Comprehensive hardening + 50/30/20 Budget Rule page

.github/workflows/ci.yml

@@ -20,6 +20,7 @@ jobs:
   # fails the build on lint/type/test errors.
   backend:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     defaults:
       run:
         working-directory: backend

.github/workflows/deploy-frontend.yml

@@ -12,6 +12,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
     defaults:
@@ -66,6 +67,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/keepalive.yml

@@ -22,11 +22,13 @@ permissions:
 jobs:
   ping:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Wake backend
         run: |
-          # The /api/health endpoint is unauthenticated and returns instantly.
-          # We don't fail the workflow on non-200 — the goal is only to keep
+          # The /health endpoint is unauthenticated and returns instantly.
+          # (App-level route in main.py -- no /api/ prefix, unlike domain routers.)
+          # We don't fail the workflow on non-200 -- the goal is only to keep
           # the branch warm; a transient 5xx during deploy is fine.
           curl --silent --max-time 30 \
             "https://ledger-sync-api.vercel.app/health" \

.github/workflows/migrate.yml

@@ -7,18 +7,20 @@ on:
       - 'backend/alembic/**'
       - 'backend/src/ledger_sync/db/migrations/**'
       - 'backend/src/ledger_sync/db/models.py'
+      - 'backend/src/ledger_sync/db/_models/**'
 
   workflow_dispatch: # Allow manual trigger
 
 jobs:
   migrate:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: '3.14'
+          python-version: '3.13'
 
       - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
 

backend/pyproject.toml

@@ -4,7 +4,7 @@ version = "2.17.0"
 description = "Personal finance dashboard backend -- Excel import, financial analytics, multi-currency exchange rates"
 authors = [{ name = "Sagar Gupta" }]
 readme = "README.md"
-requires-python = ">=3.11"
+requires-python = ">=3.13"
 dependencies = [
     "sqlalchemy>=2.0.51",
     "alembic>=1.18.4",
@@ -94,7 +94,7 @@ select = ["E", "F", "I", "N", "W", "UP"]
 "src/ledger_sync/core/analytics_engine.py" = ["PERF401"]
 
 [tool.mypy]
-python_version = "3.12"
+python_version = "3.13"
 strict = true
 warn_return_any = true
 warn_unused_configs = true

backend/src/ledger_sync/api/ai_chat.py

@@ -43,7 +43,7 @@
     record_usage,
 )
 from ledger_sync.api.deps import CurrentUser, DatabaseSession
-from ledger_sync.api.rate_limit import limiter
+from ledger_sync.api.rate_limit import limiter, user_limiter
 from ledger_sync.config.settings import settings
 from ledger_sync.db.models import UserPreferences
 
@@ -188,7 +188,11 @@ def _from_bedrock_blocks(blocks: list[dict[str, Any]]) -> list[dict[str, Any]]:
         503: {"description": "Bedrock is not configured on the server"},
     },
 )
-@limiter.limit("30/minute")
+# Two-layer rate limit. Per-user (30/min) is the primary throttle; IP-keyed
+# (60/min) protects the auth path against unauthenticated floods and gives a
+# safety net when a token is missing/malformed.
+@user_limiter.limit("30/minute")
+@limiter.limit("60/minute")
 def bedrock_chat_proxy(
     request: Request,  # slowapi requires a `request: Request` parameter  # noqa: ARG001
     current_user: CurrentUser,

backend/src/ledger_sync/api/analytics_v2.py

@@ -16,6 +16,7 @@
 from ledger_sync.api.analytics_v2_impl import (
     networth_misc_router,
     recurring_router,
+    spending_rule_router,
     summaries_router,
 )
 from ledger_sync.api.deps import CurrentUser
@@ -27,6 +28,7 @@
 # Mount the split sub-routers under the same prefix.
 router.include_router(summaries_router)
 router.include_router(recurring_router)
+router.include_router(spending_rule_router)
 router.include_router(networth_misc_router)
 
 

backend/src/ledger_sync/api/analytics_v2_impl/__init__.py

@@ -2,6 +2,12 @@
 
 from .networth_misc import router as networth_misc_router
 from .recurring import router as recurring_router
+from .spending_rule import router as spending_rule_router
 from .summaries import router as summaries_router
 
-__all__ = ["networth_misc_router", "recurring_router", "summaries_router"]
+__all__ = [
+    "networth_misc_router",
+    "recurring_router",
+    "spending_rule_router",
+    "summaries_router",
+]