Files
sure/test/models/snaptrade_item_test.rb
Max Barbare 51c93649da feat(snaptrade): replace device-flow OAuth with authorization-code + PKCE flow (#2747)
* feat(snaptrade): replace device-flow OAuth with authorization-code + PKCE flow

Squashed from 16 commits on snaptrade-oauth-apps for a clean rebase onto
current upstream/main ahead of opening a PR.

* fix(snaptrade): address PR #2747 review feedback on OAuth PKCE flow

- Remove unreachable dead-code guard in import_latest_snaptrade_data
- Guard apply_oauth_tokens! against a malformed payload missing access_token
- Wrap token endpoint network errors in ApiError and retry like data calls
- Remove unused Provider::Snaptrade#revoke_token! instance method
- Preserve return_to/accountable_type through the SnapTrade portal callback
  so the account-linking flow no longer drops users back to accounts_path
- Show the real absolute OAuth callback URL in self-hosted setup instructions
- Refresh brakeman.ignore fingerprint for the connect redirect after the
  return_to/accountable_type params were added

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y8SCCmKX6RphB5E73WSUQQ

* fix(snaptrade): don't retry non-idempotent OAuth/API requests

CodeRabbit flagged that Provider::Snaptrade retried OAuth token
exchanges/refreshes and all API POST/DELETE calls (get_connection_url,
delete_connection) after timeouts/connection failures. If the response
is lost after SnapTrade already consumed a single-use auth code,
rotated the refresh token, or applied a POST/DELETE, replaying the
request either fails with invalid_grant on a token that actually
succeeded, or risks duplicate side effects. Retries are now limited to
GET requests; OAuth token requests and non-GET API calls translate a
network failure straight into an ApiError without replay.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NrrGkgSBEqhjjBmmH1fcXL

* fix(snaptrade): stop querying non-deterministically encrypted token via empty-string compare

CodeRabbit flagged that the syncable scope's where.not(oauth_access_token:
[nil, ""]) re-encrypts "" with a random IV on every query, so the ""
comparison can never match a stored ciphertext and is a silent no-op.
No code path ever persists oauth_access_token as "" (only nil or a real
token via apply_oauth_tokens!), so the exclusion is unnecessary --
narrowed the scope to a plain NULL check, which encryption handles
transparently since nil is never encrypted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NrrGkgSBEqhjjBmmH1fcXL

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-24 22:45:44 +02:00

44 lines
1.3 KiB
Ruby

require "test_helper"
class SnaptradeItemTest < ActiveSupport::TestCase
setup do
@family = families(:dylan_family)
end
test "validates presence of name" do
item = SnaptradeItem.new(family: @family)
assert_not item.valid?
assert_includes item.errors[:name], "can't be blank"
end
test "allows oauth-only items without api credentials" do
item = SnaptradeItem.new(family: @family, name: "Test")
assert item.valid?
end
test "snaptrade_provider returns nil when oauth token not present" do
item = SnaptradeItem.new(family: @family, name: "Test")
assert_nil item.snaptrade_provider
end
test "snaptrade_provider returns provider instance when oauth token present" do
item = SnaptradeItem.new(
family: @family,
name: "Test",
oauth_access_token: "test-access-token"
)
provider = item.snaptrade_provider
assert_instance_of Provider::Snaptrade, provider
end
test "credentials_configured? mirrors oauth_configured?" do
item = SnaptradeItem.new(family: @family, name: "Test")
assert_equal item.oauth_configured?, item.credentials_configured?
assert_not item.credentials_configured?
item.oauth_access_token = "test-access-token"
assert_equal item.oauth_configured?, item.credentials_configured?
assert item.credentials_configured?
end
end