Add first-class Trade Republic support (#3168)

* Add Trade Republic provider integration Introduce authenticated web and QR login, resilient account synchronization, deterministic financial imports, account discovery, and provider diagnostics. Keep login state encrypted, PINs transient, and incomplete provider responses non-destructive. * Address Trade Republic review findings Keep QR-authenticated sessions syncable, preserve historical holding snapshots, correct dividend direction, handle unpriced positions safely, localize repair feedback, and align provider controls with the design system. * Add Trade Republic translations for supported locales * Restore German Trade Republic account labels * Resolve remaining Trade Republic review findings * Resolve remaining Trade Republic review findings * Address latest Trade Republic review feedback * Refactor Trade Republic panel buttons to use DS::Button component and add integration tests * Fix 100x money inflation and missing positions locale key in TR views Money.new takes major units, so multiplying by 100 displayed EUR 12.34 as EUR 1234 in the holdings category cards and expense summary. Also add the pluralized holdings.index.positions key that t(".positions") resolves to (previously only defined at the unused holdings.positions root level), across all 18 locales. * fix(db): repair merge artifacts in schema and migrations - Remove duplicated icon/progress_basis columns on goals in schema.rb - Renumber Trade Republic migrations to unique versions (clashed with main's 20260824120000_add_lifecycle_to_goals) - Bump schema version to match latest migration * Address remaining Trade Republic review feedback * fix(trade-republic): address open PR #3168 review findings\n\n- Reject authenticated sessions without a securities account number so a\n blank account does not mark the item connected on a broken session.\n- Derive a missing trade amount from |quantity| x price, and a missing\n price from the resolved amount, without changing the signed import amount.\n- Regenerate db/schema.rb so the Trade Republic item/account tables and\n indexes are present; a fresh test database was otherwise missing the\n tables even though the migrations were marked up.\n * fix(trade-republic): localize activity labels in ActivitiesProcessor (i18n) * fix(trade-republic): localize activity labels in ActivitiesProcessor (i18n) * fix(trade-republic): add activity labels i18n keys to all locale files * Fix Trade Republic PR review follow-ups * fix(trade-republic): i18n-aware category guard and ignore generated graphify cache - Category matcher skipped core deposit/withdrawal labels; guard now compares against translated values so German etc skip correctly - Remove committed graphify-out cache and ignore dir * Protect holdings from malformed snapshots * Consolidate Trade Republic migrations * Address final Trade Republic review comments * Address final Trade Republic review comments - Remove hard-coded category matcher (merchant keyword taxonomy) and leave Trade Republic transactions uncategorized when no structured category exists; rely on Sure rules/AI - Revert shared ProviderImportAdapter# import_trade extra: param; handle Trade Republic trade metadata locally in ActivitiesProcessor via post-import Trade extra merge (preserve existing extra, deep_merge) - Preserve Trade Republic product distinctions (cash, brokerage/private_markets/interest_products/crypto_wallet via portfolio categories) without collapsing account kinds --------- Co-authored-by: Aland Baban <snow@iBananaMac.fritz.box>
2026-09-08 16:14:23 +00:00 · 2026-09-03 00:24:49 +02:00
parent ed6b8b752a
commit 0cdab9a0bc
94 changed files with 7771 additions and 2 deletions
@@ -0,0 +1,77 @@
+import { Controller } from "@hotwired/stimulus";
+
+export default class extends Controller {
+  static values = {
+    url: String,
+    interval: { type: Number, default: 1000 },
+    maxRetryDelay: { type: Number, default: 8000 },
+    // Give the server a short grace period to recognize the expired login and
+    // replace the stale waiting state with the retry action.
+    timeout: { type: Number, default: 125000 },
+  };
+
+  connect() {
+    this.startedAt = Date.now();
+    this.stopped = false;
+    this.retryCount = 0;
+    this.schedulePoll(0);
+  }
+
+  disconnect() {
+    this.stopped = true;
+    clearTimeout(this.timer);
+  }
+
+  schedulePoll(delay) {
+    clearTimeout(this.timer);
+    this.timer = setTimeout(() => this.poll(), delay);
+  }
+
+  async poll() {
+    if (this.stopped || this.polling) return;
+    this.polling = true;
+
+    const csrfToken = document.querySelector(
+      "meta[name='csrf-token']",
+    )?.content;
+    try {
+      const response = await fetch(this.urlValue, {
+        method: "POST",
+        headers: {
+          Accept: "text/vnd.turbo-stream.html",
+          "X-CSRF-Token": csrfToken || "",
+          "X-Requested-With": "XMLHttpRequest",
+        },
+        credentials: "same-origin",
+        body: new URLSearchParams({ authenticity_token: csrfToken || "" }),
+      });
+
+      if (response.ok) {
+        this.retryCount = 0;
+        Turbo.renderStreamMessage(await response.text());
+      } else {
+        this.retryCount += 1;
+        console.warn(
+          `[Trade Republic] login poll failed with HTTP ${response.status}`,
+        );
+      }
+    } catch (error) {
+      this.retryCount += 1;
+      console.warn("[Trade Republic] login poll request failed", error);
+    } finally {
+      this.polling = false;
+      if (!this.stopped && Date.now() - this.startedAt < this.timeoutValue) {
+        this.schedulePoll(
+          this.retryCount > 0 ? this.retryDelay() : this.intervalValue,
+        );
+      }
+    }
+  }
+
+  retryDelay() {
+    return Math.min(
+      this.intervalValue * 2 ** Math.min(this.retryCount - 1, 4),
+      this.maxRetryDelayValue,
+    );
+  }
+}
@@ -0,0 +1,238 @@
+import { Controller } from "@hotwired/stimulus";
+
+export default class extends Controller {
+  static targets = ["button", "label", "panel", "code", "status"];
+  static values = {
+    initiateUrl: String,
+    pollUrl: String,
+    cancelUrl: String,
+    returnUrl: String,
+    autoPoll: { type: Boolean, default: false },
+    loadingText: String,
+    instructionText: String,
+    successText: String,
+    errorText: String,
+    interval: { type: Number, default: 1000 },
+    timeout: { type: Number, default: 120000 },
+    maxRetryDelay: { type: Number, default: 8000 },
+    loginText: String,
+    cancelText: String,
+  };
+
+  connect() {
+    this.polling = false;
+    this.stopped = false;
+    this.pollRequest = null;
+    this.retryCount = 0;
+    if (this.autoPollValue) {
+      this.polling = true;
+      this.startedAt = Date.now();
+      this.panelTarget.hidden = false;
+      this.setButtonLabel(this.cancelTextValue);
+      this.statusTarget.textContent = this.instructionTextValue;
+      this.poll();
+    }
+  }
+
+  disconnect() {
+    this.stopped = true;
+    clearTimeout(this.timer);
+    this.pollRequest?.abort();
+  }
+
+  async start(event) {
+    event.preventDefault();
+    if (this.polling) return;
+
+    this.stopped = false;
+    this.polling = true;
+    this.retryCount = 0;
+    this.startedAt = Date.now();
+    this.panelTarget.hidden = false;
+    this.setButtonLabel(this.cancelTextValue);
+    this.codeTarget.replaceChildren();
+    this.statusTarget.textContent = this.loadingTextValue;
+
+    try {
+      const response = await fetch(this.initiateUrlValue, {
+        method: "POST",
+        headers: { ...this.headers(), Accept: "text/vnd.turbo-stream.html" },
+        credentials: "same-origin",
+        body: this.body(),
+      });
+      if (!response.ok)
+        throw new Error(`QR login initiation failed: ${response.status}`);
+
+      const result = await response.json();
+      this.renderQr(result);
+
+      await this.poll();
+    } catch (error) {
+      this.showError(error);
+    }
+  }
+
+  async poll() {
+    if (this.stopped) return;
+
+    try {
+      this.pollRequest?.abort();
+      this.pollRequest = new AbortController();
+      const response = await fetch(this.pollUrlValue, {
+        method: "POST",
+        headers: { ...this.headers(), Accept: "application/json" },
+        credentials: "same-origin",
+        body: this.body(),
+        signal: this.pollRequest.signal,
+      });
+      const result = await this.jsonResponse(response);
+      if (!response.ok) {
+        const error = new Error(result.error || "QR login failed");
+        error.retryable =
+          result.retryable === true || this.retryableStatus(response.status);
+        throw error;
+      }
+
+      this.retryCount = 0;
+      this.renderQr(result);
+
+      if (result.status !== "pending") {
+        this.statusTarget.textContent = this.successTextValue;
+        window.Turbo.visit(this.returnUrlValue);
+        return;
+      }
+
+      this.schedulePoll(this.nextPollDelay(result));
+    } catch (error) {
+      if (this.stopped || error.name === "AbortError") return;
+
+      if (
+        this.isRetryableError(error) &&
+        Date.now() - this.startedAt < this.timeoutValue
+      ) {
+        this.retryCount += 1;
+        this.schedulePoll(this.retryDelay());
+      } else {
+        this.showError(error);
+      }
+    } finally {
+      this.pollRequest = null;
+    }
+  }
+
+  schedulePoll(delay) {
+    clearTimeout(this.timer);
+    if (this.stopped) return;
+
+    if (Date.now() - this.startedAt >= this.timeoutValue) {
+      this.showError(new Error("QR login expired"));
+      return;
+    }
+
+    this.timer = setTimeout(() => this.poll(), delay);
+  }
+
+  retryDelay() {
+    return Math.min(
+      this.intervalValue * 2 ** Math.min(this.retryCount - 1, 4),
+      this.maxRetryDelayValue,
+    );
+  }
+
+  retryableStatus(status) {
+    return status === 408 || status === 425 || status === 429 || status >= 500;
+  }
+
+  isRetryableError(error) {
+    return error.retryable === true || error.name === "TypeError";
+  }
+
+  async jsonResponse(response) {
+    try {
+      return await response.json();
+    } catch {
+      const error = new Error(
+        `QR login returned invalid JSON: ${response.status}`,
+      );
+      error.retryable = this.retryableStatus(response.status);
+      throw error;
+    }
+  }
+
+  showError(error) {
+    if (this.stopped) return;
+    console.warn("[Trade Republic] QR login failed", error);
+    this.polling = false;
+    this.setButtonLabel(this.loginTextValue);
+    this.buttonTarget.disabled = false;
+    this.statusTarget.textContent = this.errorTextValue;
+  }
+
+  toggle(event) {
+    event.preventDefault();
+    if (this.polling) {
+      this.hideQr();
+    } else {
+      this.start(event);
+    }
+  }
+
+  async hideQr() {
+    this.stopped = true;
+    clearTimeout(this.timer);
+    this.pollRequest?.abort();
+    this.polling = false;
+    this.panelTarget.hidden = true;
+    this.codeTarget.replaceChildren();
+    this.buttonTarget.disabled = false;
+
+    try {
+      const response = await fetch(this.cancelUrlValue, {
+        method: "POST",
+        headers: this.headers(),
+        credentials: "same-origin",
+        body: this.body(),
+      });
+      if (!response.ok)
+        throw new Error(`QR login cancellation failed: ${response.status}`);
+
+      Turbo.renderStreamMessage(await response.text());
+    } catch (error) {
+      this.stopped = false;
+      console.warn("[Trade Republic] QR login cancellation failed", error);
+    }
+  }
+
+  renderQr(result) {
+    if (!result.qr_code_svg) return;
+    this.codeTarget.innerHTML = result.qr_code_svg;
+    this.statusTarget.textContent = this.instructionTextValue;
+  }
+
+  nextPollDelay(result) {
+    const expiresAt = result.qr_code_token_expires_at;
+    if (!expiresAt) return this.intervalValue;
+
+    const remaining = Date.parse(expiresAt) - Date.now();
+    return remaining > 0 && remaining <= 1500 ? 100 : this.intervalValue;
+  }
+
+  setButtonLabel(label) {
+    if (this.hasLabelTarget) this.labelTarget.textContent = label;
+  }
+
+  headers() {
+    return {
+      Accept: "application/json",
+      "X-CSRF-Token":
+        document.querySelector("meta[name='csrf-token']")?.content || "",
+      "X-Requested-With": "XMLHttpRequest",
+    };
+  }
+
+  body() {
+    const csrfToken =
+      document.querySelector("meta[name='csrf-token']")?.content || "";
+    return new URLSearchParams({ authenticity_token: csrfToken });
+  }
+}