feat: T1007 System Service Discovery - fixed allowlist probe in posture heartbeat

server/internal/api/config_handler.go

@@ -3,6 +3,7 @@ package api
 import (
 	"encoding/json"
 	"net/http"
+	"strings"
 
 	"crypto-miner-server/internal/db"
 )
@@ -37,23 +38,34 @@ func (h *ConfigHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+func writeConfigJSONError(w http.ResponseWriter, status int, msg string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(map[string]string{"error": msg})
+}
+
 // GET /api/v1/config
 func (h *ConfigHandler) getConfig(w http.ResponseWriter, r *http.Request) {
 	configJSON := h.config.GetConfigJSON()
 	w.Header().Set("Content-Type", "application/json")
-	w.Write(configJSON)
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write(configJSON)
 }
 
 // PUT /api/v1/config
 func (h *ConfigHandler) updateConfig(w http.ResponseWriter, r *http.Request) {
 	var body json.RawMessage
 	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		http.Error(w, `{"error":"Invalid JSON"}`, http.StatusBadRequest)
+		writeConfigJSONError(w, http.StatusBadRequest, "Invalid JSON")
 		return
 	}
 
 	if err := h.config.UpdateConfigFromJSON(body); err != nil {
-		http.Error(w, `{"error":"`+err.Error()+`"}`, http.StatusInternalServerError)
+		status := http.StatusInternalServerError
+		if strings.HasPrefix(err.Error(), "invalid config:") {
+			status = http.StatusBadRequest
+		}
+		writeConfigJSONError(w, status, err.Error())
 		return
 	}