<%= t("imports.pdf_import.select_account", default: "Import to Account") %>
- <%= form_with model: import, url: import_path(import), method: :patch, class: "space-y-2" do |f| %>
- <% accounts = import.family.accounts.manual.alphabetically %>
+ <%= form_with model: import, scope: :import, url: import_path(import), method: :patch, class: "space-y-2" do |f| %>
+ <% accounts = Current.user.accessible_accounts.manual.alphabetically.pluck(:name, :id) %>
<% if accounts.any? %>
- <%= f.select :account_id, options_for_select(accounts.map { |a| [a.name, a.id] }, import.account_id), { include_blank: t("imports.pdf_import.select_account_placeholder", default: "Select an account...") }, class: "form-field__input" %>
+ <%= f.select :account_id, options_for_select(accounts, import.account_id), { include_blank: t("imports.pdf_import.select_account_placeholder", default: "Select an account...") }, class: "form-field__input" %>
<% if import.account.nil? %>
<%= t("imports.pdf_import.select_account_hint", default: "Choose which account to import these transactions into.") %>
<% end %>
diff --git a/test/controllers/import/uploads_controller_test.rb b/test/controllers/import/uploads_controller_test.rb
index 6aa3be8b6..1836ac95d 100644
--- a/test/controllers/import/uploads_controller_test.rb
+++ b/test/controllers/import/uploads_controller_test.rb
@@ -35,6 +35,18 @@ class Import::UploadsControllerTest < ActionDispatch::IntegrationTest
assert_equal "CSV uploaded successfully.", flash[:notice]
end
+ test "account select does not leak unshared family accounts (#1803)" do
+ sign_in users(:family_member)
+
+ get import_upload_url(@import)
+
+ assert_response :success
+ assert_select 'select[name="import[account_id]"] option', text: "Checking Account"
+ assert_select 'select[name="import[account_id]"] option', text: "Collectable Account", count: 0
+ assert_select 'select[name="import[account_id]"] option', text: "IOU (personal debt to friend)", count: 0
+ assert_select 'select[name="import[account_id]"] option', text: "Plaid Depository Account", count: 0
+ end
+
test "invalid csv cannot be uploaded" do
patch import_upload_url(@import), params: {
import: {
diff --git a/test/controllers/imports_controller_test.rb b/test/controllers/imports_controller_test.rb
index 1b48bd953..a92db9b1d 100644
--- a/test/controllers/imports_controller_test.rb
+++ b/test/controllers/imports_controller_test.rb
@@ -363,4 +363,22 @@ class ImportsControllerTest < ActionDispatch::IntegrationTest
assert_redirected_to imports_path
end
+
+ test "PDF import account select does not leak unshared family accounts (#1803)" do
+ sign_in users(:family_member)
+ pdf_import = imports(:pdf_with_rows)
+ # The fixture has no attached pdf_file and no statement, so
+ # ImportsController#show would redirect to the upload page. The
+ # partial under test only renders for an uploaded PDF — stub the
+ # state so we exercise the actual account-select scoping path.
+ PdfImport.any_instance.stubs(:pdf_uploaded?).returns(true)
+
+ get import_url(pdf_import)
+
+ assert_response :success
+ assert_select 'select[name="import[account_id]"] option', text: "Checking Account"
+ assert_select 'select[name="import[account_id]"] option', text: "Collectable Account", count: 0
+ assert_select 'select[name="import[account_id]"] option', text: "IOU (personal debt to friend)", count: 0
+ assert_select 'select[name="import[account_id]"] option', text: "Plaid Depository Account", count: 0
+ end
end