From 5bf0386cd492521344274769c94f4733db583648 Mon Sep 17 00:00:00 2001
From: romysaputrasihananda <romysaputrasihanandaa@gmail.com>
Date: Thu, 11 Jun 2026 15:16:19 +0700
Subject: [PATCH] fix(web): send X-API-Key header to MT5 bridge for Cloudflare
 WAF bypass

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 web/lib/mt5.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/web/lib/mt5.ts b/web/lib/mt5.ts
index 1ff16e3..465f2d3 100644
--- a/web/lib/mt5.ts
+++ b/web/lib/mt5.ts
@@ -1,9 +1,13 @@
 // Server-side only — bridge URL never leaves this file
 
 async function apiFetch<T>(path: string): Promise<T> {
-  const base = process.env.MT5_BASE_URL ?? "http://localhost:8000";
+  const base    = process.env.MT5_BASE_URL    ?? "http://localhost:8000";
+  const apiKey  = process.env.MT5_API_KEY;
+  const headers: Record<string, string> = {};
+  if (apiKey) headers["X-API-Key"] = apiKey;
   const res = await fetch(`${base}${path}`, {
-    next: { revalidate: 0 }, // always fresh
+    headers,
+    next: { revalidate: 0 },
   });
   if (!res.ok) throw new Error(`MT5 bridge ${path} → ${res.status}`);
   return res.json();