Feature improvement and bug fixes

.env.example

@@ -18,3 +18,6 @@ SMTP_FROM="FinTrack AI" <your_email@gmail.com>
 # SMTP_SECURE=false
 # SMTP_USER=apikey
 # SMTP_PASS=your_sendgrid_api_key
+
+# Google Gemini AI (Required for OCR Receipt & Bank Statement parsing)
+GEMINI_API_KEY=your_gemini_api_key_here

.gitignore

@@ -6,3 +6,4 @@ node_modules/
 dist/
 build/
 coverage/
+uploads/

package.json

@@ -27,7 +27,9 @@
     "mongoose": "^9.10.0",
     "morgan": "^1.10.0",
     "multer": "^2.3.0",
-    "nodemailer": "^10.0.8"
+    "nodemailer": "^10.0.8",
+    "pdf-parse": "^2.4.5",
+    "uuid": "^14.0.2"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

src/app.js

@@ -11,20 +11,36 @@ const app = express();
 // Security HTTP headers
 app.use(helmet({ crossOriginResourcePolicy: { policy: 'cross-origin' } }));
 
-// Enable CORS (Dynamic localhost allowed for Flutter Web dev)
+// Enable CORS (supports mobile apps, localhost, and configured client domains)
+const allowedOrigins = (config.clientUrl || '*')
+  .split(',')
+  .map((s) => s.trim().replace(/\/$/, ''))
+  .filter(Boolean);
+
 app.use(
   cors({
     origin: (origin, callback) => {
+      // Mobile apps, curl, and native HTTP clients send no Origin header
+      if (!origin) {
+        return callback(null, true);
+      }
+
+      // Development, wildcard, or local addresses
       if (
-        !origin ||
         config.nodeEnv === 'development' ||
+        allowedOrigins.includes('*') ||
         origin.includes('localhost') ||
         origin.includes('127.0.0.1')
       ) {
-        callback(null, true);
-      } else {
-        callback(null, origin === config.clientUrl);
+        return callback(null, true);
+      }
+
+      const cleanOrigin = origin.replace(/\/$/, '');
+      if (allowedOrigins.includes(cleanOrigin)) {
+        return callback(null, true);
       }
+
+      return callback(null, false);
     },
     credentials: true,
   })
@@ -39,6 +55,15 @@ if (config.nodeEnv === 'development') {
 app.use(express.json());
 app.use(express.urlencoded({ extended: true }));
 
+// Root health check for GCP Cloud Run and load balancers
+app.get('/health', (req, res) => {
+  res.status(200).json({
+    status: 'healthy',
+    uptime: Math.round(process.uptime()),
+    timestamp: new Date().toISOString(),
+  });
+});
+
 // Root welcome route
 app.get('/', (req, res) => {
   res.json({

src/config/env.js

@@ -9,4 +9,5 @@ export const config = {
   mongoUri: process.env.MONGO_URI || '',
   jwtSecret: process.env.JWT_SECRET || 'dev_secret_key_change_in_production',
   jwtExpiresIn: process.env.JWT_EXPIRES_IN || '7d',
+  geminiApiKey: process.env.GEMINI_API_KEY || '',
 };

src/controllers/auth.controller.js

@@ -27,13 +27,13 @@ export const sendEmailOtp = async (req, res, next) => {
     // Send email dispatch
     const delivery = await EmailService.sendOtpEmail({ email: cleanEmail, otp });
 
-    return ApiResponse.success(res, delivery.sent && delivery.method === 'smtp'
-      ? `Verification code delivered to ${cleanEmail}`
-      : 'Verification code generated (Check email or local console)', {
+    if (!delivery.sent) {
+      return ApiResponse.error(res, delivery.error || 'Failed to send verification email. Please check your email configuration.', 500);
+    }
+
+    return ApiResponse.success(res, `Verification code sent to ${cleanEmail}`, {
       email: cleanEmail,
-      deliveredToInbox: delivery.method === 'smtp',
-      // If delivery failed or SMTP is not yet configured, provide devOtp so user is not blocked
-      devOtp: delivery.method === 'smtp' ? undefined : otp,
+      deliveredToInbox: true,
     });
   } catch (error) {
     next(error);