e8218a3dd8
bill tracker futurue
2026-05-28 02:09:49 -05:00
fa60ea8fbd
fix paid coloum
2026-05-28 01:38:18 -05:00
a811589db4
theme correctness
2026-05-28 01:30:40 -05:00
82de135186
push
2026-05-18 09:44:16 -05:00
55837b8b25
docs: update engineering reference manual to v0.28.01
...
- Add sections 5.15-5.21 (Data Sources, Transactions, CSV Import, Match Suggestions)
- Add v0.47-v0.64 migrations to database reference
- Add data_sources, financial_accounts, transactions table schemas
- Add payment_source and transaction_id to payments table
- Update version header to 0.28.01, date to 2026-05-16
- Fix section numbering
2026-05-16 21:41:13 -05:00
060c8dc2f4
chore: version bump to 0.28.01 and update HISTORY format
2026-05-16 21:36:04 -05:00
9d933f70cc
v0.28.01
2026-05-16 20:26:09 -05:00
0c628212a0
feat: implement cycle_type logic in statusService (weekly/biweekly/quarterly/annual)
2026-05-16 15:42:54 -05:00
b124e48ebc
v0.28.0
2026-05-16 15:38:28 -05:00
8913436575
v0.28.0
2026-05-16 11:56:38 -05:00
53670b3745
v0.28.0
2026-05-16 11:42:32 -05:00
88c1374d97
v028.0
2026-05-16 10:56:56 -05:00
59d9d21d4c
v0.28.0
2026-05-16 10:34:32 -05:00
9174ec3290
v0.28.
2026-05-16 10:17:24 -05:00
bfc1521835
v0.28.0
2026-05-15 22:52:28 -05:00
0ba315bd32
v0.28.0
2026-05-15 22:45:38 -05:00
74603ff2d5
v0.27.04
2026-05-15 04:22:33 -05:00
153ed7ab79
v0.27.04
2026-05-15 02:26:10 -05:00
48dcb480ba
v0.27.04
2026-05-15 01:49:55 -05:00
263f1c5e6e
v0.27.04
2026-05-15 01:36:56 -05:00
576163e85b
apr/snowball 0.27.04
2026-05-15 00:03:32 -05:00
d720931894
v0.27.02 push
2026-05-14 21:00:07 -05:00
eea5641126
snowball visuals
2026-05-14 19:33:23 -05:00
7aff0d0283
snowball ui fiix
2026-05-14 03:23:52 -05:00
ce22139bb3
chore: bump version to 0.27.01
2026-05-14 03:01:47 -05:00
440f872d97
snowball bug fixes
2026-05-14 03:00:01 -05:00
cd61c2ef7f
v.0.50 db migration bug
2026-05-14 02:51:29 -05:00
488f329e14
chore: sync package.json version to 0.27.0
2026-05-14 02:24:50 -05:00
7d2d0bf45e
0.28.0 snowball release
2026-05-14 02:11:54 -05:00
48fe87ea25
corrections
2026-05-14 01:17:05 -05:00
d2acf44846
chore: untrack private docs (STRUCTURE, FUTURE, HISTORY, DEVELOPMENT_LOG)
2026-05-13 04:04:29 -05:00
34b0f75918
v0.26.1: fix dual-column XLSX parser bugs
...
- Rewrite detectAllHeaderSets() with repeat-field detection instead of gap-based splitting
- Require ≥2 header fields per group (filters out false matches like 'Left Over | Paid')
- Fix column leakage: right-side bills no longer pick up left-side amounts
- Add header_set_index to analyzeRow return object for frontend use
- Add isLikelySummaryRow() filter (Paycheck, Left Over, Enter how much, etc.)
- Expand isLikelyTotalRow() to catch 'Auto Total ------>' patterns
- Filter leftover calc rows (null name + negative amount, dash separators)
- Remove 'paid' from HEADER_PATTERNS.amount (was false-matching 'Paid' cells)
- Skip empty string cells in detectAllHeaderSets
2026-05-11 23:17:19 -05:00
d32a30495d
docs: update HISTORY v0.26.0, remove completed XLSX dual-column from FUTURE
2026-05-11 22:19:02 -05:00
831f617893
v0.26.0: dual-column XLSX import parser
...
- detectAllHeaderSets() finds multiple header groups per row (left 1st / right 15th)
- isBlankRowForHeaderSet() checks blanks per column range for dual layouts
- parseSheetRows() scans rows 0-4 for header row, processes each set independently
- analyzeRow() computes due_day from date/label/pattern with fallback to defaultDueDay
- Cell type validation allows 's' (shared formula) type
- Non-numeric amounts (auto, double pay, past due) become detected labels
- Day patterns (1st, 15th, 24th) parsed as due_day values
- Security: bounds validation in isBlankRowForHeaderSet, anchored regex, label sanitization
2026-05-11 22:13:37 -05:00
579eed37b8
docs: update HISTORY v0.25.0, remove completed CSRF fix from FUTURE
2026-05-11 21:46:33 -05:00
2ce5328fd2
v0.25.0: roadmap redesign, import CSRF fix, AdminDashboard removed
...
- RoadmapPage: kanban-style priority lanes, shadcn Collapsible/Tabs,
lazy-loaded activity log, admin-only /api/about/roadmap + /dev-log endpoints
- Import CSRF fix: added x-csrf-token header to importAdminBackup,
previewSpreadsheetImport, previewUserDbImport raw fetch() calls
- Removed AdminDashboard.jsx, replaced by RoadmapPage
- Added @radix-ui/react-collapsible + collapsible shadcn component
- Security audit by Private_Hudson: PASS (CSRF fix verified,
admin endpoints gated, path traversal mitigated, XSS safe)
2026-05-11 21:42:36 -05:00
98ede20cd3
fix: prevent duplicate payment prompts
2026-05-11 16:04:21 -05:00
22f9a570aa
v0.24.5: starting amounts fix, pay badge alignment, demo data persistence
2026-05-11 15:25:04 -05:00
b29d3a0b02
fix: starting amounts paid_from_other calculation + pay badge alignment on tracker
2026-05-11 15:00:35 -05:00
890427c75a
v0.24.3: Session fixes, activity log corrections, UI polish
2026-05-11 13:39:48 -05:00
24b4e8d24e
refactor: extract bills.js business logic into services/billsService.js (Phase 1)
2026-05-11 12:12:31 -05:00
c1ac14efe3
v0.24.4: analytics mobile layout + previous month payment toggle
2026-05-11 11:56:49 -05:00
86148a101f
feat: remove confirmation popup from status badge toggle (v0.24.3)
...
Clicking status badges (Late, Due Soon, Upcoming, Missed) now instantly
toggles paid/unpaid. Removed AlertDialog from TrackerPage.jsx — no more
confirmation dialog blocking the action.
2026-05-10 17:56:23 -05:00
6d42453e07
fix: status badge toggle-paid using wrong property name (v0.24.2)
...
handleTogglePaid() was using row.bill_id instead of row.id, causing
the API call to fail with an undefined bill ID. Clicking status badges
(Late, Due Soon, Upcoming, Missed) now correctly toggles paid/unpaid.
2026-05-10 17:28:26 -05:00
ba888c1c6f
feat: export privacy warning + updated included fields list (v0.24.1)
...
- Added amber warning banner on Download My Data section about sensitive metadata
- Updated 'What's included' list to show monthly starting amounts and history ranges
- Marked LOW export sensitive fields item as FIXED in FUTURE.md
2026-05-10 15:29:35 -05:00
80b3bcc17b
fix: HIGH+MEDIUM batch — 10 fixes (v0.24.0)
...
HIGH:
- Admin toggle-paid: removed cross-user admin branch, now requires ownership
- Analytics crash: imported missing standardizeError
- Export data loss: added cycle_type, cycle_day, bill_history_ranges to exports
- Single-user lockout: removed unnecessary sessions join from getSingleModeUser
MEDIUM:
- Password rate limiter: scoped to change-password only, not all profile routes
- Profile session invalidation: fixed req.sessionId → req.cookies[COOKIE_NAME]
- CSRF default: httpOnly now defaults to false (matches SPA double-submit pattern)
- CSRF password routes: removed csrfSkip for password change endpoints
- Notification due-day: calendar day comparison instead of timestamp floor
- Upcoming bills: clamped days to 1-365, default 30 for invalid input
FUTURE.md: marked all 10 items as FIXED, bumped version refs
HISTORY.md: added v0.24.0 entry
2026-05-10 15:25:47 -05:00
5537ab2bd5
fix: clear demo data button, seed user ID bug, duplicate endpoint (v0.23.4)
...
- DataPage: removed 'coming soon' placeholder, made Clear Demo Data button accessible from seeded state
- seedDemoData.js: fixed userId -> targetUserId bug
- settings.js: removed duplicate /api/settings/seed-demo-data endpoint
- Version bumped to 0.23.4
2026-05-10 15:11:02 -05:00
6d488aa8bd
docs: update HISTORY.md and FUTURE.md for v0.23.3
2026-05-10 14:37:42 -05:00
5eed5932b4
feat: replace native confirm() with shadcn/ui AlertDialog (v0.23.3)
...
- TrackerPage: confirm('Mark as paid?') → AlertDialog with dynamic bill name
- DataPage: window.confirm('Import SQLite?') → AlertDialog for import confirmation
- Both dialogs use proper shadcn/ui components (AlertDialogAction/Cancel)
- Theme-aware, accessible, consistent with app design system
- STRUCTURE.md: corrected tech stack (Vite+React, not Next.js)
- Version bumped to 0.23.3
2026-05-10 14:36:59 -05:00
7c3cfd1715
docs: update README.md, ERM, FUTURE.md, HISTORY.md
...
README.md updates:
- Added billing cycles (weekly/biweekly/quarterly/annual), history ranges,
monthly income/starting amounts, migration rollback, audit logging,
auth-mode/OIDC config, CSRF protection details
- Added INIT_REGULAR_USER/PASS and SESSION_CLEANUP_INTERVAL_MS env vars
- Added CSRF env vars (CSRF_HTTP_ONLY, CSRF_SAME_SITE, CSRF_SECURE,
CSRF_COOKIE_NAME)
- Noted export limitation: cycle_type, cycle_day, history_ranges omitted
- Fixed: CSP is now implemented with per-request nonces (was 'deferred')
- Added: default admin restricted from tracker routes, session rotation
on password change, audit logging
- Cleaned up demo server formatting, project structure listing, scripts
- Removed authLogin.js from project structure (file was deleted in v0.23.2)
Engineering_Reference_Manual.md:
- Removed stale authLogin.js duplicate route note (file no longer exists)
- Removed 401/403 error detail from login endpoint (simplified)
- Updated version to 0.23.2
FUTURE.md:
- Marked notification privacy leak (CRITICAL) as FIXED v0.23.2
- Marked duplicate login route (LOW) as FIXED v0.23.2
- Updated current version to v0.23.2
HISTORY.md:
- Added v0.23.2 entry with security fix and route consolidation details
2026-05-10 12:42:45 -05:00
null