First commit to main from feature/backend

README.md

@@ -1 +1,15 @@
 # FinanceGPT
+
+Personal Automated Finance Copilot.
+
+## MAIN FUNCTIONAL REQUIREMENTS
+
+- Automated SMS capture of expenses + income and automatically catergorize them (Food, Transport, Bills, etc).
+- Scan bill/receipt (OCR).
+- AI Chatbot (Gemini AI API) to provid financial insights based on user's finances.
+
+## TECH STACK
+
+- React Native + Expo Routing for mobile frontend
+- Python FASTAPI for backend
+- Supabase (AUTH + Database)

apps/backend/.env.example

@@ -0,0 +1,8 @@
+# Copy this file to .env and fill in real values. Never commit .env.
+
+# Supabase project settings -> Database -> Connection string
+DATABASE_URL=postgresql+psycopg://postgres.[YOUR-PROJECT-REF]:[YOUR-PASSWORD]@[YOUR-POOLER-HOST]:6543/postgres
+
+# Supabase project settings -> API -> Project URL
+# Used to derive the JWKS endpoint for verifying auth tokens: <SUPABASE_URL>/auth/v1/.well-known/jwks.json
+SUPABASE_URL=https://[YOUR-PROJECT-REF].supabase.co

apps/backend/.gitignore

@@ -0,0 +1,5 @@
+.venv/
+__pycache__/
+*.pyc
+.env
+BACKEND.md

apps/backend/README.md

@@ -0,0 +1,55 @@
+# FinanceGPT Backend
+
+Python FastAPI backend for FinanceGPT, backed by Supabase (Auth + Postgres).
+
+## Stack
+
+- **FastAPI** — web framework
+- **SQLModel** — ORM (SQLAlchemy + Pydantic combined) for talking to Postgres
+- **Alembic** — database schema migrations
+- **psycopg** (v3) — Postgres driver
+- **Supabase** — hosted Postgres + Auth (JWT-based, asymmetric/JWKS signing keys)
+
+## Local setup
+
+1. Create and activate a virtual environment (from this `apps/backend` folder):
+
+   ```
+   python -m venv .venv
+   source .venv/Scripts/activate   # Git Bash
+   .venv\Scripts\Activate.ps1      # PowerShell
+   ```
+
+2. Install dependencies:
+
+   ```
+   pip install "fastapi[standard]" sqlmodel "psycopg[binary]" pydantic-settings alembic
+   ```
+
+3. Copy `.env.example` to `.env` and fill in real values from your Supabase project (Project Settings → Database for the connection string, Project Settings → API for the project URL). Use the **pooler** connection string (port `6543`) and the `postgresql+psycopg://` scheme.
+
+4. Apply database migrations:
+
+   ```
+   alembic upgrade head
+   ```
+
+5. Run the dev server:
+
+   ```
+   fastapi dev main.py
+   ```
+
+   Visit `http://127.0.0.1:8000/health` and `http://127.0.0.1:8000/docs`.
+
+## Working with migrations
+
+After changing a model in `app/models/`, remember to add it to `app/models/__init__.py` (this is how Alembic's autogenerate discovers it), then:
+
+```
+alembic revision --autogenerate -m "describe the change"
+```
+
+**Always review the generated file before applying it.** Known quirk: autogenerate sometimes references `sqlmodel.sql.sqltypes.AutoString()` for string columns without adding `import sqlmodel` to the file — check for this and add the import manually if needed, or the migration will crash on `alembic upgrade head`.
+
+Apply with `alembic upgrade head`. Check current state with `alembic current`.

apps/backend/alembic.ini

@@ -0,0 +1,149 @@
+# A generic, single database configuration.
+
+[alembic]
+# path to migration scripts.
+# this is typically a path given in POSIX (e.g. forward slashes)
+# format, relative to the token %(here)s which refers to the location of this
+# ini file
+script_location = %(here)s/app/migrations
+
+# template used to generate migration file names; The default value is %%(rev)s_%%(slug)s
+# Uncomment the line below if you want the files to be prepended with date and time
+# see https://alembic.sqlalchemy.org/en/latest/tutorial.html#editing-the-ini-file
+# for all available tokens
+# file_template = %%(year)d_%%(month).2d_%%(day).2d_%%(hour).2d%%(minute).2d-%%(rev)s_%%(slug)s
+# Or organize into date-based subdirectories (requires recursive_version_locations = true)
+# file_template = %%(year)d/%%(month).2d/%%(day).2d_%%(hour).2d%%(minute).2d_%%(second).2d_%%(rev)s_%%(slug)s
+
+# sys.path path, will be prepended to sys.path if present.
+# defaults to the current working directory.  for multiple paths, the path separator
+# is defined by "path_separator" below.
+prepend_sys_path = .
+
+
+# timezone to use when rendering the date within the migration file
+# as well as the filename.
+# If specified, requires the tzdata library which can be installed by adding
+# `alembic[tz]` to the pip requirements.
+# string value is passed to ZoneInfo()
+# leave blank for localtime
+# timezone =
+
+# max length of characters to apply to the "slug" field
+# truncate_slug_length = 40
+
+# set to 'true' to run the environment during
+# the 'revision' command, regardless of autogenerate
+# revision_environment = false
+
+# set to 'true' to allow .pyc and .pyo files without
+# a source .py file to be detected as revisions in the
+# versions/ directory
+# sourceless = false
+
+# version location specification; This defaults
+# to <script_location>/versions.  When using multiple version
+# directories, initial revisions must be specified with --version-path.
+# The path separator used here should be the separator specified by "path_separator"
+# below.
+# version_locations = %(here)s/bar:%(here)s/bat:%(here)s/alembic/versions
+
+# path_separator; This indicates what character is used to split lists of file
+# paths, including version_locations and prepend_sys_path within configparser
+# files such as alembic.ini.
+# The default rendered in new alembic.ini files is "os", which uses os.pathsep
+# to provide os-dependent path splitting.
+#
+# Note that in order to support legacy alembic.ini files, this default does NOT
+# take place if path_separator is not present in alembic.ini.  If this
+# option is omitted entirely, fallback logic is as follows:
+#
+# 1. Parsing of the version_locations option falls back to using the legacy
+#    "version_path_separator" key, which if absent then falls back to the legacy
+#    behavior of splitting on spaces and/or commas.
+# 2. Parsing of the prepend_sys_path option falls back to the legacy
+#    behavior of splitting on spaces, commas, or colons.
+#
+# Valid values for path_separator are:
+#
+# path_separator = :
+# path_separator = ;
+# path_separator = space
+# path_separator = newline
+#
+# Use os.pathsep. Default configuration used for new projects.
+path_separator = os
+
+# set to 'true' to search source files recursively
+# in each "version_locations" directory
+# new in Alembic version 1.10
+# recursive_version_locations = false
+
+# the output encoding used when revision files
+# are written from script.py.mako
+# output_encoding = utf-8
+
+# database URL.  This is consumed by the user-maintained env.py script only.
+# other means of configuring database URLs may be customized within the env.py
+# file.
+sqlalchemy.url = driver://user:pass@localhost/dbname
+
+
+[post_write_hooks]
+# post_write_hooks defines scripts or Python functions that are run
+# on newly generated revision scripts.  See the documentation for further
+# detail and examples
+
+# format using "black" - use the console_scripts runner, against the "black" entrypoint
+# hooks = black
+# black.type = console_scripts
+# black.entrypoint = black
+# black.options = -l 79 REVISION_SCRIPT_FILENAME
+
+# lint with attempts to fix using "ruff" - use the module runner, against the "ruff" module
+# hooks = ruff
+# ruff.type = module
+# ruff.module = ruff
+# ruff.options = check --fix REVISION_SCRIPT_FILENAME
+
+# Alternatively, use the exec runner to execute a binary found on your PATH
+# hooks = ruff
+# ruff.type = exec
+# ruff.executable = ruff
+# ruff.options = check --fix REVISION_SCRIPT_FILENAME
+
+# Logging configuration.  This is also consumed by the user-maintained
+# env.py script only.
+[loggers]
+keys = root,sqlalchemy,alembic
+
+[handlers]
+keys = console
+
+[formatters]
+keys = generic
+
+[logger_root]
+level = WARNING
+handlers = console
+qualname =
+
+[logger_sqlalchemy]
+level = WARNING
+handlers =
+qualname = sqlalchemy.engine
+
+[logger_alembic]
+level = INFO
+handlers =
+qualname = alembic
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = NOTSET
+formatter = generic
+
+[formatter_generic]
+format = %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %H:%M:%S

apps/backend/app/core/config.py

@@ -0,0 +1,15 @@
+from functools import lru_cache
+
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(env_file=".env")
+
+    database_url: str
+    supabase_url: str
+
+
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()

apps/backend/app/core/security.py

@@ -0,0 +1,30 @@
+import jwt
+from fastapi import HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials
+
+from app.core.config import get_settings
+
+settings = get_settings()
+
+# PyJWT's PyJWKClient fetches Supabase's public signing keys and caches them,
+# so we don't hit the JWKS endpoint on every single request.
+_jwks_client = jwt.PyJWKClient(f"{settings.supabase_url}/auth/v1/.well-known/jwks.json")
+
+
+def decode_supabase_jwt(credentials: HTTPAuthorizationCredentials) -> dict:
+    """Verify a Supabase-issued JWT and return its claims."""
+    token = credentials.credentials
+    try:
+        signing_key = _jwks_client.get_signing_key_from_jwt(token)
+        return jwt.decode(
+            token,
+            signing_key.key,
+            algorithms=["ES256"],
+            audience="authenticated",
+        )
+    except jwt.PyJWTError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or expired token",
+            headers={"WWW-Authenticate": "Bearer"},
+        ) from exc

apps/backend/app/db/session.py

@@ -0,0 +1,13 @@
+from collections.abc import Generator
+
+from sqlmodel import Session, create_engine
+
+from app.core.config import get_settings
+
+settings = get_settings()
+engine = create_engine(settings.database_url)
+
+
+def get_session() -> Generator[Session, None, None]:
+    with Session(engine) as session:
+        yield session

apps/backend/app/deps.py

@@ -0,0 +1,23 @@
+from typing import Annotated
+from uuid import UUID
+
+from fastapi import Depends
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from sqlmodel import Session
+
+from app.core.security import decode_supabase_jwt
+from app.db.session import get_session
+
+SessionDep = Annotated[Session, Depends(get_session)]
+
+bearer_scheme = HTTPBearer()
+
+
+def get_current_user_id(
+    credentials: Annotated[HTTPAuthorizationCredentials, Depends(bearer_scheme)],
+) -> UUID:
+    claims = decode_supabase_jwt(credentials)
+    return UUID(claims["sub"])
+
+
+CurrentUserId = Annotated[UUID, Depends(get_current_user_id)]

apps/backend/app/migrations/README

@@ -0,0 +1 @@
+Generic single-database configuration.