Skip to content

Add comprehensive contribution documentation #533

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
PankajSingh34 wants to merge 5 commits into from
Closed

Add comprehensive contribution documentation #533

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3dbda07
Add comprehensive contribution documentation
PankajSingh34 Feb 3, 2026
b6712df
docs: improve CONTRIBUTION_GUIDE.md formatting
PankajSingh34 Feb 4, 2026
9ca660b
feat: implement invite modal functionality
PankajSingh34 Feb 4, 2026
ab2cabd
test: add comprehensive unit testing infrastructure
PankajSingh34 Feb 4, 2026
b9dc1c5
docs: add comprehensive contribution summary
PankajSingh34 Feb 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
92 changes: 92 additions & 0 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
# ExpenseFlow Environment Variables
# Copy this file to .env and fill in your actual values

# Server Configuration
PORT=5000
Copy link

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The default PORT value is inconsistent with server.js. The server.js file uses process.env.PORT || 3000 (line 46), but this .env.example file specifies PORT=5000. This inconsistency may confuse developers. Either update this to PORT=3000 to match the server.js default, or update server.js to match this value.

Suggested change
PORT=5000
PORT=3000

Copilot uses AI. Check for mistakes.
NODE_ENV=development

# MongoDB Configuration
MONGODB_URI=mongodb://localhost:27017/expenseflow
# Or use MongoDB Atlas:
# MONGODB_URI=mongodb+srv://<username>:<password>@cluster.mongodb.net/expenseflow?retryWrites=true&w=majority

# JWT Configuration
JWT_SECRET=your_super_secret_jwt_key_change_this_in_production
JWT_EXPIRE=7d
JWT_REFRESH_SECRET=your_refresh_token_secret_change_this
JWT_REFRESH_EXPIRE=30d
Comment on lines +13 to +17
Copy link

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Weak example JWT secrets could be accidentally used in production. Lines 14 and 16 contain example secrets like "your_super_secret_jwt_key_change_this_in_production" and "your_refresh_token_secret_change_this". While these include warnings to change them, developers might forget. Consider adding a more prominent warning comment above the JWT section, such as: "# CRITICAL: Generate strong random secrets for production. Never use these example values!" Also consider adding a note about using a tool like openssl rand -base64 32 to generate secure secrets.

Copilot uses AI. Check for mistakes.

# Email Configuration (for notifications)
EMAIL_HOST=smtp.gmail.com
EMAIL_PORT=587
EMAIL_USER=your-email@gmail.com
EMAIL_PASSWORD=your-app-specific-password
Copy link

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The environment variable name is inconsistent with the codebase. The code uses EMAIL_PASS (see services/emailService.js line 11, services/notificationService.js line 153), but this file specifies EMAIL_PASSWORD. This will cause email functionality to fail because the password won't be read correctly. Change EMAIL_PASSWORD to EMAIL_PASS to match the actual codebase usage.

Suggested change
EMAIL_PASSWORD=your-app-specific-password
EMAIL_PASS=your-app-specific-password

Copilot uses AI. Check for mistakes.
EMAIL_FROM=noreply@expenseflow.com

# Twilio Configuration (for SMS notifications)
TWILIO_ACCOUNT_SID=your_twilio_account_sid
TWILIO_AUTH_TOKEN=your_twilio_auth_token
TWILIO_PHONE_NUMBER=+1234567890

# Exchange Rate API (for multi-currency support)
EXCHANGE_RATE_API_KEY=your_exchange_rate_api_key
# Free API: https://www.exchangerate-api.com/

# OCR Configuration (for receipt scanning)
OCR_SPACE_API_KEY=your_ocr_space_api_key
# Free API: https://ocr.space/ocrapi

# Cloud Storage (for receipts and documents)
CLOUDINARY_CLOUD_NAME=your_cloudinary_cloud_name
CLOUDINARY_API_KEY=your_cloudinary_api_key
CLOUDINARY_API_SECRET=your_cloudinary_api_secret
# Or AWS S3:
# AWS_ACCESS_KEY_ID=your_aws_access_key
# AWS_SECRET_ACCESS_KEY=your_aws_secret_key
# AWS_BUCKET_NAME=your_bucket_name
# AWS_REGION=us-east-1

# Banking Integration (Optional)
# Plaid Configuration
PLAID_CLIENT_ID=your_plaid_client_id
PLAID_SECRET=your_plaid_secret
PLAID_ENV=sandbox
# Options: sandbox, development, production

# QuickBooks Integration (Optional)
QUICKBOOKS_CLIENT_ID=your_quickbooks_client_id
QUICKBOOKS_CLIENT_SECRET=your_quickbooks_client_secret
QUICKBOOKS_REDIRECT_URI=http://localhost:5000/api/accounting/quickbooks/callback

# Xero Integration (Optional)
XERO_CLIENT_ID=your_xero_client_id
XERO_CLIENT_SECRET=your_xero_client_secret
XERO_REDIRECT_URI=http://localhost:5000/api/accounting/xero/callback

# Push Notifications (Optional)
VAPID_PUBLIC_KEY=your_vapid_public_key
VAPID_PRIVATE_KEY=your_vapid_private_key
VAPID_SUBJECT=mailto:your-email@example.com

# Rate Limiting
RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX_REQUESTS=100

# Security
BCRYPT_ROUNDS=10
SESSION_SECRET=your_session_secret_change_this

# CORS Configuration
CORS_ORIGIN=http://localhost:3000,http://localhost:5000
# Add your frontend URL in production
Comment on lines +80 to +81
Copy link

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CORS origin configuration may be redundant or incorrect. The default value includes both http://localhost:3000 and http://localhost:5000, but the PORT is set to 5000 in this file (line 5), and server.js defaults to 3000 (line 46 of server.js). This creates confusion about which port is actually being used. If the server runs on port 5000 (as configured in this file), then http://localhost:3000 in CORS_ORIGIN would be incorrect unless there's a separate frontend server. Clarify which port(s) should be in CORS_ORIGIN based on the actual deployment setup, or add a comment explaining when multiple origins are needed (e.g., separate frontend dev server).

Suggested change
CORS_ORIGIN=http://localhost:3000,http://localhost:5000
# Add your frontend URL in production
# Comma-separated list of allowed frontend origins.
# Example: http://localhost:3000 for a React/Vue dev server, http://localhost:5000 for the API server itself.
# In most setups, the backend runs on PORT=5000 (see above) and the frontend dev server on 3000.
# Update/remove entries as needed for your actual deployment, and add your production frontend URL(s) here.
CORS_ORIGIN=http://localhost:3000,http://localhost:5000

Copilot uses AI. Check for mistakes.

# Logging
LOG_LEVEL=info
# Options: error, warn, info, debug

# Feature Flags
ENABLE_BANK_SYNC=false
ENABLE_OCR=false
ENABLE_AI_CATEGORIZATION=true
ENABLE_NOTIFICATIONS=true
ENABLE_MULTI_CURRENCY=true
Copy link

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing critical environment variables that are used in the codebase. The following environment variables should be added to this file:

  • SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS - used by services/alertService.js, services/inviteService.js, and services/reminderService.js for email functionality
  • FRONTEND_URL or APP_URL - used by server.js line 40, 98, and throughout services for generating URLs
  • REDIS_HOST, REDIS_PORT, REDIS_DB - used by middleware/rateLimiter.js for distributed rate limiting
  • ADMIN_EMAIL or ADMIN_EMAILS - used by services/alertService.js for admin notifications
  • SUPPORT_EMAIL - used by services/emailService.js
  • ALPHA_VANTAGE_API_KEY - used by services/investmentService.js and services/priceUpdateService.js
  • COINGECKO_API_KEY, FINNHUB_API_KEY, POLYGON_API_KEY - used by services/priceUpdateService.js
  • DEFAULT_CURRENCY, DEFAULT_LOCALE - used by services/analyticsService.js
  • EMAIL_SERVICE - used by services/notificationService.js
  • PLAID_WEBHOOK_SECRET - used by services/openBankingService.js
  • ALERT_LOG_FILE - used by services/alertService.js

These variables are necessary for various features to work properly.

Suggested change
ENABLE_MULTI_CURRENCY=true
ENABLE_MULTI_CURRENCY=true
# SMTP Configuration (for email functionality)
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=your-email@gmail.com
SMTP_PASS=your-app-specific-password
# Frontend URL (used for generating links in emails, redirects, etc.)
FRONTEND_URL=http://localhost:3000
# Redis Configuration (for distributed rate limiting, caching, etc.)
REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_DB=0
# Admin & Support Emails
ADMIN_EMAILS=admin1@example.com,admin2@example.com
SUPPORT_EMAIL=support@example.com
# Market Data & Investment APIs
ALPHA_VANTAGE_API_KEY=your_alpha_vantage_api_key
COINGECKO_API_KEY=your_coingecko_api_key
FINNHUB_API_KEY=your_finnhub_api_key
POLYGON_API_KEY=your_polygon_api_key
# Analytics Defaults
DEFAULT_CURRENCY=USD
DEFAULT_LOCALE=en-US
# Notification Service (e.g., smtp, sendgrid, mailgun)
EMAIL_SERVICE=smtp
# Plaid Webhook (used to verify Plaid webhook signatures)
PLAID_WEBHOOK_SECRET=your_plaid_webhook_secret
# Alert Logging
ALERT_LOG_FILE=logs/alerts.log

Copilot uses AI. Check for mistakes.
32 changes: 32 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,35 @@
.env
.env.test
node_modules
node_modules/

# Test coverage
coverage/
*.lcov
.nyc_output/

# Test results
test-results/
junit.xml

# IDE
.vscode/
.idea/
*.swp
*.swo
*~

# OS
.DS_Store
Thumbs.db

# Logs
logs/
*.log
npm-debug.log*
yarn-debug.log*
yarn-error.log*

# Build
dist/
build/
Loading