Files
sure/app/helpers/settings_helper.rb
Max Barbare 51c93649da feat(snaptrade): replace device-flow OAuth with authorization-code + PKCE flow (#2747)
* feat(snaptrade): replace device-flow OAuth with authorization-code + PKCE flow

Squashed from 16 commits on snaptrade-oauth-apps for a clean rebase onto
current upstream/main ahead of opening a PR.

* fix(snaptrade): address PR #2747 review feedback on OAuth PKCE flow

- Remove unreachable dead-code guard in import_latest_snaptrade_data
- Guard apply_oauth_tokens! against a malformed payload missing access_token
- Wrap token endpoint network errors in ApiError and retry like data calls
- Remove unused Provider::Snaptrade#revoke_token! instance method
- Preserve return_to/accountable_type through the SnapTrade portal callback
  so the account-linking flow no longer drops users back to accounts_path
- Show the real absolute OAuth callback URL in self-hosted setup instructions
- Refresh brakeman.ignore fingerprint for the connect redirect after the
  return_to/accountable_type params were added

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y8SCCmKX6RphB5E73WSUQQ

* fix(snaptrade): don't retry non-idempotent OAuth/API requests

CodeRabbit flagged that Provider::Snaptrade retried OAuth token
exchanges/refreshes and all API POST/DELETE calls (get_connection_url,
delete_connection) after timeouts/connection failures. If the response
is lost after SnapTrade already consumed a single-use auth code,
rotated the refresh token, or applied a POST/DELETE, replaying the
request either fails with invalid_grant on a token that actually
succeeded, or risks duplicate side effects. Retries are now limited to
GET requests; OAuth token requests and non-GET API calls translate a
network failure straight into an ApiError without replay.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NrrGkgSBEqhjjBmmH1fcXL

* fix(snaptrade): stop querying non-deterministically encrypted token via empty-string compare

CodeRabbit flagged that the syncable scope's where.not(oauth_access_token:
[nil, ""]) re-encrypts "" with a random IV on every query, so the ""
comparison can never match a stored ciphertext and is a silent no-op.
No code path ever persists oauth_access_token as "" (only nil or a real
token via apply_oauth_tokens!), so the exclusion is unnecessary --
narrowed the scope to a plain NULL check, which encryption handles
transparently since nil is never encrypted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NrrGkgSBEqhjjBmmH1fcXL

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-24 22:45:44 +02:00

264 lines
11 KiB
Ruby

module SettingsHelper
SETTINGS_ORDER = [
# General section
{ name: -> { t("settings.settings_nav.accounts_label") }, path: :accounts_path },
{ name: -> { t("settings.settings_nav.bank_sync_label") }, path: :settings_providers_path, condition: :admin_user? },
{ name: -> { t("settings.settings_nav.preferences_label") }, path: :settings_preferences_path },
{ name: -> { t("settings.settings_nav.appearance_label") }, path: :settings_appearance_path },
{ name: -> { t("settings.settings_nav.profile_label") }, path: :settings_profile_path },
{ name: -> { t("settings.settings_nav.security_label") }, path: :settings_security_path },
{ name: -> { t("settings.settings_nav.payment_label") }, path: :settings_payment_path, condition: :not_self_hosted? },
# Transactions section
{ name: -> { t("settings.settings_nav.categories_label") }, path: :categories_path },
{ name: -> { t("settings.settings_nav.tags_label") }, path: :tags_path },
{ name: -> { t("settings.settings_nav.rules_label") }, path: :rules_path },
{ name: -> { t("settings.settings_nav.merchants_label") }, path: :family_merchants_path },
{ name: -> { t("settings.settings_nav.recurring_transactions_label") }, path: :recurring_transactions_path },
{ name: -> { t("settings.settings_nav.statement_vault_label") }, path: :account_statements_path, condition: :admin_user? },
# Advanced section
{ name: -> { t("settings.settings_nav.ai_prompts_label") }, path: :settings_ai_prompts_path, condition: :admin_user? },
{ name: -> { t("settings.settings_nav.llm_usage_label") }, path: :settings_llm_usage_path, condition: :admin_user? },
{ name: -> { t("settings.settings_nav.api_key_label") }, path: :settings_api_keys_path, condition: :admin_user? },
{ name: -> { t("settings.settings_nav.self_hosting_label") }, path: :settings_hosting_path, condition: :self_hosted_and_admin? },
{ name: -> { t("settings.settings_nav.imports_label") }, path: :imports_path, condition: :admin_user? },
{ name: -> { t("settings.settings_nav.exports_label") }, path: :family_exports_path, condition: :admin_user? },
# More section
{ name: -> { t("settings.settings_nav.guides_label") }, path: :settings_guides_path },
{ name: -> { t("settings.settings_nav.whats_new_label") }, path: :changelog_path },
{ name: -> { t("settings.settings_nav.feedback_label") }, path: :feedback_path }
]
def adjacent_setting(current_path, offset)
visible_settings = SETTINGS_ORDER.select { |setting| setting[:condition].nil? || send(setting[:condition]) }
current_index = visible_settings.index { |setting| send(setting[:path]) == current_path }
return nil unless current_index
adjacent_index = current_index + offset
return nil if adjacent_index < 0 || adjacent_index >= visible_settings.size
adjacent = visible_settings[adjacent_index]
render partial: "settings/settings_nav_link_large", locals: {
path: send(adjacent[:path]),
direction: offset > 0 ? "next" : "previous",
title: setting_name(adjacent)
}
end
def settings_section(title: nil, subtitle: nil, collapsible: false, open: true, auto_open_param: nil, status: nil, meta: nil, actions: nil, badge: nil, &block)
content = capture(&block)
render partial: "settings/section", locals: { title: title, subtitle: subtitle, content: content, collapsible: collapsible, open: open, auto_open_param: auto_open_param, status: status, meta: meta, actions: actions, badge: badge }
end
def provider_summary(provider_key)
key = provider_key.to_s.downcase
case key
when "plaid", "plaid_eu"
configured = @provider_configurations&.find { |c| c.provider_key.to_s.casecmp(key).zero? }&.configured?
configured ? { status: :ok } : { status: :off }
when "akahu"
return { status: :off } unless @akahu_items&.any?
sync_based_summary(key)
when "up"
return { status: :off } unless @up_items&.any?
sync_based_summary(key)
when "simplefin"
return { status: :off } unless @simplefin_items&.any?
sync_based_summary(key)
when "lunchflow"
return { status: :off } unless @lunchflow_items&.any?
sync_based_summary(key)
when "enable_banking"
return { status: :off } unless @enable_banking_items&.any?
enable_banking_summary
when "coinstats"
return { status: :off } unless @coinstats_items&.any?
sync_based_summary(key)
when "mercury"
return { status: :off } unless @mercury_items&.any?
sync_based_summary(key)
when "brex"
return { status: :off } unless @brex_items&.any?
sync_based_summary(key)
when "coinbase"
return { status: :off } unless @coinbase_items&.any?
sync_based_summary(key)
when "binance"
return { status: :off } unless @binance_items&.any?
sync_based_summary(key)
when "kraken"
return { status: :off } unless @kraken_items&.any?
sync_based_summary(key)
when "snaptrade"
configured_item = @snaptrade_items&.find(&:oauth_configured?)
return { status: :off } unless configured_item
sync_based_summary(key)
when "ibkr"
return { status: :off } unless @ibkr_items&.any?
sync_based_summary(key)
when "indexa_capital"
return { status: :off } unless @indexa_capital_items&.any?
sync_based_summary(key)
when "sophtron"
return { status: :off } unless @sophtron_items&.any?
sync_based_summary(key)
when "questrade"
return { status: :off } unless @questrade_items&.any?
sync_based_summary(key)
else
{ status: :off }
end
end
def settings_nav_footer
previous_setting = adjacent_setting(request.path, -1)
next_setting = adjacent_setting(request.path, 1)
content_tag :div, class: "hidden md:flex flex-row justify-between gap-4" do
concat(previous_setting)
concat(next_setting)
end
end
def settings_nav_footer_mobile
previous_setting = adjacent_setting(request.path, -1)
next_setting = adjacent_setting(request.path, 1)
content_tag :div, class: "md:hidden flex flex-col gap-4 pb-[env(safe-area-inset-bottom)]" do
concat(previous_setting)
concat(next_setting)
end
end
def yahoo_finance_health_presentation(status)
status = status.to_sym if status.respond_to?(:to_sym)
status = :unknown unless %i[healthy rate_limited unavailable unknown].include?(status)
presentation = {
status_class: {
healthy: "bg-success",
rate_limited: "bg-warning",
unavailable: "bg-destructive",
unknown: "bg-surface-inset"
}.fetch(status),
status_text: t("settings.hostings.yahoo_finance_settings.status_#{status}")
}
presentation[:alert] = case status
when :rate_limited
{
title: t("settings.hostings.yahoo_finance_settings.rate_limited_title"),
message: t("settings.hostings.yahoo_finance_settings.rate_limited_message"),
variant: :warning
}
when :unavailable
{
title: t("settings.hostings.yahoo_finance_settings.unavailable_title"),
message: t("settings.hostings.yahoo_finance_settings.unavailable_message"),
variant: :warning
}
end
presentation
end
# Below this many synced accounts, the per-row pills already give the user
# enough at-a-glance signal and the strip is redundant chrome.
HEALTH_STRIP_MIN_ACCOUNTS = 10
# Slim health-strip data for the providers index. Pulls counts from the
# already-resolved entry summaries plus the family's distinct synced-account
# count for the trailing stat. Returns a hash consumed by the
# `settings/providers/_health_strip` partial, or nil when the family has
# fewer than HEALTH_STRIP_MIN_ACCOUNTS connected accounts.
def provider_health_strip(connected:, needs_attention:)
accounts_count = Current.family.accounts.joins(:account_providers).distinct.count
return nil if accounts_count < HEALTH_STRIP_MIN_ACCOUNTS
active_entries = connected + needs_attention
last_synced_at = active_entries.map { |e| e[:summary][:last_synced_at] }.compact.max
{
connected: active_entries.size,
needs_attention: needs_attention.size,
accounts_syncing: accounts_count,
last_synced_at: last_synced_at
}
end
# Strips the leading "about " from `time_ago_in_words` so copy reads as
# "Synced 6 hours ago" instead of "Synced about 6 hours ago".
def concise_time_ago(time)
time_ago_in_words(time).sub(/\Aabout /, "")
end
private
def sync_based_summary(provider_key)
health = @provider_sync_health&.dig(provider_key) || {}
last_synced_at = health[:last_synced_at]
base = if health[:error]
{ status: :err, meta: t("settings.providers.meta.sync_error") }
elsif health[:stale]
{ status: :warn, meta: t("settings.providers.meta.no_recent_sync") }
elsif last_synced_at.present?
{ status: :ok, meta: t("settings.providers.meta.last_synced", time: concise_time_ago(last_synced_at)) }
else
{ status: :ok }
end
base.merge(last_synced_at: last_synced_at)
end
def enable_banking_summary
health = @provider_sync_health&.dig("enable_banking") || {}
last_synced_at = health[:last_synced_at]
return { status: :err, meta: t("settings.providers.meta.sync_error"), last_synced_at: nil } if health[:error]
valid_items = @enable_banking_items&.select(&:session_valid?) || []
# All items have expired/missing sessions — need re-authorization
if valid_items.empty?
return { status: :warn, meta: t("settings.providers.meta.reconsent_required"), last_synced_at: last_synced_at }
end
expiring = valid_items.find do |item|
item.session_expires_at.present? && item.session_expires_at < 7.days.from_now
end
if expiring
days = [ ((expiring.session_expires_at - Time.current) / 1.day).ceil, 1 ].max
return { status: :warn, meta: t("settings.providers.meta.reconsent_needed", count: days), last_synced_at: last_synced_at }
end
return { status: :warn, meta: t("settings.providers.meta.no_recent_sync"), last_synced_at: last_synced_at } if health[:stale]
if last_synced_at.present?
{ status: :ok, meta: t("settings.providers.meta.last_synced", time: concise_time_ago(last_synced_at)), last_synced_at: last_synced_at }
else
{ status: :ok, last_synced_at: nil }
end
end
def not_self_hosted?
!self_hosted?
end
def setting_name(setting)
name = setting[:name]
name.respond_to?(:call) ? instance_exec(&name) : name
end
# Helper used by SETTINGS_ORDER conditions
def admin_user?
Current.user&.admin?
end
def self_hosted_and_admin?
self_hosted? && admin_user?
end
end