From 0685bbdfd5bb7052dbb17c60b58609b0f0b7f60e Mon Sep 17 00:00:00 2001
From: dripsmvcp <138900956+dripsmvcp@users.noreply.github.com>
Date: Mon, 8 Jun 2026 10:26:02 +0900
Subject: [PATCH] test(import): cover PDF account-select scoping; pluck PDF
 partial (#2194 review)

jjmata: the _pdf_import.html.erb scoping change was not covered by the
existing test (which only hit /import/uploads). Add a regression test
hitting GET /imports/:id with a PdfImport fixture, asserting the
account dropdown options match accessible accounts only.

Also swap the PDF partial's accounts.map { |a| [a.name, a.id] } for
.pluck(:name, :id) to match the .pluck pattern the other three CSV/QIF
selects already use.
---
 app/views/imports/_pdf_import.html.erb      |  4 ++--
 test/controllers/imports_controller_test.rb | 13 +++++++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/app/views/imports/_pdf_import.html.erb b/app/views/imports/_pdf_import.html.erb
index 421eed656..884cbecce 100644
--- a/app/views/imports/_pdf_import.html.erb
+++ b/app/views/imports/_pdf_import.html.erb
@@ -40,9 +40,9 @@
         <div class="space-y-2">
           <h2 class="font-medium text-primary"><%= t("imports.pdf_import.select_account", default: "Import to Account") %></h2>
           <%= form_with model: import, url: import_path(import), method: :patch, class: "space-y-2" do |f| %>
-            <% accounts = Current.user.accessible_accounts.manual.alphabetically %>
+            <% accounts = Current.user.accessible_accounts.manual.alphabetically.pluck(:name, :id) %>
             <% if accounts.any? %>
-              <%= f.select :account_id, options_for_select(accounts.map { |a| [a.name, a.id] }, import.account_id), { include_blank: t("imports.pdf_import.select_account_placeholder", default: "Select an account...") }, class: "form-field__input" %>
+              <%= f.select :account_id, options_for_select(accounts, import.account_id), { include_blank: t("imports.pdf_import.select_account_placeholder", default: "Select an account...") }, class: "form-field__input" %>
               <% if import.account.nil? %>
                 <p class="text-xs text-secondary"><%= t("imports.pdf_import.select_account_hint", default: "Choose which account to import these transactions into.") %></p>
               <% end %>
diff --git a/test/controllers/imports_controller_test.rb b/test/controllers/imports_controller_test.rb
index 1b48bd953..4689e4edf 100644
--- a/test/controllers/imports_controller_test.rb
+++ b/test/controllers/imports_controller_test.rb
@@ -363,4 +363,17 @@ class ImportsControllerTest < ActionDispatch::IntegrationTest
 
     assert_redirected_to imports_path
   end
+
+  test "PDF import account select does not leak unshared family accounts (#1803)" do
+    sign_in users(:family_member)
+    pdf_import = imports(:pdf_with_rows)
+
+    get import_url(pdf_import)
+
+    assert_response :success
+    assert_select 'select[name="import[account_id]"] option', text: "Checking Account"
+    assert_select 'select[name="import[account_id]"] option', text: "Collectable Account", count: 0
+    assert_select 'select[name="import[account_id]"] option', text: "IOU (personal debt to friend)", count: 0
+    assert_select 'select[name="import[account_id]"] option', text: "Plaid Depository Account", count: 0
+  end
 end