feat(finance): Phase 6 — Budget & Analytics

Add monthly budgets per category with spend-vs-budget dashboard and 6-month trend table.
Includes upsert budget API, monthly analytics endpoint, inline budget editing, and route auth fixes.

src/app/api/analytics/monthly/route.ts

@@ -0,0 +1,105 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getCurrentUser } from "@/lib/auth";
+import { queryRaw } from "@/lib/db";
+
+export async function GET(req: NextRequest) {
+  const user = await getCurrentUser(req);
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
+
+  const { searchParams } = new URL(req.url);
+  const monthCount = Math.min(Math.max(Number(searchParams.get("months") || "6"), 1), 24);
+
+  const now = new Date();
+  const endDate = new Date(now.getFullYear(), now.getMonth() + 1, 1);
+  const startDate = new Date(now.getFullYear(), now.getMonth() - monthCount + 1, 1);
+
+  const startStr = startDate.toISOString().slice(0, 10);
+  const endStr = endDate.toISOString().slice(0, 10);
+
+  const spendRows = await queryRaw<{
+    month: string;
+    category: string;
+    total_spent: number;
+    transaction_count: number;
+  }>(
+    `SELECT
+      TO_CHAR(DATE_TRUNC('month', t.transaction_date::date), 'YYYY-MM') as month,
+      COALESCE(o.category_override, t.category) as category,
+      SUM(t.amount)::numeric(12,2) as total_spent,
+      COUNT(*)::int as transaction_count
+    FROM transactions t
+    LEFT JOIN transaction_overrides o ON o.transaction_id = t.id
+    JOIN statements s ON s.id = t.statement_id
+    WHERE s.owner_id = $1
+      AND t.transaction_type = 'debit'
+      AND t.transaction_date >= $2
+      AND t.transaction_date < $3
+    GROUP BY 1, 2
+    ORDER BY 1 DESC, total_spent DESC`,
+    [user.id, startStr, endStr]
+  );
+
+  const budgetRows = await queryRaw<{ month: string; category: string; amount_limit: number }>(
+    `SELECT TO_CHAR(month, 'YYYY-MM') as month, category, amount_limit::numeric
+     FROM budgets
+     WHERE owner_id = $1 AND month >= $2::date AND month < $3::date`,
+    [user.id, startStr, endStr]
+  );
+
+  // Build month list (most recent first)
+  const months: string[] = [];
+  for (let i = monthCount - 1; i >= 0; i--) {
+    const d = new Date(now.getFullYear(), now.getMonth() - i, 1);
+    months.push(`${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}`);
+  }
+  months.reverse();
+
+  const spendMap = new Map<string, number>();
+  const countMap = new Map<string, number>();
+  const budgetMap = new Map<string, number>();
+
+  for (const r of spendRows) {
+    spendMap.set(`${r.category}:${r.month}`, Number(r.total_spent));
+    countMap.set(`${r.category}:${r.month}`, r.transaction_count);
+  }
+  for (const r of budgetRows) {
+    budgetMap.set(`${r.category}:${r.month}`, Number(r.amount_limit));
+  }
+
+  const allCategories = new Set<string>();
+  for (const r of spendRows) allCategories.add(r.category);
+  for (const r of budgetRows) allCategories.add(r.category);
+
+  const rows = Array.from(allCategories)
+    .sort()
+    .map((cat) => {
+      const spent: Record<string, number> = {};
+      const budget: Record<string, number> = {};
+      const txCount: Record<string, number> = {};
+      for (const m of months) {
+        const s = spendMap.get(`${cat}:${m}`);
+        const b = budgetMap.get(`${cat}:${m}`);
+        const c = countMap.get(`${cat}:${m}`);
+        if (s !== undefined) spent[m] = s;
+        if (b !== undefined) budget[m] = b;
+        if (c !== undefined) txCount[m] = c;
+      }
+      return { category: cat, spent, budget, txCount };
+    });
+
+  const totals: Record<string, { spent: number; budget: number }> = {};
+  for (const m of months) {
+    let s = 0;
+    let b = 0;
+    for (const row of rows) {
+      s += row.spent[m] || 0;
+      b += row.budget[m] || 0;
+    }
+    totals[m] = {
+      spent: Math.round(s * 100) / 100,
+      budget: Math.round(b * 100) / 100,
+    };
+  }
+
+  return NextResponse.json({ months, rows, totals });
+}

src/app/api/budgets/[id]/route.ts

@@ -0,0 +1,18 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getCurrentUser } from "@/lib/auth";
+import { queryRaw } from "@/lib/db";
+
+export async function DELETE(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const user = await getCurrentUser(req);
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
+
+  const { id } = await params;
+  const existing = await queryRaw<{ id: number }>(
+    `SELECT id FROM budgets WHERE id = $1 AND owner_id = $2`,
+    [Number(id), user.id]
+  );
+  if (!existing.length) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  await queryRaw(`DELETE FROM budgets WHERE id = $1`, [Number(id)]);
+  return NextResponse.json({ ok: true });
+}

src/app/api/budgets/route.ts

@@ -0,0 +1,46 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getCurrentUser } from "@/lib/auth";
+import { queryRaw } from "@/lib/db";
+
+export async function GET(req: NextRequest) {
+  const user = await getCurrentUser(req);
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
+
+  const { searchParams } = new URL(req.url);
+  const month = searchParams.get("month");
+
+  let monthDate: string;
+  if (month) {
+    monthDate = month.length === 7 ? `${month}-01` : month;
+  } else {
+    const now = new Date();
+    monthDate = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-01`;
+  }
+
+  const rows = await queryRaw<{ id: number; category: string; month: string; amount_limit: number }>(
+    `SELECT id, category, month::text, amount_limit::numeric FROM budgets WHERE owner_id = $1 AND month = $2::date`,
+    [user.id, monthDate]
+  );
+  return NextResponse.json(rows);
+}
+
+export async function POST(req: NextRequest) {
+  const user = await getCurrentUser(req);
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
+
+  const { category, month, amount_limit } = await req.json();
+  if (!category || !month || amount_limit === undefined) {
+    return NextResponse.json({ error: "category, month, and amount_limit required" }, { status: 400 });
+  }
+
+  const monthDate = month.length === 7 ? `${month}-01` : month;
+
+  const rows = await queryRaw<{ id: number; category: string; month: string; amount_limit: number }>(
+    `INSERT INTO budgets (owner_id, category, month, amount_limit)
+     VALUES ($1, $2, $3::date, $4)
+     ON CONFLICT (owner_id, category, month) DO UPDATE SET amount_limit = $4, updated_at = NOW()
+     RETURNING id, category, month::text, amount_limit::numeric`,
+    [user.id, category, monthDate, amount_limit]
+  );
+  return NextResponse.json(rows[0], { status: 201 });
+}

src/app/api/statements/route.ts

@@ -1,7 +1,10 @@
-import { NextResponse } from "next/server";
+import { NextRequest, NextResponse } from "next/server";
+import { getCurrentUser } from "@/lib/auth";
 import { getStatements } from "@/lib/queries";
 
-export async function GET() {
-  const statements = await getStatements();
+export async function GET(req: NextRequest) {
+  const user = await getCurrentUser(req);
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
+  const statements = await getStatements(user.id);
   return NextResponse.json(statements);
 }

src/app/api/transactions/route.ts

@@ -1,16 +1,20 @@
 import { NextRequest, NextResponse } from "next/server";
+import { getCurrentUser } from "@/lib/auth";
 import { getTransactions } from "@/lib/queries";
 
 export async function GET(req: NextRequest) {
-  const sp = req.nextUrl.searchParams;
+  const user = await getCurrentUser(req);
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
 
-  const result = await getTransactions({
+  const sp = req.nextUrl.searchParams;
+  const result = await getTransactions(user.id, {
     from: sp.get("from") || undefined,
     to: sp.get("to") || undefined,
     category: sp.get("category") || undefined,
     bank_name: sp.get("bank_name") || undefined,
     search: sp.get("search") || undefined,
     statement_id: sp.get("statement_id") || undefined,
+    tag_id: sp.get("tag_id") || undefined,
     sort_by: sp.get("sort_by") || undefined,
     sort_dir: sp.get("sort_dir") || undefined,
     limit: sp.get("limit") ? Number(sp.get("limit")) : undefined,