Commit inicial - upload de todos os arquivos da pasta

app/routes/auth_routes.py

@@ -0,0 +1,45 @@
+"""Rotas de login/logout."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, Form, Request
+from starlette.responses import RedirectResponse
+
+from .. import auth
+from ..templating import flash, render
+
+router = APIRouter()
+
+
+@router.get("/login")
+def login_form(request: Request):
+    if auth.current_user(request):
+        return RedirectResponse("/", status_code=303)
+    return render(request, "login.html", hide_nav=True)
+
+
+@router.post("/login")
+def login_submit(
+    request: Request,
+    username: str = Form(...),
+    password: str = Form(...),
+    csrf_token: str = Form(""),
+):
+    if not auth.check_csrf(request, csrf_token):
+        flash(request, "Sessão expirada. Tente novamente.", "error")
+        return RedirectResponse("/login", status_code=303)
+
+    if auth.authenticate(username.strip(), password):
+        auth.login_session(request, username.strip())
+        flash(request, "Bem-vindo de volta.", "success")
+        return RedirectResponse("/", status_code=303)
+
+    flash(request, "Usuário ou senha inválidos.", "error")
+    return RedirectResponse("/login", status_code=303)
+
+
+@router.post("/logout")
+def logout(request: Request, csrf_token: str = Form("")):
+    if auth.check_csrf(request, csrf_token):
+        auth.logout_session(request)
+    return RedirectResponse("/login", status_code=303)

app/routes/dashboard_routes.py

@@ -0,0 +1,48 @@
+"""Dashboard: KPIs, gastos por mês e por fornecedor, últimas notas."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, Request
+
+from .. import database as db
+from ..storage import money
+from ..templating import render
+
+router = APIRouter()
+
+_MESES = ["jan", "fev", "mar", "abr", "mai", "jun", "jul", "ago", "set", "out", "nov", "dez"]
+
+
+def _mes_label(ym: str) -> str:
+    try:
+        year, month = ym.split("-")
+        return f"{_MESES[int(month) - 1]}/{year}"
+    except (ValueError, IndexError):
+        return ym
+
+
+@router.get("/")
+def dashboard(request: Request):
+    with db.session() as conn:
+        totals = db.overall_totals(conn)
+        months = [dict(r) for r in db.monthly_totals(conn)]
+        suppliers = [dict(r) for r in db.supplier_totals(conn, limit=8)]
+        recent = [dict(r) for r in db.list_fiscal(conn)][:10]
+
+    max_month = max((m["total"] for m in months), default=0) or 1
+    for m in months:
+        m["label"] = _mes_label(m["month"])
+        m["pct"] = round(m["total"] / max_month * 100, 1)
+    max_sup = max((s["total"] for s in suppliers), default=0) or 1
+    for s in suppliers:
+        s["pct"] = round(s["total"] / max_sup * 100, 1)
+
+    return render(
+        request,
+        "dashboard.html",
+        totals=totals,
+        months=months,
+        suppliers=suppliers,
+        recent=recent,
+        money=money,
+    )

app/routes/documents_routes.py

@@ -0,0 +1,137 @@
+"""CRUD de documentos fiscais confirmados."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, Form, Query, Request
+from starlette.responses import RedirectResponse
+
+from .. import auth
+from .. import database as db
+from ..dates import resolve_purchase_date
+from ..storage import money
+from ..templating import flash, render
+
+router = APIRouter()
+
+
+def _parse_money(value: str) -> float | None:
+    text = (value or "").strip().replace("R$", "").replace(" ", "")
+    if not text:
+        return None
+    if "," in text and "." in text:
+        text = text.replace(".", "").replace(",", ".")
+    elif "," in text:
+        text = text.replace(",", ".")
+    try:
+        return round(float(text), 2)
+    except ValueError:
+        return None
+
+
+@router.get("/documents")
+def list_documents(
+    request: Request,
+    start: str = Query(""),
+    end: str = Query(""),
+    supplier: str = Query(""),
+):
+    with db.session() as conn:
+        rows = [dict(r) for r in db.list_fiscal(conn, start=start or None, end=end or None, supplier=supplier or None)]
+    total = sum(r["total_paid"] for r in rows)
+    return render(
+        request,
+        "documents_list.html",
+        rows=rows,
+        total=total,
+        filters={"start": start, "end": end, "supplier": supplier},
+        money=money,
+    )
+
+
+@router.get("/documents/new")
+def new_form(request: Request):
+    return render(request, "document_form.html", doc=None, mode="new")
+
+
+@router.post("/documents/new")
+def create_document(
+    request: Request,
+    csrf_token: str = Form(""),
+    purchase_date: str = Form(""),
+    supplier_name: str = Form(""),
+    total_paid: str = Form(""),
+):
+    if not auth.check_csrf(request, csrf_token):
+        flash(request, "Sessão expirada.", "error")
+        return RedirectResponse("/documents/new", status_code=303)
+
+    total = _parse_money(total_paid)
+    supplier = supplier_name.strip()
+    if not supplier or total is None:
+        flash(request, "Informe fornecedor e valor válidos.", "error")
+        return RedirectResponse("/documents/new", status_code=303)
+
+    with db.session() as conn:
+        db.create_fiscal(
+            conn,
+            purchase_date=resolve_purchase_date(purchase_date),
+            supplier_name=supplier,
+            total_paid=total,
+        )
+    flash(request, "Documento lançado.", "success")
+    return RedirectResponse("/documents", status_code=303)
+
+
+@router.get("/documents/{doc_id}/edit")
+def edit_form(request: Request, doc_id: int):
+    with db.session() as conn:
+        doc = db.get_fiscal(conn, doc_id)
+    if doc is None:
+        flash(request, "Documento não encontrado.", "error")
+        return RedirectResponse("/documents", status_code=303)
+    return render(request, "document_form.html", doc=dict(doc), mode="edit")
+
+
+@router.post("/documents/{doc_id}/edit")
+def update_document(
+    request: Request,
+    doc_id: int,
+    csrf_token: str = Form(""),
+    purchase_date: str = Form(""),
+    supplier_name: str = Form(""),
+    total_paid: str = Form(""),
+):
+    if not auth.check_csrf(request, csrf_token):
+        flash(request, "Sessão expirada.", "error")
+        return RedirectResponse(f"/documents/{doc_id}/edit", status_code=303)
+
+    total = _parse_money(total_paid)
+    supplier = supplier_name.strip()
+    if not supplier or total is None:
+        flash(request, "Informe fornecedor e valor válidos.", "error")
+        return RedirectResponse(f"/documents/{doc_id}/edit", status_code=303)
+
+    with db.session() as conn:
+        if db.get_fiscal(conn, doc_id) is None:
+            flash(request, "Documento não encontrado.", "error")
+            return RedirectResponse("/documents", status_code=303)
+        db.update_fiscal(
+            conn,
+            doc_id,
+            purchase_date=resolve_purchase_date(purchase_date),
+            supplier_name=supplier,
+            total_paid=total,
+        )
+    flash(request, "Documento atualizado.", "success")
+    return RedirectResponse("/documents", status_code=303)
+
+
+@router.post("/documents/{doc_id}/delete")
+def delete_document(request: Request, doc_id: int, csrf_token: str = Form("")):
+    if not auth.check_csrf(request, csrf_token):
+        flash(request, "Sessão expirada.", "error")
+        return RedirectResponse("/documents", status_code=303)
+    with db.session() as conn:
+        db.delete_fiscal(conn, doc_id)
+    flash(request, "Documento excluído.", "info")
+    return RedirectResponse("/documents", status_code=303)

app/routes/files_routes.py

@@ -0,0 +1,39 @@
+"""Servir arquivos enviados SOMENTE via rota autenticada.
+
+Documentos fiscais contêm CPF/CNPJ, endereços e valores — nunca ficam num
+static mount público. O acesso passa pela guarda de sessão do middleware.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import APIRouter, Request
+from starlette.responses import FileResponse, Response
+
+from .. import database as db
+from ..config import get_settings
+
+router = APIRouter()
+
+
+@router.get("/files/{upload_id}")
+def serve_file(request: Request, upload_id: int):
+    settings = get_settings()
+    with db.session() as conn:
+        row = db.get_upload(conn, upload_id)
+    if row is None:
+        return Response("Arquivo não encontrado.", status_code=404)
+
+    stored = Path(row["stored_path"]).resolve()
+    upload_root = settings.upload_dir.resolve()
+    # trava contra path traversal: o arquivo precisa estar dentro de data/uploads
+    if upload_root not in stored.parents or not stored.is_file():
+        return Response("Arquivo indisponível.", status_code=404)
+
+    return FileResponse(
+        str(stored),
+        media_type=row["content_type"] or "application/octet-stream",
+        filename=row["original_name"],
+        content_disposition_type="inline",
+    )

app/routes/upload_routes.py

@@ -0,0 +1,169 @@
+"""Fluxo de importação: upload -> staging (revisão) -> confirmação em lote."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import APIRouter, File, Form, Request, UploadFile
+from starlette.responses import RedirectResponse
+
+from .. import auth
+from .. import database as db
+from ..config import get_settings
+from ..dates import resolve_purchase_date
+from ..ingestion import extract_file
+from ..storage import money, safe_original_name, unique_storage_name
+from ..templating import flash, render
+
+router = APIRouter()
+
+
+def _confidence(legible: bool, uncertain: list[str]) -> str:
+    if legible and not uncertain:
+        return "high"
+    if len(uncertain) >= 2 or not legible:
+        return "low"
+    return "medium"
+
+
+@router.post("/upload")
+async def upload(request: Request, csrf_token: str = Form(""), files: list[UploadFile] = File(...)):
+    if not auth.check_csrf(request, csrf_token):
+        flash(request, "Sessão expirada. Tente novamente.", "error")
+        return RedirectResponse("/", status_code=303)
+
+    settings = get_settings()
+    accepted = 0
+    rejected = 0
+
+    with db.session() as conn:
+        batch_id = db.create_batch(conn)
+        for upload_file in files:
+            original = safe_original_name(upload_file.filename or "upload")
+            suffix = Path(original).suffix.lower()
+            content = await upload_file.read()
+            if suffix not in settings.allowed_extensions or len(content) > settings.max_upload_bytes:
+                rejected += 1
+                continue
+
+            stored_name = unique_storage_name(original)
+            stored_path = settings.upload_dir / stored_name
+            stored_path.write_bytes(content)
+            content_type = upload_file.content_type or "application/octet-stream"
+            upload_id = db.insert_upload(conn, batch_id, original, stored_path, content_type, len(content))
+
+            try:
+                extractions = extract_file(stored_path, original)
+                for raw in extractions:
+                    purchase_date = resolve_purchase_date(raw.purchase_date_raw)
+                    uncertain = list(raw.uncertain_fields)
+                    db.insert_detected(
+                        conn,
+                        upload_id=upload_id,
+                        batch_id=batch_id,
+                        source_file_name=original,
+                        source_page=None,
+                        source_location=original,
+                        raw_text=raw.raw_text,
+                        purchase_date=purchase_date,
+                        supplier_name=raw.supplier_name,
+                        total_paid=raw.total_paid,
+                        confidence=_confidence(raw.legible, uncertain),
+                        field_confidence={},
+                        legible=raw.legible,
+                        uncertain_fields=uncertain,
+                        extractor=raw.extractor,
+                    )
+                    accepted += 1
+                status = "processed" if extractions else "needs_attention"
+                message = None if extractions else "Nenhum documento fiscal detectado."
+                db.update_upload_status(conn, upload_id, status, len(extractions), message)
+            except Exception as exc:  # nunca deixa um arquivo derrubar o lote
+                db.update_upload_status(conn, upload_id, "failed", 0, str(exc)[:300])
+
+    if rejected:
+        flash(request, f"{rejected} arquivo(s) recusado(s). Use PDF/JPG/PNG até {settings.max_upload_bytes // (1024*1024)} MB.", "error")
+    if accepted == 0:
+        flash(request, "Nenhum documento foi extraído dos arquivos enviados.", "error")
+        return RedirectResponse("/", status_code=303)
+    return RedirectResponse(f"/import/{batch_id}/review", status_code=303)
+
+
+@router.get("/import/{batch_id}/review")
+def review(request: Request, batch_id: int):
+    with db.session() as conn:
+        batch = db.get_batch(conn, batch_id)
+        if batch is None:
+            flash(request, "Lote de importação não encontrado.", "error")
+            return RedirectResponse("/", status_code=303)
+        rows = [dict(r) for r in db.staged_documents(conn, batch_id)]
+        summary = db.batch_summary(conn, batch_id)
+
+    return render(
+        request,
+        "staging.html",
+        batch=dict(batch),
+        rows=rows,
+        summary=summary,
+        money=money,
+    )
+
+
+@router.post("/import/{batch_id}/update/{detected_id}")
+def update_row(
+    request: Request,
+    batch_id: int,
+    detected_id: int,
+    csrf_token: str = Form(""),
+    purchase_date: str = Form(""),
+    supplier_name: str = Form(""),
+    total_paid: str = Form(""),
+):
+    if not auth.check_csrf(request, csrf_token):
+        flash(request, "Sessão expirada.", "error")
+        return RedirectResponse(f"/import/{batch_id}/review", status_code=303)
+
+    try:
+        total = float(total_paid.replace(".", "").replace(",", ".")) if "," in total_paid else float(total_paid or 0)
+    except ValueError:
+        flash(request, "Valor inválido na correção.", "error")
+        return RedirectResponse(f"/import/{batch_id}/review", status_code=303)
+
+    resolved_date = resolve_purchase_date(purchase_date)
+    with db.session() as conn:
+        db.update_staged(
+            conn,
+            detected_id,
+            purchase_date=resolved_date,
+            supplier_name=supplier_name.strip(),
+            total_paid=round(total, 2),
+            legible=True,
+        )
+    flash(request, "Documento corrigido.", "success")
+    return RedirectResponse(f"/import/{batch_id}/review", status_code=303)
+
+
+@router.post("/import/{batch_id}/discard/{detected_id}")
+def discard_row(request: Request, batch_id: int, detected_id: int, csrf_token: str = Form("")):
+    if auth.check_csrf(request, csrf_token):
+        with db.session() as conn:
+            db.discard_staged(conn, detected_id)
+        flash(request, "Documento descartado do lote.", "info")
+    return RedirectResponse(f"/import/{batch_id}/review", status_code=303)
+
+
+@router.post("/import/{batch_id}/confirm")
+def confirm(request: Request, batch_id: int, csrf_token: str = Form("")):
+    if not auth.check_csrf(request, csrf_token):
+        flash(request, "Sessão expirada.", "error")
+        return RedirectResponse(f"/import/{batch_id}/review", status_code=303)
+
+    with db.session() as conn:
+        summary = db.batch_summary(conn, batch_id)
+        if summary["pendentes"] > 0:
+            flash(request, f"Ainda há {summary['pendentes']} documento(s) com problema (ilegível ou sem fornecedor/valor). Corrija ou descarte antes de importar.", "error")
+            return RedirectResponse(f"/import/{batch_id}/review", status_code=303)
+        inserted = db.confirm_batch(conn, batch_id)
+
+    flash(request, f"{inserted} documento(s) importado(s) com sucesso.", "success")
+    return RedirectResponse("/documents", status_code=303)