942 Commits

Author	SHA1	Message	Date
Juan José Mata	f6f9feba8a	Bank Sync cleanup (#1710) ... * feat(settings/providers): surface connection status in section headers Lifts the per-panel status indicator up to each collapsed accordion header so admins can see at a glance which providers are connected without expanding every section. Connected providers sort first. - Add optional status: and meta: locals to settings/_section partial; pill hides via group-open:hidden when the section is expanded - New settings/providers/_status_pill partial (ok/warn/err/off states) - Add SettingsHelper#provider_summary to centralise the connected-vs-not logic already scattered across panel partials - Refactor show.html.erb to pass status to every section and sort family_panels by connection state - Add settings.providers.status.* i18n keys - Add system tests asserting pill renders and sort order https://claude.ai/code/session_01KW2HCN9rP1fiyQuw7Cju9D * feat(settings/providers): group providers into Connected and Available Partition the provider list in the controller into @connected_providers and @available_providers based on provider_summary status, and render each group under its own heading with a count. Auto-open the section when only one provider is connected. Adds an empty-state line when nothing is connected yet. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(settings/providers): health strip, action-needed group, and sync error surfacing - Extend provider_summary to return :err/:warn with meta text by checking latest sync per item (window function, same pattern as ProviderConnectionStatus) and Enable Banking session expiry within 7 days - Partition provider entries into three groups: Connected (:ok), Action needed (:warn/:err, auto-opened), Available (:off) - Add Settings::HealthSummary ViewComponent — four-tile grid showing Connected, Action needed, Errors, and Accounts synced counts - Render health strip directly under page description; omit Action needed heading when group is empty - Add i18n keys for tile labels, group heading, and all meta strings Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(settings/providers): card grid for available providers with connect drawer - Add Provider::Metadata registry with static display data (region, kind, tier, maturity, logo) for all 11 providers - Add Settings::ProviderCard ViewComponent rendering logo square, name, Beta/Alpha pill, meta line (region · type · tier), tagline, and Connect link - Add connect_form action + route (GET /settings/providers/:key/connect_form) that opens the existing panel partial or config form in a DS::Dialog drawer - Replace the Available accordion loop with a 2-column responsive card grid; empty state when all providers are connected - Fix layout override: use turbo_rails/frame layout for frame requests so the drawer response is not wrapped in the full settings layout (was causing Turbo to pick the empty outer drawer frame instead of the filled one) - Add SyncAllProvidersJob and last_sync_all_attempted_at migration (sync-all throttle support) - Unify Connected + Action needed into a single "Your connections" section; items with warn/err status auto-open - Fix Enable Banking grouping: items with expired sessions were returning :off (Available) instead of :warn (Your connections); gate now checks any? instead of any?(&:session_valid?) - Add reconsent_required locale key for fully-expired EB sessions - Surface Beta/Alpha maturity pills on connected provider accordion rows via new badge: param on settings_section helper - Add i18n taglines for all 11 providers; add connect and empty_available keys Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(settings): retire /settings/bank_sync; merge into providers page - Delete Settings::BankSyncController and its views (the providers page is now a strict superset of what bank_sync offered) - Add permanent 301 redirect: GET /settings/bank_sync → /settings/providers - Collapse nav to a single "Bank Sync" entry pointing at /settings/providers; remove the duplicate admin-only "Providers" entry from the Advanced section - Remove "Providers" from SETTINGS_ORDER; point "Bank Sync" at settings_providers_path for next/prev navigation - Rename page title to "Bank Sync"; replace admin-credential lede with user-facing copy ("Connect external accounts…") - Update breadcrumb: Home → Bank sync - Add controller test asserting 301 status and Location header Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Migrations are 7.2 here * Minimize schema noise * Schema duplication * Small copy edits * Fix tests * Address provider settings review feedback * refactor(settings/providers): finish design-review cleanup pass Picks up the remaining items from Claude Design's review of #1710 that the previous review-feedback commit didn't cover. DS / casing - Sentence-case the page title ("Bank Sync" -> "Bank sync") and align the nav label. - Drop the card hover-lift (shadow-border-sm) in favour of bg-container-hover; per the DS, card hover is colour-only. - Whole-tile click target on each provider card — the inner "Connect ->" link was a hit-target inversion. - Set Sync all to whitespace-nowrap so the label stops wrapping at narrow viewport widths. UX simplifications - Drop the four health-summary tiles (per-row warn/err pills already surface the signal at the scale this app sees). Removes Settings::HealthSummary, the @health_counts controller block, and the now-unused health.* locale keys. - Hide "Your connections" heading + empty-state line when no providers are connected — the lede already invites a connect. - Drop the redundant "Free" tier from per-card meta lines (printed 10x for one fact); "Paid" still surfaces on Plaid. Tests updated to drop the obsolete tiles assertion and switch the provider-card click selector to look up the (now whole-card) anchor by provider name. * feat(settings/providers): replace Add another provider CTA with a search + kind filter Per the design review, the "Add another provider · Browse providers" card was a redirect to content one scroll-tick away. A search input plus kind chips lets users self-segment the catalog and is the right tool once it grows beyond the four to twelve providers we ship today. - New providers_filter Stimulus controller — case-insensitive free text search across name/region/kind, plus a chip group with All / Banks / Crypto / Investment that toggle visibility via Tailwind's `hidden` class. - _search_filters partial: search box (count-pluralized placeholder) + chip group, ARIA-labelled and aria-pressed for the chips. - ProviderCard exposes filter_data (target + name/region/kind data attrs) so the controller can match without re-rendering. - Lunchflow's `kind` was "Lunch" — switched to "Bank" so it falls under the Banks chip alongside its actual offering (it aggregates banks). - Drops the add_provider_cta partial and its locale entries; adds search_filters.* and an empty_filter message. * Private method fix * refactor(settings/providers): drawer cleanup, header lock-up, trust statement Per the design review's §07. - Drop the trailing "Configured / Not configured" footer status from every provider panel (binance, coinbase, coinstats, indexa_capital, lunchflow, mercury, simplefin, snaptrade, sophtron, provider_form). The parent details section's status pill already carries that signal; the footer was redundant — and the copy/styling was inconsistent across panels (free-text vs. dot pill, "configured" vs. "not connected"). - Connect drawer gets a header lock-up: small logo chip + provider name + maturity badge, mirroring the available-card layout. Implemented as _drawer_header partial; connect_form passes custom_header: true to DS::Dialog so we own the row. - Drawer footer trust statement: "Read-only — Sure can never move money. Stored encrypted." A single-line reassurance covering all panels. - Sentence-case the hardcoded primary buttons that were Title Case: "Save Configuration" -> "Save and connect" "Update Configuration" -> "Update connection" "Connect Bank" -> "Connect bank" Affects simplefin, lunchflow, enable_banking, provider_form. The i18n'd panels (binance, coinbase, coinstats, indexa_capital, mercury, snaptrade, sophtron) keep their existing keys. * chore(locales): drop unused provider-panel status strings Footer "Configured / Not configured" status was removed from each provider panel partial in the prior drawer-cleanup pass; the matching i18n keys are no longer referenced. Removing them across every locale to keep the catalogue clean. Dropped (15 keys × varying locale coverage, 36 line removals across 24 files): - coinstats_items.new.{status_configured_html, status_not_configured} - indexa_capital_items.panel.{status_configured_html, status_not_configured} - mercury_items.provider_panel.{configured_html, not_configured, accounts_link} - sophtron_items.sophtron_panel.status.{configured_html, not_configured} (parent `status:` removed where it became empty) - providers.snaptrade.{status_needs_registration, status_not_configured} (status_connected stays — still used by the lazy-load summary) - settings.providers.{binance_panel, coinbase_panel}.{status_connected, status_not_connected} * feat(settings/providers): connected-state polish per design §05 + Linked institutions rename Building the next phase of the design review. Pulls forward the slim health strip, denser connection rows, and "Linked institutions" heading rename — the small Phase A lift the designer flagged in §08 of the doc. - New _health_strip partial: single-line at-a-glance pulse — connected count + needs-attention count + accounts syncing + last-synced timestamp. Renders only when at least one provider is linked or needs action. - New _connection_row partial replaces the generic settings_section call for providers. Tighter rows: text-sm title (was text-lg), px-4 py-3.5 padding, single-line summary (chevron + name + maturity badge + meta + status pill + sync action). Warn/error rows get a coloured outline (border-warning/25 or border-destructive/25) so the at-risk row stands out without shouting. - "Sync all" button restyled to match the design's secondary button: text-primary, alpha-black-100 border, rounded-[10px], padding 7px 12px (was the broader px-3 py-1.5 ghost). - "Your connections" → "Linked institutions" heading, lifted from the designer's Phase-C reconciliation note. Primes users for the Option-C institution-search wizard six months early; existing i18n key stays as `groups.your_connections` for now to keep the rename to a single value flip. - Controller computes the new @health hash (connected, needs_attention, accounts_syncing, last_synced_at) feeding the strip; brings back the single accounts query that was removed with the four-tile component. System test updated for the new heading copy. * fix(settings/providers): align connected state with the final design mock Tightening the §05 polish to match the user-confirmed final design. - Revert "Linked institutions" → "Your connections". The §08 designer note about the Phase-A heading rename didn't carry forward to the final mock; keep the original wording. - Drop the warn/err auto-open on connection rows. The design shows Enable Banking collapsed with a warn-outline and a status pill — no auto-expanded form. Single-connection auto-open kept (handy when the page is otherwise empty). - Hide the "accounts syncing" segment in the health strip when the count is 0 — the design mock assumes a populated number; an always-visible "0 accounts syncing" reads as a placeholder. - Strip the leading "about " from `time_ago_in_words` everywhere the result is shown to the user (health strip "Last synced %{time} ago" plus per-row "Synced %{time} ago" meta). Matches the design's shorter copy. * refactor(settings/providers): tighten paddings, dedupe maturity badge, semantic + a11y fixes Pixel-level alignment to the design's §05 mock + cleanup from a DS audit pass. Paddings, margins, font sizes - Health strip: my-4 → mt-4 mb-5 to match the design's 16px / 20px vertical breathing room. - Search filters bar: gap-2 → gap-2.5; mt-2 → mt-5 mb-3 (was missing the 12px bottom margin entirely). - Search box: rounded-lg → rounded-[10px]; px-3 py-2 → px-[14px] py-[9px]. Search icon downsized w-4 → w-3.5 to match. - Chip group: p-1 → p-[3px]; rounded-lg → rounded-[10px]. - Chip: py-1 → py-[5px]; rounded-md → rounded-lg. - Group heading: mt-2 → mt-[18px]; mb-1 → mb-1.5. - Status pill: text-xs → text-[11px]. - Provider card: gap-3 → gap-2.5 (outer + top); name gets explicit text-sm; tagline + foot 14px → 13px; arrow icon w-4 → w-3.5. - Sync icon button: p-1 → fixed w-7 h-7 (28×28) so the row hit target matches the design's column width. - Connect drawer header logo glyph: text-[10px] → text-xs (matches the available card's logo-glyph treatment). Component / partial cleanup (DS audit follow-ups) - New _maturity_badge partial replaces the inline span that was duplicated in 3 places (_connection_row, _drawer_header, provider_card.html.erb). - Settings::ProviderCard.maturity_label class method centralizes the MATURITY_LABELS lookup; callers no longer reach into the constant. - _connection_row title: <h2> → <h3> (the row sits inside the "Your connections" h2 group heading; nested h2s flattened the outline). - show.html.erb encryption error: <h3> → <h2> for the same reason. Locale - Drop orphaned keys: settings.providers.groups.connected and groups.needs_attention (no view code uses them) plus the leftover show.coinbase_title block. - Health strip "needs reconsent" → "needs attention" so the strip copy lines up with the per-row status pill ("Action needed") and the original group heading wording. A11y - focus-visible:ring-2 on chip buttons, provider-card link, and focus-within:ring-2 on the search input wrapper. Keyboard users now get a visible focus state. - Search input: explicit autocomplete="off" (erb_lint hint). * fix(settings/providers): icons + search input height - Icons were rendering at 20px because the application_helper's `icon` default size (`md` = w-5 h-5) was beating the inline class override in compiled CSS source order. Pass `size: "sm"` and use the project's `!w-3.5 !h-3.5` important-prefix pattern (precedent: dashboard.html.erb) so chevron, refresh-cw, search, check, circle-alert, and arrow-right all render at the design's 14px. - Search input was 54px tall because @tailwindcss/forms applies `padding: 8px 12px` to bare `<input type="search">`. Override with `!p-0 focus:ring-0 focus:shadow-none` so the wrapping div's padding alone defines the box (38px total — matches the design). * refactor(settings/providers): align Sync all + search input with DS, address review feedback - Sync all: replace the hand-rolled `button_to` with `DS::Link.new(variant: "outline", method: :post)` — same component as the "Identify Patterns" button on the recurring-transactions page. - Search input: switch to the icon-overlay pattern used by the Manage-currencies and transaction filter rows (relative wrapper + absolutely positioned search icon + bordered input with `focus:ring-gray-500`). Brings the keyboard focus state in line with the rest of the app's filterable lists. - SnapTrade panel: restore the "needs registration" status row that the drawer-cleanup pass dropped along with the redundant Configured/Not configured footer. The unregistered case is meaningful state, not redundant chrome. - Move the slim health-strip computation out of the controller and into `SettingsHelper#provider_health_strip` (Convention 2: skinny controllers). - Extract `concise_time_ago` helper so the "drop leading 'about '" trick stops being duplicated 3x. - `Settings::ProviderCard#maturity_label` (instance) now delegates to `.maturity_label` (class) instead of duplicating the lookup. - Drop unused `warn_or_err` local in `_connection_row`. - Replace the `data-controller` string-injection + html_safe in `_connection_row` with `tag.details(data: ...)`; safer and more idiomatic. - Add a system test for the empty-filter message wiring. * fix(settings/providers): drawer trust statement uses border-tertiary `border-secondary/10` was reaching for the text-foreground token at 10% opacity for a divider. The project ships a dedicated divider token (`border-tertiary`, ~8% black) used by DS::Menu, the holdings page, and admin/sso forms. Switching to it makes the trust-statement HR match every other thin divider in Sure and stops misusing the text token as a border. * refactor(settings/providers): swap arbitrary Tailwind values for scale tokens Per the user's directive — DS-compliance over pixel-perfect alignment with the design mock. Walked the design audit and applied every swap that lands within ±2px of the original. Swaps: - _health_strip: gap-[18px] → gap-5 (+2), px-[14px] → px-3.5 (=), text-[13px] → text-sm (+1). - _search_filters: chip group p-[3px] → p-1, rounded-[10px] → rounded-xl (concentric with rounded-lg inner pills), chip py-[5px] → py-1. - _status_pill: text-[11px] → text-xs. - _group_heading: mt-[18px] → mt-5. - _maturity_badge: text-[10px] → text-xs. - provider_card: tagline + foot text-[13px] → text-sm. Kept arbitrary: `min-w-[200px]` in _search_filters — nearest scale tokens are min-w-48 (192px) and min-w-52 (208px); both are noticeable layout shifts for a one-off responsive guard. Worth keeping the arbitrary here. Net: 9 of 10 arbitrary values gone. Visual delta: max +2px on a single value. Design mock and DS scale now agree. * revert(settings/providers): drop the slim health strip Per-row status pills already carry the at-a-glance signal (connected / action needed) at the scale this app sees (1–4 connections per family). The strip was redundant chrome for almost every user; only worth bringing back if the catalog grows to a point where the row list itself stops fitting on a single screen. - Delete _health_strip.html.erb partial. - Drop @health controller assignment + provider_health_strip helper. - Drop unused settings.providers.health_strip.* locale keys. - concise_time_ago helper stays — still used by per-row meta text. * refactor(settings/providers): align with DS conventions Two consistency wins from the screenshot/DS audit pass. Sync icon button now renders DS::Button (variant: icon, size: sm) instead of a hand-rolled `button_to`. Same component used by other icon-only actions across the app (settings/profiles, layouts/imports). Visual delta: 28×28 → 32×32 (DS sm size). Accept the +4px for consistency. `event.stopPropagation()` still wired via the form opt so the row's <details> doesn't toggle when the user clicks the button. Group heading now follows the established Sure section-label style (`text-xs font-medium text-secondary uppercase`) used by `_settings_nav` and the imports/categories surfaces. The previous sentence-case `text-sm text-primary` was a one-off that didn't match the rest of the app. Locale strings stay sentence-case; uppercase comes from CSS `text-transform`. Tests updated to case-insensitively match the rendered heading text. * fix(provider/metadata): add plaid_eu entry `plaid_eu` is registered as a separate Provider::ConfigurationRegistry entry but had no Provider::Metadata row, so its card in the Available grid fell through to the gray-500 default and rendered empty (no region, kind, tier, or tagline). The title also came out as "Plaid Eu" because `titleize` doesn't know "EU" is an initialism. - Add a `plaid_eu` row to Provider::Metadata::REGISTRY with the same shape as `plaid` (US → EU, otherwise identical). - Introduce an optional `name:` field in metadata; controller falls back to it before titleizing the provider key. Lets `plaid_eu` render as "Plaid EU". - Add the missing `settings.providers.taglines.plaid_eu` translation. * fix(settings/providers): center-align Sync all next to the lede `items-start` made the button hug the first line when the lede wrapped; on a single line the button sat at the top of the text bounding box which read slightly off. Center matches the dominant convention across the rest of settings (api_keys, securities, hostings, _section, _settings_nav_link_large). * fix(settings/providers): drop colour palette + filter polish + drawer warnings Round of design-feedback fixes. Provider chips - Drop the per-provider raw Tailwind palette (bg-blue-600 etc.) from Provider::Metadata. All cards + drawer logo lock-up now use bg-surface-inset + text-primary, matching the design's §04 "drop colour entirely" recommendation. Solves the long-standing §01 BLOCKER without externalising brand assets. Re-introducing logos later just means an optional logo_svg: field on metadata. - ProviderCard component drops the `logo_bg:` parameter; the chip is now styled in the template. Filter / search - "Available · N" count and the empty-filter state now update client-side as the chip filter and free-text search narrow the grid (new `count` Stimulus target + dedicated update path). - Empty-filter state now offers a Clear filters button that resets both the search input and the active chip in one click. - Search placeholder drops the drifting "Search 9 providers" count for plain "Search providers" — the section heading carries the number. - Chip labels normalised to plural where natural: "Banks · Crypto · Investments" (Crypto stays as the mass noun). Drawer copy / treatment - "IP Whitelisting Required" → "IP whitelisting required" (DS sentence-case). - Binance "do NOT enable withdrawal permissions" lifted out of inline red-text into a proper bg-warning-50 border-warning-200 alert block with an alert-triangle icon. Matches the api_keys / hosting alert pattern. - SnapTrade free-tier inline alert-triangle now uses `size: "sm"` so the icon stops rendering at 20px next to 14px body text. Spacing - Group-heading margin top bumped 5 → 6 (20→24px) so the eyebrow has more breathing room above the search bar. * refactor(settings/providers): drawer alerts use DS::Alert; drop card-in-card Two consistency fixes from a design-review pass. DS::Alert adoption - Replaces 9 hand-rolled error blocks across the provider panels (`bg-destructive/10 text-destructive ... line-clamp-3`) with `DS::Alert(variant: :error)` — the project's existing primitive. - Replaces the just-shipped Binance no-withdraw warning block with `DS::Alert(variant: :warning)` instead of a hand-rolled `bg-warning-50 border-warning-200` card. - Replaces the SnapTrade free-tier inline icon-prefixed warning paragraph with `DS::Alert(variant: :warning)` — proper alert treatment for an actual warning, not body copy. - Replaces the Enable Banking "Configuration locked" inline `bg-warning/10` two-paragraph block with `DS::Alert(variant: :warning)` using `safe_join` for the title + body. - Replaces the encryption-error block at the top of show.html.erb with `DS::Alert(variant: :error)`, again via `safe_join`. Mercury card-within-card - The "Add another Mercury connection" form was wrapped in a `<details>` `bg-container shadow-border-xs rounded-xl` card. In the Connect drawer (always 0 existing connections), that wrapping card-inside-the-drawer-card has no value — the form is the only thing on the surface. Drop the wrapper when no connections exist; keep the heading + form inline. When 1+ connections exist (the section page) the heading hints "+ Add another connection" without the disclosure indirection. Trade-off: the error-alert blocks lose their `line-clamp-3` / `title=` truncation. Acceptable for now — DS::Alert can grow a truncate option as a follow-up if needed. Open follow-up: DS::Alert itself uses raw Tailwind palette (`bg-yellow-50` etc.) instead of semantic tokens, and only accepts a single string `message:`. A separate issue tracks this. * fix(settings/providers): hoist warning alerts to top of drawer DS::Alert convention across the rest of the app: alerts sit at the top of the form / page / section, not floating between content blocks. The Binance no-withdraw warning and SnapTrade free-tier warning were rendering between the setup-instructions list and the form fields — visually wonky. Move both to the top of their respective panels so the warning is the first thing the user sees when the connect drawer opens. Existing precedents this aligns with: - accounts/_form.html.erb (error alert above form) - valuations/new.html.erb (error alert above form) - other_assets/new.html.erb (info alert above form) - holdings/show.html.erb (warn alerts above content) * fix(DS::Alert): align icon to cap-height of first text line `items-start` on the container made the icon's top edge flush with the text's top edge, leaving the icon's optical center sitting below the text's first-line center. The hand-rolled alerts elsewhere in the codebase (api_keys/new, hostings/_sync_settings, holdings/show) all add `mt-0.5` to the icon for the same reason — fold that into the primitive so every caller gets the cap-height alignment. * copy(settings/providers): tighten alert messaging per voice review Copy expert pass on the new provider drawer alerts. House style: sentence case for titles, lead with the action, drop "Warning:" / "Please" filler (the alert variant icon already signals tone), prefer one short sentence + optional title-paragraph for emphasis. - Binance no-withdraw warning: was a single line "Warning: do NOT enable withdrawal permissions" — alarmist without context. Now splits into "Read-only key only" (title) + "Don't enable withdrawal permissions when creating your Binance API key — Sure only needs read access." (body). - SnapTrade free-tier note: "Free tier includes 5 brokerage connections. Additional connections require a paid SnapTrade plan." → "SnapTrade's free tier covers 5 brokerage connections. Upgrade on SnapTrade for more." - SnapTrade connection-limit-info inside the brokerage list: cut entirely. The drawer already shows the cap; restating it in the list was noise. - SnapTrade needs-registration: "Credentials saved — finish registration to connect a brokerage." → "Credentials saved. Finish setup to connect a brokerage." ("registration" was ambiguous — register where, with whom?) - Enable Banking "Configuration locked" body: "Credentials cannot be changed while you have active bank connections. Remove all connections first to update credentials." → "Disconnect all linked banks before changing these credentials." Same meaning, half the words. - Encryption-error block: title-cased "Encryption Configuration Required" → "Encryption keys missing"; body strips "Please ensure" filler and the parenthetical credential dump, leaving the three credential names inline as a clean list. Self-hosters still get exactly the names they need to set. * feat(settings/providers): SetupSteps partial for connect-drawer instructions Per the design's drawer-cleanup follow-up. Replaces the per-panel "Setup instructions:" + ordered list + "Field descriptions:" block with a shared boxed-step component. The new partial — `_setup_steps.html.erb` — takes a `steps:` array of strings (or html_safe strings for inline links / code) plus an optional `help:` hash for a docs link below the steps. The eyebrow label is "Setup" (uppercase, tracking-wider) matching Sure's other section labels. Applied across all eleven provider panels: - _provider_form (Plaid + Plaid EU): field descriptions move to per-field helper text below the input. - _binance, _coinbase, _coinstats, _indexa_capital, _lunchflow, _mercury, _simplefin, _snaptrade, _sophtron, _enable_banking: ordered list + duplicate "Field descriptions" block both replaced by the partial. - Some panels' inline copy tightened in the same pass (Lunch Flow, SimpleFIN, Enable Banking) — the design copy is shorter than the current legacy strings; a copy-pass through every panel can follow as a separate cleanup. Token notes: uses scale tokens (`rounded-xl`, `text-xs`/`text-sm`, `tracking-wider`) instead of the design mock's exact arbitrary values, per the consistency-over-design-specs directive on this branch. * fix(settings/providers): tighten panel spacing + relocate per-panel notes Read-flow audit on each connect drawer. The uniform `space-y-4` treated every block (alert, steps, info card, fields, button) the same — visually they were five sibling boxes with no grouping. The fix is per panel; some notes belong as helper text on a specific field, others as a tightly-grouped pre-fill primer. Per panel: - Binance: IP-whitelisting card now matches the setup_steps box (`bg-surface-inset rounded-xl`) and is wrapped with setup_steps in an inner `space-y-2` so they read as a single pre-fill primer cluster. Same eyebrow treatment ("IP whitelisting required") so the two boxes look like sister panels, not unrelated chrome. - SnapTrade: drop the description paragraph above setup_steps. The available-providers card grid already markets SnapTrade ("Connect brokerage accounts via the SnapTrade aggregation network."); repeating in the drawer was duplication. - Mercury: move the sandbox-API note out of its standalone <p> below setup_steps and into per-field helper text under the base_url field — the user only cares about the sandbox URL when they're filling that field. Applied to both the per-item edit form and the add-new form. - _setup_steps partial: drop the now-pointless `mb-2` (outer `space-y-4` already controls the gap; bottom-margin was dead CSS thanks to margin-collapse rules with the next sibling's margin-top). * fix(settings/providers): plaid + indexa drawers join the SetupSteps look Two unifying fixes after the panel-by-panel screenshots showed mixed treatments. Plaid + Plaid EU - The registry-driven panel (_provider_form) was still rendering each adapter's markdown `description` block as plain prose ("Setup instructions: 1. Visit the Plaid Dashboard ..."). Other panels switched to the SetupSteps box; Plaid was the odd one out. - Drop the markdown `description` block from both plaid_adapter and plaid_eu_adapter. Render setup_steps in _provider_form for these two provider keys via inline ERB (link helper handles the Plaid Dashboard link cleanly; the regional differences fold to the same dashboard URL with a different account scope). - Other registry-based providers fall through to the previous markdown description path — no behavior change for them. Indexa Capital - The API token field was wrapped in a `bg-surface border` "card" that duplicated the field label inside as a heading and put the description above the input. Same pattern the user flagged as the "card within input" anti-shape. - Drop the wrapper. The styled-form input renders its own label; description moves to per-field helper text below the input, matching the pattern used by Plaid (provider_form) and Mercury. * fix(settings/providers): surface configured plaid_eu + dedup show context provider_summary had no plaid_eu branch — configured plaid_eu was falling through to status :off and rendering in Available even with credentials set. Collapse plaid + plaid_eu into a single registry check. Drawer title for non-panel configurations was provider_key.titleize, which produced "Plaid Eu" while the available card grid used metadata[:name] = "Plaid EU". Read from metadata first. While here: - compute_provider_sync_health no longer relies on instance_variable_get; pass family_panel_items explicitly so the hash-key/ivar-name coupling is gone. - drop unused .includes(:syncs, :mercury_accounts) and .includes(:snaptrade_accounts) from prepare_show_context. The show view only consults summary[:status]; the eager-loads were carried over from connect_form (which has its own load_provider_items). * i18n(settings/providers): localize plaid setup steps + drop dead defaults The plaid + plaid_eu setup steps in _provider_form.html.erb were hardcoded English strings. Move them to settings.providers.plaid_panel (shared) + plaid_eu_panel (EU-specific step 1) so they can be translated like every other panel. _setup_steps.html.erb was passing default: "Setup" / "Need help?" to t(), masking missing translations in non-EN locales. Both keys exist in en.yml — drop the defaults so missing translations actually surface. * test(settings/providers): cover plaid_eu, clear filters, warn outline Three system test additions: - Configured plaid_eu surfaces in Your connections (regression guard for the helper fix; previously fell through to Available). - Clear filters button resets input + chip state and brings cards back into view. - :warn-state connection row carries the border-warning/25 outline that distinguishes it from an :ok row. * copy(settings/providers): drop em dashes, naturalize phrasing Sweep through every string this branch added and replace em-dash splices with full sentences or simple connectives. en.yml: - drawer_trust_statement now reads "Read-only access. Sure can never move money, and your credentials are stored encrypted." instead of em-dash splicing. - sync_all_recently / recently_synced split into two sentences. - binance_panel.no_withdraw_body, plaid_panel.step_1_html / step_2, plaid_eu_panel.step_1_html same treatment. Hardcoded panel steps (enable_banking, lunchflow, simplefin) become "Go to <link> and …" or "Go to <link> for …" instead of the "<link> — get …" splice. Same setup_steps comment cleaned up. * fix(settings/providers): address CodeRabbit pass on PR #1717 Fixed: - Localize the setup steps in _enable_banking_panel, _lunchflow_panel, and _simplefin_panel. The em-dash sweep had rewritten these into hardcoded English; they now route through settings.providers.{enable_banking,lunchflow,simplefin}_panel step_1_html / step_2 / step_3 keys, mirroring the plaid_panel treatment. - connect_form: silent redirect when provider_key is unknown now carries an alert (settings.providers.not_found) so misrouted links don't drop users on the page with no feedback. - sync action: redirect notice now reflects whether anything was actually scheduled — adds settings.providers.sync_provider_no_items for the "all items already syncing or none exist" path. - Family::Syncer test: count plaid_items via the .syncable scope to match what Family::Syncer actually schedules (already done for binance_items in the same test). Skipped, with reasons: - focus:ring-gray-500/-gray-900 in coinstats / coinbase / simplefin / search_filters: tracked under issue #1715 as part of the raw-palette → DS-token sweep across the whole codebase. - Coinbase #0052FF brand-color wrapper: tracked under PR #1710's follow-up tracking comment as the deferred Provider::Metadata colour-palette decision (designer §01). - Sophtron submit-button extraction into DS::Button: same deferred sweep — every panel hand-rolls this class string; one-off extraction would just churn. - Redundant .html_safe on _html keys in coinstats: tracked in #1715. - _provider_form.html.erb env hint, "Optional" placeholder, "Save and connect" submit: pre-existing strings not added on this branch. - Renaming sync_health_for's :stale to :data_stale: pre-existing shape, refactor scope. - Plaid_eu using plaid_panel.step_2/step_3 keys: deliberate. Same English copy across both providers; duplicating keys would just give translators twice the work for identical strings. - _enable_banking_panel / _lunchflow_panel / _simplefin_panel alert + submit + button labels: pre-existing hardcoded strings from before this branch. Setup steps were the strings actually touched in the em-dash sweep, so those got localized; the rest belong in a broader panel-i18n pass. Verified: - bundle exec erb_lint on the three panels: clean. - bin/rubocop on controller + test: clean. - bin/rails test test/models/family/syncer_test.rb test/controllers/settings/providers_controller_test.rb: 23 runs, 85 assertions, 0 failures. - DISABLE_PARALLELIZATION=true bin/rails test test/system/settings/providers_test.rb: 15 runs, 38 assertions, 0 failures. * fix(db): rename migration to clear collision with main's 20260508120000 Main's PR #1705 (Sophtron manual sync) shipped a migration with the same 20260508120000 timestamp as our add_last_sync_all_attempted_at_to_families migration. The merge that brought main into this branch left both files at the same prefix, which trips Rails' "Duplicate migration" guard at db:schema:load time and broke CI. Renaming our migration to 20260510120000 keeps the column it adds intact (already in db/schema.rb) and bumps the schema version to match. No DB-level change. * fix(settings/providers): card + strip a11y polish - Bring back the slim health strip; gate behind 10+ accounts (HEALTH_STRIP_MIN_ACCOUNTS) so it stays out of the way for small libraries where per-row pills already carry the signal. - Status pill: drop the bg-{c}/10 text-{c} pattern (failed AA on warn / err); switch to bg-surface-inset text-primary with the dot still carrying semantic colour. Passes AA in both themes; the dot is the only colourful affordance. - Maturity badge: bg-alpha-black-50 was invisible against the hovered card bg in light mode and against bg-container in dark mode. Move to bg-surface-inset + border-tertiary so it stays delineated through hover and dark theme. - Provider card: keep the bg shift on hover (now bg-surface-inset for a perceptible delta), focus ring promoted alpha-black-100 -> alpha-black-300 (visible to keyboard users), meta line text-subdued -> text-secondary (text-subdued failed AA at 2.86:1 against bg-container). - Restore the per-provider logo palette dropped in 6abceb07. Yellow-on-white was the BLOCKER then; bumped Binance to yellow-600 and CoinStats to pink-600 (distinct from Binance and AA-safe with white text). - Health strip dividers: bg-alpha-black-100 was invisible in dark mode. Switch to border-l border-secondary so the DS variant flips correctly. * fix(settings/providers): keep row height on open The right-side meta + status pill + sync button group is hidden via group-open:hidden, but the sync button (DS::Button size sm, h-8) is what dictated the row's natural height. With it gone, the row collapsed from 60px to 48px and the title appeared to jump upward. Pin a min-h-15 on the <summary> so the height stays constant through open/close. * Let's not regress IPv6 * Keep the only real change in schema.rb --------- Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Signed-off-by: Guillem Arias Fauste <accounts@gariasf.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Guillem Arias <accounts@gariasf.com> Co-authored-by: Guillem Arias Fauste <gariasf@proton.me>	2026-05-10 22:13:57 +02:00
Guillem Arias Fauste	57d71cd55e	refactor(design-system): extend DS::Alert and migrate 9 inline alert blocks (#1731) ... * feat(design-system): add info semantic color token Mirrors success/warning/destructive: --color-info maps to blue-600 in light mode, blue-500 in dark mode. Unblocks the DS::Alert info variant from carrying a raw 'blue-600' literal in icon_color and lets surface tokens use bg-info/N alpha modifiers like the rest of the system. Refs #1715 * refactor(design-system): adopt semantic tokens and add body slot in DS::Alert Replaces the bg-{blue,green,yellow,red}-50 / text-{...}-700 / border-{...}-200 palette block in DS::Alert with semantic alpha-modifier surfaces (bg-{info,success,warning,destructive}/10 + matching /20 borders). Drops the 'blue-600' literal that icon_color was returning for the info variant; helpers#icon now accepts color: :info backed by the new --color-info token. Adds an optional title: kwarg and an opt-in block-content slot so rich alerts (title + paragraph, lists, embedded actions) can render without callers reaching for a hand-rolled flex layout. The existing message: API stays backward-compatible — nothing in the codebase that already calls DS::Alert.new(message: ..., variant: ...) needs to change. Lookbook gains with_title and with_body_slot examples covering the new shapes. Refs #1715 * refactor(views): migrate api_keys, hostings, lunchflow alerts to DS::Alert Cleans up nine bespoke alert blocks that hand-rolled the same flex + icon + bordered-surface shape DS::Alert already provides: - settings/api_keys/{new,created,created.turbo_stream}.html.erb — three near-identical 'Security Warning' / 'Important Security Note' boxes using the broken bg-warning-50 / text-warning-700 raw-palette pair. - settings/hostings/{_alpha_vantage,_eodhd,_yahoo_finance,_twelve_data,_provider_selection}_settings.html.erb — five amber-50 / amber-200 warning boxes covering rate-limit notes, health-check failure messaging, and the env-configured override banner. The twelve_data plan-restriction block keeps its bullet list and pricing link inside the new DS::Alert body slot. - lunchflow_items/{_api_error,_setup_required}.html.erb — two modal alert headers whose flex+icon scaffolding now collapses onto DS::Alert. The surrounding bg-surface 'Common issues' / 'Setup steps' info cards stay as-is; this PR only touches the alert shape itself. No functional or behavioural changes. Locale keys preserved. amber-* palette uses on the alerts disappear; remaining bg-amber-* hits in the codebase live outside the alert pattern and stay for follow-up sub-PRs of #1715. Refs #1715	2026-05-10 17:14:06 +02:00
Juan José Mata	c92b984cef	[codex] Add Sophtron manual sync fixes (#1714) ... * Add manual Sophtron sync flow (#1705) Branch-to-branch merge. * Copy edits * Make Sophtron manual sync institution scoped * Populate Sophtron manual sync stats * Restore Sophtron bank credential copy * Address Sophtron manual sync review feedback * Scope manual sync processing failure handling * Hide raw Sophtron processor errors from flash * Clear Sophtron manual sync pointers on provider errors * Keep manual Sophtron MFA on manual sync records * Preserve manual sync processing error details	2026-05-09 21:55:20 +02:00
CrossDrain	0b7fa732ae	feat(splits): add exclusion support for splits and improve rendering (#1661) ... * feat(splits): add excluded attribute support for split children and improve rendering of split transactions * address coderabbitai suggestions to improve code quality * Fix split excluded coercion, DRY helpers, and clean up view partials Fix boolean coercion bug where string "false" from form params was truthy in Ruby, causing all split children to be marked excluded. Use ActiveModel::Type::Boolean for explicit casting in Entry#split!. Additional changes addressing code review feedback: - Extract duplicated in_split_group logic from TransactionsController and TransactionCategoriesController into TransactionsHelper - Remove redundant local_assigns.fetch calls in partials that already declare defaults via the Rails 7.1 locals: magic comment - Simplify ternary in _transaction.html.erb to pass grouped directly - Guard hidden_field_tag :grouped to only emit when value is "true" - Add model tests for excluded on split children (boolean and string) - Add controller test for excluded param through full HTTP stack - Add test confirming excluded children are dropped from balance queries * fix(splits): simplify excluded attribute boolean check * refactor(splits): extract truthy values constant for excluded check Extract the array of truthy values used for excluded attribute check into a private constant to improve code maintainability and avoid duplication of the magic array. * refactor: simplify split grouping link generation and add test coverage for excluded split parameters	2026-05-09 12:36:41 +02:00
thomasbaker9010251	43e7e35e7e	fix(transactions): update dialog content class for new transaction view (#1693) ... * fix(transactions): update dialog content class for new transaction view * feat(credit_card): add validation for expiration date and update form to prevent past dates - Implemented a validation method to ensure the expiration date of credit cards is not in the past. - Updated the credit card form to set a minimum date for the expiration date field, preventing users from selecting past dates. * fix(credit_card): update expiration date validation error message format - Changed the error message assertion for the expiration date validation to check for the symbol :greater_than_or_equal_to instead of a specific date string. This improves the flexibility and clarity of the validation error handling. * fix(transactions): enhance dialog content class for improved overflow handling * rebase --------- Co-authored-by: ms1112 <milosdelic.tech@gmail.com> Co-authored-by: petermilord <petermilord6@gmail.com>	2026-05-09 11:01:23 +02:00
ghost	8abecf8a8d	feat(exports): preserve transfer decisions (#1639) ... * feat(exports): preserve transfer decisions * fix(api): apply transfer date filters to both sides * fix(api): refine transfer decision handling * fix(api): align transfer decision schemas * fix(api): use current context for transfer filters * fix(api): include either side in transfer date filters * fix(api): deduplicate transfer decision filters * fix(api): guard transfer decision exports	2026-05-08 23:03:57 +02:00
Juan José Mata	81cdccb768	[codex] Complete Sophtron account mapping (#1698) ... * Complete Sophtron account mapping * Clarify Sophtron login challenge flow * Add Sophtron connection UI timeout * Treat Sophtron timeout jobs as failed * Reset failed Sophtron connection state * Handle stale Sophtron connection jobs * Advance Sophtron polling timeout * Shorten Sophtron connection timeout * Fix Sophtron modal polling updates * Stabilize Sophtron MFA polling * Give Sophtron OTP challenges more time * Clarify Sophtron institution login failures * Extend Sophtron polling during login progress * Probe Sophtron accounts after completed MFA step * Align Sophtron dialogs with design system * Start Sophtron initial load after linking accounts * Fix Sophtron initial transaction load * Fail Sophtron sync without institution connection * Fix tests * Wrap Sophtron account linking in transaction * Wrap Sophtron provider responses * Fix Sophtron MFA security tests * Guard Sophtron MFA challenge arrays * Respect Sophtron initial load window * Use unique Sophtron MFA answer field ids * Address Sophtron review follow-ups * Fix Sophtron transaction sync refresh * Avoid blocking Sophtron refresh polling * Move Sophtron account helpers to model * Keep Sophtron grouping provider-level * Start new Sophtron institution links * Isolate Sophtron institution connections --------- Signed-off-by: Juan José Mata <juanjo.mata@gmail.com>	2026-05-08 15:15:23 +02:00
GermanDZ	7e1de420ca	perf(accounts): kill sidebar/sparkline N+1s and cache the sidebar (#1683) ... * perf(accounts): kill sidebar/sparkline N+1s and cache the sidebar The dashboard was issuing hundreds of per-account `SELECT 1` and polymorphic `accountable` lookups on every page load. Sidebar render alone hit the DB ~50–100× and ran twice per request (mobile + desktop). Changes: - AccountableSparklinesController: short-circuit `requires_normalized_aggregation?` to Investment/Crypto only and collapse the per-account `linked?` loop into a single `EXISTS`. Kills the N+1 `AccountProvider Exists?` queries on every sparkline endpoint. - BalanceSheet::AccountTotals#visible_accounts: preload `:accountable`, `:plaid_account`, `:simplefin_account`, and `account_providers: :provider` so the sidebar's `account.subtype` / `account.linked?` / `account.provider` calls don't trigger per-row polymorphic loads. - AccountsController#index: same preloads on `@manual_accounts`. - accounts/index/_account_groups.erb: extend the existing `Preloader` call to batch-load accountable + provider associations so the per-provider-item partials (Plaid, SimpleFIN, Coinbase, etc.) stop re-issuing N+1s when rendering account rows on /accounts. - accounts/_account_sidebar_tabs.html.erb: wrap the partial in a `cache` block keyed on the family's data-version, the current user, shares fingerprint, locale, mobile flag, active tab, and a path-derived "current account" component (`sidebar_active_account_id` helper). The sidebar is rendered on every page in the layout (twice — mobile + desktop drawers), so most navigations now serve the cached fragment instead of re-walking accounts/balances. Local impact (DZG family, 23 accounts, 6.1k transactions): - Dashboard `/`: ~6.5s → ~1.95s - /accounts: ~2.7s → ~0.85s on warm cache - /accountable_sparklines/*: per-request N+1s eliminated; remaining cost is request boilerplate which can be addressed by bumping `RAILS_MAX_THREADS` (the dashboard fans out 5 sparkline turbo frames in parallel and Puma's default 3 threads serialize them). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(perf): address PR review on sidebar/sparkline perf changes - AccountableSparklinesController#requires_normalized_aggregation? also matches legacy plaid_account_id / simplefin_account_id links, not just new-style account_providers, so investment/crypto accounts in the legacy linking state still get LinkedInvestmentSeriesNormalizer applied (Codex P1 / CodeRabbit major). - Sidebar share fingerprint includes both `count` and `max(updated_at)` so deleting a non-most-recent AccountShare invalidates the cached fragment for users who lost access (Codex P1). - Move the sidebar cache-key construction (incl. the AccountShare query) from the ERB into a new `account_sidebar_tabs_cache_key` helper, per the project's "no heavy logic in ERB" rule (CodeRabbit). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(perf): address human review on perf PR - Account.linked: new SQL-level scope mirroring `Account#linked?` so the controller and per-instance method share one definition. Removes the duplicated raw SQL string in `AccountableSparklinesController#requires_normalized_aggregation?`, which now reads `accounts.linked.exists?` (jjmata, sure-design). - AccountsHelper: move `sidebar_active_account_id` and `account_sidebar_tabs_cache_key` out of `ApplicationHelper`. The cache-key helper also collapses the AccountShare `count` + `max(updated_at)` fingerprint into a single `pick` query so we don't pay two round-trips on every render (jjmata, sure-design). - test/models/account/linkable_test.rb: pin the `Account.linked` scope against all three link types (account_providers, legacy plaid_account, legacy simplefin_account) so any future schema change that diverges the SQL definition from `linked?` breaks a test instead of silently serving wrong sparkline aggregations (sure-design). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(perf): correct shares cache fingerprint on raw-SQL pick `pick(Arel.sql("count(*), max(updated_at)"))` passes a single comma- separated fragment, which Rails returns as a String (per the documented behavior of `pluck` with SQL fragments). The previous `max_at&.to_i` silently truncated `"2025-05-06 12:34:56.789 UTC"` to `2025`, so the sidebar cache key would not change for share `updated_at` movements within the same calendar year — including share deletions — leaving revoked users with a stale sidebar until the 12h expiry. Pass the aggregates as two separate `Arel.sql` args and just concatenate the raw String values into the cache key. The values only need to be stable for a given DB state, not numerically meaningful. Caught by CodeRabbit on PR #1683. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-07 17:31:16 +02:00
ghost	45c5284148	feat(api): expose provider connection health (#1636) ... * feat(api): expose provider connection health * fix(api): harden provider health review paths * fix(api): refine provider health responses * test(api): align provider health docs key scope * fix(api): clarify provider connection status * fix(api): batch provider connection sync status * fix(api): polish provider connection status review feedback * fix(api): correct provider connection summaries	2026-05-07 00:42:32 +02:00
ghost	9e369831ce	feat(api): expose sync status (#1635) ... * feat(api): expose sync status * fix(api): harden sync status review paths * fix(api): address sync status review * fix(api): tighten sync status review fixes * fix(api): address sync status review * test(api): avoid secret-like sync fixture key * test(api): reuse sync status fixture key * fix(api): align sync route helpers * fix(api): tighten sync status scoping * fix(api): make sync status schema nullable-compliant	2026-05-06 22:02:21 +02:00
Julien Roy	1e0666eca2	Update link text for new account to use translation (#1690) ... Signed-off-by: Julien Roy <royto81+github@gmail.com>	2026-05-06 21:36:08 +02:00
ghost	2d38cfb011	feat(api): expose budget state (#1640) ... * feat(api): expose budget state * fix(api): guard malformed budget ids * fix(api): address budget state review * fix(api): address budget state review * fix(api): document budget id formats * fix(api): align budget category docs auth * fix(api): lighten budget category index payload * fix(api): use shared pagination clamp * fix(api): centralize budget filter handling	2026-05-06 20:50:46 +02:00
ghost	41339b0494	feat(api): expose balance history (#1641) ... * feat(api): expose balance history * fix(api): address balance history review * fix(api): address balance history review * fix(api): tighten balance history docs * fix(exports): preserve balance chronology * fix(api): guard nullable balance account type * test(api): align balances api key helper * fix(api): use shared pagination clamp * test(export): set explicit balance flows factor	2026-05-05 19:09:36 +02:00
Juan José Mata	a9661253f4	Revert "feat(accounts): Highlight matching activity search text in entry names" (#1682) ... Explanation in #1679	2026-05-05 18:48:06 +02:00
Sure Admin (bot)	e535a7ab0b	Merge pull request #1671 from bugbug11111/feat/search-highlight ... feat(accounts): Highlight matching activity search text in entry names	2026-05-05 12:21:34 +02:00
bugbug11111	5519716274	fix(transactions): correct HTML syntax in split parent row view ... * Fixed a minor syntax issue in the _split_parent_row.html.erb file by ensuring the closing tag for the link_to helper is properly formatted. This change enhances code readability and maintains consistency in the view structure.	2026-05-05 11:59:53 +02:00
bugbug11111	bba32a3e61	feat(accounts): add activity entry highlighting in summary cards ... * Introduced a new helper method `highlight_activity_entry_name` to highlight search terms in activity entry names. * Updated various views to utilize the new highlighting method for improved user experience in displaying relevant entries.	2026-05-05 08:08:48 +02:00
ghost	d0883f9018	fix(auth): hash MFA backup codes (#1629) ... * fix(auth): hash MFA backup codes * fix(auth): lock and filter backup code verification * test(auth): assert consumed backup code digest * fix(auth): strengthen backup code handling * fix(auth): require otp secret before mfa enable * test(auth): assert backup code digest consumption * fix(auth): rehash legacy MFA backup codes * fix(auth): narrow legacy backup code migration	2026-05-05 01:20:57 +02:00
ghost	1ec8bd90b7	feat(api): expose import row diagnostics (#1644) ... * feat(api): expose import row diagnostics * fix(api): stabilize import row diagnostics * fix(api): harden import row diagnostics * fix(api): number Mint import diagnostics rows * fix(api): enforce unique import row diagnostics * fix(api): address import row diagnostics review	2026-05-05 01:12:48 +02:00
ghost	a48f264799	feat(api): expose securities and price history (#1642) ... * feat(api): expose securities and prices * fix(api): stabilize security price filters * fix(api): cap security pagination limits * fix(api): preserve security price decimal scale * fix(api): validate securities boolean filters * fix(api): reject blank securities boolean filters * fix(api): trim security exchange filter * fix(api): tighten security price filters * fix(api): tighten security resource filters * fix(api): tighten securities docs fixtures	2026-05-05 01:08:43 +02:00
Guillem Arias Fauste	0d32bb70ec	chore(design-system): swap raw gray classes for semantic tokens across remaining views (#1655) ... * chore(design-system): swap raw gray classes for semantic tokens across remaining views Finalizes the raw-color sweep started in #1652 (settings) and continued in #1654 (holdings). Covers accounts, budgets, chats, pages, imports, provider integrations (mercury, lunchflow, sophtron, enable_banking, coinstats), auth flows (password reset, MFA, registrations), shared layouts, and selected DS component hover states. 35 files, ~56 line changes. Mappings (matching the patterns established in the prior sweeps): - text-white bg-gray-900 hover:bg-gray-800 (with optional focus:ring-gray-900) -> text-inverse button-bg-primary hover:button-bg-primary-hover -> focus:ring-button-bg-primary - text-gray-500 / 600 / 700 -> text-secondary - text-gray-800 -> text-primary - text-gray-400 -> text-subdued - hover:text-gray-700 / hover:text-gray-100 -> hover:text-primary - bg-gray-50 / 100 / 200 (standalone) -> bg-surface-inset - bg-gray-500/5 -> bg-gray-tint-5 - bg-gray-500/10 -> bg-gray-tint-10 - bg-gray-900 (decorative active states) -> bg-inverse - hover:bg-gray-50 / 100 (standalone) -> hover:bg-surface-inset - hover:bg-gray-300 -> hover:bg-surface-inset-hover - bg-white hover:bg-gray-100 -> bg-container hover:bg-container-hover - border-gray-300 -> border-secondary - focus:border-gray-200 -> focus:border-secondary - focus-within:border-gray-900 -> focus-within:border-primary - DS::Buttonish outline / ghost / icon hover: hover:bg-gray-100 theme-dark:hover:bg-gray-700 -> hover:bg-container-inset-hover Left intentionally raw, with rationale: - bg-gray-300 / bg-gray-400 decorative dots and avatar circles. The raw value reads OK against both bg-container variants; no semantic "neutral indicator" token exists. Same pattern as #1652 / #1654. - bg-gray-400/20 theme-dark:bg-gray-500/20 (onboardings/trial). Custom alpha tint with no equivalent token. - bg-white theme-dark:bg-gray-700 (DS::Tabs active pill, budgets tabs). Custom tab-pill pattern; gray-700 in dark mode (one shade lighter than page bg-gray-900) is intentional for visibility. - bg-gray-100 theme-dark:bg-gray-700 (DS::Toggle base bg). Closest match (bg-container-inset-hover) is semantically a hover state. - DS::Buttonish secondary variant gray-200/300/700/600 pattern. Same pattern as #1654 holdings; needs button-bg-secondary-strong from that PR. Will swap in a follow-up after #1654 merges. - disabled:bg-gray-500 theme-dark:disabled:bg-gray-400 on inverse buttons (DS::Buttonish primary, enable_banking, coinstats). Custom disabled state for the inverse pair; no token. - text-gray-300 SVG stroke (shared/_progress_circle). - bg-white text-gray-900 (layouts/print). Print contexts intentionally light regardless of theme. - bg-gray-800 / border-gray-700 / text-white / hover:text-gray-100 (impersonation_sessions/_super_admin_bar). Admin overlay styled to remain dark in both modes; not a theme-aware component. Files covered by other in-flight PRs were skipped to avoid rebase conflicts: chats/_ai_consent's fg-inverse swap (#1626), shared/_text_tooltip and shared/_money_field tooltip pills (#1626), investments/_value_tooltip (#1626), components/DS/tooltip (#1626). * fix(design-system): keep changelog avatar text raw to preserve dark-mode contrast The changelog avatar fallback (when @release_notes[:avatar] is missing) sits inside the "decorative + raw" exception list — bg-gray-300 stays fixed across themes since no semantic neutral-indicator token exists. The earlier sweep partially themed the pair: bg-gray-300 stayed raw but text-gray-600 became text-secondary. text-secondary resolves to gray-300 in dark mode, which matches the bg → text became invisible against its own background. Reverting only the text class to text-gray-600 restores the original fixed-light placeholder behavior. Both classes raw, both themes readable. * fix(design-system): address review feedback on raw-color-sweep-finalize Six issues caught by CodeRabbit + Codex review: 1. focus:ring-button-bg-primary silently emits no CSS (×6 files). button-bg-primary is a custom @utility, not a theme color, so Tailwind's ring-{name} resolution finds no --color-button-bg-primary. Replaces with focus:ring-gray-900 theme-dark:focus:ring-white — same color flip as the button bg, but resolved through theme colors so the ring actually renders. Files: lunchflow/mercury/sophtron _api_error + _setup_required, coinstats_items/new. 2. accounts/show/_activity.html.erb: focus-within:ring-gray-100 was dead (no ring-width on the parent). Removed. 3. import/confirms/show.html.erb: uniform hover:bg-surface-inset-hover applied to both active and inactive step indicators created a jarring dark-to-light flip on the active step (bg-inverse → bg-surface-inset-hover). Now hover follows the resting state: active uses hover:bg-inverse-hover, inactive uses hover:bg-surface-inset-hover. 4. password_resets/new.html.erb: bg-white left raw alongside the migrated hover:bg-surface-inset. Swapped to bg-container so dark mode flips properly. 5. registrations/new.html.erb + password_validator_controller.js: view now uses bg-surface-inset on password strength block lines, but the Stimulus controller still toggled bg-gray-200 on validate. Updated controller to add/remove bg-surface-inset matching the view, so unmet states reset to the tokenized class instead of leaving raw gray-200 stuck on the element.	2026-05-04 21:47:01 +02:00
Guillem Arias Fauste	99844c1b90	chore(design-system): swap raw gray classes for semantic tokens in holdings/ (#1654) ... * chore(design-system): swap raw gray classes for semantic tokens in holdings/ Continues the raw-color sweep on the holdings/ domain plus the related account activity feed component. 11 occurrences across 5 files. Token additions: - button-bg-secondary-strong (gray-200 / gray-700) and -hover (gray-300 / gray-600). Holdings CTAs (Add Trade, Add Holding, Edit Cost Basis, Sync Prices, etc.) used a hand-rolled "secondary-strong" pattern that doesn't match the existing button-bg-secondary token (which is gray-50 / gray-700, much subtler). Adding the strong variant preserves the intentional visual weight of these CTAs and gives future PRs a name to reuse. - $version bump 1.0.0 -> 1.1.0 (additive). Mappings: - 8x text-primary bg-gray-200 hover:bg-gray-300 theme-dark:bg-gray-700 theme-dark:hover:bg-gray-600 (holdings/show + sync_prices + cost_basis_cell) -> text-primary button-bg-secondary-strong hover:button-bg-secondary-strong-hover - 1x bg-gray-50 theme-dark:bg-gray-700 hover:bg-gray-100 theme-dark:hover:bg-gray-600 (holdings/index search button) -> button-bg-secondary hover:button-bg-secondary-hover - 1x hover:bg-gray-100 theme-dark:hover:bg-gray-700 (cost_basis_cell hover row) -> hover:bg-container-inset-hover - 1x focus-within:border-gray-900 (activity_feed search wrapper) -> focus-within:border-primary Left intentionally: - bg-gray-300 status indicator dot in show.html.erb (same pattern as the settings pilot; no semantic equivalent for "neutral inactive indicator" yet). - bg-gray-700 in _missing_price_tooltip.html.erb (already fixed in PR #1626; would conflict on rebase). - focus-within:ring-gray-100 (subtle effect that works in both modes; ring-color tokens are a separate concern). * chore(design-system): bump $version to 2.1.0 for additive token additions Per the design tokens semver contract: PR #1626 already bumped to 2.0.0 (major / breaking when fg-* utilities were removed). This PR adds button-bg-secondary-strong + hover without removing or changing existing tokens, so the correct bump is minor (2.0.0 → 2.1.0). Spotted by CodeRabbit on the rebased branch. * fix(design-system): drop dead focus-within:ring-gray-100 on activity feed search The focus-within:ring-gray-100 class only sets --tw-ring-color, but the parent has no ring-width utility, so it produces no visible ring — dead code from before the focus-within:border-primary swap landed. Same issue spotted on app/views/accounts/show/_activity.html.erb in the finalize sweep PR; applying the equivalent fix here for the holdings activity feed component. --------- Signed-off-by: Guillem Arias Fauste <gariasf@proton.me>	2026-05-04 21:44:47 +02:00
Guillem Arias Fauste	83cb287294	chore(design-system): swap raw gray classes for semantic tokens in settings/ (#1652) ... * chore(design-system): swap raw gray classes for semantic tokens in settings/ Pilot for the broader raw-color sweep. Maps 21 occurrences across 11 files to design-system equivalents: - text-white bg-gray-900 hover:bg-gray-800 (CTA buttons) -> text-inverse button-bg-primary hover:button-bg-primary-hover - bg-gray-25 / bg-gray-50 / bg-gray-100 (subtle surface backgrounds) -> bg-surface-inset - bg-gray-800 (tooltip pills) -> bg-inverse - text-white inside tooltips -> text-inverse - text-gray-300 (muted tooltip labels) -> text-inverse opacity-70 - text-gray-600 (muted body text) -> text-secondary - hover:text-gray-700 -> hover:text-primary - focus:ring-gray-900 -> focus:ring-button-bg-primary The 7 status-indicator dots (`bg-gray-400`) are intentionally left as raw classes. Gray-400 against both light and dark container bgs gives reasonable contrast either way, and there's no semantic token that fits a "neutral inactive indicator" use case yet. Worth a follow-up if a `bg-subdued` token would benefit other places. * fix(design-system): use theme-aware focus ring on provider submit buttons Two issues caught in code review: 1. focus:ring-button-bg-primary silently emits no CSS (CodeRabbit, Codex). button-bg-primary is a custom @utility, not a theme color, so Tailwind's ring-{name} resolution finds no --color-button-bg-primary and falls back to the default. Replaces with focus:ring-gray-900 theme-dark:focus:ring-white — same color flip as the button bg, but resolved through theme colors so ring-{name} actually generates CSS. 2. _enable_banking_panel.html.erb dropped focus-ring + transition entirely in the original sweep (CodeRabbit). Restores parity with the other provider panels using the corrected ring classes. Long-term cleanup: tracked under issue #1653 (modifier-aware utilities) to make button-bg-primary also a theme color so ring-button-bg-primary becomes valid.	2026-05-04 21:42:44 +02:00
Guillem Arias Fauste	2bcdf6c554	fix(design-system): replace undefined utility classes and broken /N modifiers (#1660) ... * fix(design-system): replace undefined utility classes and broken /N modifiers Audit of class-name resolution in views surfaced two related silent failures across ~17 files: 1. Class names that don't exist anywhere in the design system. Tailwind silently drops them and the element renders with no CSS for that property. - bg-primary (and bg-primary/5, /10, /90): never defined as a custom utility, no --color-primary in @theme. Used as a CTA bg in 8 places, all rendered transparent. - text-inverted: typo of text-inverse. - text-primary-foreground: shadcn/Radix vocabulary, not in our token system. - bg-accent / border-accent / text-accent: same shadcn vocabulary; not defined. 2. Slash modifier (/N) used on custom @utility blocks. Modifiers only resolve on Tailwind theme colors (anything in tokens.json color.*). Custom @utility blocks compile to static @apply statements and silently drop the /N variant. Affected uses: - border-surface-inset/50 across provider account selectors. - border-secondary/30, /40 in admin SSO form and simplefin setup. - bg-surface-inset/30, /40 in settings preferences and simplefin. Fixes: | From | To | |---------------------------------------------------|------------------------------------------------------| | bg-primary text-white (and similar primary CTAs) | button-bg-primary text-inverse | | bg-primary text-primary-foreground (badges) | button-bg-primary text-inverse | | bg-primary text-inverted (typo) | button-bg-primary text-inverse | | bg-primary text-primary (broken active pill) | bg-inverse text-inverse | | bg-primary (status dot) | bg-inverse | | bg-primary/5, bg-primary/10 (subtle accent bg) | bg-gray-tint-5, bg-gray-tint-10 | | hover:bg-primary/90 | hover:button-bg-primary-hover | | border-accent bg-accent/10 text-accent (badges) | border-secondary bg-surface-inset text-secondary | | border-surface-inset/50 | border-secondary | | border-secondary/30, /40 | border-tertiary | | bg-surface-inset/30 | bg-surface-inset (full strength) | | bg-surface-inset/40 | bg-container-inset | Also documents the alpha-modifier limitation in design/tokens/README.md under a new "Alpha modifiers in views (/N syntax)" section, with the opacity-N convention for custom utilities and a note that the gray-tint-5 / gray-tint-10 family (and similar pre-resolved tints) are theme colors and accept /N modifiers natively. The accent-badge mapping uses neutral semantics for now. A dedicated brand-accent token (text-link-tint-10 etc.) is worth considering as a follow-up if the "highlighted metadata badge" pattern recurs. * fix(design-system): replace undefined divide-primary / divide-secondary with alpha tokens Same class of bug as the rest of this PR: divide-{name} requires the name to be a theme color (i.e. expose --color-{name}), and our custom @utility utilities (primary, secondary, etc.) do not. Tailwind silently drops the unrecognized class and rows render with no separator. Spotted six instances during the visual audit: - admin/users/index.html.erb (×2): users table + pending invitations - admin/sso_providers/index.html.erb (×2): configured + legacy lists - transactions/categorizes/_transaction_list.html.erb: categorize sidebar - settings/preferences/show.html.erb: divide-secondary/60 (also broken) Swapped to the alpha-black/white pattern already used elsewhere in the codebase (imports/cleans/show, transactions/_summary, etc.): divide-y divide-primary -> divide-y divide-alpha-black-200 theme-dark:divide-alpha-white-200 divide-y divide-secondary/60 -> divide-y divide-alpha-black-100 theme-dark:divide-alpha-white-100 The lighter (-100) variant on the preferences list matches the original intent of /60 (more subtle).	2026-05-04 21:40:17 +02:00
Guillem Arias Fauste	0fe1e06645	refactor(design-system): migrate fg-* utilities to text-* and remove namespace (#1626) ... * refactor(design-system): migrate fg-* utilities to text-* and remove namespace The design system carried two parallel namespaces for foreground colors: text-* (canonical, ~2,000 uses) and fg-* (32 uses). Most fg-* tokens were 1:1 duplicates of a text-* counterpart. fg-gray was nearly identical to text-secondary, with a one-step shade difference in dark mode. This PR migrates all 32 usages to their text-* equivalents and removes the fg-* block from the design tokens. Closes #1606. Mapping: - fg-inverse -> text-inverse (20 usages, identical light/dark values) - fg-gray -> text-secondary (7 usages; light values match, dark is one step lighter: gray-300 vs gray-400) - fg-primary -> text-primary (3 usages, identical values) - fg-subdued -> text-subdued (2 usages, identical values) The four other fg-* tokens (fg-contrast, fg-primary-variant, fg-secondary, fg-secondary-variant) had zero usages despite being defined; they are removed without replacement. JSON / build: - design/tokens/sure.tokens.json: $version 1.0.0 -> 2.0.0 (breaking schema change per the policy added in #1620). 8 fg-* token definitions removed. - button-bg-ghost-hover's dark value still references "fg-inverse" internally; rewritten to "bg-gray-800 text-inverse" so the cleanup doesn't break that utility. - _generated.css regenerated. 42 utility blocks now (was 50). Lookbook tokens preview: - The Text & foregrounds section dropped its split between text-* (canonical) and fg-* (legacy). Now a single section listing the five text-* utilities. The "(legacy)" framing is gone since there's no legacy left. README: - design/tokens/README.md's button-bg-ghost-hover edge-case example updated to reflect the new "bg-gray-800 text-inverse" dark value. Visual review needed in dark mode: - Anywhere icons use the application_helper#icon helper with color: "default" (most icons in the app). The default class moved from fg-gray (gray-400 dark) to text-secondary (gray-300 dark), so default-color icons render slightly lighter in dark mode. - DS::Buttonish icons in secondary buttons (same shade shift). - DS::Link icons (same). - Time series chart axes (same). - All tooltips, account add flow, settings hostings buttons, invitations, AI consent, family export, danger-zone buttons -- these used fg-inverse, which is identical to text-inverse, so no visual change expected. * fix(design-system): use inverse pair on tooltips for readable dark mode * fix(lookbook): use semantic tokens in menu preview header text * fix(lookbook): set text-primary on layout body so previews inherit theme * fix(design-system): keep shadows dark-toned in dark mode Inverting shadows to white|8% on dark surfaces produces a halo effect rather than an elevation cue, and stacks redundantly with the alpha-white 1px ring already in shadow-border-*. Switch dark-mode shadows to black at progressively higher alpha (25%/30%/35%/40%/50% for xs..xl) so they read as actual cast shadows on near-black surfaces. Surface-tint differences and the existing alpha-white border ring continue to handle elevation hierarchy and edge definition. Approach matches Material 3, Apple HIG, IBM Carbon, Refactoring UI, and the dark-mode shadows used in Linear/Vercel/Stripe. * fix(design-system): set text-primary on DS::Dialog element Browser UA stylesheets apply color: black directly to <dialog>, which overrides ancestor inheritance even when a body or html ancestor sets a theme-aware color. Unstyled child content then renders black regardless of theme. Setting text-primary on the dialog element itself defeats the UA override and lets descendants inherit the semantic token. * fix(lookbook): use shadow css vars in effects preview so dark theme renders * Revert "fix(design-system): keep shadows dark-toned in dark mode" This reverts commit 3e9d76ed0b. * fix(design-system): use opacity-70 instead of text-inverse/70 in value tooltip The custom @utility text-inverse expands to @apply text-white and isn't modifier-aware, so text-inverse/70 produced no CSS at all and the muted labels fell through to inherited color (invisible on the white pill in dark mode). Replace with text-inverse + opacity-70. Same visual effect, works with the existing utility definition.	2026-05-04 00:50:52 +02:00
ghost	9cb3b8e05c	feat(api): expose rule run history (#1646) ... * feat(api): expose rule run history * fix(api): address rule run review * fix(api): complete rule run review * test(api): cover unauthenticated rule run show * test(api): align rule run api key helper * Small Sonnet nit-pick --------- Co-authored-by: Juan José Mata <jjmata@jjmata.com>	2026-05-03 23:33:35 +02:00
ghost	e93b1f1fd7	feat(api): expose family settings (#1645) ... * feat(api): expose family settings * test(api): assert family settings moniker * test(api): align family settings api key helper * fix(api): tighten family settings schema	2026-05-03 23:10:46 +02:00
ghost	911aa34ba9	feat(auth): add WebAuthn MFA credentials (#1628) ... * feat(auth): add WebAuthn MFA credentials * fix(auth): harden WebAuthn MFA review paths * fix(auth): polish WebAuthn error handling * fix(auth): handle duplicate WebAuthn credential races * fix(auth): permit WebAuthn credential params * fix(auth): trim WebAuthn registration controller cleanup * fix(auth): tighten WebAuthn MFA handling * fix(auth): pin WebAuthn relying party config	2026-05-03 22:13:28 +02:00
Michal Tajchert	ccd6a53071	fix(chat): eager pending AssistantMessage to fix Turbo subscribe race (#1657) (#1658) ... * fix(chat): persist eager pending assistant message to fix subscribe race When the LLM replies in ~1-2s the assistant message broadcast could fire before the client's Turbo stream subscription was established, leaving the UI stuck on the thinking indicator while the response was already persisted. Create the AssistantMessage as `pending` synchronously in `Chat#ask_assistant_later`, so it is rendered server-side on the chat show page with a "Thinking ..." inline placeholder. The worker then finds and updates the existing row via `append_text!`, which flips the status to `complete` and broadcasts updates against a DOM id that is already in the page — no race possible. On error, the placeholder is destroyed if no content streamed, otherwise demoted to `failed`. Replaces the standalone thinking indicator partial and the `Assistant::Broadcastable` thinking helpers, both now redundant. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(chat): bind each assistant job to its specific pending placeholder Addressing review feedback on #1658: 1. The pending placeholder lookup based on `last pending` was racy — back-to-back user messages would let one job fill another job's placeholder. Pass the placeholder through the job arguments (`AssistantResponseJob.perform_later(user_message, pending)`) so each turn is bound to its own row. 2. In `Assistant::External#respond_to`, the configured/authorized guards raise before the local was bound, leaving rescue cleanup with `nil` and the placeholder visible forever. Bind the parameter first so cleanup can destroy it on the misconfigured path. The kwarg defaults to nil so the API#retry path (`AssistantResponseJob.perform_later(new_message)`) and the model-level test calls continue to work — they fall back to an in-memory new message, restoring the original test count assertions. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(chat): i18n the pending assistant placeholder string Move the hardcoded "Thinking ..." indicator into the locale file per CLAUDE.md i18n guidelines. With i18n.fallbacks enabled, non-en locales fall back to English until translated. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add thinking label translations * Fix chat pending assistant expectations * Fix external assistant pending test lookup * Scope chat stream targets per chat * Update message broadcast target tests --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-03 20:33:29 +02:00
ghost	50936000e7	feat(api): expose family exports (#1632) ... * feat(api): expose family exports * fix(api): harden family export review paths * fix(api): tighten family export review paths * fix(api): reject invalid family export params * fix(api): address family export review * fix(api): share uuid guard for exports	2026-05-03 11:29:29 +02:00
ghost	6c84fc760e	fix(mercury): support named multiple API connections (#1627) ... * fix(mercury): support named multiple connections * fix(mercury): address multi-connection review feedback * fix(mercury): localize connection labels * fix(mercury): strip API tokens before provider calls * test(mercury): localize provider config assertions * fix(mercury): address multi-connection review * refactor(mercury): simplify connection selection failure	2026-05-03 10:56:31 +02:00
ghost	c4414c4fbb	feat(api): expose import status details (#1599) ... * feat(api): expose import status details * fix(api): reuse import status validation counts * fix(api): cache Sure import status reads * fix(imports): invalidate cached Sure import blobs * docs(api): split import status schemas * fix(api): refine import status detail contract	2026-05-01 22:59:32 +02:00
Guillem Arias Fauste	c429f20a77	chore(design-system): replace dead Bootstrap classes with Sure tokens (#1621) ... Sure uses Tailwind v4 with the design system tokens but several views still carried Bootstrap-style class names that don't render anything because no Bootstrap stylesheet is loaded. They're effectively dead markup. Replacements: - text-muted, text-muted-foreground -> text-subdued - bg-light -> bg-surface - font-italic -> italic - text-uppercase -> uppercase - font-weight-bold -> font-bold Touched files: - app/views/doorkeeper/applications/_form.html.erb - app/views/doorkeeper/applications/show.html.erb - app/views/pages/privacy.html.erb - app/views/pages/terms.html.erb - app/views/pages/redis_configuration_error.html.erb - app/views/settings/providers/_mercury_panel.html.erb Also tightening application.css: - The .hw-combobox__label rule used raw text-gray-500 / text-gray-400 via @apply. Now uses the text-secondary / text-subdued tokens so the combobox label responds to the theme. - Custom scrollbar thumbs in .windows and .scrollbar used hardcoded #d6d6d6 / #a6a6a6 hex values. Now reference var(--color-gray-300) / var(--color-gray-400). Slight color shift (the hex values were close to but not identical to those tokens), so this needs a quick visual check. And reports/print.html.erb had four <span style="color: #666"> elements on the metric cards. Replaced with class="text-secondary" merged into the existing tufte-metric-card-change class, so print uses the same secondary-text color the rest of the app uses.	2026-05-01 22:10:46 +02:00
ghost	b710b55124	feat(api): add recurring transaction endpoints (#1600) ... * feat(api): add recurring transaction endpoints * fix(api): return validation errors for recurring writes * fix(api): harden recurring transaction request handling * fix(api): require writable recurring account access * fix(api): default null recurring manual flag * fix(api): tighten recurring transaction contracts * test(api): align recurring transaction fixtures * docs(api): regenerate recurring transaction OpenAPI	2026-05-01 21:21:34 +02:00
ghost	783309188f	feat(api): expose rule export endpoints (#1602) ... * feat(api): expose rule export endpoints * fix(api): tighten rule export contracts * fix(api): document balance sheet auth errors * test(api): align rule API key fixtures * Update docs/api/openapi.yaml Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Juan José Mata <jjmata@jjmata.com> * Quick win Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Juan José Mata <jjmata@jjmata.com> --------- Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Signed-off-by: Juan José Mata <jjmata@jjmata.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Juan José Mata <jjmata@jjmata.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>	2026-05-01 19:47:06 +02:00
ghost	352c301e4b	feat(api): expose valuation history index (#1596) ... * feat(api): expose valuation history index * fix(api): hide valuation exception details * fix(api): reuse eager-loaded valuation entries * fix(api): tighten valuation index contracts * fix(api): scope valuation filter errors * docs(api): nest valuation account filter format * Fix merge conflict mistakes --------- Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Juan José Mata <jjmata@jjmata.com>	2026-05-01 19:09:56 +02:00
ghost	cc043b5caf	feat(api): expose complete account export state (#1597) ... * feat(api): expose complete account export state * fix(api): handle malformed account identifiers * fix(api): tighten account export contracts * fix(api): correct account id OpenAPI format * fix(api): tighten account docs auth contracts * docs(api): document balance sheet auth errors * docs(api): clarify account scope fixture	2026-05-01 15:22:28 +02:00
maverick	ee352dada4	Added ability to bulk-edit transaction names for multiple selected transactions (#1553) ... * Added ability to bulk-edit transaction names for multiple selected transactions. * Added ability to bulk-edit transaction names for multiple selected transactions. * Added ability to bulk-edit transaction names for multiple selected transactions. * Lint, minimize changes --------- Co-authored-by: Juan José Mata <jjmata@jjmata.com>	2026-04-29 18:35:00 +02:00
Xing Hong	475dbbfb8d	fix: Enable and persist notes and tags on split child transactions (#1535) (#1552) ... * fix: enable and persist notes on split child transactions (#1535) * fix: enable tags on split child transactions and new tests for split child notes + tags * Update app/components/DS/dialog_controller.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Xing Hong <39619359+xingxing21@users.noreply.github.com> * fix(transactions): only stream notes frame when notes params are submitted * fix(transactions): address PR review issues in notes stream and tests --------- Signed-off-by: Xing Hong <39619359+xingxing21@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2026-04-29 18:17:36 +02:00
Juan José Mata	d49250826b	Improve error handling with user-friendly messages and classification (#1591) ... * Improve chat LLM error messages * Fix chat visibility regression in tests * Harden chat error handling for review feedback * Fix rubocop private method indentation * Fix nil presentable_error_message, i18n strings, bare rescue - Guard `presentable_error_message` with `return nil if error.blank?` so chats with no error return nil instead of the fallback string; this prevents the API serialisers from emitting a spurious error message and stops the mobile polling guard from firing on every successful chat - Move all hardcoded user-facing error strings into config/locales/models/chat/en.yml and reference them via I18n.t() - Replace bare `rescue` in `error_message_for` with `rescue StandardError` to avoid swallowing system-level exceptions - Update tests to reference I18n keys instead of raw strings, and add tests for the nil-error case and the unrecognized-error fallback https://claude.ai/code/session_01YFMjEds5WVyKPL42xBqMCX --------- Co-authored-by: SureBot <sure-bot@we-promise.com> Co-authored-by: Claude <noreply@anthropic.com>	2026-04-29 17:51:06 +02:00
Brian Richard	162caf0e9f	fix(localization): update API usage instructions to include product name placeholder (#1555) ... * fix(localization): update API usage instructions to include product name placeholder * Fix: Update show and created views to use dynamic usage_instructions per CodeRabbit * fix: update usage instructions translation key for API key usage	2026-04-26 09:29:23 +02:00
Juan José Mata	6fa3be7d87	Trim message length	2026-04-22 10:10:18 +02:00
Roger Saner	b3c88e09f3	Feature: remember value of chart period selector (#1528) ... * feat: remember chart period by last selection not user preferences * feat: schema update * fix: revert unnecessary parts of schema.rb update * fix: check period key is valid before setting it * revert: no database changes and keep the UI setting * refactor: don't store the default period in the session, just use the user * fix: migration The migration uses the User model directly, which loads all current enums including ui_layout which doesn't exist yet at that point in migration history. Fix it with raw SQL. * revert: not relevant to this PR	2026-04-21 19:02:41 +02:00
Alessio Cappa	30481fbc07	fix: create new partial for tabs rendering. Address mobile UI issues. (#1534)	2026-04-21 12:43:37 +02:00
Roger Saner	1297078f7e	Feature: improve transfer matcher UI copy (#1526) ... * refactor: improve UI copy for transaction matcher drawer * refactor: transfer matcher UI copy * fix: improvement * feat: use i18n	2026-04-20 08:17:38 +02:00
Copilot	3199c9b76d	Prevent long category labels from overflowing or crowding adjacent controls (#1498) ... * Initial plan * Fix category delete dialog dropdown overflow Agent-Logs-Url: https://github.com/we-promise/sure/sessions/200da7a4-fd59-4ae4-a709-f631ccf21e8c Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com> * Tighten category deletion regression test Agent-Logs-Url: https://github.com/we-promise/sure/sessions/200da7a4-fd59-4ae4-a709-f631ccf21e8c Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com> * Fix deletion button text overflow Agent-Logs-Url: https://github.com/we-promise/sure/sessions/e802e01f-079e-4322-ba03-b222ab5d4b84 Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com> * Preserve category menu spacing on mobile Agent-Logs-Url: https://github.com/we-promise/sure/sessions/74b5dd1e-7935-4356-806a-759bff911930 Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com> * Prevent account activity label overlap on mobile Agent-Logs-Url: https://github.com/we-promise/sure/sessions/e94027d6-e230-44c8-99a1-6e5645bec82b Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com> * Fix wide account activity category overflow Agent-Logs-Url: https://github.com/we-promise/sure/sessions/4ad79894-2935-47a3-8d37-037e2bd14376 Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com> * Linter * Fix flaky system tests in CI Agent-Logs-Url: https://github.com/we-promise/sure/sessions/3507447f-363f-4759-807c-c62a2858d270 Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com> * Reset system test viewport between tests Agent-Logs-Url: https://github.com/we-promise/sure/sessions/357a43b1-11c5-49be-972d-0592a37d97b1 Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com>	2026-04-19 18:40:50 +02:00
Copilot	cb842d0d9b	Close privacy mode gaps on accounts, budget editing, and account activity (#1495) ... * Initial plan * Hide missed values in privacy mode Agent-Logs-Url: https://github.com/we-promise/sure/sessions/ba225f77-fcf1-4d79-8f89-da446e77fab6 Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com> * Tighten privacy mode test coverage Agent-Logs-Url: https://github.com/we-promise/sure/sessions/ba225f77-fcf1-4d79-8f89-da446e77fab6 Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com> * Polish privacy mode assertions Agent-Logs-Url: https://github.com/we-promise/sure/sessions/ba225f77-fcf1-4d79-8f89-da446e77fab6 Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com> * Refine privacy mode tests Agent-Logs-Url: https://github.com/we-promise/sure/sessions/ba225f77-fcf1-4d79-8f89-da446e77fab6 Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com> * Restore budget privacy mode form interactivity Agent-Logs-Url: https://github.com/we-promise/sure/sessions/f3c51447-290c-421f-9cad-e8ff88c91d2f Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: jjmata <187772+jjmata@users.noreply.github.com>	2026-04-19 18:12:03 +02:00
Sophtron Rocky	b32e9dbc45	Add Sophtron Provider (#596) ... * Add Sophtron Provider * fix syncer test issue * fix schema wrong merge * sync #588 * sync code for #588 * fixed a view issue * modified by comment * modified * modifed * modified * modified * fixed a schema issue * use global subtypes * add some locales * fix a safe_return_to_path * fix exposing raw exception messages issue * fix a merged issue * update schema.rb * fix a schema issue * fix some issue * Update bank sync controller to reflect beta status Signed-off-by: Juan José Mata <jjmata@jjmata.com> * Rename settings section title to 'Sophtron (alpha)' Signed-off-by: Juan José Mata <jjmata@jjmata.com> * Consistency in alpha/beta for Sophtron * Good PR suggestions from CodeRabbit --------- Signed-off-by: soky srm <sokysrm@gmail.com> Signed-off-by: Sophtron Rocky <rocky@sophtron.com> Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Signed-off-by: Juan José Mata <jjmata@jjmata.com> Co-authored-by: soky srm <sokysrm@gmail.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Juan José Mata <jjmata@jjmata.com>	2026-04-19 11:16:04 +02:00
LPW	0a96bf199d	SimpleFIN: setup UX + same-provider relink + card-replacement detection (#1493) ... * SimpleFIN: setup UX + same-provider relink + card-replacement detection Fixes three bugs and adds auto-detection for credit-card fraud replacement. Bugs: - Importer: per-institution auth errors no longer flip the whole item to requires_update. Partial errors stay on sync_stats so other institutions keep syncing. - Setup page: new activity badges (recent / dormant / empty / likely-closed) via SimplefinAccount::ActivitySummary. Likely-closed (dormant + near-zero balance + prior history) defaults to "skip" in the type picker. - Relink: link_existing_account allows SimpleFIN to SimpleFIN swaps by atomically detaching the old AccountProvider inside a transaction. Adds "Change SimpleFIN account" menu item on linked-account dropdowns. Feature (credit-card scope only): - SimplefinItem::ReplacementDetector runs post-sync. Pairs a linked dormant zero-balance sfa with an unlinked active sfa at the same institution and account type. Persists suggestions on Sync#sync_stats. - Inline banner on the SimpleFIN item card prompts relink via CustomConfirm. Per-pair dismiss button scoped to the current sync (resurfaces on next sync if still applicable). Auto-suppresses once the relink has landed. Dev tooling: - bin/rails simplefin:seed_fraud_scenario[email] creates a realistic broken pair for manual QA; cleanup_fraud_scenario reverses it. * Address review feedback on #1493 - ReplacementDetector: symmetric one-to-one matching. Two dormant cards pointing at the same active card are now both skipped — previously the detector could emit two suggestions that would clobber each other if the user accepted both. - ReplacementDetector: require non-blank institution names on both sides before matching. Blank-vs-blank was accidentally treated as equal, risking cross-provider false matches when SimpleFIN omitted org_data. - ActivitySummary: fall back to "posted" when "transacted_at" is 0 (SimpleFIN's "unknown" sentinel). Integer 0 is truthy in Ruby, so the previous `|| fallback` short-circuited and ignored posted. - Controller: dismiss key is now the (dormant, active) pair so dismissing one candidate for a dormant card doesn't suppress others. - Helper test: freeze time around "6.hours.ago" and "5.days.ago" assertions so they don't flake when the suite runs before 06:00. * Address second review pass on #1493 - ReplacementDetector: canonicalize account_type in one place so filtering (supported_type?) and matching (type_matches?) agree on "credit card" vs "credit_card" variants. - ReplacementDetector: skip candidates with nil current_balance. nil is "unknown," not "zero" — previously fell back to 0 and passed the near- zero gate, allowing suggestions without balance evidence.	2026-04-18 09:50:34 +02:00
Ang Wei Feng (Ted)	c46aa09607	feat(settings): improve currency preferences UI (#1483) ... * feat(settings): improve currency preferences UI * fix: remove redundant keydown action from currency search input * fix(settings): localize currency count pluralization in dialog * feat: update selected count handling with pluralization support	2026-04-18 00:06:08 +02:00