p[0], Name: p[1], ID: p[2], Bn: p[3]}
		default:
			continue
		}
		c.Sym = strings.TrimSpace(c.Sym)
		c.Name = strings.TrimSpace(c.Name)
		c.ID = strings.TrimSpace(c.ID)
		c.Bn = strings.TrimSpace(c.Bn)
		if c.Sym == "" || c.ID == "" {
			continue
		}
		if c.Name == "" {
			c.Name = c.Sym
		}
		out = append(out, c)
	}
	return out
}

func coinsFromEnv() []Coin {
	return parseAssets(os.Getenv("POLYDISPLAY_ASSETS"))
}

// POLYDISPLAY_PORT wins; else config.json; else 8080.
func listenPort(file int) int {
	if s := strings.TrimSpace(os.Getenv("POLYDISPLAY_PORT")); s != "" {
		if p, err := strconv.Atoi(s); err == nil && p > 0 && p < 65536 {
			return p
		}
	}
	if file > 0 {
		return file
	}
	return 8080
}

func loadConfig() Config {
	c := defaultConfig()
	b, err := os.ReadFile(configPath)
	if err != nil {
		saveConfig(c)
	} else if json.Unmarshal(b, &c) != nil {
		c = defaultConfig()
	}
	c.Port = listenPort(c.Port)
	if !validMarketProvider(c.MarketProvider) {
		c.MarketProvider = "auto"
	}
	if c.CandleDays == 0 {
		c.CandleDays = 7
	}
	if c.Sort == "" {
		c.Sort = "trades"
	}
	if len(c.Coins) == 0 {
		c.Coins = coinsFromEnv()
	}
	return c
}

// order coins for display per cfg.Sort
//
//	"trades" (default): tokens in current Polymarket positions first, then A-Z
//	"az": symbol A-Z    "config": as added
func sortedCoins(coins []Coin, mode string, active map[string]bool) []Coin {
	out := make([]Coin, len(coins))
	copy(out, coins)
	byAZ := func(i, j int) bool { return strings.ToUpper(out[i].Sym) < strings.ToUpper(out[j].Sym) }
	switch mode {
	case "config":
		// keep as added
	case "az":
		sort.SliceStable(out, byAZ)
	default: // "trades"
		sort.SliceStable(out, func(i, j int) bool {
			ai, aj := active[out[i].ID], active[out[j].ID]
			if ai != aj {
				return ai // traded assets float to the top
			}
			return byAZ(i, j)
		})
	}
	return out
}

// which watchlist tokens are referenced by current Polymarket positions
// (e.g. a "Will Ethereum reach $X" market activates ETH)
func activeCoins(positions []Position, coins []Coin) map[string]bool {
	active := map[string]bool{}
	for _, p := range positions {
		lt := strings.ToLower(p.Title)
		for _, cn := range coins {
			if strings.Contains(lt, strings.ToLower(cn.Name)) ||
				(len(cn.Sym) >= 3 && strings.Contains(lt, strings.ToLower(cn.Sym))) {
				active[cn.ID] = true
			}
		}
	}
	return active
}

func saveConfig(c Config) error {
	b, err := json.MarshalIndent(c, "", "  ")
	if err != nil {
		return err
	}
	// Callers serialize runtime writes under mu; replace atomically.
	if err := os.WriteFile(configPath+".tmp", b, 0644); err != nil {
		os.Remove(configPath + ".tmp")
		return err
	}
	if err := os.Rename(configPath+".tmp", configPath); err != nil {
		os.Remove(configPath + ".tmp")
		return err
	}
	return nil
}

/* ------------------------- state ------------------------- */

type Candle [5]float64 // [openTimeMs, open, high, low, close]

type CoinState struct {
	Kind           string   `json:"kind,omitempty"`
	Unit           string   `json:"unit,omitempty"`
	Contract       string   `json:"contract,omitempty"`
	QuoteTime      int64    `json:"quoteTime,omitempty"`
	CandlesUpdated int64    `json:"candlesUpdated"`
	MarketError    string   `json:"marketError,omitempty"`
	Sym            string   `json:"sym"`
	Name           string   `json:"name"`
	ID             string   `json:"id"`
	Price          float64  `json:"price"`
	Chg24h         *float64 `json:"chg24h"`
	Source         string   `json:"source"` // "kraken" | "coinbase" | "binance" | ""
	Active         bool     `json:"active"` // referenced by a current Polymarket position
	Candles        []Candle `json:"candles"`
	Cand24         []Candle `json:"cand24"` // last 24h, whatever the display period
}

type Position struct {
	Title        string   `json:"title"`
	Outcome      string   `json:"outcome"`
	Asset        string   `json:"asset"`
	Size         float64  `json:"size"`
	AvgPrice     float64  `json:"avgPrice"`
	CurPrice     float64  `json:"curPrice"`
	Redeemable   bool     `json:"redeemable"`
	CashPnl      float64  `json:"cashPnl"`
	PercentPnl   float64  `json:"percentPnl"`
	CurrentValue float64  `json:"currentValue"`
	ConditionID  string   `json:"conditionId"`
	EndDate      string   `json:"endDate"`
	Slug         string   `json:"slug,omitempty"`
	EventSlug    string   `json:"eventSlug,omitempty"`
	PriceToBeat  *float64 `json:"priceToBeat,omitempty"`
}

type Act struct {
	Time    int64   `json:"t"`
	Type    string  `json:"type"` // TRADE, REDEEM, MERGE, SPLIT, REWARD, ...
	Side    string  `json:"side"` // BUY / SELL (for TRADE)
	Size    float64 `json:"size"`
	Price   float64 `json:"price"`
	Usdc    float64 `json:"usdc"`
	Title   string  `json:"title"`
	Outcome string  `json:"outcome"`
}

// Portfolio P/L over the whole account history (realized + unrealized), from
// Polymarket's user-pnl feed. The open positions' own value and P/L are summed
// in the column header, not here.
type PnL struct {
	Total  float64      `json:"total"` // all-time, realized + unrealized
	D1     *float64     `json:"d1"`    // the day's P/L, as polymarket.com shows it
	D7     *float64     `json:"d7"`
	D30    *float64     `json:"d30"`
	Series [][2]float64 `json:"series"`
}

type State struct {
	Loading    bool        `json:"loading,omitempty"`
	Version    string      `json:"version"`
	Updated    int64       `json:"updated"`
	Wallet     string      `json:"wallet"`
	CandleDays int         `json:"candleDays"`
	Positions  []Position  `json:"positions"`
	Coins      []CoinState `json:"coins"`
	Activity   []Act       `json:"activity"`
	Pnl        *PnL        `json:"pnl,omitempty"`
	Note       string      `json:"note"`
}

var (
	mu             sync.RWMutex
	configRevision uint64
	cfg            Config
	state          State
	candles        = map[string][]Candle{} // id -> candles (refreshed slowly)
	cand24         = map[string][]Candle{} // id -> last 24h, for daily price change
	candleErrors   = map[string]string{}
	candleUpdated  = map[string]int64{}
	csource        = map[string]string{}  // id -> candle source
	marketPrice    = map[string]float64{} // id -> last good spot price
	slowMu         sync.Mutex
	// Fresh connection per request: a VPN's short idle timeout was dropping the
	// pooled keep-alive connections during the 20s gap between cycles, so the
	// first couple of requests each cycle failed (BTC/ETH showed price 0).
	client = &http.Client{
		Timeout:   12 * time.Second,
		Transport: &http.Transport{Proxy: http.ProxyFromEnvironment, DisableKeepAlives: true},
	}
	trigger = make(chan struct{}, 1)
)

/* --------------------- Polymarket pacing --------------------- */
//
// The APIs are rate limited per public IP by Cloudflare. Keep each endpoint on
// its own schedule, space calls to the shared Data API host, and add jitter so
// multiple clients behind the same egress do not synchronize their requests.

// data-api host; a var so tests can point it at a stub
var polyBase = "https://data-api.polymarket.com"

const (
	positionsInterval = 30 * time.Second
	activityInterval  = time.Minute
	pnlInterval       = 30 * time.Minute
	dataAPIMinGap     = 5 * time.Second
	activityStartWait = 10 * time.Second
	pnlStartWait      = 20 * time.Second
	polyBackoffMin    = time.Minute
	polyBackoffMax    = 30 * time.Minute
)

type pollSchedule struct {
	nextAt  time.Time
	backoff time.Duration
}

var (
	positionsPoll pollSchedule
	activityPoll  pollSchedule
	pnlPoll       pollSchedule
	dataAPILastAt time.Time
	polyWallet    string // wallet the cached positions/activity belong to
	lastPositions []Position
	lastActivity  []Act
)

// The P/L series is a separate host with its own history-sized response, and it
// only moves as fast as prices do, so it gets a slower cadence of its own.
var pnlBase = "https://user-pnl-api.polymarket.com"

const pnlSeriesMax = 120 // points kept for the sparkline

var pnlSeries [][2]float64

func jitter(d time.Duration) time.Duration {
	if d <= 0 {
		return d
	}
	// Positive-only jitter preserves minimum delays and Retry-After semantics.
	return d + time.Duration(rand.Int64N(max(1, int64(d/10))))
}

func (p *pollSchedule) success(now time.Time, interval time.Duration) {
	p.backoff = 0
	p.nextAt = now.Add(jitter(interval))
}

func (p *pollSchedule) failed(now time.Time, retryAfter time.Duration) time.Duration {
	if p.backoff == 0 {
		p.backoff = polyBackoffMin
	} else if p.backoff < polyBackoffMax {
		p.backoff *= 2
	}
	if p.backoff > polyBackoffMax {
		p.backoff = polyBackoffMax
	}
	wait := jitter(p.backoff)
	if retryAfter > wait {
		wait = retryAfter
	}
	p.nextAt = now.Add(wait)
	return wait
}

func polyBackoffNote(p pollSchedule) string {
	return fmt.Sprintf("polymarket: rate limited, retrying in %s",
		time.Until(p.nextAt).Round(time.Second))
}

/* ------------------------- HTTP helpers ------------------------- */

// httpError carries the upstream status so callers can treat 429 specially.
type httpError struct {
	Status     int
	RetryAfter time.Duration // from the Retry-After header, 0 if absent
}

func (e *httpError) Error() string { return fmt.Sprintf("HTTP %d", e.Status) }

// Retry-After is either a delay in seconds or an HTTP date.
func parseRetryAfter(v string) time.Duration {
	if v == "" {
		return 0
	}
	if secs, err := strconv.Atoi(strings.TrimSpace(v)); err == nil && secs > 0 {
		return time.Duration(secs) * time.Second
	}
	if t, err := http.ParseTime(v); err == nil {
		if d := time.Until(t); d > 0 {
			return d
		}
	}
	return 0
}

// host+path only - keeps the wallet and query noise out of the log line
func shortURL(raw string) string {
	if i := strings.Index(raw, "?"); i >= 0 {
		raw = raw[:i]
	}
	return strings.TrimPrefix(strings.TrimPrefix(raw, "https://"), "http://")
}

// Log upstream failures, but collapse repeats so a temporary provider outage
// does not bury the first useful error in repeated refresh attempts.
const upstreamLogEvery = 10 * time.Minute

var (
	upstreamLogMu    sync.Mutex
	upstreamLoggedAt = map[string]time.Time{}
)

func logUpstream(url string, outcome interface{}) {
	key := fmt.Sprintf("%s|%v", shortURL(url), outcome)
	upstreamLogMu.Lock()
	last, seen := upstreamLoggedAt[key]
	fresh := !seen || time.Since(last) >= upstreamLogEvery
	if fresh {
		upstreamLoggedAt[key] = time.Now()
	}
	upstreamLogMu.Unlock()
	if fresh {
		log.Printf("upstream %s -> %v", shortURL(url), outcome)
	}
}

func getJSON(url string, out interface{}, headers map[string]string) error {
	var lastErr error
	for attempt := 0; attempt < 2; attempt++ { // retry once on a network error
		req, err := http.NewRequest("GET", url, nil)
		if err != nil {
			return err
		}
		for k, v := range headers {
			req.Header.Set(k, v)
		}
		resp, err := client.Do(req)
		if err != nil {
			lastErr = err
			continue
		}
		if resp.StatusCode != 200 {
			ra := parseRetryAfter(resp.Header.Get("Retry-After"))
			resp.Body.Close()
			err := &httpError{Status: resp.StatusCode, RetryAfter: ra}
			logUpstream(url, err)
			return err
		}
		b, err := io.ReadAll(io.LimitReader(resp.Body, 8<<20))
		resp.Body.Close()
		if err != nil {
			lastErr = err
			continue
		}
		return json.Unmarshal(b, out)
	}
	if lastErr != nil {
		logUpstream(url, lastErr)
	}
	return lastErr
}

func cgHeaders() map[string]string {
	if k := os.Getenv("CG_DEMO_KEY"); k != "" {
		return map[string]string{"x-cg-demo-api-key": k}
	}
	return nil
}

/* ------------------------- data fetchers ------------------------- */

var (
	krakenBase   = "https://api.kraken.com"
	coinbaseBase = "https://api.exchange.coinbase.com"
	binanceBase  = "https://api.binance.com"
)

func validMarketProvider(provider string) bool {
	return provider == "auto" || provider == "kraken" || provider == "coinbase" || provider == "binance"
}

func binanceSymbol(c Coin) string { return marketSymbol(c) + "USDT" }

func fetchBinanceCandles(c Coin, days int) ([]Candle, error) {
	interval, limit := candleParams(days, "kraken")
	intervalName := "15m"
	if interval == 60 {
		intervalName = "1h"
	}
	if interval == 240 {
		intervalName = "4h"
	}
	q := url.Values{"symbol": {binanceSymbol(c)}, "interval": {intervalName}, "limit": {strconv.Itoa(limit)}}
	var rows [][]interface{}
	if err := getJSON(binanceBase+"/api/v3/klines?"+q.Encode(), &rows, nil); err != nil {
		return nil, err
	}
	var out []Candle
	for _, row := range rows {
		if len(row) < 5 {
			return nil, fmt.Errorf("invalid Binance candle")
		}
		var candle Candle
		for i := 0; i < 5; i++ {
			v, err := strconv.ParseFloat(fmt.Sprint(row[i]), 64)
			if err != nil {
				return nil, fmt.Errorf("invalid Binance candle: %w", err)
			}
			candle[i] = v
		}
		out = append(out, candle)
	}
	if len(out) == 0 {
		return nil, fmt.Errorf("empty")
	}
	return trimCandles(out, limit), nil
}

func fetchSelectedCandles(c Coin, days int, provider string) ([]Candle, string, error) {
	var candles []Candle
	var err error
	switch provider {
	case "kraken":
		candles, err = fetchKrakenCandles(c, days)
	case "coinbase":
		candles, err = fetchCoinbaseCandles(c, days)
	case "binance":
		candles, err = fetchBinanceCandles(c, days)
	default:
		return fetchMarketCandles(c, days)
	}
	return candles, provider, err
}

func fetchBinancePrice(c Coin) (float64, error) {
	var raw struct {
		Price string `json:"price"`
	}
	if err := getJSON(binanceBase+"/api/v3/ticker/price?symbol="+url.QueryEscape(binanceSymbol(c)), &raw, nil); err != nil {
		return 0, err
	}
	p, err := strconv.ParseFloat(raw.Price, 64)
	if err != nil || p <= 0 {
		return 0, fmt.Errorf("no price")
	}
	return p, nil
}

func marketSymbol(c Coin) string {
	s := strings.ToUpper(strings.TrimSpace(c.Sym))
	if c.Bn != "" { // accept old fourth-field values such as WIFUSDT
		s = strings.ToUpper(strings.TrimSpace(c.Bn))
		for _, suffix := range []string{"USDT", "USD"} {
			s = strings.TrimSuffix(s, suffix)
		}
		s = strings.TrimRight(s, "-/")
	}
	return s
}

func krakenPair(c Coin) string {
	s := marketSymbol(c)
	if s == "BTC" {
		s = "XBT"
	}
	return s + "USD"
}

func coinbaseProduct(c Coin) string { return marketSymbol(c) + "-USD" }

func candleParams(days int, provider string) (interval, limit int) {
	if provider == "kraken" {
		switch {
		case days <= 1:
			return 15, 96
		case days <= 7:
			return 60, 168
		case days <= 14:
			return 240, 84
		default:
			return 240, 180
		}
	}
	switch {
	case days <= 1:
		return 900, 96
	case days <= 7:
		return 3600, 168
	case days <= 14:
		return 3600, 336
	default:
		return 3600, 720
	}
}

func trimCandles(in []Candle, limit int) []Candle {
	sort.Slice(in, func(i, j int) bool { return in[i][0] < in[j][0] })
	if len(in) > limit {
		return in[len(in)-limit:]
	}
	return in
}

func fetchKrakenCandles(c Coin, days int) ([]Candle, error) {
	interval, limit := candleParams(days, "kraken")
	q := url.Values{}
	q.Set("pair", krakenPair(c))
	q.Set("interval", strconv.Itoa(interval))
	q.Set("assetVersion", "1")
	q.Set("since", strconv.FormatInt(time.Now().Add(-time.Duration(days)*24*time.Hour).Unix(), 10))
	u := krakenBase + "/0/public/OHLC?" + q.Encode()
	var raw struct {
		Error  []string                   `json:"error"`
		Result map[string]json.RawMessage `json:"result"`
	}
	if err := getJSON(u, &raw, nil); err != nil {
		return nil, err
	}
	if len(raw.Error) > 0 {
		return nil, fmt.Errorf("%s", strings.Join(raw.Error, ", "))
	}
	var rows [][]interface{}
	for key, value := range raw.Result {
		if key != "last" && json.Unmarshal(value, &rows) == nil {
			break
		}
	}
	out := make([]Candle, 0, len(rows))
	for _, k := range rows {
		if len(k) < 5 {
			continue
		}
		t, _ := strconv.ParseFloat(fmt.Sprint(k[0]), 64)
		o, _ := strconv.ParseFloat(fmt.Sprint(k[1]), 64)
		h, _ := strconv.ParseFloat(fmt.Sprint(k[2]), 64)
		l, _ := strconv.ParseFloat(fmt.Sprint(k[3]), 64)
		cl, _ := strconv.ParseFloat(fmt.Sprint(k[4]), 64)
		out = append(out, Candle{t * 1000, o, h, l, cl})
	}
	if len(out) == 0 {
		return nil, fmt.Errorf("empty")
	}
	return trimCandles(out, limit), nil
}

func fetchCoinbaseCandles(c Coin, days int) ([]Candle, error) {
	granularity, _ := candleParams(days, "coinbase")
	interval, limit := candleParams(days, "kraken")
	bucketSeconds := int64(interval * 60)
	end := time.Now().UTC()
	start := time.Unix(end.Unix()/bucketSeconds*bucketSeconds-int64(days)*86400, 0).UTC()
	var out []Candle
	for from := start; from.Before(end); {
		// Leave room for an inclusive endpoint within Coinbase's 300-candle cap.
		to := from.Add(time.Duration(299*granularity) * time.Second)
		if to.After(end) {
			to = end
		}
		q := url.Values{}
		q.Set("granularity", strconv.Itoa(granularity))
		q.Set("start", from.Format(time.RFC3339))
		q.Set("end", to.Format(time.RFC3339))
		u := coinbaseBase + "/products/" + url.PathEscape(coinbaseProduct(c)) + "/candles?" + q.Encode()
		var raw [][]float64
		if err := getJSON(u, &raw, nil); err != nil {
			return nil, err
		}
		for _, k := range raw {
			if len(k) >= 5 && k[0] >= float64(start.Unix()) && k[0] <= float64(end.Unix()) {
				out = append(out, Candle{k[0] * 1000, k[3], k[2], k[1], k[4]})
			}
		}
		from = to
		if from.Before(end) {
			time.Sleep(1100 * time.Millisecond)
		}
	}
	out = aggregateCandles(out, granularity, interval*60, end)
	if len(out) == 0 {
		return nil, fmt.Errorf("empty")
	}
	return trimCandles(out, limit), nil
}

// Rebucket Coinbase into the same UTC-aligned intervals used by Kraken.
// Deduplicate overlapping pages and reject incomplete historical buckets.
func aggregateCandles(in []Candle, sourceSeconds, targetSeconds int, now time.Time) []Candle {
	trimCandles(in, len(in))
	var out []Candle
	var bucket Candle
	count := 0
	previous := float64(-1)
	flush := func() {
		if count == targetSeconds/sourceSeconds || (count > 0 && bucket[0]+float64(targetSeconds)*1000 > float64(now.UnixMilli())) {
			out = append(out, bucket)
		}
	}
	for _, c := range in {
		if c[0] == previous {
			continue
		}
		previous = c[0]
		t := float64(int64(c[0])/int64(targetSeconds*1000)) * float64(targetSeconds*1000)
		if count == 0 || t != bucket[0] {
			flush()
			bucket = c
			bucket[0] = t
			count = 1
		} else {
			if c[2] > bucket[2] {
				bucket[2] = c[2]
			}
			if c[3] < bucket[3] {
				bucket[3] = c[3]
			}
			bucket[4] = c[4]
			count++
		}
	}
	flush()
	return out
}

func fetchMarketCandles(c Coin, days int) ([]Candle, string, error) {
	cs, kerr := fetchKrakenCandles(c, days)
	if kerr == nil {
		return cs, "kraken", nil
	}
	cs, cerr := fetchCoinbaseCandles(c, days)
	if cerr == nil {
		return cs, "coinbase", nil
	}
	return nil, "", fmt.Errorf("kraken: %v; coinbase: %v", kerr, cerr)
}

func pairKey(s string) string {
	s = strings.NewReplacer("/", "", "-", "").Replace(strings.ToUpper(s))
	if strings.HasPrefix(s, "XBT") {
		s = "BTC" + strings.TrimPrefix(s, "XBT")
	}
	return s
}

func fetchKrakenPrices(coins []Coin) (map[string]float64, error) {
	if len(coins) == 0 {
		return map[string]float64{}, nil
	}
	pairs := make([]string, 0, len(coins))
	ids := map[string]string{}
	for _, c := range coins {
		pair := krakenPair(c)
		pairs = append(pairs, pair)
		ids[pairKey(pair)] = c.ID
	}
	u := krakenBase + "/0/public/Ticker?pair=" + url.QueryEscape(strings.Join(pairs, ",")) + "&assetVersion=1"
	var raw struct {
		Error  []string `json:"error"`
		Result map[string]struct {
			Close []string `json:"c"`
		} `json:"result"`
	}
	if err := getJSON(u, &raw, nil); err != nil {
		return nil, err
	}
	if len(raw.Error) > 0 {
		return nil, fmt.Errorf("%s", strings.Join(raw.Error, ", "))
	}
	out := map[string]float64{}
	for pair, ticker := range raw.Result {
		id, ok := ids[pairKey(pair)]
		if !ok || len(ticker.Close) == 0 {
			continue
		}
		if p, err := strconv.ParseFloat(ticker.Close[0], 64); err == nil && p > 0 {
			out[id] = p
		}
	}
	return out, nil
}

func fetchCoinbasePrice(c Coin) (float64, error) {
	var raw struct {
		Price string `json:"price"`
	}
	u := coinbaseBase + "/products/" + url.PathEscape(coinbaseProduct(c)) + "/ticker"
	if err := getJSON(u, &raw, nil); err != nil {
		return 0, err
	}
	p, err := strconv.ParseFloat(raw.Price, 64)
	if err != nil || p <= 0 {
		return 0, fmt.Errorf("no price")
	}
	return p, nil
}

func candleChange24(price float64, data []Candle) float64 {
	if price <= 0 || len(data) == 0 || data[0][1] <= 0 {
		return 0
	}
	return (price/data[0][1] - 1) * 100
}

func fetchPositions(wallet string) ([]Position, error) {
	url := polyBase + "/positions?user=" + wallet +
		"&sizeThreshold=0.1&limit=100&sortBy=CURRENT&sortDirection=DESC"
	var out []Position
	err := getJSON(url, &out, nil)
	open := out[:0]
	for _, p := range out {
		if p.Redeemable && p.CurPrice == 0 {
			continue
		}
		open = append(open, p)
	}
	out = open
	fillMarketMetadata(out)
	// Soonest resolution first; undated last. ISO timestamps sort as strings.
	sort.SliceStable(out, func(i, j int) bool {
		a, b := out[i].EndDate, out[j].EndDate
		if (a == "") != (b == "") {
			return b == ""
		}
		return a < b
	})
	return out, err
}

// gamma host; a var so tests can point it at a stub
var gammaBase = "https://gamma-api.polymarket.com"

type marketMeta struct {
	EndDate     string
	PriceToBeat *float64
}

// End times never move once a market exists. Up/Down reference prices can
// appear after the market metadata is first published, so retry those until set.
var marketMetadata = map[string]marketMeta{}

func normID(id string) string {
	return strings.ToLower(strings.TrimSpace(id))
}

func isUpDown(p Position) bool {
	if strings.EqualFold(p.Outcome, "up") || strings.EqualFold(p.Outcome, "down") {
		return true
	}
	s := strings.ToLower(p.EventSlug + " " + p.Slug + " " + p.Title)
	return strings.Contains(s, "updown") ||
		strings.Contains(s, "up-down") ||
		strings.Contains(s, "up/down") ||
		strings.Contains(s, "up or down") ||
		strings.Contains(s, "up-or-down")
}

// /positions only carries a date ("2026-08-12"), which can't separate a market
// closing at noon from one closing at 18:00. gamma has the full timestamp.
func fillMarketMetadata(pos []Position) {
	var missing []string
	seen := map[string]bool{}
	for _, p := range pos {
		cid := normID(p.ConditionID)
		if cid == "" {
			continue
		}
		meta, ok := marketMetadata[cid]
		needsPrice := isUpDown(p) && meta.PriceToBeat == nil
		if (!ok || needsPrice) && !seen[cid] {
			seen[cid] = true
			missing = append(missing, p.ConditionID)
		}
	}
	for len(missing) > 0 {
		n := min(len(missing), 20)
		if err := loadMarketMetadata(missing[:n]); err != nil {
			log.Printf("gamma: end times unavailable, sorting by date: %v", err)
			break
		}
		missing = missing[n:]
	}
	for i, p := range pos {
		if meta, ok := marketMetadata[normID(p.ConditionID)]; ok {
			if meta.EndDate != "" {
				pos[i].EndDate = meta.EndDate
			}
			pos[i].PriceToBeat = meta.PriceToBeat
		}
	}
}

func loadMarketMetadata(ids []string) error {
	url := gammaBase + "/markets?limit=" + strconv.Itoa(len(ids))
	for _, id := range ids {
		url += "&condition_ids=" + id
	}
	var raw []struct {
		ConditionID   string   `json:"conditionId"`
		EndDate       string   `json:"endDate"`
		PriceToBeat   *float64 `json:"priceToBeat"`
		EventMetadata struct {
			PriceToBeat *float64 `json:"priceToBeat"`
		} `json:"eventMetadata"`
		Events []struct {
			EventMetadata struct {
				PriceToBeat *float64 `json:"priceToBeat"`
			} `json:"eventMetadata"`
		} `json:"events"`
	}
	if err := getJSON(url, &raw, nil); err != nil {
		return err
	}
	for _, m := range raw {
		cid := normID(m.ConditionID)
		meta := marketMeta{EndDate: m.EndDate}
		if prev, ok := marketMetadata[cid]; ok && prev.PriceToBeat != nil {
			meta.PriceToBeat = prev.PriceToBeat
		}
		if m.PriceToBeat != nil && *m.PriceToBeat > 0 {
			meta.PriceToBeat = m.PriceToBeat
		} else if m.EventMetadata.PriceToBeat != nil && *m.EventMetadata.PriceToBeat > 0 {
			meta.PriceToBeat = m.EventMetadata.PriceToBeat
		}
		for _, event := range m.Events {
			if event.EventMetadata.PriceToBeat != nil && *event.EventMetadata.PriceToBeat > 0 {
				meta.PriceToBeat = event.EventMetadata.PriceToBeat
				break
			}
		}
		marketMetadata[cid] = meta
	}
	// Cache the misses too, so an unknown market isn't re-queried every cycle.
	for _, id := range ids {
		cid := normID(id)
		if _, ok := marketMetadata[cid]; !ok {
			marketMetadata[cid] = marketMeta{}
		}
	}
	return nil
}

func fetchActivity(wallet string) ([]Act, error) {
	url := polyBase + "/activity?user=" + wallet + "&limit=20"
	var raw []struct {
		Timestamp int64   `json:"timestamp"`
		Type      string  `json:"type"`
		Side      string  `json:"side"`
		Size      float64 `json:"size"`
		Price     float64 `json:"price"`
		UsdcSize  float64 `json:"usdcSize"`
		Title     string  `json:"title"`
		Outcome   string  `json:"outcome"`
	}
	if err := getJSON(url, &raw, nil); err != nil {
		return nil, err
	}
	out := make([]Act, 0, len(raw))
	for _, a := range raw {
		out = append(out, Act{a.Timestamp, a.Type, a.Side, a.Size, a.Price, a.UsdcSize, a.Title, a.Outcome})
	}
	return out, nil
}

// Cumulative account P/L, hourly over the last 30 days.
func fetchPnlSeries(wallet string) ([][2]float64, error) {
	url := pnlBase + "/user-pnl?user_address=" + wallet + "&interval=1m&fidelity=1h"
	var raw []struct {
		T int64   `json:"t"`
		P float64 `json:"p"`
	}
	if err := getJSON(url, &raw, nil); err != nil {
		return nil, err
	}
	if len(raw) == 0 {
		return nil, fmt.Errorf("empty")
	}
	out := make([][2]float64, 0, len(raw))
	for _, p := range raw {
		out = append(out, [2]float64{float64(p.T), p.P})
	}
	return out, nil
}

// Change over a trailing number of hourly samples. Polymarket's own profile
// anchors this by sample, not by clock: its "1D" series is 24 hourly points
// spanning 23h, so the day's P/L is the change against the point 24 samples
// back. Matching that anchor makes the card agree with polymarket.com exactly.
// nil when the series is too young to cover the window.
func pnlDelta(series [][2]float64, samples int) *float64 {
	i := len(series) - samples
	if len(series) < 2 || samples < 1 || i < 0 {
		return nil
	}
	d := series[len(series)-1][1] - series[i][1]
	return &d
}

// Thin to at most max points, always keeping the first and last.
func thin(series [][2]float64, max int) [][2]float64 {
	if len(series) <= max || max < 2 {
		return series
	}
	out := make([][2]float64, 0, max)
	step := float64(len(series)-1) / float64(max-1)
	for i := 0; i < max-1; i++ {
		out = append(out, series[int(float64(i)*step)])
	}
	return append(out, series[len(series)-1])
}

func buildPnl(series [][2]float64) *PnL {
	if len(series) == 0 {
		return nil
	}
	return &PnL{
		Total:  series[len(series)-1][1],
		D1:     pnlDelta(series, 24),
		D7:     pnlDelta(series, 7*24),
		D30:    pnlDelta(series, 30*24),
		Series: thin(series, pnlSeriesMax),
	}
}

// refresh the cached P/L series when it's due; failures keep the last one
func refreshPnl(wallet string, now time.Time) {
	if wallet == "" || now.Before(pnlPoll.nextAt) {
		return
	}
	s, err := fetchPnlSeries(wallet)
	if err == nil {
		pnlSeries = s
		pnlPoll.success(now, pnlInterval)
		return
	}
	var retryAfter time.Duration
	if he, ok := err.(*httpError); ok && he.Status == 429 {
		retryAfter = he.RetryAfter
	}
	wait := pnlPoll.failed(now, retryAfter)
	log.Printf("polymarket pnl: request failed, backing off %s", wait.Round(time.Second))
}

/* ------------------------- refresh loops ------------------------- */

// fast: positions + live prices (every 20s)
func refreshFast() {
	mu.RLock()
	c := cfg
	revision := configRevision
	mu.RUnlock()
	now := time.Now()

	note := ""
	positions, activity := lastPositions, lastActivity
	wallet := strings.TrimSpace(c.Wallet)
	if wallet != polyWallet { // wallet changed -> refetch now, drop stale data
		polyWallet = wallet
		positionsPoll = pollSchedule{}
		activityPoll = pollSchedule{nextAt: now.Add(activityStartWait)}
		pnlPoll = pollSchedule{nextAt: now.Add(pnlStartWait)}
		dataAPILastAt = time.Time{}
		positions, activity = nil, nil
		pnlSeries = nil
	}

	if wallet == "" {
		positions, activity = nil, nil
	} else if now.Before(positionsPoll.nextAt) {
		if positionsPoll.backoff > 0 { // say why positions are stale
			note = polyBackoffNote(positionsPoll)
		}
	} else {
		p, err := fetchPositions(wallet)
		finishedAt := time.Now()
		dataAPILastAt = finishedAt
		he, isHTTP := err.(*httpError)
		switch {
		case err == nil:
			positions = p
			positionsPoll.success(finishedAt, positionsInterval)
		case isHTTP && he.Status == 429:
			wait := positionsPoll.failed(finishedAt, he.RetryAfter)
			log.Printf("polymarket positions: rate limited, backing off %s", wait.Round(time.Second))
			note = polyBackoffNote(positionsPoll)
		default:
			note = "polymarket: " + err.Error()
			wait := positionsPoll.failed(finishedAt, 0)
			log.Printf("polymarket positions: request failed, backing off %s", wait.Round(time.Second))
		}
	}
	// Never burst activity immediately after positions on the shared Data API.
	if wallet != "" && !now.Before(activityPoll.nextAt) &&
		(dataAPILastAt.IsZero() || now.Sub(dataAPILastAt) >= dataAPIMinGap) {
		a, err := fetchActivity(wallet)
		finishedAt := time.Now()
		dataAPILastAt = finishedAt
		he, isHTTP := err.(*httpError)
		switch {
		case err == nil:
			activity = a
			activityPoll.success(finishedAt, activityInterval)
		case isHTTP && he.Status == 429:
			wait := activityPoll.failed(finishedAt, he.RetryAfter)
			log.Printf("polymarket activity: rate limited, backing off %s", wait.Round(time.Second))
		default:
			wait := activityPoll.failed(finishedAt, 0)
			log.Printf("polymarket activity: request failed, backing off %s", wait.Round(time.Second))
		}
	}
	lastPositions, lastActivity = positions, activity
	if wallet == "" {
		pnlSeries = nil
	} else {
		refreshPnl(wallet, time.Now())
	}

	// Explicit selection never silently mixes providers. Auto retains fallback.
	prices := map[string]float64{}
	if c.MarketProvider == "" || c.MarketProvider == "auto" || c.MarketProvider == "kraken" {
		prices, _ = fetchKrakenPrices(cryptoCoins(c.Coins))
	}
	if prices == nil {
		prices = map[string]float64{}
	}
	var priceMu sync.Mutex
	var priceWG sync.WaitGroup
	var missing []Coin
	for _, cn := range c.Coins {
		if cn.Kind != "commodity" && prices[cn.ID] == 0 && c.MarketProvider != "kraken" {
			missing = append(missing, cn)
		}
	}
	for _, cn := range missing {
		priceWG.Add(1)
		go func() {
			defer priceWG.Done()
			var p float64
			var err error
			if c.MarketProvider == "binance" {
				p, err = fetchBinancePrice(cn)
			} else {
				p, err = fetchCoinbasePrice(cn)
			}
			if err == nil {
				priceMu.Lock()
				prices[cn.ID] = p
				priceMu.Unlock()
			}
		}()
	}
	priceWG.Wait()

	active := activeCoins(positions, c.Coins)

	mu.Lock()
	if revision != configRevision {
		mu.Unlock()
		return
	}
	for id, price := range prices {
		marketPrice[id] = price
	}
	coinStates := make([]CoinState, 0, len(c.Coins))
	for _, cn := range sortedCoins(cfg.Coins, cfg.Sort, active) {
		p := marketPrice[cn.ID]
		coinState := CoinState{
			Sym: cn.Sym, Name: cn.Name, ID: cn.ID,
			Price: p, Chg24h: cryptoChange(p, cand24[cn.ID]),
			CandlesUpdated: candleUpdated[cn.ID], MarketError: candleErrors[cn.ID], Source: csource[cn.ID], Active: active[cn.ID], Candles: candles[cn.ID],
			Cand24: cand24[cn.ID],
		}
		if cn.Kind == "commodity" {
			asset, _ := findCommodity(cn.ID)
			quote := commodityQuotes[cn.ID]
			coinState.Kind = "commodity"
			coinState.Source = "yahoo"
			coinState.Unit = asset.Unit
			coinState.Contract = quote.Contract
			coinState.QuoteTime = quote.Time
			coinState.Price = quote.Price
			coinState.Chg24h = quote.Change
		}
		coinStates = append(coinStates, coinState)
	}
	state = State{
		Version:    strings.TrimSpace(serverVersion),
		Updated:    time.Now().Unix(),
		Wallet:     wallet,
		CandleDays: c.CandleDays,
		Positions:  positions,
		Coins:      coinStates,
		Activity:   activity,
		Pnl:        buildPnl(pnlSeries),
		Note:       note,
	}
	mu.Unlock()
}

// slow: candles + polymarket history (every 5 min), spaced out
func refreshSlow() {
	slowMu.Lock()
	defer slowMu.Unlock()

	mu.RLock()
	c := cfg
	revision := configRevision
	mu.RUnlock()

	for _, cn := range c.Coins {
		if cn.Kind == "commodity" {
			cs, quote, err := fetchCommodity(cn, c.CandleDays)
			mu.Lock()
			if revision != configRevision {
				mu.Unlock()
				return
			}
			if err != nil {
				candleErrors[cn.ID] = err.Error()
			} else {
				delete(candleErrors, cn.ID)
				commodityQuotes[cn.ID] = quote
				candles[cn.ID] = cs
				candleUpdated[cn.ID] = time.Now().UnixMilli()
			}
			mu.Unlock()
			time.Sleep(1100 * time.Millisecond)
			continue
		}
		cs, src, err := fetchSelectedCandles(cn, c.CandleDays, c.MarketProvider)
		if err != nil {
			log.Printf("market candles %s: %v", cn.Sym, err)
		}
		// Keep a separate 24h series only for the daily price change.
		var c24 []Candle
		if cs != nil && c.CandleDays == 1 {
			c24 = cs
		} else {
			time.Sleep(1100 * time.Millisecond)
			if trend, _, trendErr := fetchSelectedCandles(cn, 1, c.MarketProvider); trendErr == nil {
				c24 = trend
			} else {
				log.Printf("market trend %s: %v", cn.Sym, trendErr)
			}
		}
		mu.Lock()
		if revision != configRevision {
			mu.Unlock()
			return
		}
		if err != nil {
			candleErrors[cn.ID] = err.Error()
		} else {
			delete(candleErrors, cn.ID)
		}
		if cs != nil {
			candles[cn.ID] = cs
			candleUpdated[cn.ID] = time.Now().UnixMilli()
			csource[cn.ID] = src
		}
		if c24 != nil {
			cand24[cn.ID] = c24
		}
		mu.Unlock()
		time.Sleep(1100 * time.Millisecond) // Kraken public REST guidance: at most 1 request/s
	}
}

func loops() {
	refreshFast()
	go refreshSlow()
	fast := time.NewTicker(20 * time.Second)
	slow := time.NewTicker(5 * time.Minute)
	for {
		select {
		case <-fast.C:
			refreshFast()
		case <-slow.C:
			go refreshSlow()
		case <-trigger:
			refreshFast()
			go refreshSlow()
		}
	}
}

/* ------------------------- HTTP handlers ------------------------- */

func handleState(w http.ResponseWriter, r *http.Request) {
	mu.RLock()
	b, _ := json.Marshal(state)
	mu.RUnlock()
	w.Header().Set("Content-Type", "application/json")
	w.Write(b)
}

func handleConfig(w http.ResponseWriter, r *http.Request) {
	if r.Method == "POST" {
		var nc struct {
			Config
			Wallet *string `json:"wallet"`
		}
		if err := json.NewDecoder(r.Body).Decode(&nc); err != nil {
			http.Error(w, "bad json", 400)
			return
		}

		if nc.MarketProvider != "" && !validMarketProvider(nc.MarketProvider) {
			http.Error(w, "unsupported market provider", http.StatusBadRequest)
			return
		}
		if nc.CandleDays != 0 && nc.CandleDays != 1 && nc.CandleDays != 7 && nc.CandleDays != 14 && nc.CandleDays != 30 {
			http.Error(w, "unsupported candle period", http.StatusBadRequest)
			return
		}
		seen := map[string]bool{}
		for i, asset := range nc.Coins {
			if asset.ID == "" || seen[asset.ID] {
				http.Error(w, "invalid or duplicate asset", 400)
				return
			}
			seen[asset.ID] = true
			if asset.Kind == "commodity" {
				c, ok := findCommodity(asset.ID)
				if !ok {
					http.Error(w, "unsupported commodity", 400)
					return
				}
				nc.Coins[i] = c.Coin
			} else if (asset.Kind != "" && asset.Kind != "crypto") || strings.HasPrefix(asset.ID, "yahoo:") {
				http.Error(w, "unsupported asset kind", 400)
				return
			}
		}
		if nc.Wallet != nil {
			wallet := strings.TrimSpace(*nc.Wallet)
			if wallet != "" && !validWallet(wallet) {
				http.Error(w, "invalid wallet address", 400)
				return
			}
		}

		mu.Lock()
		configRevision++
		if nc.MarketProvider != "" {
			cfg.MarketProvider = nc.MarketProvider
		}
		if nc.Wallet != nil {
			cfg.Wallet = strings.TrimSpace(*nc.Wallet)
		}
		if nc.CandleDays != 0 {
			cfg.CandleDays = nc.CandleDays
		}
		if nc.Sort != "" {
			cfg.Sort = nc.Sort
		}
		if nc.Coins != nil {
			cfg.Coins = nc.Coins
		}
		saved := cfg
		state.Wallet = cfg.Wallet
		state.Positions = nil
		state.Activity = nil
		state.Pnl = nil
		state.Coins = nil
		state.Loading = len(cfg.Coins) > 0
		state.CandleDays = cfg.CandleDays
		candles = map[string][]Candle{}
		cand24 = map[string][]Candle{}
		csource = map[string]string{}
		candleErrors = map[string]string{}
		candleUpdated = map[string]int64{}
		marketPrice = map[string]float64{}
		commodityQuotes = map[string]commodityQuote{}
		saveErr := saveConfig(saved)
		mu.Unlock()
		if saveErr != nil {
			http.Error(w, "could not save config", 500)
			return
		}
		select {
		case trigger <- struct{}{}:
		default:
		}
	}
	mu.RLock()
	b, _ := json.Marshal(cfg)
	mu.RUnlock()
	w.Header().Set("Content-Type", "application/json")
	w.Write(b)
}

// Order-only writes preserve market caches and all other settings.
func handleOrder(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		http.Error(w, "method", 405)
		return
	}
	var request struct {
		IDs []string `json:"ids"`
	}
	if json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10)).Decode(&request) != nil {
		http.Error(w, "bad json", 400)
		return
	}
	mu.Lock()
	defer mu.Unlock()
	if len(request.IDs) != len(cfg.Coins) {
		http.Error(w, "watchlist changed", 409)
		return
	}
	byID := map[string]Coin{}
	for _, coin := range cfg.Coins {
		byID[coin.ID] = coin
	}
	ordered := make([]Coin, 0, len(request.IDs))
	for _, id := range request.IDs {
		coin, ok := byID[id]
		if !ok {
			http.Error(w, "invalid asset order", 400)
			return
		}
		ordered = append(ordered, coin)
		delete(byID, id)
	}
	saved := cfg
	saved.Coins = ordered
	saved.Sort = "config"
	if err := saveConfig(saved); err != nil {
		http.Error(w, "could not save order", 500)
		return
	}
	cfg = saved
	byState := map[string]CoinState{}
	for _, coin := range state.Coins {
		byState[coin.ID] = coin
	}
	state.Coins = make([]CoinState, 0, len(byState))
	for _, id := range request.IDs {
		if coin, ok := byState[id]; ok {
			state.Coins = append(state.Coins, coin)
		}
	}
	w.Header().Set("Content-Type", "application/json")
	w.Write([]byte(`{"saved":true}`))
}

// proxy CoinGecko search so the browser never calls out directly
func handleSearch(w http.ResponseWriter, r *http.Request) {
	q := r.URL.Query().Get("q")
	if r.URL.Query().Get("type") == "commodity" {
		w.Header().Set("Content-Type", "application/json")
		json.NewEncoder(w).Encode(searchCommodities(q))
		return
	}
	if q == "" {
		w.Write([]byte("[]"))
		return
	}
	var raw struct {
		Coins []struct {
			ID     string `json:"id"`
			Symbol string `json:"symbol"`
			Name   string `json:"name"`
		} `json:"coins"`
	}
	if err := getJSON("https://api.coingecko.com/api/v3/search?query="+url.QueryEscape(q), &raw, cgHeaders()); err != nil {
		http.Error(w, "[]", 200)
		return
	}
	type res struct {
		Sym, Name, ID string
	}
	out := []res{}
	for i, c := range raw.Coins {
		if i >= 10 {
			break
		}
		out = append(out, res{c.Symbol, c.Name, c.ID})
	}
	b, _ := json.Marshal(out)
	w.Header().Set("Content-Type", "application/json")
	w.Write(b)
}

func staticHandler() http.Handler {
	fs := http.FileServer(http.Dir("."))
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if blockedStatic(r.URL.Path) {
			http.NotFound(w, r)
			return
		}
		if strings.HasSuffix(r.URL.Path, ".webmanifest") {
			w.Header().Set("Content-Type", "application/manifest+json")
		}
		w.Header().Set("Cache-Control", "no-cache")
		fs.ServeHTTP(w, r)
	})
}

func main() {
	setupLogging()
	loadEnvFile(envPath)
	cfg = loadConfig()
	log.Printf("polyDisplay: %d assets, port %d, pin-auth=%v", len(cfg.Coins), cfg.Port, authEnabled())

	go loops()

	mux := http.NewServeMux()
	mux.HandleFunc("/api/auth/pin", handleAuthPin)
	mux.HandleFunc("/api/auth/refresh", handleAuthRefresh)
	mux.HandleFunc("/api/state", requireAccess(handleState))
	mux.HandleFunc("/api/config", requireAccess(handleConfig))
	mux.HandleFunc("/api/order", requireAccess(handleOrder))
	mux.HandleFunc("/api/search", requireAccess(handleSearch))

	mux.Handle("/", staticHandler())

	addr := fmt.Sprintf(":%d", cfg.Port)
	log.Printf("listening on http://0.0.0.0%s", addr)
	log.Fatal(http.ListenAndServe(addr, mux))
}