test(import): cover PDF account-select scoping; pluck PDF partial (#2194 review)

jjmata: the _pdf_import.html.erb scoping change was not covered by the
existing test (which only hit /import/uploads). Add a regression test
hitting GET /imports/:id with a PdfImport fixture, asserting the
account dropdown options match accessible accounts only.

Also swap the PDF partial's accounts.map { |a| [a.name, a.id] } for
.pluck(:name, :id) to match the .pluck pattern the other three CSV/QIF
selects already use.
This commit is contained in:
dripsmvcp
2026-06-08 10:26:02 +09:00
parent 35b23da442
commit 0685bbdfd5
2 changed files with 15 additions and 2 deletions

View File

@@ -40,9 +40,9 @@
<div class="space-y-2">
<h2 class="font-medium text-primary"><%= t("imports.pdf_import.select_account", default: "Import to Account") %></h2>
<%= form_with model: import, url: import_path(import), method: :patch, class: "space-y-2" do |f| %>
<% accounts = Current.user.accessible_accounts.manual.alphabetically %>
<% accounts = Current.user.accessible_accounts.manual.alphabetically.pluck(:name, :id) %>
<% if accounts.any? %>
<%= f.select :account_id, options_for_select(accounts.map { |a| [a.name, a.id] }, import.account_id), { include_blank: t("imports.pdf_import.select_account_placeholder", default: "Select an account...") }, class: "form-field__input" %>
<%= f.select :account_id, options_for_select(accounts, import.account_id), { include_blank: t("imports.pdf_import.select_account_placeholder", default: "Select an account...") }, class: "form-field__input" %>
<% if import.account.nil? %>
<p class="text-xs text-secondary"><%= t("imports.pdf_import.select_account_hint", default: "Choose which account to import these transactions into.") %></p>
<% end %>

View File

@@ -363,4 +363,17 @@ class ImportsControllerTest < ActionDispatch::IntegrationTest
assert_redirected_to imports_path
end
test "PDF import account select does not leak unshared family accounts (#1803)" do
sign_in users(:family_member)
pdf_import = imports(:pdf_with_rows)
get import_url(pdf_import)
assert_response :success
assert_select 'select[name="import[account_id]"] option', text: "Checking Account"
assert_select 'select[name="import[account_id]"] option', text: "Collectable Account", count: 0
assert_select 'select[name="import[account_id]"] option', text: "IOU (personal debt to friend)", count: 0
assert_select 'select[name="import[account_id]"] option', text: "Plaid Depository Account", count: 0
end
end