e94a17160b
All checks were successful
Build and Test / build-and-test (push) Successful in 39s
deploy/CICD.md documents which git push/tag triggers which pipeline steps; deploy/AUTH.md documents the Authelia OIDC integration contract with a sequence diagram of the login flow. Cross-link from README and INSTALL. The 0.1.0 release also ships the previously-committed security hardening (server-side session expiry + nosniff on served files). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
3.3 KiB
3.3 KiB
Changelog
All notable changes to this project are documented here. Versions are git tags;
release tags X.Y.Z are built and deployed automatically (pre-release tags such
as 0.0.0a1 are built and staged only).
[0.1.0] - 2026-06-20
Security
- Enforce the 12h session lifetime server-side (reject sessions older than the TTL even if the sealed cookie is intact), so a leaked cookie can't be replayed forever.
- Send
X-Content-Type-Options: nosniffwhen serving user-uploaded receipt and attachment bytes.
Docs
- Add deploy docs:
deploy/CICD.md(which git push/tag triggers which pipeline steps) anddeploy/AUTH.md(the Authelia/OIDC integration contract + a sequence diagram of the login flow). Cross-linked from the README anddeploy/INSTALL.md.
[0.0.4] - 2026-06-20
Changed
- AI tab: correction notes are now full-width, wrapping, auto-growing textareas (Save/Delete per note) instead of single-line inputs that truncated long notes, so the whole note is readable and editable.
[0.0.3] - 2026-06-20
Added
- AI classifier correction notes + misread review (new "AI" tab).
- A global list of free-text correction notes is appended to the classifier prompt; managed inline (add/edit/delete). The notes table is temporal (edits soft-delete + insert), seeded once from a no-PII default list (documented in the README), and read live per classification.
- A read-only view of the exact assembled prompt.
- Every AI-run upload records the suggestion blob + model (round-tripped from the browser). Misreads — where a final field differs from the AI's guess — are derived and listed for review; reviewing shows the image and per-field guess-vs-entered, and lets the user attribute which note(s) fixed it (or close it unresolved).
- See SPEC.md §10 and DESIGN.md item 15.
[0.0.2] - 2026-06-20
Added
- Optional tags on a receipt. An "Add tags" button on the upload form (after
"Who") opens an in-page card with an alphabetical chip mosaic; tap to select or
deselect, and create a new tag inline (auto-selected for this receipt). Tags are
a shared, free-form vocabulary stored separately from the fixed categories.
- New tags are written to the catalog only when the receipt is actually saved, matched case-insensitively so casing variants don't duplicate.
- A receipt's tags are shown on the confirmation page and in the recent lists.
- See spec.md item 14. Out of scope for now: tag-based filtering, tally-by-tag, and editing/merging tags in Manage.
[0.0.1] - 2026-06-19
Added
- Upright receipt images (EXIF orientation normalization). Phone cameras often
store a photo sideways with an EXIF "Orientation" tag that only some viewers
honor, so receipts could appear rotated. On upload the indicated rotation is now
baked into the pixels (and the tag dropped) so the stored image is upright in
every consumer — browser, download, the AI classifier, and any future export.
- Applies only when orientation is actually known (a JPEG with an EXIF tag of 2..8). Images with no tag, an already-upright tag, non-JPEG images, and PDFs are left byte-for-byte untouched — no guessing from image content.
- Runs on the primary receipt, every additional attachment, and the image sent to the AI classifier. New uploads only; existing stored receipts are unchanged.
- See spec.md item 13.