Commit graph

17 commits

Author SHA1 Message Date
d65c0cd5fa feat: add month hierarchy, AI categories, and UI polish
- Restructure hierarchy: Month → Event → Expense (new months table, FK)
- Add MonthHandler with CRUD, monthly reports, dropdown create form
- Events now scoped under months with extended ownership chain
- AI extraction: 16 specific expense categories (Airfare, Meals, etc.)
- UI: category dropdown, button-consistent cards, centered mobile shell on desktop
- Dashboard/month views show claim totals per card
- Description field now mandatory, forms simplified
- Months sorted by name chronologically (latest first)
2026-07-14 09:29:26 +00:00
92f070440f refactor: implement best-practice recommendations from code review
MUST FIX:
- M1: Fixed ignored errors in AI providers (json.Marshal, http.NewRequest, json.Unmarshal)
- M2: Template cache — pre-parse all templates once at startup, reuse via getTemplate()
- M3: Fixed silent ParseFloat error fallbacks — now returns HTTP 400 on invalid amounts
- M4: Wrapped readFile errors with context (fmt.Errorf with %w)
- M5: Deleted stale llm.go placeholder file
- M6: Renamed utils.New() to utils.NewUUID() for clarity
- M7: Validate current_event_id cookie UUID format, prevent tampering

SHOULD FIX:
- S4: Added utils.Timestamp() helper to replace repeated time.Now().Format() calls
- S6: Added request ID middleware for concurrent request log tracing
- S7: Increased DB pool from 1 to 4 connections (HTMX concurrency)
- S8: Graceful shutdown via http.Server.Shutdown() on SIGINT/SIGTERM
- S9: Storage served behind auth middleware with path traversal check

COULD FIX:
- C2: renderOTPForm uses cached template (not per-request Must)
- C3: CSP pinned to unpkg.com/htmx.org@1.9.10
- C4: Added ReadHeaderTimeout, ReadTimeout, WriteTimeout, IdleTimeout
- C7: PDF generation auto-adds page breaks when content overflows

ADDITIONAL:
- Pass config to AI provider constructors (newGeminiProvider, newOpenAIProvider)
- Value receivers on geminiProvider/openaiProvider (empty structs)
- Added envOrDefault() helper in ai/receipt.go
- Session cleanup goroutine started in main.go
- Removed duplicate imports and unused html/template from handlers
2026-05-31 02:13:07 +00:00
a7381bde0c fix: final vulnerability sweep — storage auth, security headers, body limits, cookie flags
- Storage route moved behind auth middleware (was publicly accessible)
- Security headers: X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy
- Request body size limit: 10 MB on all endpoints via MaxBytesReader
- Session cookie now sets Secure flag when BASE_URL uses HTTPS
- readFile() returns proper errors for dirs & oversized files (was nil,nil)
- Removed dead DEEPSEEK_API_KEY code from main.go
- Added fmt import to ai/receipt.go for error formatting
2026-05-31 02:01:12 +00:00
9f52198647 fix: remove orphaned fallthrough after ollama removal 2026-05-30 17:40:40 +00:00
3327fd4fac feat: use glm-ocr as default Ollama model (specialized OCR, not a general LLM)
- glm-ocr is a 1.1B parameter model built specifically for OCR
- No reasoning overhead, no thinking field issues
- Faster inference than qwen3.5 on CPU
- Removed old qwen3.5 models (2B + 0.8B) to free ~4GB disk
- Updated install.sh, ollama.go, .env.example defaults
2026-05-30 17:17:06 +00:00
1eca4ae777 fix: qwen3.5 reasoning model outputs to thinking field not content
- ollamaResponse now reads both content and thinking fields
- Falls back to thinking if content is empty
- Install script adds model warm-up prompt to preload into memory
- Warm-up uses OLLAMA_HOST for correct user context
- Makes first real receipt analysis faster
2026-05-30 16:51:43 +00:00
b6c2c3f99d fix: Ollama timeout + image compression + selective sudo in install.sh 2026-05-30 15:41:47 +00:00
c0d3002e22 fix: remove hardcoded credentials from .env.example and source
- .env.example: placeholder values only
- gemini.go: error on missing API key instead of fallback
- main.go: dynamic from address from SMTP_USER
- Security: old credentials removed from active codebase
2026-05-30 15:08:01 +00:00
5ca3ff7555 feat: configurable AI provider system (Gemini, OpenAI, Ollama)
- New provider architecture with common interface
- Provider selected via AI_PROVIDER env var (gemini/openai/ollama)
- Gemini (default): existing implementation, uses GEMINI_API_KEY
- OpenAI-compatible: uses OPENAI_API_KEY + AI_MODEL + AI_BASE_URL
  - Works with OpenAI, Perplexity, Together AI, Groq, etc.
- Ollama: local LLM, uses AI_BASE_URL + AI_MODEL
  - Supports llava, bakllava, and other vision models
- deepseek.go renamed to llm.go (cleanup)
- .env.example updated with all AI provider options
2026-05-30 14:05:19 +00:00
646378df64 feat: gallery upload + PDF receipt support
- Two upload buttons: Camera (capture) and Upload (gallery/PDF)
- PDF receipts from Uber/email now accepted and processed by Gemini Vision
- PDF detection via %PDF magic bytes in both handler and AI module
- Descriptions updated to reflect broader file support
2026-05-30 13:50:22 +00:00
4895b3d608 feat: add KES support + base currency + exchange rate for expense claims
- Added KES and 12+ additional currencies to receipt form
- Events now have base_currency (claim currency) and exchange_rate fields
- Receipts show original amount + auto-computed converted amount
- Converted amounts stored per expense in database
- CSV and PDF reports include both original and converted amounts
- Dashboard shows claim currency per event card
2026-05-30 12:23:31 +00:00
46c78ef507 chore: use gemini-2.0-flash-lite (most cost-effective model) 2026-05-30 12:14:46 +00:00
127046c9b7 feat: switch AI provider from DeepSeek to Google Gemini Vision API
- DeepSeek API does not support vision (only chat UI supports images)
- Google Gemini Vision supports native image analysis via inline_data
- Images are sent directly as base64 with proper MIME type detection
- No more OCR pipeline needed - Gemini sees the image directly
- Supports: JPEG, PNG, WebP, GIF, BMP, TIFF, HEIC, AVIF
- Updated .env.example to use GEMINI_API_KEY instead of DEEPSEEK_API_KEY
- Also: log OTP code in server log for easier debugging
2026-05-30 12:11:20 +00:00
fecf4af8a2 fix: AI receipt extraction now uses OCR (Tesseract) + LLM (DeepSeek) pipeline
- Problem: deepseek-v4-flash is text-only, cannot process base64 images - hallucinated fake data
- Solution: Two-step pipeline that actually extracts real data:
  1. Tesseract OCR extracts raw text from the receipt image
  2. DeepSeek v4 parses the OCR text into structured JSON
- Benefits: works with any image format, fast, accurate, no hallucinated data
- Properly handles HEIC/HEIF via heif-convert before OCR
2026-05-30 12:00:40 +00:00
ebe06082cf fix: support HEIC/HEIF photos from iPhone + broaden accepted image formats
- detectImageExtension now handles: JPEG, PNG, WebP, GIF, BMP, TIFF, HEIC, AVIF
- Added heif-convert + ImageMagick fallback for decoding unsupported formats
- AI extraction properly converts HEIC to JPEG before analysis
- Model: deepseek-v4-flash (confirmed working)
2026-05-30 11:54:31 +00:00
dc407fbf06 fix: DeepSeek Vision API changed - use text-embedded base64 + image compression instead of image_url content type
- DeepSeek no longer supports image_url in chat completions
- Images are now resized (max 300px) and JPEG-compressed (quality 50)
- Base64 data embedded directly in text prompt for processing
- Increased API timeout to 120s for larger prompts
- Also fixed mobile receipt capture (missing name attribute on file input)
- Also fixed OTP htmx:targetError (outerHTML → innerHTML swap)
2026-05-30 11:46:49 +00:00
ca970104ee chore: initial commit — ExpenseFlow AI-Powered Expense Tracker
- Passwordless email OTP authentication
- Event-based expense tracking with HTMX UI
- AI receipt extraction via DeepSeek Vision API
- CSV/PDF report generation with email filing
- PWA with service worker and manifest
- Mobile-first responsive design
- SQLite database with auto-migration
2026-05-29 19:43:30 +00:00