Wolf-Pak LINE Bot

AI-powered business automation for Japanese SMEs via LINE messaging.

What Was Updated (March 2026)

Security Hardening

• Bcrypt-based API key authentication (API_KEY_HASH support with API_KEY fallback for local dev)
• Request rate limiting on API routes
• Input validation with express-validator
• SQL injection protection through parameter validation and parameterized query patterns
• Input sanitization helpers for user-provided text fields
• Improved HTTP security headers using helmet
• Safer error responses (reduced internal error leakage)
• Prompt injection guard rails on AI system prompt

Performance Improvements

• Added database indexes for common query patterns (users, conversations, reservations, reminders, analytics)
• Improved PostgreSQL pool configuration (min/max connections, timeouts)
• Added query helper patterns for safer and more consistent DB access

Core Features

• Invoice automation (OCR + accounting integration)
• Expense approvals and workflows
• Voice translation and transcription (Japanese/English)
• Business card OCR and QR workflows
• Location services and directions
• Scheduled reminders and analytics
• QuickBooks integration
• Stripe and PayPay integration

Quick Start

Prerequisites

• Node.js 18+
• npm

Install

npm install

Configure Environment

Create .env from .env.example (or use your existing env setup), then set at minimum:

• LINE_CHANNEL_ACCESS_TOKEN
• LINE_CHANNEL_SECRET
• OPENAI_API_KEY
• API_KEY_HASH (recommended) or API_KEY (dev fallback)

Generate a bcrypt API key hash:

node -e "const bcrypt = require('bcrypt'); bcrypt.hash('your-api-key', 10).then(console.log)"

Run Locally

node index.js

Health endpoint:

GET /api/health

PowerShell API Test Example (Windows)

$headers = @{ "x-api-key" = "test-api-key" }
Invoke-WebRequest -Uri "http://localhost:3000/api/health" -Headers $headers -Method GET

Security Test Docs

• TESTING_SECURITY_POWERSHELL.md
• API_KEY_SETUP.md
• SECURITY_FIXES.md
• SECURITY.md

Project Documentation

• INVOICE_SETUP.md
• QUICKBOOKS_SETUP.md
• ACCOUNTING_SETUP.md
• PAYMENT_SETUP.md
• REMINDERS_GUIDE.md
• BUSINESS_CARD_OCR_GUIDE.md
• LOCATION_SETUP.md
• FEATURE_FLAGS.md
• SEO_SETUP.md
• AZURE_DATABASE_SETUP.md

Deployment Notes

• Heroku and local development are both supported.
• For production, use API_KEY_HASH and rotate keys regularly.
• Keep secrets out of git (.env must remain uncommitted).

License

Copyright (c) 2025 Wolf-Pak Innovations LLC.

This project is licensed under the MIT License. See LICENSE for details.

Contact

• codycodesIT@pak-innovations.net
• WolfPak_Innovations@outlook.com