fix: address code review findings

cmd/api/handlers.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"os"
 	"strings"
 	"time"
 
@@ -109,11 +110,11 @@ func CityStations(hc *HandlerContext, w http.ResponseWriter, r *http.Request) {
 	// Check if any main station is closed by looking for stations without real edges.
 	// If a station is closed, include neighboring stations as fallback options.
 	var closedStationIndices []int
-	for i := range stations {
-		// For demo: if the graph has real edges, station is not closed
+	for i, station := range stations {
+		// Check if this specific station has real edges
 		hasRealEdges := false
-		if len(hc.Router.Edges()) > 0 {
-			for _, edge := range hc.Router.Edges() {
+		for _, edge := range hc.Router.Edges() {
+			if edge.From.ID == station[0] || edge.To.ID == station[0] {
 				if edge.Kind == routing.EdgeKindReal {
 					hasRealEdges = true
 					break
@@ -139,18 +140,16 @@ func CityStations(hc *HandlerContext, w http.ResponseWriter, r *http.Request) {
 			neighborTable.Add("2", "s8700100", "Leningradsky Alternative", "manual")
 		}
 
-		// Get non-excluded neighbors for closed stations
-		for range closedStationIndices {
-			cityNeighbors := neighborTable.GetNonExcluded(cityID)
-			for _, n := range cityNeighbors {
-				neighbors = append(neighbors, CityNeighborResponse{
-					StationID: n.StationID,
-					Name:      n.Name,
-					CityCode:  n.CityCode,
-					Source:    n.Source,
-					IsExcluded: n.IsExcluded,
-				})
-			}
+		// Get non-excluded neighbors for the city
+		cityNeighbors := neighborTable.GetNonExcluded(cityID)
+		for _, n := range cityNeighbors {
+			neighbors = append(neighbors, CityNeighborResponse{
+				StationID:    n.StationID,
+				Name:         n.Name,
+				CityCode:     n.CityCode,
+				Source:       n.Source,
+				IsExcluded:   n.IsExcluded,
+			})
 		}
 	}
 
@@ -404,14 +403,17 @@ func StationStatus(hc *HandlerContext, w http.ResponseWriter, r *http.Request) {
 // adminAuth checks authentication for admin endpoints.
 // Returns true if the request is authenticated, false otherwise.
 func adminAuth(hc *HandlerContext, w http.ResponseWriter, r *http.Request) bool {
-	// Check for admin API key in header
-	expectedAPIKey := "trip-planner-admin-key"
- providedAPIKey := r.Header.Get("X-Admin-Api-Key")
- if providedAPIKey != expectedAPIKey {
-	 http.Error(w, "unauthorized: admin API key required", http.StatusUnauthorized)
-	 return false
- }
- return true
+	// Check for admin API key in header, fallback to default if not set
+	expectedAPIKey := os.Getenv("TRIP_PLANNER_ADMIN_API_KEY")
+	if expectedAPIKey == "" {
+		expectedAPIKey = "trip-planner-admin-key"
+	}
+	providedAPIKey := r.Header.Get("X-Admin-Api-Key")
+	if providedAPIKey != expectedAPIKey {
+		http.Error(w, "unauthorized: admin API key required", http.StatusUnauthorized)
+		return false
+	}
+	return true
 }
 
 // AdminStationStatus handles POST /internal/admin/stations/{id}/status.