NextExpense

cclohmar/NextExpense

Fork 0

Commit graph

Author	SHA1	Message	Date
cclohmar	92f070440f	refactor: implement best-practice recommendations from code review MUST FIX: - M1: Fixed ignored errors in AI providers (json.Marshal, http.NewRequest, json.Unmarshal) - M2: Template cache — pre-parse all templates once at startup, reuse via getTemplate() - M3: Fixed silent ParseFloat error fallbacks — now returns HTTP 400 on invalid amounts - M4: Wrapped readFile errors with context (fmt.Errorf with %w) - M5: Deleted stale llm.go placeholder file - M6: Renamed utils.New() to utils.NewUUID() for clarity - M7: Validate current_event_id cookie UUID format, prevent tampering SHOULD FIX: - S4: Added utils.Timestamp() helper to replace repeated time.Now().Format() calls - S6: Added request ID middleware for concurrent request log tracing - S7: Increased DB pool from 1 to 4 connections (HTMX concurrency) - S8: Graceful shutdown via http.Server.Shutdown() on SIGINT/SIGTERM - S9: Storage served behind auth middleware with path traversal check COULD FIX: - C2: renderOTPForm uses cached template (not per-request Must) - C3: CSP pinned to unpkg.com/htmx.org@1.9.10 - C4: Added ReadHeaderTimeout, ReadTimeout, WriteTimeout, IdleTimeout - C7: PDF generation auto-adds page breaks when content overflows ADDITIONAL: - Pass config to AI provider constructors (newGeminiProvider, newOpenAIProvider) - Value receivers on geminiProvider/openaiProvider (empty structs) - Added envOrDefault() helper in ai/receipt.go - Session cleanup goroutine started in main.go - Removed duplicate imports and unused html/template from handlers	2026-05-31 02:13:07 +00:00
cclohmar	c0d3002e22	fix: remove hardcoded credentials from .env.example and source - .env.example: placeholder values only - gemini.go: error on missing API key instead of fallback - main.go: dynamic from address from SMTP_USER - Security: old credentials removed from active codebase	2026-05-30 15:08:01 +00:00
cclohmar	5ca3ff7555	feat: configurable AI provider system (Gemini, OpenAI, Ollama) - New provider architecture with common interface - Provider selected via AI_PROVIDER env var (gemini/openai/ollama) - Gemini (default): existing implementation, uses GEMINI_API_KEY - OpenAI-compatible: uses OPENAI_API_KEY + AI_MODEL + AI_BASE_URL - Works with OpenAI, Perplexity, Together AI, Groq, etc. - Ollama: local LLM, uses AI_BASE_URL + AI_MODEL - Supports llava, bakllava, and other vision models - deepseek.go renamed to llm.go (cleanup) - .env.example updated with all AI provider options	2026-05-30 14:05:19 +00:00

Author

SHA1

Message

Date

cclohmar

92f070440f

refactor: implement best-practice recommendations from code review

MUST FIX:
- M1: Fixed ignored errors in AI providers (json.Marshal, http.NewRequest, json.Unmarshal)
- M2: Template cache — pre-parse all templates once at startup, reuse via getTemplate()
- M3: Fixed silent ParseFloat error fallbacks — now returns HTTP 400 on invalid amounts
- M4: Wrapped readFile errors with context (fmt.Errorf with %w)
- M5: Deleted stale llm.go placeholder file
- M6: Renamed utils.New() to utils.NewUUID() for clarity
- M7: Validate current_event_id cookie UUID format, prevent tampering

SHOULD FIX:
- S4: Added utils.Timestamp() helper to replace repeated time.Now().Format() calls
- S6: Added request ID middleware for concurrent request log tracing
- S7: Increased DB pool from 1 to 4 connections (HTMX concurrency)
- S8: Graceful shutdown via http.Server.Shutdown() on SIGINT/SIGTERM
- S9: Storage served behind auth middleware with path traversal check

COULD FIX:
- C2: renderOTPForm uses cached template (not per-request Must)
- C3: CSP pinned to unpkg.com/htmx.org@1.9.10
- C4: Added ReadHeaderTimeout, ReadTimeout, WriteTimeout, IdleTimeout
- C7: PDF generation auto-adds page breaks when content overflows

ADDITIONAL:
- Pass config to AI provider constructors (newGeminiProvider, newOpenAIProvider)
- Value receivers on geminiProvider/openaiProvider (empty structs)
- Added envOrDefault() helper in ai/receipt.go
- Session cleanup goroutine started in main.go
- Removed duplicate imports and unused html/template from handlers

2026-05-31 02:13:07 +00:00

cclohmar

c0d3002e22

fix: remove hardcoded credentials from .env.example and source

- .env.example: placeholder values only
- gemini.go: error on missing API key instead of fallback
- main.go: dynamic from address from SMTP_USER
- Security: old credentials removed from active codebase

2026-05-30 15:08:01 +00:00

cclohmar

5ca3ff7555

feat: configurable AI provider system (Gemini, OpenAI, Ollama)

- New provider architecture with common interface
- Provider selected via AI_PROVIDER env var (gemini/openai/ollama)
- Gemini (default): existing implementation, uses GEMINI_API_KEY
- OpenAI-compatible: uses OPENAI_API_KEY + AI_MODEL + AI_BASE_URL
  - Works with OpenAI, Perplexity, Together AI, Groq, etc.
- Ollama: local LLM, uses AI_BASE_URL + AI_MODEL
  - Supports llava, bakllava, and other vision models
- deepseek.go renamed to llm.go (cleanup)
- .env.example updated with all AI provider options

2026-05-30 14:05:19 +00:00

3 commits