Changelog · Pasona Finance Tracker API

v1.1.0 — Mailing system & opt-in email verification

Opt-in email verification. The User model implements MustVerifyEmail; a verification email is queued on register. Endpoints GET /api/email/verify/{id}/{hash} (signed), POST /api/email/verification-notification (resend, throttled 6/min), and GET /api/email/verification-status are now available. Google OAuth auto-flips email_verified_at on first login.
Sensitive writers are now gated. POST /api/transactions/sync, POST /api/import/store, and POST /api/import/kuda/store return 403 { "requires_verified_email": true } for unverified users. Read endpoints are unaffected.
Daily reminder email. New artisan reminders:send-daily command (scheduled every 5 minutes in routes/console.php) emails each user at their reminder_time with a personalised today-stats panel. Smart-skips users who already logged today and dedupes via users.reminder_last_sent_at.
Polished password-reset email. The reset-password mail is now a queued Markdown mailable (resources/views/emails/reset-password.blade.php) with a one-click link to the SPA reset form.
New endpoints documented. Kuda import (/api/import/kuda/preview, /api/import/kuda/store) and the email-availability probe (GET /api/auth/check-email) are now in the reference.
API surface tweak. POST /api/register and POST /api/login now return email_verified + email_verified_at. GET /api/me now returns reminder_time and reminder_last_sent_at.

Added POST /register, POST /login, POST /logout, and GET /me for authentication.
Added full CRUD on /accounts, /categories, and /transactions.
Added POST /transactions/sync for offline batch upload via a queue job.
Added POST /import/preview and POST /import/store for CSV bank-statement import with duplicate detection.
Added GET /summary for the dashboard data (totals, monthly summary, category breakdown).
Added Google OAuth via /auth/google and /auth/google/callback.

Duplicate checks now match on transaction_date, type, amount, and account_id.
Pass "force": true in the request body to skip the duplicate check.

This release introduced the Sanctum bearer-token format. Personal-access tokens issued before this date are invalid.