866bc175fb
All checks were successful
Build and Test / build-and-test (push) Successful in 38s
1. Enforce the 12h session lifetime server-side in requireAuth (reject a session older than the TTL even if the sealed cookie is intact), so a leaked cookie value can't be replayed indefinitely. Shared sessionTTL const drives both the cookie MaxAge and the check. 2. Send X-Content-Type-Options: nosniff when serving user-uploaded receipt/attachment bytes, so the browser won't sniff past the declared (upload-time allowlisted) MIME type. Update SPEC §2 and §6 accordingly; tests cover stale-session rejection. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .forgejo/workflows | ||
| cmd/hsa | ||
| deploy | ||
| internal | ||
| scripts | ||
| .env.example | ||
| .gitignore | ||
| call_claude.sh | ||
| CHANGELOG.md | ||
| config.json | ||
| DESIGN.md | ||
| go.mod | ||
| go.sum | ||
| plan.md | ||
| README.md | ||
| secret.md | ||
| secret.sh | ||
| SPEC.md | ||
HSA Receipt Tracker
A small, mobile-first web app for two household users to capture and archive HSA-eligible receipts (photo or PDF) for future reimbursement and tax substantiation, with optional AI auto-fill of the amount/date/category/patient.
- What it does (current behavior): SPEC.md — the source of truth.
- Why it's built this way (history & rationale): DESIGN.md.
- Version log: CHANGELOG.md.
Running
It's a single static Go binary (CGO_ENABLED=0, pure-Go SQLite). Configure via
environment (see .env.example); ./scripts/build.sh builds it and
./scripts/run.sh runs it locally. Deployment notes: deploy/INSTALL.md.
AI classifier correction notes
When an API key is configured, each upload is read by the model to pre-fill the form. You can steer it with correction notes — free-text rules appended to the classifier prompt — managed under the AI tab. When the model misreads a receipt, that upload is recorded; the AI tab lets you review misreads one by one and attribute which note fixed each.
Notes live only in the database (private, never committed, included in /export/db
backups). On first run the table is seeded once with these default notes (no
PII), which you can edit or delete:
- Amounts that use a comma as the decimal separator (e.g. "12,50") mean 12.50, not 1250.
- When both a service/visit date and a separate statement, print, or due date appear, use the service date.
- "Patient Pay", "You Paid", "Amount Due", and "Patient Responsibility" are the amount actually paid — prefer them over subtotals or insurance-covered amounts.
These defaults are defined in code (internal/storage/ai_notes.go); this list is
the human-readable copy. They are only seeded when the notes table is empty, so a
deleted default does not come back on restart.