Loyiha haqida — developerlar uchun
QarzFlow codebase'ining knowledge-graph diagrammalari (Graphify + Mermaid).
Arxitektura
🤖 AI kategoriyalash
Har bir xarajat elementi qo'shimcha qadamsiz avtomatik kategoriyaga ajratiladi. Google Gemini tavsifni tahlil qilib, kategoriya + ishonch darajasini (confidence) qaytaradi.
- Kesh-birinchi: normalizatsiya qilingan tavsif avval mahalliy keshdan (item_category_cache) qidiriladi — takroriy AI so'rovi yuborilmaydi.
- Fallback: Gemini javob bermasa yoki xato bersa, xarajat "Boshqa" kategoriyasiga tushadi (confidence=0) — hech narsa bloklanmaydi.
- O'z-o'zini o'rgatuvchi: admin yoki xarajat egasining qo'lda tuzatishi keshni ustidan yozadi (source=admin/creator, confidence=1.0) va keyingi AI yozuvlari uni bosib eza olmaydi.
- Rate-limit: barcha chaqiruvlar (jonli bot + backfill skript) bitta global throttle orqali cheklanadi — bepul tarif kvotasidan chiqib ketmaslik uchun.
Jarayonlar (flows)
Deep-link web loginauth
New user approvaladmin
Real-time stats (WS)ws
Expense → report → settlecore
/remind (manual + auto)remind
Language pick + resolutioni18n
Notification read-statenotif
/hype landing overrideadmin
Mini App chip badgesmini-app
Analytics cachingcache
Theme switchingweb
Critical error notifyops
Full graph access (admin)gated
Pending re-reminderremind
Ma'lumotlar modeli
🔒 Xavfsizlik: shifrlangan zaxira nusxalar
Postgres bazasining kunlik to'liq dump'i (pg_dump) hech qachon serverda yoki Telegram'da ochiq matn holida saqlanmaydi.
- Asimmetrik shifrlash (GPG/PGP): serverda faqat public key bor. Xususiy (private) kalit hech qachon serverga yuklanmagan — faqat admin'ning shaxsiy qurilmasida.
- Jarayon: pg_dump → gzip → GPG bilan shifrlash → Telegram admin'ga yuboriladi va serverda 7 kunlik aylanma (rolling) saqlanadi.
- Server butunlay buzilsa ham — hujumchi faqat shifrlangan (.gpg) fayllarni oladi, private key bo'lmagani uchun ularni ocha olmaydi.
- Kalit fingerprint kod ichida qat'iy belgilangan (pinned) — import qilingan boshqa kalit tasodifan nishonga aylanib qolmaydi.
API / endpointlar
Asosan o'qish uchun. Yozish amallari Telegram-autentifikatsiyalangan sessiya talab qiladi; admin amallari — faqat ega (owner).
🌐 Ommaviy
GET/api/statsLive landing stats (+ deltas)
WS/api/wsReal-time stats stream
🔑 Foydalanuvchi · sessiya
GET/api/me/overview🔑 sessionMoney totals + KPIs
GET/api/me/spending🔑 sessionMonthly spending
GET/api/me/reports🔑 sessionYour reports
GET/api/me/reports/{id}🔑 sessionReport detail
POST/api/me/reports/{id}/verify🔑 sessionVerify a report
GET/api/me/expenses🔑 sessionYour expenses
GET/api/me/debts🔑 sessionActive debts
GET/api/me/balances🔑 sessionI owe / owed to me
POST/api/me/settle/request🔑 sessionStart a settle
POST/api/me/remind🔑 sessionRemind a debtor
GET/api/me/groups🔑 sessionYour groups
GET/api/me/pending-verifications🔑 sessionActions awaiting you
GET/api/me/notifications🔑 sessionNotifications feed
POST/api/me/notifications/read🔑 sessionMark notifications read
GET/api/me/analytics🔑 sessionAnalytics (cached 1h)
GET/api/me/settings🔑 sessionRead settings
PUT/api/me/settings🔑 sessionUpdate settings
GET/api/auth/me🔑 sessionSession info
POST/api/auth/out🔑 sessionLog out
🛡️ Admin · himoyalangan
🔒
Admin API · 13 endpoints
Sessiya + ega (ADMIN) talab qilinadi
To'liq interaktiv graf kerakmi?
1127 node'li to'liq knowledge graph admin ruxsati bilan beriladi. Bot orqali so'rov yuboring.
🤖 Bot orqali ruxsat so'rashDiagrammalar repo'dagi docs/*.md mermaid bloklaridan generatsiya qilingan.