Upload 7 files

agents.py

@@ -0,0 +1,256 @@
+"""
+OmniParse AI — Agentic AI Pipeline
+Multi-stage extraction with specialized sub-agents:
+  1. OCR Agent     — reads raw pixels → text
+  2. Extractor     — structured extraction via LLM
+  3. Validator     — cross-field validation, duplicate check
+  4. Chat Agent    — natural language queries over invoice corpus
+All sub-agents degrade gracefully if their dependencies are missing.
+"""
+
+import re, json, time, uuid
+from datetime import datetime
+from config import GROQ_API_KEY, HF_TOKEN
+
+# ── Lazy Groq client ────────────────────────────────────────────────────────
+_groq = None
+def _groq_client():
+    global _groq
+    if _groq is None and GROQ_API_KEY:
+        try:
+            from groq import Groq
+            _groq = Groq(api_key=GROQ_API_KEY)
+        except ImportError: pass
+    return _groq
+
+# ── Agent 1: OCR (external, handled by ocr.py) ──────────────────────────────
+# ── Agent 2: Extraction ─────────────────────────────────────────────────────
+
+EXTRACTION_SYSTEM = (
+    "You are an invoice data extraction engine. Extract structured data from the "
+    "raw OCR text of an invoice. Return ONLY a valid JSON object, no markdown, "
+    "with exactly these keys: vendor (string), invoice_number (string), "
+    "invoice_date (string, YYYY-MM-DD if possible), due_date (string, "
+    "YYYY-MM-DD if possible), amount (number, subtotal before tax), "
+    "vat_amount (number), total (number), currency (3-letter code), "
+    "line_items (array of {description, quantity, unit_price, total}). "
+    "Use null for any field you cannot determine. Never invent data."
+)
+
+def _safe_json(text: str) -> dict | None:
+    if not text: return None
+    m = re.search(r"\{.*\}", text, re.DOTALL)
+    if not m: return None
+    try: return json.loads(m.group(0))
+    except json.JSONDecodeError: return None
+
+def extractor_groq(ocr_text: str) -> dict | None:
+    """Sub-agent: Groq Llama-based structured extraction."""
+    gc = _groq_client()
+    if not gc: return None
+    try:
+        r = gc.chat.completions.create(
+            model="llama-3.1-8b-instant",
+            messages=[
+                {"role":"system","content":EXTRACTION_SYSTEM},
+                {"role":"user","content":ocr_text[:3000]}
+            ],
+            max_tokens=512, temperature=0.05, timeout=15,
+        )
+        return _safe_json(r.choices[0].message.content)
+    except Exception as e:
+        print(f"[AGENT] Groq extraction failed: {e}")
+        return None
+
+def extractor_hf(ocr_text: str) -> dict | None:
+    """Sub-agent: HuggingFace Inference fallback."""
+    if not HF_TOKEN: return None
+    try:
+        import requests
+        url = "https://api-inference.huggingface.co/models/mistralai/Mistral-7B-Instruct-v0.3"
+        h = {"Authorization": f"Bearer {HF_TOKEN}"}
+        prompt = f"<s>[INST] {EXTRACTION_SYSTEM}\n\n{ocr_text[:3000]} [/INST]"
+        payload = {"inputs":prompt,"parameters":{"max_new_tokens":512,"temperature":0.05}}
+        r = requests.post(url, headers=h, json=payload, timeout=45)
+        if r.status_code == 503:
+            time.sleep(25)
+            r = requests.post(url, headers=h, json=payload, timeout=45)
+        r.raise_for_status()
+        d = r.json()
+        text = d[0]["generated_text"] if isinstance(d,list) else str(d)
+        return _safe_json(text)
+    except Exception as e:
+        print(f"[AGENT] HF extraction failed: {e}")
+        return None
+
+def extractor_regex(ocr_text: str) -> dict:
+    """Sub-agent: Pure regex fallback when no LLM available."""
+    def _re(pat, txt, g=1):
+        m = re.search(pat, txt, re.IGNORECASE)
+        return m.group(g) if m else None
+
+    inv = _re(r"(?:invoice|inv)[#:\s]+([A-Z0-9\-]{4,24})", ocr_text)
+    dates = re.findall(r"\d{1,2}[/.\-]\d{1,2}[/.\-]\d{4}", ocr_text)
+    tm = _re(r"(?:total|amount due)[\s:$]+([0-9,\.]+)", ocr_text)
+    vendor = None
+    for line in ocr_text.splitlines():
+        s = line.strip()
+        if s and not s.lower().startswith(
+            ("total","invoice","date","due","amount","subtotal","tax","vat")
+        ):
+            vendor = s; break
+    try: tv = float(tm.replace(",","")) if tm else None
+    except: tv = None
+    return {
+        "vendor":vendor, "invoice_number":inv,
+        "invoice_date":dates[0] if dates else None,
+        "due_date":dates[1] if len(dates)>1 else None,
+        "amount":None, "vat_amount":None, "total":tv,
+        "currency":"USD", "line_items":[],
+    }
+
+# ── Agent 3: Validator ──────────────────────────────────────────────────────
+
+def _parse_date_any(s: str):
+    for fmt in ("%Y-%m-%d","%d/%m/%Y","%m/%d/%Y","%d.%m.%Y","%d-%m-%Y"):
+        try: return datetime.strptime(str(s), fmt)
+        except: continue
+    return None
+
+def validator_crossfield(data: dict) -> list[str]:
+    """Check arithmetic consistency, date logic, sanity."""
+    warnings = []
+    try:
+        a = data.get("amount"); v = data.get("vat_amount"); t = data.get("total")
+        if all(x is not None for x in (a, v, t)):
+            if abs((float(a)+float(v))-float(t)) > 0.10:
+                warnings.append("Subtotal + VAT does not match total.")
+    except (TypeError,ValueError): pass
+    try:
+        d1 = data.get("invoice_date"); d2 = data.get("due_date")
+        if d1 and d2:
+            p1 = _parse_date_any(str(d1)); p2 = _parse_date_any(str(d2))
+            if p1 and p2 and p2 < p1:
+                warnings.append("Due date is before invoice date.")
+    except (TypeError,ValueError): pass
+    try:
+        if data.get("total") is not None and float(data["total"]) < 0:
+            warnings.append("Total amount cannot be negative.")
+    except: pass
+    vendor = data.get("vendor")
+    if vendor and len(str(vendor).strip()) < 2:
+        warnings.append("Vendor name appears invalid.")
+    return warnings
+
+# ── Agent 4: Chat Agent ─────────────────────────────────────────────────────
+
+CHAT_SYSTEM = (
+    "You are a financial assistant answering questions about the user's invoices. "
+    "Here is their invoice data as JSON: {context}. "
+    "Answer concisely based ONLY on this data. Never reveal the raw JSON. "
+    "If asked about totals, compute carefully. Respond in plain English."
+)
+
+def chat_agent(message: str, invoices_json: str) -> str:
+    """Answer natural-language questions about invoice data."""
+    gc = _groq_client()
+    if not gc:
+        return "AI Chat is not configured. Please set GROQ_API_KEY."
+
+    msg = message.strip()[:2000]
+    ctx = invoices_json[:6000]
+
+    try:
+        r = gc.chat.completions.create(
+            model="llama-3.1-8b-instant",
+            messages=[
+                {"role":"system","content":CHAT_SYSTEM.format(context=ctx)},
+                {"role":"user","content":msg},
+            ],
+            max_tokens=400, temperature=0.2, timeout=15,
+        )
+        return r.choices[0].message.content
+    except Exception as e:
+        return f"AI is temporarily unavailable. Please try again later. ({e})"
+
+# ── Agent 5: Duplicate Detector ─────────────────────────────────────────────
+
+def duplicate_detector(
+    vendor: str, total: float, existing_invoices: list[dict]
+) -> bool:
+    """
+    Check if a vendor+total combination already exists in this month's invoices.
+    """
+    if not vendor or total is None:
+        return False
+    now = datetime.now()
+    vl = vendor.strip().lower()
+    for inv in existing_invoices:
+        try:
+            created = datetime.fromisoformat(inv.get("created_at",""))
+        except (ValueError,KeyError):
+            continue
+        if created.year == now.year and created.month == now.month:
+            iv = (inv.get("vendor") or "").strip().lower()
+            it = inv.get("total")
+            if iv == vl and it is not None and abs(float(it)-float(total)) < 0.01:
+                return True
+    return False
+
+# ── Orchestrator: Full pipeline ─────────────────────────────────────────────
+
+def run_extraction_pipeline(ocr_text: str, filename: str) -> dict:
+    """
+    Main agent orchestrator. Runs extraction → validation → sanitization.
+    Returns a complete, sanitized invoice data dict.
+    """
+    # Stage 1: Extract with fallback chain
+    if ocr_text.strip():
+        data = extractor_groq(ocr_text) or extractor_hf(ocr_text) or extractor_regex(ocr_text)
+        confidence = 0.95
+    else:
+        data = {
+            "vendor":"Demo Vendor Inc.",
+            "invoice_number":f"DEMO-{uuid.uuid4().hex[:6].upper()}",
+            "invoice_date":datetime.now().strftime("%Y-%m-%d"),
+            "due_date":None, "amount":100.0, "vat_amount":21.0,
+            "total":121.0, "currency":"USD", "line_items":[],
+        }
+        confidence = 0.3
+
+    data["filename"] = filename
+    data["confidence"] = confidence
+
+    # Stage 2: Validate
+    warnings = validator_crossfield(data)
+    data["warnings"] = warnings
+    data["status"] = "review" if warnings else "done"
+
+    # Stage 3: Sanitize (strip HTML, control chars, truncate)
+    data = _sanitize_invoice(data)
+
+    return data
+
+# ── Sanitization ────────────────────────────────────────────────────────────
+
+def _sanitize_string(v, max_len=500) -> str:
+    if not isinstance(v, str): return ""
+    clean = re.sub(r"<[^>]*>", "", v)
+    clean = re.sub(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]", "", clean)
+    clean = re.sub(r"\s+", " ", clean).strip()
+    return clean[:max_len]
+
+def _sanitize_invoice(data: dict) -> dict:
+    string_fields = (
+        "vendor","invoice_number","invoice_date","due_date",
+        "currency","filename","status",
+    )
+    for f in string_fields:
+        if f in data and data[f] is not None:
+            data[f] = _sanitize_string(str(data[f]))
+    if "line_items" in data and isinstance(data["line_items"], list):
+        for item in data["line_items"]:
+            if isinstance(item, dict) and "description" in item:
+                if item["description"] is not None:
+                    item["description"] = _sanitize_string(str(item["description"]), 300)
+    return data

auth.py

@@ -0,0 +1,116 @@
+"""OmniParse AI — Auth: bcrypt hashing, HttpOnly session cookies, password policy, HIBP check."""
+
+import re, secrets, hashlib, bcrypt
+from datetime import datetime, timedelta, timezone
+from config import (
+    BCRYPT_ROUNDS, MIN_PASSWORD_LENGTH, REQUIRE_MIXED_CASE, REQUIRE_DIGIT,
+    REQUIRE_SPECIAL, BANNED_PASSWORDS, SESSION_TTL_HOURS, COOKIE_NAME,
+    COOKIE_SECURE, COOKIE_HTTPONLY, COOKIE_SAMESITE,
+)
+from database import (
+    get_user_by_email, create_user as db_create_user, create_session,
+    get_session, delete_session, get_user_by_id,
+)
+
+# ── Password hashing ────────────────────────────────────────────────────────
+def hash_password(plain: str) -> str:
+    return bcrypt.hashpw(plain.encode("utf-8"), bcrypt.gensalt(rounds=BCRYPT_ROUNDS)).decode("utf-8")
+
+def verify_password(plain: str, hashed: str) -> bool:
+    try: return bcrypt.checkpw(plain.encode("utf-8"), hashed.encode("utf-8"))
+    except (ValueError, TypeError): return False
+
+# ── Password policy ─────────────────────────────────────────────────────────
+def _sha1(s: str) -> str: return hashlib.sha1(s.encode("utf-8")).hexdigest().upper()
+
+def check_password_strength(pw: str) -> list[str]:
+    errs = []
+    if len(pw) < MIN_PASSWORD_LENGTH:
+        errs.append(f"At least {MIN_PASSWORD_LENGTH} characters required.")
+    if REQUIRE_MIXED_CASE and (pw.lower() == pw or pw.upper() == pw):
+        errs.append("Must contain uppercase and lowercase letters.")
+    if REQUIRE_DIGIT and not re.search(r"\d", pw):
+        errs.append("Must contain at least one digit.")
+    if REQUIRE_SPECIAL and not re.search(r'[!@#$%^&*()_+\-=\[\]{}|;:\'",.<>?/~`]', pw):
+        errs.append("Must contain at least one special character (!@#$…).")
+    if pw.lower() in BANNED_PASSWORDS:
+        errs.append("Password is too common. Choose something stronger.")
+    if re.search(r"(.)\1{4,}", pw):
+        errs.append("Must not contain 5+ repeated characters.")
+    return errs
+
+def check_password_leaked(pw: str) -> bool:
+    """k-anonymity check via HIBP range API. Returns True if leaked."""
+    try:
+        import requests
+        s = _sha1(pw); prefix, suffix = s[:5], s[5:]
+        resp = requests.get(
+            f"https://api.pwnedpasswords.com/range/{prefix}",
+            timeout=5, headers={"User-Agent": "OmniParse-AI"},
+        )
+        if resp.status_code != 200: return False
+        return any(line.split(":")[0] == suffix for line in resp.text.splitlines())
+    except Exception: return False  # fail open
+
+def validate_password_full(pw: str) -> tuple[bool, list[str]]:
+    errs = check_password_strength(pw)
+    if errs: return False, errs
+    if check_password_leaked(pw):
+        errs.append("This password appeared in known data breaches. Choose another.")
+        return False, errs
+    return True, []
+
+# ── Session management ──────────────────────────────────────────────────────
+def generate_session_token() -> str:
+    return secrets.token_urlsafe(48)
+
+def create_user_session(user_id: int) -> str:
+    token = generate_session_token()
+    expires = (datetime.now(timezone.utc) + timedelta(hours=SESSION_TTL_HOURS)).isoformat()
+    create_session(user_id, token, expires)
+    return token
+
+def validate_session_token(token: str | None) -> dict | None:
+    if not token: return None
+    s = get_session(token)
+    return get_user_by_id(s["user_id"]) if s else None
+
+def set_session_cookie(response, token: str) -> None:
+    response.set_cookie(
+        key=COOKIE_NAME, value=token, httponly=COOKIE_HTTPONLY,
+        secure=COOKIE_SECURE, samesite=COOKIE_SAMESITE,
+        max_age=SESSION_TTL_HOURS * 3600, path="/",
+    )
+
+def clear_session_cookie(response) -> None:
+    response.delete_cookie(key=COOKIE_NAME, path="/", httponly=COOKIE_HTTPONLY,
+                            secure=COOKIE_SECURE, samesite=COOKIE_SAMESITE)
+
+# ── Auth actions ────────────────────────────────────────────────────────────
+def register_user(email: str, name: str, password: str) -> tuple[dict | None, str | None]:
+    email = email.strip().lower()
+    if not re.match(r"^[^@\s]+@[^@\s]+\.[^@\s]+$", email):
+        return None, "Please enter a valid email address."
+    name = name.strip()
+    if len(name) < 2:  return None, "Name must be at least 2 characters."
+    if len(name) > 100: return None, "Name must be 100 characters or fewer."
+    if not re.match(r"^[a-zA-ZÀ-ž\s\-']+$", name):
+        return None, "Name contains invalid characters."
+    valid, errs = validate_password_full(password)
+    if not valid: return None, " ".join(errs)
+    if get_user_by_email(email):
+        return None, "An account with this email already exists."
+    user = db_create_user(email, name, hash_password(password))
+    return (user, None) if user else (None, "Account creation failed. Try again.")
+
+def login_user(email: str, password: str) -> tuple[dict | None, str | None]:
+    email = email.strip().lower()
+    if not email or not password: return None, "Enter both email and password."
+    user = get_user_by_email(email)
+    # constant-time defense against user enumeration:
+    if not user:
+        bcrypt.checkpw(password.encode("utf-8"), bcrypt.gensalt(rounds=BCRYPT_ROUNDS))
+        return None, "Invalid email or password."
+    if not verify_password(password, user["password_hash"]):
+        return None, "Invalid email or password."
+    return user, None

config.py

@@ -0,0 +1,58 @@
+"""OmniParse AI — Configuration & Secrets. All sensitive values from env vars."""
+
+import os
+
+# ── API Keys ────────────────────────────────────────────────────────────────
+HF_TOKEN           = os.environ.get("HF_TOKEN")
+GROQ_API_KEY       = os.environ.get("GROQ_API_KEY")
+SUPABASE_URL       = os.environ.get("SUPABASE_URL")
+SUPABASE_KEY       = os.environ.get("SUPABASE_KEY")
+GOOGLE_VISION_KEY  = os.environ.get("GOOGLE_VISION_KEY")
+STRIPE_SECRET_KEY  = os.environ.get("STRIPE_SECRET_KEY")
+STRIPE_PRICE_BASIC = os.environ.get("STRIPE_PRICE_BASIC")
+STRIPE_PRICE_PRO   = os.environ.get("STRIPE_PRICE_PRO")
+STRIPE_PRICE_ENTERPRISE = os.environ.get("STRIPE_PRICE_ENTERPRISE")
+STRIPE_WEBHOOK_SECRET  = os.environ.get("STRIPE_WEBHOOK_SECRET")
+APP_URL = os.environ.get("APP_URL", "http://localhost:7860")
+
+# ── Session & Cookies ───────────────────────────────────────────────────────
+SESSION_TTL_HOURS  = 168   # 7 days
+COOKIE_NAME        = "op_sid"
+COOKIE_SECURE      = os.environ.get("COOKIE_SECURE", "false").lower() == "true"
+COOKIE_HTTPONLY    = True
+COOKIE_SAMESITE    = "lax"
+
+# ── Password Policy ─────────────────────────────────────────────────────────
+BCRYPT_ROUNDS       = 12
+MIN_PASSWORD_LENGTH = 10
+REQUIRE_MIXED_CASE   = True
+REQUIRE_DIGIT        = True
+REQUIRE_SPECIAL      = True
+BANNED_PASSWORDS = {
+    "password", "1234567890", "qwerty12345", "admin12345",
+    "letmein123", "welcome123",  "monkey1234", "dragon1234",
+    "password123", "omniparse123", "invoice1234", "changeme123",
+}
+
+# ── File Upload Limits ──────────────────────────────────────────────────────
+MAX_FILE_SIZE_MB   = 20
+MAX_FILES_PER_REQ  = 10
+
+# ── Rate Limits ─────────────────────────────────────────────────────────────
+RATE_GLOBAL         = "200/minute"
+RATE_AUTH           = "10/minute"
+RATE_UPLOAD         = "30/minute"
+RATE_API            = "60/minute"
+
+# ── Plans ───────────────────────────────────────────────────────────────────
+PLAN_LIMITS = {"free": 20, "basic": 200, "pro": 2000, "enterprise": float("inf")}
+PLAN_LABELS = {"free": "Free", "basic": "Basic", "pro": "Pro", "enterprise": "Enterprise"}
+PLAN_PRICES = {"free": 0, "basic": 29, "pro": 129, "enterprise": 499}
+PLAN_PRICE_IDS = {
+    "basic": STRIPE_PRICE_BASIC, "pro": STRIPE_PRICE_PRO,
+    "enterprise": STRIPE_PRICE_ENTERPRISE,
+}
+
+# ── Database ────────────────────────────────────────────────────────────────
+SQLITE_PATH  = os.environ.get("SQLITE_PATH", "omniparse.db")
+USE_SUPABASE = bool(SUPABASE_URL and SUPABASE_KEY)

database.py

@@ -0,0 +1,249 @@
+"""OmniParse AI — Database layer. SQLite fallback + optional Supabase. All queries parameterized."""
+
+import sqlite3, json, secrets as _secrets
+from datetime import datetime, timezone
+from config import SQLITE_PATH, USE_SUPABASE, SUPABASE_URL, SUPABASE_KEY
+
+_sb = None
+
+def _supabase():
+    global _sb
+    if _sb is None and USE_SUPABASE:
+        try:
+            from supabase import create_client as sc
+            _sb = sc(SUPABASE_URL, SUPABASE_KEY)
+        except Exception as e:
+            print(f"[WARN] Supabase init failed: {e}")
+            return None
+    return _sb
+
+def _sqlite():
+    c = sqlite3.connect(SQLITE_PATH)
+    c.row_factory = sqlite3.Row
+    c.execute("PRAGMA journal_mode=WAL")
+    c.execute("PRAGMA foreign_keys=ON")
+    return c
+
+# ── Init ────────────────────────────────────────────────────────────────────
+def db_init():
+    sb = _supabase()
+    if sb: return  # tables created in Supabase SQL editor
+    c = _sqlite()
+    c.executescript("""
+        CREATE TABLE IF NOT EXISTS users (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            email TEXT UNIQUE NOT NULL COLLATE NOCASE,
+            name TEXT NOT NULL,
+            password_hash TEXT NOT NULL,
+            plan TEXT NOT NULL DEFAULT 'free',
+            stripe_cid TEXT,
+            api_key TEXT UNIQUE,
+            email_verified INTEGER NOT NULL DEFAULT 0,
+            is_admin INTEGER NOT NULL DEFAULT 0,
+            created_at TEXT NOT NULL,
+            updated_at TEXT
+        );
+        CREATE TABLE IF NOT EXISTS sessions (
+            token TEXT PRIMARY KEY,
+            user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+            expires_at TEXT NOT NULL,
+            created_at TEXT NOT NULL
+        );
+        CREATE TABLE IF NOT EXISTS invoices (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+            filename TEXT, vendor TEXT, inv_number TEXT,
+            inv_date TEXT, due_date TEXT, amount REAL,
+            vat_amount REAL, total REAL, currency TEXT DEFAULT 'USD',
+            status TEXT DEFAULT 'done', is_duplicate INTEGER DEFAULT 0,
+            confidence REAL, raw_json TEXT, created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS ix_inv_user ON invoices(user_id);
+        CREATE INDEX IF NOT EXISTS ix_inv_date ON invoices(created_at);
+        CREATE INDEX IF NOT EXISTS ix_ses_user ON sessions(user_id);
+        CREATE INDEX IF NOT EXISTS ix_ses_exp  ON sessions(expires_at);
+    """)
+    c.commit(); c.close()
+
+# ── Users ───────────────────────────────────────────────────────────────────
+def create_user(email: str, name: str, password_hash: str, plan: str = "free") -> dict | None:
+    email = email.strip().lower()
+    api_key = "op_live_" + _secrets.token_hex(20)
+    now = datetime.now(timezone.utc).isoformat()
+    sb = _supabase()
+    if sb:
+        ex = sb.table("users").select("id").eq("email", email).execute()
+        if ex.data: return None
+        r = sb.table("users").insert({"email":email,"name":name,"password_hash":password_hash,
+              "plan":plan,"api_key":api_key,"created_at":now}).execute()
+        return r.data[0] if r.data else None
+    c = _sqlite()
+    try:
+        cur = c.execute("INSERT INTO users(email,name,password_hash,plan,api_key,created_at) VALUES(?,?,?,?,?,?)",
+                        (email, name, password_hash, plan, api_key, now))
+        c.commit(); uid = cur.lastrowid
+        row = c.execute("SELECT * FROM users WHERE id=?", (uid,)).fetchone()
+        return dict(row)
+    except sqlite3.IntegrityError: return None
+    finally: c.close()
+
+def get_user_by_email(email: str) -> dict | None:
+    email = email.strip().lower()
+    sb = _supabase()
+    if sb:
+        r = sb.table("users").select("*").eq("email",email).execute()
+        return r.data[0] if r.data else None
+    c = _sqlite()
+    row = c.execute("SELECT * FROM users WHERE email=? COLLATE NOCASE", (email,)).fetchone()
+    c.close(); return dict(row) if row else None
+
+def get_user_by_id(uid: int) -> dict | None:
+    sb = _supabase()
+    if sb:
+        r = sb.table("users").select("*").eq("id",uid).execute()
+        return r.data[0] if r.data else None
+    c = _sqlite()
+    row = c.execute("SELECT * FROM users WHERE id=?", (uid,)).fetchone()
+    c.close(); return dict(row) if row else None
+
+def update_user(uid: int, fields: dict) -> None:
+    fields["updated_at"] = datetime.now(timezone.utc).isoformat()
+    sb = _supabase()
+    if sb: sb.table("users").update(fields).eq("id",uid).execute(); return
+    c = _sqlite()
+    cols = ", ".join(f"{k}=?" for k in fields)
+    vals = list(fields.values()) + [uid]
+    c.execute(f"UPDATE users SET {cols} WHERE id=?", vals)
+    c.commit(); c.close()
+
+def delete_user(uid: int) -> None:
+    sb = _supabase()
+    if sb:
+        sb.table("invoices").delete().eq("user_id",uid).execute()
+        sb.table("sessions").delete().eq("user_id",uid).execute()
+        sb.table("users").delete().eq("id",uid).execute(); return
+    c = _sqlite()
+    c.execute("DELETE FROM invoices WHERE user_id=?",(uid,))
+    c.execute("DELETE FROM sessions WHERE user_id=?",(uid,))
+    c.execute("DELETE FROM users WHERE id=?",(uid,))
+    c.commit(); c.close()
+
+# ── Sessions ────────────────────────────────────────────────────────────────
+def create_session(user_id: int, token: str, expires_at: str) -> None:
+    now = datetime.now(timezone.utc).isoformat()
+    sb = _supabase()
+    if sb:
+        sb.table("sessions").insert({"token":token,"user_id":user_id,"expires_at":expires_at,"created_at":now}).execute()
+        return
+    c = _sqlite()
+    c.execute("INSERT INTO sessions(token,user_id,expires_at,created_at) VALUES(?,?,?,?)",(token,user_id,expires_at,now))
+    c.commit(); c.close()
+
+def get_session(token: str) -> dict | None:
+    if not token: return None
+    sb = _supabase()
+    if sb:
+        r = sb.table("sessions").select("*").eq("token",token).execute()
+        if not r.data: return None
+        session = r.data[0]
+    else:
+        c = _sqlite()
+        row = c.execute("SELECT * FROM sessions WHERE token=?",(token,)).fetchone()
+        c.close()
+        if not row: return None
+        session = dict(row)
+    try:
+        expires = datetime.fromisoformat(session["expires_at"])
+        if expires.tzinfo is None: expires = expires.replace(tzinfo=timezone.utc)
+        if expires < datetime.now(timezone.utc): delete_session(token); return None
+    except (ValueError, KeyError): return None
+    return session
+
+def delete_session(token: str) -> None:
+    if not token: return
+    sb = _supabase()
+    if sb: sb.table("sessions").delete().eq("token",token).execute(); return
+    c = _sqlite()
+    c.execute("DELETE FROM sessions WHERE token=?",(token,))
+    c.commit(); c.close()
+
+def cleanup_sessions() -> int:
+    now = datetime.now(timezone.utc).isoformat()
+    sb = _supabase()
+    if sb:
+        r = sb.table("sessions").delete().lt("expires_at",now).execute()
+        return len(r.data) if r.data else 0
+    c = _sqlite()
+    cur = c.execute("DELETE FROM sessions WHERE expires_at<?",(now,))
+    c.commit(); n = cur.rowcount; c.close(); return n
+
+# ── Invoices ────────────────────────────────────────────────────────────────
+def insert_invoice(user_id: int, data: dict) -> dict:
+    now = datetime.now(timezone.utc).isoformat()
+    row = {
+        "user_id": user_id,
+        "filename": data.get("filename"),
+        "vendor": data.get("vendor"),
+        "inv_number": data.get("invoice_number"),
+        "inv_date": data.get("invoice_date"),
+        "due_date": data.get("due_date"),
+        "amount": data.get("amount"),
+        "vat_amount": data.get("vat_amount"),
+        "total": data.get("total"),
+        "currency": data.get("currency","USD"),
+        "status": data.get("status","done"),
+        "is_duplicate": bool(data.get("is_duplicate", False)),
+        "confidence": data.get("confidence"),
+        "raw_json": json.dumps(data, ensure_ascii=False, default=str),
+        "created_at": now,
+    }
+    sb = _supabase()
+    if sb:
+        r = sb.table("invoices").insert(row).execute()
+        return r.data[0] if r.data else row
+    c = _sqlite()
+    cols = ", ".join(row.keys())
+    phs  = ", ".join("?" for _ in row)
+    c.execute(f"INSERT INTO invoices({cols}) VALUES({phs})", tuple(row.values()))
+    c.commit()
+    iid = c.execute("SELECT last_insert_rowid()").fetchone()[0]
+    res = c.execute("SELECT * FROM invoices WHERE id=?",(iid,)).fetchone()
+    c.close(); return dict(res)
+
+def get_invoices(user_id: int) -> list[dict]:
+    sb = _supabase()
+    if sb:
+        r = sb.table("invoices").select("*").eq("user_id",user_id).order("created_at",desc=True).execute()
+        return r.data or []
+    c = _sqlite()
+    rows = c.execute("SELECT * FROM invoices WHERE user_id=? ORDER BY created_at DESC",(user_id,)).fetchall()
+    c.close(); return [dict(r) for r in rows]
+
+def delete_invoice(user_id: int, invoice_id: int) -> None:
+    sb = _supabase()
+    if sb: sb.table("invoices").delete().eq("id",invoice_id).eq("user_id",user_id).execute(); return
+    c = _sqlite()
+    c.execute("DELETE FROM invoices WHERE id=? AND user_id=?",(invoice_id,user_id))
+    c.commit(); c.close()
+
+def count_invoices_this_month(user_id: int) -> int:
+    invs = get_invoices(user_id); now = datetime.now(timezone.utc); n = 0
+    for inv in invs:
+        try:
+            cr = datetime.fromisoformat(inv["created_at"])
+            if cr.year == now.year and cr.month == now.month: n += 1
+        except (ValueError, KeyError): pass
+    return n
+
+def check_duplicate(user_id: int, vendor: str, total: float) -> bool:
+    if not vendor or total is None: return False
+    invs = get_invoices(user_id); now = datetime.now(timezone.utc)
+    vl = vendor.strip().lower()
+    for inv in invs:
+        try: cr = datetime.fromisoformat(inv["created_at"])
+        except: continue
+        if cr.year == now.year and cr.month == now.month:
+            iv = (inv.get("vendor") or "").strip().lower()
+            it = inv.get("total")
+            if iv == vl and it is not None and abs(float(it)-float(total))<0.01: return True
+    return False

middleware.py

@@ -0,0 +1,108 @@
+"""OmniParse AI — Rate limiting + security middleware."""
+
+import time, re, os
+from collections import defaultdict
+from fastapi import Request, HTTPException
+from fastapi.responses import Response
+from starlette.middleware.base import BaseHTTPMiddleware
+from config import (
+    RATE_GLOBAL, RATE_AUTH, RATE_UPLOAD, RATE_API,
+    MAX_FILE_SIZE_MB, MAX_FILES_PER_REQ,
+    STRIPE_WEBHOOK_SECRET,
+)
+
+# ── Token bucket ────────────────────────────────────────────────────────────
+class TokenBucket:
+    def __init__(self, rate: float, cap: int):
+        self.tokens = float(cap); self.cap = cap; self.rate = rate
+        self.last = time.monotonic()
+    def _refill(self):
+        now = time.monotonic(); e = now - self.last
+        self.tokens = min(self.cap, self.tokens + e * self.rate); self.last = now
+    def consume(self, n=1) -> bool:
+        self._refill()
+        if self.tokens >= n: self.tokens -= n; return True
+        return False
+
+class RateLimiter:
+    def __init__(self):
+        self._buckets: dict = defaultdict(dict)
+    def _get(self, key: str, limit: str) -> TokenBucket:
+        if limit not in self._buckets[key]:
+            cnt, period = limit.split("/"); cnt = int(cnt)
+            secs = {"second":1,"seconds":1,"minute":60,"minutes":60,"hour":3600,"hours":3600}.get(period,60)
+            self._buckets[key][limit] = TokenBucket(cnt/secs, cnt)
+        return self._buckets[key][limit]
+    def limited(self, key: str, limit: str) -> bool:
+        return not self._get(key, limit).consume()
+
+limiter = RateLimiter()
+
+def client_ip(req: Request) -> str:
+    fwd = req.headers.get("X-Forwarded-For")
+    if fwd: return fwd.split(",")[0].strip()
+    rip = req.headers.get("X-Real-IP")
+    if rip: return rip.strip()
+    return req.client.host if req.client else "unknown"
+
+# ── Security headers middleware ─────────────────────────────────────────────
+class SecurityHeadersMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, req: Request, call_next):
+        resp = await call_next(req)
+        resp.headers["X-Content-Type-Options"] = "nosniff"
+        resp.headers["X-Frame-Options"] = "DENY"
+        resp.headers["X-XSS-Protection"] = "1; mode=block"
+        resp.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
+        resp.headers["Permissions-Policy"] = "camera=(), microphone=(), geolocation=()"
+        if req.url.scheme == "https":
+            resp.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+        return resp
+
+# ── Rate limit helpers ──────────────────────────────────────────────────────
+def global_limit(req: Request):
+    ip = client_ip(req)
+    if limiter.limited(ip, RATE_GLOBAL):
+        raise HTTPException(429, detail="Too many requests. Slow down.", headers={"Retry-After":"60"})
+
+def auth_limit(req: Request):
+    ip = client_ip(req)
+    if limiter.limited(f"auth:{ip}", RATE_AUTH):
+        raise HTTPException(429, detail="Too many login attempts. Wait and retry.", headers={"Retry-After":"60"})
+
+def upload_limit(req: Request):
+    ip = client_ip(req)
+    if limiter.limited(f"upload:{ip}", RATE_UPLOAD):
+        raise HTTPException(429, detail="Upload rate exceeded. Wait before uploading more.", headers={"Retry-After":"30"})
+
+def api_limit(req: Request):
+    ip = client_ip(req)
+    if limiter.limited(f"api:{ip}", RATE_API):
+        raise HTTPException(429, detail="API rate limit exceeded.", headers={"Retry-After":"30"})
+
+# ── File validation ─────────────────────────────────────────────────────────
+def validate_file_size(size: int):
+    if size > MAX_FILE_SIZE_MB * 1024 * 1024:
+        raise HTTPException(413, detail=f"File too large. Maximum {MAX_FILE_SIZE_MB} MB.")
+
+def validate_file_count(n: int):
+    if n > MAX_FILES_PER_REQ:
+        raise HTTPException(400, detail=f"Maximum {MAX_FILES_PER_REQ} files per upload.")
+
+def validate_filename(fn: str) -> str:
+    clean = os.path.basename(fn)
+    clean = re.sub(r'[^a-zA-Z0-9._\- ()]', '_', clean)
+    if not clean or clean.startswith('.'): clean = "uploaded_file"
+    if len(clean) > 255:
+        name, ext = os.path.splitext(clean); clean = name[:250] + ext
+    return clean
+
+# ── Stripe webhook signature verification ──────────────────────────────────
+async def verify_stripe_webhook(req: Request, raw_body: bytes) -> bool:
+    """Verify Stripe webhook signature. Returns True if valid."""
+    if not STRIPE_WEBHOOK_SECRET: return False
+    try:
+        import stripe
+        sig = req.headers.get("Stripe-Signature", "")
+        stripe.Webhook.construct_event(raw_body, sig, STRIPE_WEBHOOK_SECRET)
+        return True
+    except Exception: return False

ocr.py

@@ -0,0 +1,63 @@
+"""OmniParse AI — OCR pipeline: Tesseract (primary) + Google Vision (fallback)."""
+
+import io, base64
+from PIL import Image as PILImage
+import requests
+from config import GOOGLE_VISION_KEY
+
+# Lazy imports
+_pt = None; _pdf2img = None
+
+def _get_pt():
+    global _pt
+    if _pt is None:
+        try:
+            import pytesseract as t
+            _pt = t
+        except ImportError: pass
+    return _pt
+
+def _get_pdf2img():
+    global _pdf2img
+    if _pdf2img is None:
+        try:
+            from pdf2image import convert_from_path as c
+            _pdf2img = c
+        except ImportError: pass
+    return _pdf2img
+
+def pdf_to_images(path: str, dpi: int = 200) -> list:
+    c = _get_pdf2img()
+    if not c: return []
+    try: return c(path, dpi=dpi)
+    except Exception as e: print(f"[WARN] pdf2image: {e}"); return []
+
+def load_image(path: str):
+    try: return PILImage.open(path).convert("RGB")
+    except Exception as e: print(f"[WARN] open image: {e}"); return None
+
+def ocr_tesseract(img, lang: str = "eng") -> str:
+    pt = _get_pt()
+    if not pt: return ""
+    try: return pt.image_to_string(img.convert("L"), lang=lang)
+    except Exception as e: print(f"[WARN] tesseract: {e}"); return ""
+
+def ocr_google_vision(img) -> str:
+    if not GOOGLE_VISION_KEY: return ""
+    try:
+        buf = io.BytesIO(); img.save(buf, format="PNG")
+        b64 = base64.b64encode(buf.getvalue()).decode("utf-8")
+        payload = {"requests":[{"image":{"content":b64},"features":[{"type":"TEXT_DETECTION"}]}]}
+        r = requests.post(
+            f"https://vision.googleapis.com/v1/images:annotate?key={GOOGLE_VISION_KEY}",
+            json=payload, timeout=15)
+        r.raise_for_status()
+        return r.json()["responses"][0].get("fullTextAnnotation",{}).get("text","")
+    except Exception as e: print(f"[WARN] vision: {e}"); return ""
+
+def run_ocr(img) -> str:
+    text = ocr_tesseract(img)
+    if len(text.strip()) < 100 and GOOGLE_VISION_KEY:
+        vt = ocr_google_vision(img)
+        if len(vt.strip()) > len(text.strip()): text = vt
+    return text

server.py

@@ -0,0 +1,394 @@
+"""
+OmniParse AI — Main Server (gradio.Server → FastAPI + custom HTML frontend).
+
+Run:
+    python server.py
+
+Deploy as a HuggingFace Space with Gradio SDK.
+Uses gradio.Server for queuing/concurrency + custom HTML/CSS/JS frontend.
+"""
+
+import os, io, csv, json, uuid, tempfile
+from datetime import datetime, timezone
+from fastapi import Request, HTTPException, UploadFile, File, Form, Depends
+from fastapi.responses import JSONResponse, HTMLResponse, StreamingResponse
+from fastapi.staticfiles import StaticFiles
+from fastapi.middleware.cors import CORSMiddleware
+from gradio import Server
+
+# ── Our modules ─────────────────────────────────────────────────────────────
+from config import (
+    APP_URL, PLAN_LIMITS, PLAN_LABELS, PLAN_PRICES, PLAN_PRICE_IDS,
+    STRIPE_SECRET_KEY, MAX_FILE_SIZE_MB, MAX_FILES_PER_REQ,
+)
+from database import (
+    db_init, get_user_by_id, update_user, delete_user,
+    insert_invoice, get_invoices, delete_invoice,
+    count_invoices_this_month, check_duplicate,
+)
+from auth import (
+    register_user, login_user, create_user_session, validate_session_token,
+    hash_password, check_password_strength, verify_password,
+    set_session_cookie, clear_session_cookie,
+)
+from ocr import run_ocr, pdf_to_images, load_image
+from ai_extraction import (
+    ai_extract_groq, ai_extract_hf, regex_extract,
+    validate_invoice, sanitize_invoice_data,
+)
+from middleware import (
+    SecurityHeadersMiddleware,
+    global_limit, auth_limit, upload_limit,
+    validate_file_size, validate_file_count, validate_filename,
+)
+
+# ── Init ────────────────────────────────────────────────────────────────────
+app = Server()
+app.add_middleware(SecurityHeadersMiddleware)
+app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_credentials=True,
+                   allow_methods=["GET","POST","DELETE"], allow_headers=["Content-Type","Authorization"])
+
+BASE = os.path.dirname(os.path.abspath(__file__))
+STATIC = os.path.join(BASE, "static")
+os.makedirs(os.path.join(STATIC, "css"), exist_ok=True)
+os.makedirs(os.path.join(STATIC, "js"), exist_ok=True)
+os.makedirs(os.path.join(STATIC, "img"), exist_ok=True)
+app.mount("/static", StaticFiles(directory=STATIC), name="static")
+
+db_init()
+
+# Lazy Stripe
+_stripe = None
+def _get_stripe():
+    global _stripe
+    if _stripe is None and STRIPE_SECRET_KEY:
+        try:
+            import stripe; stripe.api_key = STRIPE_SECRET_KEY; _stripe = stripe
+        except ImportError: pass
+    return _stripe
+
+# ── Session dependency ──────────────────────────────────────────────────────
+async def current_user(req: Request):
+    token = req.cookies.get("op_sid")
+    if not token: return None
+    return validate_session_token(token)
+
+async def require_auth(req: Request):
+    u = await current_user(req)
+    if not u: raise HTTPException(401, detail="Authentication required.")
+    return u
+
+async def require_admin(req: Request):
+    u = await require_auth(req)
+    if not u.get("is_admin"):
+        raise HTTPException(403, detail="Admin access required.")
+    return u
+
+# ── Demo account bootstrap ──────────────────────────────────────────────────
+def _ensure_demo():
+    from database import get_user_by_email
+    if not get_user_by_email("demo@omniparse.ai"):
+        from database import create_user as cu
+        cu("demo@omniparse.ai", "Demo User", hash_password("Demo@12345!"), plan="pro")
+        print("[INFO] Demo account: demo@omniparse.ai / Demo@12345! (Pro)")
+
+_ensure_demo()
+
+# ═══════════════════════════════════════════════════════════════════════════
+#  API Routes — Auth
+# ═══════════════════════════════════════════════════════════════════════════
+@app.post("/api/auth/register")
+async def api_register(req: Request, email: str = Form(...), name: str = Form(...), password: str = Form(...)):
+    auth_limit(req); global_limit(req)
+    user, err = register_user(email, name, password)
+    if err: raise HTTPException(400, detail=err)
+    token = create_user_session(user["id"])
+    resp = JSONResponse({"status":"ok","user":_safe_user(user)})
+    set_session_cookie(resp, token)
+    return resp
+
+@app.post("/api/auth/login")
+async def api_login(req: Request, email: str = Form(...), password: str = Form(...)):
+    auth_limit(req); global_limit(req)
+    user, err = login_user(email, password)
+    if err: raise HTTPException(401, detail=err)
+    token = create_user_session(user["id"])
+    resp = JSONResponse({"status":"ok","user":_safe_user(user)})
+    set_session_cookie(resp, token)
+    return resp
+
+@app.post("/api/auth/logout")
+async def api_logout(req: Request):
+    from database import delete_session as ds
+    t = req.cookies.get("op_sid")
+    if t: ds(t)
+    resp = JSONResponse({"status":"ok"})
+    clear_session_cookie(resp)
+    return resp
+
+@app.get("/api/auth/me")
+async def api_me(u: dict = Depends(require_auth)):
+    return _safe_user(u)
+
+# ═══════════════════════════════════════════════════════════════════════════
+#  API Routes — Invoices
+# ═══════════════════════════════════════════════════════════════════════════
+@app.post("/api/invoices/upload")
+async def api_upload(req: Request, files: list[UploadFile] = File(...), u: dict = Depends(require_auth)):
+    upload_limit(req); global_limit(req)
+    validate_file_count(len(files))
+    plan = u.get("plan","free")
+    limit = PLAN_LIMITS.get(plan, 20)
+    used = count_invoices_this_month(u["id"])
+    results, skipped, errs, processed = [], 0, [], 0
+
+    for f in files:
+        try: contents = await f.read()
+        except Exception as e: errs.append(f"Read error {f.filename}: {e}"); continue
+        validate_file_size(len(contents))
+        cn = validate_filename(f.filename or "upload")
+        ext = cn.lower().split(".")[-1] if "." in cn else ""
+        if ext not in ("pdf","jpg","jpeg","png","tiff","tif"):
+            errs.append(f"{cn}: Unsupported format."); continue
+        if limit != float("inf") and (used + processed) >= limit: skipped += 1; continue
+        tmp = os.path.join(tempfile.gettempdir(), f"op_{uuid.uuid4().hex}_{cn}")
+        try:
+            with open(tmp,"wb") as tf: tf.write(contents)
+            data = _process_file(tmp, u, cn)
+            data = sanitize_invoice_data(data); data["filename"] = cn
+            if plan in ("pro","enterprise") and check_duplicate(u["id"], data.get("vendor"), data.get("total")):
+                data["status"] = "duplicate"; data["is_duplicate"] = True
+            saved = insert_invoice(u["id"], data); results.append(_serialize(saved)); processed += 1
+        except Exception as e: errs.append(f"{cn}: {e}")
+        finally:
+            try: os.unlink(tmp)
+            except OSError: pass
+
+    nu = count_invoices_this_month(u["id"])
+    return {"status":"ok","processed":processed,"skipped":skipped,"errors":errs,
+            "results":results,"usage":{"used":nu,"limit":None if limit==float("inf") else int(limit)}}
+
+@app.get("/api/invoices")
+async def api_list(req: Request, filter: str = "all", u: dict = Depends(require_auth)):
+    global_limit(req)
+    invs = get_invoices(u["id"])
+    out = []
+    for i in invs:
+        s = i.get("status","done")
+        if filter == "done" and s != "done": continue
+        if filter == "review" and s != "review": continue
+        if filter == "duplicates" and not i.get("is_duplicate"): continue
+        out.append(_serialize(i))
+    return {"status":"ok","invoices":out,"count":len(out)}
+
+@app.delete("/api/invoices/{inv_id}")
+async def api_delete(inv_id: int, req: Request, u: dict = Depends(require_auth)):
+    global_limit(req)
+    delete_invoice(u["id"], inv_id)
+    return {"status":"ok","deleted":inv_id}
+
+# ═══════════════════════════════════════════════════════════════════════════
+#  API Routes — Export
+# ═══════════════════════════════════════════════════════════════════════════
+@app.get("/api/export/csv")
+async def api_csv(req: Request, u: dict = Depends(require_auth)):
+    global_limit(req)
+    invs = get_invoices(u["id"])
+    out = io.StringIO(); w = csv.writer(out)
+    w.writerow(["ID","Filename","Vendor","Invoice#","Date","Due Date","Amount","VAT","Total","Currency","Status"])
+    for i in invs:
+        w.writerow([i.get("id"),i.get("filename"),i.get("vendor"),i.get("inv_number"),
+                    i.get("inv_date"),i.get("due_date"),i.get("amount"),i.get("vat_amount"),
+                    i.get("total"),i.get("currency"),i.get("status")])
+    out.seek(0)
+    return StreamingResponse(iter([out.getvalue()]), media_type="text/csv",
+                             headers={"Content-Disposition":"attachment; filename=omniparse_export.csv"})
+
+@app.get("/api/export/json")
+async def api_json(req: Request, u: dict = Depends(require_auth)):
+    global_limit(req)
+    if u.get("plan") == "free": raise HTTPException(403, detail="JSON export requires Basic+ plan.")
+    j = json.dumps(get_invoices(u["id"]), default=str, ensure_ascii=False, indent=2)
+    return StreamingResponse(iter([j]), media_type="application/json",
+                             headers={"Content-Disposition":"attachment; filename=omniparse_export.json"})
+
+# ═══════════════════════════════════════════════════════════════════════════
+#  API Routes — Stripe
+# ═══════════════════════════════════════════════════════════════════════════
+@app.post("/api/upgrade/checkout")
+async def api_checkout(req: Request, plan: str = Form(...), u: dict = Depends(require_auth)):
+    global_limit(req)
+    s = _get_stripe()
+    if not s: raise HTTPException(503, detail="Payments not configured.")
+    pid = PLAN_PRICE_IDS.get(plan)
+    if not pid: raise HTTPException(400, detail="Unknown plan.")
+    try:
+        session = s.checkout.Session.create(
+            mode="subscription", payment_method_types=["card"],
+            line_items=[{"price":pid,"quantity":1}], customer_email=u["email"],
+            success_url=f"{APP_URL}?checkout=success&session_id={{CHECKOUT_SESSION_ID}}",
+            cancel_url=f"{APP_URL}?checkout=cancel",
+            metadata={"plan":plan,"user_id":str(u["id"])})
+        return {"status":"ok","url":session.url}
+    except Exception as e: raise HTTPException(500, detail=f"Checkout error: {e}")
+
+@app.post("/api/upgrade/verify")
+async def api_verify(req: Request, session_id: str = Form(...), u: dict = Depends(require_auth)):
+    global_limit(req)
+    s = _get_stripe()
+    if not s: raise HTTPException(503, detail="Payments not configured.")
+    try:
+        session = s.checkout.Session.retrieve(session_id)
+        if session.payment_status == "paid":
+            plan = session.metadata.get("plan","basic"); cid = session.customer
+            update_user(u["id"], {"plan":plan,"stripe_cid":cid})
+            return {"status":"ok","plan":plan,"plan_label":PLAN_LABELS.get(plan,plan),
+                    "message":f"Upgraded to {PLAN_LABELS.get(plan,plan)}!"}
+        return {"status":"pending","message":"Payment not yet confirmed."}
+    except Exception as e: raise HTTPException(500, detail=f"Verification error: {e}")
+
+# ═══════════════════════════════════════════════════════════════════════════
+#  API Routes — Stripe Webhook (signature verified)
+# ═══════════════════════════════════════════════════════════════════════════
+@app.post("/api/webhooks/stripe")
+async def api_stripe_webhook(req: Request):
+    from middleware import verify_stripe_webhook
+    body = await req.body()
+    if not await verify_stripe_webhook(req, body):
+        raise HTTPException(400, detail="Invalid webhook signature.")
+    try:
+        event = json.loads(body)
+        t = event.get("type","")
+        if t == "checkout.session.completed":
+            obj = event["data"]["object"]
+            plan = obj.get("metadata",{}).get("plan","basic")
+            uid = int(obj.get("metadata",{}).get("user_id","0"))
+            if uid: update_user(uid, {"plan":plan,"stripe_cid":obj.get("customer")})
+        elif t == "customer.subscription.deleted":
+            obj = event["data"]["object"]
+            cid = obj.get("customer")
+            if cid:
+                from database import _supabase
+                sb = _supabase()
+                if sb:
+                    u = sb.table("users").select("id").eq("stripe_cid",cid).execute()
+                    if u.data: update_user(u.data[0]["id"],{"plan":"free"})
+    except Exception as e: print(f"[WARN] webhook: {e}")
+    return {"status":"ok"}
+
+# ═══════════════════════════════════════════════════════════════════════════
+#  API Routes — AI Chat (Pro+)
+# ═══════════════════════════════════════════════════════════════════════════
+@app.post("/api/chat")
+async def api_chat(req: Request, message: str = Form(...), u: dict = Depends(require_auth)):
+    global_limit(req)
+    plan = u.get("plan","free")
+    if plan not in ("pro","enterprise"):
+        raise HTTPException(403, detail="AI Chat requires Pro or Enterprise plan.")
+    msg = message.strip()[:2000]
+    invs = get_invoices(u["id"])
+    ctx = json.dumps(invs[:100], default=str, ensure_ascii=False)[:6000]
+    from config import GROQ_API_KEY
+    answer = "AI is currently unavailable."
+    if GROQ_API_KEY:
+        try:
+            from groq import Groq
+            gc = Groq(api_key=GROQ_API_KEY)
+            r = gc.chat.completions.create(
+                model="llama-3.1-8b-instant",
+                messages=[{"role":"system","content":f"You answer questions about invoices. Data: {ctx}. Concise, data only. Never reveal raw JSON."},
+                          {"role":"user","content":msg}],
+                max_tokens=400, temperature=0.2, timeout=15)
+            answer = r.choices[0].message.content
+        except Exception as e: answer = f"AI unavailable: {e}"
+    return {"status":"ok","answer":answer}
+
+# ═══════════════════════════════════════════════════════════════════════════
+#  API Routes — Profile
+# ═══════════════════════════════════════════════════════════════════════════
+@app.post("/api/profile/password")
+async def api_chpw(req: Request, current_password: str = Form(...), new_password: str = Form(...), u: dict = Depends(require_auth)):
+    global_limit(req); auth_limit(req)
+    if not verify_password(current_password, u["password_hash"]):
+        raise HTTPException(400, detail="Current password is incorrect.")
+    valid, errs = check_password_strength(new_password)
+    if not valid: raise HTTPException(400, detail=" ".join(errs))
+    update_user(u["id"], {"password_hash": hash_password(new_password)})
+    return {"status":"ok","message":"Password changed."}
+
+@app.delete("/api/profile/account")
+async def api_delete_account(req: Request, u: dict = Depends(require_auth)):
+    global_limit(req); auth_limit(req)
+    delete_user(u["id"])
+    resp = JSONResponse({"status":"ok","message":"Account deleted."})
+    clear_session_cookie(resp)
+    return resp
+
+# ═══════════════════════════════════════════════════════════════════════════
+#  Health
+# ═══════════════════════════════════════════════════════════════════════════
+@app.get("/api/health")
+async def health():
+    return {"status":"healthy","timestamp":datetime.now(timezone.utc).isoformat(),"version":"2.0.0"}
+
+# ═══════════════════════════════════════════════════════════════════════════
+#  Internals
+# ═══════════════════════════════════════════════════════════════════════════
+def _process_file(filepath: str, user: dict, filename: str) -> dict:
+    ext = filename.lower().split(".")[-1] if "." in filename else ""
+    images = []
+    if ext == "pdf": images = pdf_to_images(filepath)
+    elif ext in ("jpg","jpeg","png","tiff","tif"):
+        img = load_image(filepath)
+        if img: images = [img]
+    ocr_text = ""
+    for img in images: ocr_text += run_ocr(img) + "\n"
+    if ocr_text.strip():
+        data = ai_extract_groq(ocr_text) or ai_extract_hf(ocr_text) or regex_extract(ocr_text)
+    else:
+        data = {"vendor":"Demo Vendor Inc.","invoice_number":f"DEMO-{uuid.uuid4().hex[:6].upper()}",
+                "invoice_date":datetime.now().strftime("%Y-%m-%d"),"due_date":None,
+                "amount":100.0,"vat_amount":21.0,"total":121.0,"currency":"USD","line_items":[]}
+    data["filename"] = filename; data["confidence"] = 0.95 if ocr_text.strip() else 0.3
+    warnings = validate_invoice(data); data["warnings"] = warnings
+    data["status"] = "review" if warnings else "done"
+    return data
+
+def _serialize(inv: dict) -> dict:
+    labels = {"done":"Done","review":"Needs Review","duplicate":"Duplicate","processing":"Processing"}
+    return {"id":inv.get("id"),"filename":inv.get("filename"),"vendor":inv.get("vendor"),
+            "invoice_number":inv.get("inv_number"),"invoice_date":inv.get("inv_date"),
+            "due_date":inv.get("due_date"),"amount":inv.get("amount"),
+            "vat_amount":inv.get("vat_amount"),"total":inv.get("total"),
+            "currency":inv.get("currency","USD"),"status":inv.get("status","done"),
+            "status_label":labels.get(inv.get("status"),inv.get("status")),
+            "is_duplicate":bool(inv.get("is_duplicate")),
+            "confidence":inv.get("confidence"),"created_at":inv.get("created_at")}
+
+def _safe_user(u: dict) -> dict:
+    return {"id":u["id"],"email":u["email"],"name":u["name"],"plan":u["plan"],
+            "plan_label":PLAN_LABELS.get(u["plan"],u["plan"]),
+            "api_key":u.get("api_key"),"created_at":u.get("created_at"),
+            "is_admin":bool(u.get("is_admin"))}
+
+# ═══════════════════════════════════════════════════════════════════════════
+#  Frontend — serve SPA
+# ═══════════════════════════════════════════════════════════════════════════
+@app.get("/", response_class=HTMLResponse)
+async def serve_frontend():
+    p = os.path.join(STATIC, "index.html")
+    if not os.path.exists(p): return HTMLResponse("<h1>Frontend not found.</h1>", 404)
+    with open(p, "r", encoding="utf-8") as f: return HTMLResponse(f.read())
+
+@app.get("/{path:path}")
+async def catch_all(path: str):
+    p = os.path.join(STATIC, "index.html")
+    if os.path.exists(p):
+        with open(p, "r", encoding="utf-8") as f: return HTMLResponse(f.read())
+    return HTMLResponse("<h1>Not Found</h1>", 404)
+
+# ═══════════════════════════════════════════════════════════════════════════
+#  Launch
+# ═══════════════════════════════════════════════════════════════════════════
+if __name__ == "__main__":
+    app.launch(show_error=True, server_name="0.0.0.0", server_port=7860)