mirror of
https://github.com/we-promise/sure.git
synced 2026-07-28 04:32:12 +00:00
* feat(snaptrade): replace device-flow OAuth with authorization-code + PKCE flow Squashed from 16 commits on snaptrade-oauth-apps for a clean rebase onto current upstream/main ahead of opening a PR. * fix(snaptrade): address PR #2747 review feedback on OAuth PKCE flow - Remove unreachable dead-code guard in import_latest_snaptrade_data - Guard apply_oauth_tokens! against a malformed payload missing access_token - Wrap token endpoint network errors in ApiError and retry like data calls - Remove unused Provider::Snaptrade#revoke_token! instance method - Preserve return_to/accountable_type through the SnapTrade portal callback so the account-linking flow no longer drops users back to accounts_path - Show the real absolute OAuth callback URL in self-hosted setup instructions - Refresh brakeman.ignore fingerprint for the connect redirect after the return_to/accountable_type params were added Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y8SCCmKX6RphB5E73WSUQQ * fix(snaptrade): don't retry non-idempotent OAuth/API requests CodeRabbit flagged that Provider::Snaptrade retried OAuth token exchanges/refreshes and all API POST/DELETE calls (get_connection_url, delete_connection) after timeouts/connection failures. If the response is lost after SnapTrade already consumed a single-use auth code, rotated the refresh token, or applied a POST/DELETE, replaying the request either fails with invalid_grant on a token that actually succeeded, or risks duplicate side effects. Retries are now limited to GET requests; OAuth token requests and non-GET API calls translate a network failure straight into an ApiError without replay. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrrGkgSBEqhjjBmmH1fcXL * fix(snaptrade): stop querying non-deterministically encrypted token via empty-string compare CodeRabbit flagged that the syncable scope's where.not(oauth_access_token: [nil, ""]) re-encrypts "" with a random IV on every query, so the "" comparison can never match a stored ciphertext and is a silent no-op. No code path ever persists oauth_access_token as "" (only nil or a real token via apply_oauth_tokens!), so the exclusion is unnecessary -- narrowed the scope to a plain NULL check, which encryption handles transparently since nil is never encrypted. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrrGkgSBEqhjjBmmH1fcXL --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
264 lines
11 KiB
Ruby
264 lines
11 KiB
Ruby
module SettingsHelper
|
|
SETTINGS_ORDER = [
|
|
# General section
|
|
{ name: -> { t("settings.settings_nav.accounts_label") }, path: :accounts_path },
|
|
{ name: -> { t("settings.settings_nav.bank_sync_label") }, path: :settings_providers_path, condition: :admin_user? },
|
|
{ name: -> { t("settings.settings_nav.preferences_label") }, path: :settings_preferences_path },
|
|
{ name: -> { t("settings.settings_nav.appearance_label") }, path: :settings_appearance_path },
|
|
{ name: -> { t("settings.settings_nav.profile_label") }, path: :settings_profile_path },
|
|
{ name: -> { t("settings.settings_nav.security_label") }, path: :settings_security_path },
|
|
{ name: -> { t("settings.settings_nav.payment_label") }, path: :settings_payment_path, condition: :not_self_hosted? },
|
|
# Transactions section
|
|
{ name: -> { t("settings.settings_nav.categories_label") }, path: :categories_path },
|
|
{ name: -> { t("settings.settings_nav.tags_label") }, path: :tags_path },
|
|
{ name: -> { t("settings.settings_nav.rules_label") }, path: :rules_path },
|
|
{ name: -> { t("settings.settings_nav.merchants_label") }, path: :family_merchants_path },
|
|
{ name: -> { t("settings.settings_nav.recurring_transactions_label") }, path: :recurring_transactions_path },
|
|
{ name: -> { t("settings.settings_nav.statement_vault_label") }, path: :account_statements_path, condition: :admin_user? },
|
|
# Advanced section
|
|
{ name: -> { t("settings.settings_nav.ai_prompts_label") }, path: :settings_ai_prompts_path, condition: :admin_user? },
|
|
{ name: -> { t("settings.settings_nav.llm_usage_label") }, path: :settings_llm_usage_path, condition: :admin_user? },
|
|
{ name: -> { t("settings.settings_nav.api_key_label") }, path: :settings_api_keys_path, condition: :admin_user? },
|
|
{ name: -> { t("settings.settings_nav.self_hosting_label") }, path: :settings_hosting_path, condition: :self_hosted_and_admin? },
|
|
{ name: -> { t("settings.settings_nav.imports_label") }, path: :imports_path, condition: :admin_user? },
|
|
{ name: -> { t("settings.settings_nav.exports_label") }, path: :family_exports_path, condition: :admin_user? },
|
|
# More section
|
|
{ name: -> { t("settings.settings_nav.guides_label") }, path: :settings_guides_path },
|
|
{ name: -> { t("settings.settings_nav.whats_new_label") }, path: :changelog_path },
|
|
{ name: -> { t("settings.settings_nav.feedback_label") }, path: :feedback_path }
|
|
]
|
|
|
|
def adjacent_setting(current_path, offset)
|
|
visible_settings = SETTINGS_ORDER.select { |setting| setting[:condition].nil? || send(setting[:condition]) }
|
|
current_index = visible_settings.index { |setting| send(setting[:path]) == current_path }
|
|
return nil unless current_index
|
|
|
|
adjacent_index = current_index + offset
|
|
return nil if adjacent_index < 0 || adjacent_index >= visible_settings.size
|
|
|
|
adjacent = visible_settings[adjacent_index]
|
|
|
|
render partial: "settings/settings_nav_link_large", locals: {
|
|
path: send(adjacent[:path]),
|
|
direction: offset > 0 ? "next" : "previous",
|
|
title: setting_name(adjacent)
|
|
}
|
|
end
|
|
|
|
def settings_section(title: nil, subtitle: nil, collapsible: false, open: true, auto_open_param: nil, status: nil, meta: nil, actions: nil, badge: nil, &block)
|
|
content = capture(&block)
|
|
render partial: "settings/section", locals: { title: title, subtitle: subtitle, content: content, collapsible: collapsible, open: open, auto_open_param: auto_open_param, status: status, meta: meta, actions: actions, badge: badge }
|
|
end
|
|
|
|
def provider_summary(provider_key)
|
|
key = provider_key.to_s.downcase
|
|
|
|
case key
|
|
when "plaid", "plaid_eu"
|
|
configured = @provider_configurations&.find { |c| c.provider_key.to_s.casecmp(key).zero? }&.configured?
|
|
configured ? { status: :ok } : { status: :off }
|
|
when "akahu"
|
|
return { status: :off } unless @akahu_items&.any?
|
|
sync_based_summary(key)
|
|
when "up"
|
|
return { status: :off } unless @up_items&.any?
|
|
sync_based_summary(key)
|
|
when "simplefin"
|
|
return { status: :off } unless @simplefin_items&.any?
|
|
sync_based_summary(key)
|
|
when "lunchflow"
|
|
return { status: :off } unless @lunchflow_items&.any?
|
|
sync_based_summary(key)
|
|
when "enable_banking"
|
|
return { status: :off } unless @enable_banking_items&.any?
|
|
enable_banking_summary
|
|
when "coinstats"
|
|
return { status: :off } unless @coinstats_items&.any?
|
|
sync_based_summary(key)
|
|
when "mercury"
|
|
return { status: :off } unless @mercury_items&.any?
|
|
sync_based_summary(key)
|
|
when "brex"
|
|
return { status: :off } unless @brex_items&.any?
|
|
sync_based_summary(key)
|
|
when "coinbase"
|
|
return { status: :off } unless @coinbase_items&.any?
|
|
sync_based_summary(key)
|
|
when "binance"
|
|
return { status: :off } unless @binance_items&.any?
|
|
sync_based_summary(key)
|
|
when "kraken"
|
|
return { status: :off } unless @kraken_items&.any?
|
|
sync_based_summary(key)
|
|
when "snaptrade"
|
|
configured_item = @snaptrade_items&.find(&:oauth_configured?)
|
|
return { status: :off } unless configured_item
|
|
|
|
sync_based_summary(key)
|
|
when "ibkr"
|
|
return { status: :off } unless @ibkr_items&.any?
|
|
sync_based_summary(key)
|
|
when "indexa_capital"
|
|
return { status: :off } unless @indexa_capital_items&.any?
|
|
sync_based_summary(key)
|
|
when "sophtron"
|
|
return { status: :off } unless @sophtron_items&.any?
|
|
sync_based_summary(key)
|
|
when "questrade"
|
|
return { status: :off } unless @questrade_items&.any?
|
|
sync_based_summary(key)
|
|
else
|
|
{ status: :off }
|
|
end
|
|
end
|
|
|
|
def settings_nav_footer
|
|
previous_setting = adjacent_setting(request.path, -1)
|
|
next_setting = adjacent_setting(request.path, 1)
|
|
|
|
content_tag :div, class: "hidden md:flex flex-row justify-between gap-4" do
|
|
concat(previous_setting)
|
|
concat(next_setting)
|
|
end
|
|
end
|
|
|
|
def settings_nav_footer_mobile
|
|
previous_setting = adjacent_setting(request.path, -1)
|
|
next_setting = adjacent_setting(request.path, 1)
|
|
|
|
content_tag :div, class: "md:hidden flex flex-col gap-4 pb-[env(safe-area-inset-bottom)]" do
|
|
concat(previous_setting)
|
|
concat(next_setting)
|
|
end
|
|
end
|
|
|
|
def yahoo_finance_health_presentation(status)
|
|
status = status.to_sym if status.respond_to?(:to_sym)
|
|
status = :unknown unless %i[healthy rate_limited unavailable unknown].include?(status)
|
|
|
|
presentation = {
|
|
status_class: {
|
|
healthy: "bg-success",
|
|
rate_limited: "bg-warning",
|
|
unavailable: "bg-destructive",
|
|
unknown: "bg-surface-inset"
|
|
}.fetch(status),
|
|
status_text: t("settings.hostings.yahoo_finance_settings.status_#{status}")
|
|
}
|
|
|
|
presentation[:alert] = case status
|
|
when :rate_limited
|
|
{
|
|
title: t("settings.hostings.yahoo_finance_settings.rate_limited_title"),
|
|
message: t("settings.hostings.yahoo_finance_settings.rate_limited_message"),
|
|
variant: :warning
|
|
}
|
|
when :unavailable
|
|
{
|
|
title: t("settings.hostings.yahoo_finance_settings.unavailable_title"),
|
|
message: t("settings.hostings.yahoo_finance_settings.unavailable_message"),
|
|
variant: :warning
|
|
}
|
|
end
|
|
|
|
presentation
|
|
end
|
|
|
|
# Below this many synced accounts, the per-row pills already give the user
|
|
# enough at-a-glance signal and the strip is redundant chrome.
|
|
HEALTH_STRIP_MIN_ACCOUNTS = 10
|
|
|
|
# Slim health-strip data for the providers index. Pulls counts from the
|
|
# already-resolved entry summaries plus the family's distinct synced-account
|
|
# count for the trailing stat. Returns a hash consumed by the
|
|
# `settings/providers/_health_strip` partial, or nil when the family has
|
|
# fewer than HEALTH_STRIP_MIN_ACCOUNTS connected accounts.
|
|
def provider_health_strip(connected:, needs_attention:)
|
|
accounts_count = Current.family.accounts.joins(:account_providers).distinct.count
|
|
return nil if accounts_count < HEALTH_STRIP_MIN_ACCOUNTS
|
|
|
|
active_entries = connected + needs_attention
|
|
last_synced_at = active_entries.map { |e| e[:summary][:last_synced_at] }.compact.max
|
|
|
|
{
|
|
connected: active_entries.size,
|
|
needs_attention: needs_attention.size,
|
|
accounts_syncing: accounts_count,
|
|
last_synced_at: last_synced_at
|
|
}
|
|
end
|
|
|
|
# Strips the leading "about " from `time_ago_in_words` so copy reads as
|
|
# "Synced 6 hours ago" instead of "Synced about 6 hours ago".
|
|
def concise_time_ago(time)
|
|
time_ago_in_words(time).sub(/\Aabout /, "")
|
|
end
|
|
|
|
private
|
|
def sync_based_summary(provider_key)
|
|
health = @provider_sync_health&.dig(provider_key) || {}
|
|
last_synced_at = health[:last_synced_at]
|
|
|
|
base = if health[:error]
|
|
{ status: :err, meta: t("settings.providers.meta.sync_error") }
|
|
elsif health[:stale]
|
|
{ status: :warn, meta: t("settings.providers.meta.no_recent_sync") }
|
|
elsif last_synced_at.present?
|
|
{ status: :ok, meta: t("settings.providers.meta.last_synced", time: concise_time_ago(last_synced_at)) }
|
|
else
|
|
{ status: :ok }
|
|
end
|
|
|
|
base.merge(last_synced_at: last_synced_at)
|
|
end
|
|
|
|
def enable_banking_summary
|
|
health = @provider_sync_health&.dig("enable_banking") || {}
|
|
last_synced_at = health[:last_synced_at]
|
|
|
|
return { status: :err, meta: t("settings.providers.meta.sync_error"), last_synced_at: nil } if health[:error]
|
|
|
|
valid_items = @enable_banking_items&.select(&:session_valid?) || []
|
|
|
|
# All items have expired/missing sessions — need re-authorization
|
|
if valid_items.empty?
|
|
return { status: :warn, meta: t("settings.providers.meta.reconsent_required"), last_synced_at: last_synced_at }
|
|
end
|
|
|
|
expiring = valid_items.find do |item|
|
|
item.session_expires_at.present? && item.session_expires_at < 7.days.from_now
|
|
end
|
|
|
|
if expiring
|
|
days = [ ((expiring.session_expires_at - Time.current) / 1.day).ceil, 1 ].max
|
|
return { status: :warn, meta: t("settings.providers.meta.reconsent_needed", count: days), last_synced_at: last_synced_at }
|
|
end
|
|
|
|
return { status: :warn, meta: t("settings.providers.meta.no_recent_sync"), last_synced_at: last_synced_at } if health[:stale]
|
|
|
|
if last_synced_at.present?
|
|
{ status: :ok, meta: t("settings.providers.meta.last_synced", time: concise_time_ago(last_synced_at)), last_synced_at: last_synced_at }
|
|
else
|
|
{ status: :ok, last_synced_at: nil }
|
|
end
|
|
end
|
|
|
|
def not_self_hosted?
|
|
!self_hosted?
|
|
end
|
|
|
|
def setting_name(setting)
|
|
name = setting[:name]
|
|
name.respond_to?(:call) ? instance_exec(&name) : name
|
|
end
|
|
|
|
# Helper used by SETTINGS_ORDER conditions
|
|
def admin_user?
|
|
Current.user&.admin?
|
|
end
|
|
|
|
def self_hosted_and_admin?
|
|
self_hosted? && admin_user?
|
|
end
|
|
end
|