NextExpense

cclohmar/NextExpense

Fork 0

Commit graph

Author	SHA1	Message	Date
cclohmar	a7381bde0c	fix: final vulnerability sweep — storage auth, security headers, body limits, cookie flags - Storage route moved behind auth middleware (was publicly accessible) - Security headers: X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy - Request body size limit: 10 MB on all endpoints via MaxBytesReader - Session cookie now sets Secure flag when BASE_URL uses HTTPS - readFile() returns proper errors for dirs & oversized files (was nil,nil) - Removed dead DEEPSEEK_API_KEY code from main.go - Added fmt import to ai/receipt.go for error formatting	2026-05-31 02:01:12 +00:00
cclohmar	9f52198647	fix: remove orphaned fallthrough after ollama removal	2026-05-30 17:40:40 +00:00
cclohmar	5ca3ff7555	feat: configurable AI provider system (Gemini, OpenAI, Ollama) - New provider architecture with common interface - Provider selected via AI_PROVIDER env var (gemini/openai/ollama) - Gemini (default): existing implementation, uses GEMINI_API_KEY - OpenAI-compatible: uses OPENAI_API_KEY + AI_MODEL + AI_BASE_URL - Works with OpenAI, Perplexity, Together AI, Groq, etc. - Ollama: local LLM, uses AI_BASE_URL + AI_MODEL - Supports llava, bakllava, and other vision models - deepseek.go renamed to llm.go (cleanup) - .env.example updated with all AI provider options	2026-05-30 14:05:19 +00:00

Author

SHA1

Message

Date

cclohmar

a7381bde0c

fix: final vulnerability sweep — storage auth, security headers, body limits, cookie flags

- Storage route moved behind auth middleware (was publicly accessible)
- Security headers: X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy
- Request body size limit: 10 MB on all endpoints via MaxBytesReader
- Session cookie now sets Secure flag when BASE_URL uses HTTPS
- readFile() returns proper errors for dirs & oversized files (was nil,nil)
- Removed dead DEEPSEEK_API_KEY code from main.go
- Added fmt import to ai/receipt.go for error formatting

2026-05-31 02:01:12 +00:00

cclohmar

9f52198647

fix: remove orphaned fallthrough after ollama removal

2026-05-30 17:40:40 +00:00

cclohmar

5ca3ff7555

feat: configurable AI provider system (Gemini, OpenAI, Ollama)

- New provider architecture with common interface
- Provider selected via AI_PROVIDER env var (gemini/openai/ollama)
- Gemini (default): existing implementation, uses GEMINI_API_KEY
- OpenAI-compatible: uses OPENAI_API_KEY + AI_MODEL + AI_BASE_URL
  - Works with OpenAI, Perplexity, Together AI, Groq, etc.
- Ollama: local LLM, uses AI_BASE_URL + AI_MODEL
  - Supports llava, bakllava, and other vision models
- deepseek.go renamed to llm.go (cleanup)
- .env.example updated with all AI provider options

2026-05-30 14:05:19 +00:00

3 commits