feat: enhance gitignore and bot prefix handling

- Updated .gitignore to properly exclude Python cache files and environment variables
- Modified bot.py to improve prefix case handling for better command recognition
- Refactored mail.py to streamline feedback email generation and database interaction
- Added environment variable loading in mail.py for better configuration management

web/app.py

@@ -11,6 +11,7 @@ else:
 
 import os
 import requests
+from urllib.parse import urlencode
 from flask import Flask, redirect, url_for, session, request, render_template, flash
 from dotenv import load_dotenv
 from collections import defaultdict
@@ -49,6 +50,19 @@ DISCORD_BOT_TOKEN = os.getenv("TOKEN")
 http = requests.Session()
 http.headers.update({"User-Agent": "DiscordBotWeb/1.0"})
 
+# Default request timeout (seconds) for external HTTP calls
+REQUEST_TIMEOUT = int(os.getenv("REQUEST_TIMEOUT", "10"))
+
+def build_discord_oauth_url():
+    params = {
+        "client_id": DISCORD_CLIENT_ID,
+        "redirect_uri": DISCORD_REDIRECT_URI,
+        "response_type": "code",
+        "scope": "identify guilds applications.commands bot",
+    }
+    return f"{DISCORD_API_BASE_URL}/oauth2/authorize?{urlencode(params)}"
+
+
 def discord_request(method, endpoint, headers=None, **kwargs):
     url = f"{DISCORD_API_BASE_URL}{endpoint}"
     try:
@@ -59,9 +73,6 @@ def discord_request(method, endpoint, headers=None, **kwargs):
         app.logger.warning("Discord API request failed: %s %s %s", method, url, exc)
         raise
 
-# Default request timeout (seconds) for external HTTP calls
-REQUEST_TIMEOUT = int(os.getenv("REQUEST_TIMEOUT", "10"))
-
 # Check for missing environment variables
 if not all([DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET, DISCORD_REDIRECT_URI]):
     raise EnvironmentError("One or more required environment variables are missing.")
@@ -70,12 +81,7 @@ if not all([DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET, DISCORD_REDIRECT_URI]):
 # OAuth2 login route
 @app.route("/login")
 def login():
-    discord_auth_url = (
-        f"{DISCORD_API_BASE_URL}/oauth2/authorize"
-        f"?client_id={DISCORD_CLIENT_ID}&redirect_uri={DISCORD_REDIRECT_URI}"
-        f"&response_type=code&scope=identify%20guilds%20applications.commands%20bot"
-    )
-    return redirect(discord_auth_url)
+    return redirect(build_discord_oauth_url())
 
 
 def can_add_bot(guild):
@@ -174,7 +180,6 @@ def callback():
 def logout():
     session.pop("user", None)
     session.pop("guilds", None)
-    session.pop("access_token", None)  # Ensure access token is also cleared
     session.pop("guilds_with_bot_permission", None)
     flash("You have been logged out.")
     return redirect(url_for("home"))
@@ -253,8 +258,12 @@ def transactions():
         flash("You are not logged in.")
         return redirect(url_for("login"))
 
-    sort_by = request.args.get("sort", "date")
-    order = request.args.get("order", "asc")
+    sort_by = request.args.get("sort", "date").lower()
+    order = request.args.get("order", "asc").lower()
+    if sort_by not in {"date", "amount"}:
+        sort_by = "date"
+    if order not in {"asc", "desc"}:
+        order = "asc"
 
     user_transactions = get_user_transactions(str(user["id"]), sort_by, order)
     daily_totals = defaultdict(float)