mirror of
https://github.com/we-promise/sure.git
synced 2026-09-05 14:51:15 +00:00
* feat(snaptrade): replace device-flow OAuth with authorization-code + PKCE flow Squashed from 16 commits on snaptrade-oauth-apps for a clean rebase onto current upstream/main ahead of opening a PR. * fix(snaptrade): address PR #2747 review feedback on OAuth PKCE flow - Remove unreachable dead-code guard in import_latest_snaptrade_data - Guard apply_oauth_tokens! against a malformed payload missing access_token - Wrap token endpoint network errors in ApiError and retry like data calls - Remove unused Provider::Snaptrade#revoke_token! instance method - Preserve return_to/accountable_type through the SnapTrade portal callback so the account-linking flow no longer drops users back to accounts_path - Show the real absolute OAuth callback URL in self-hosted setup instructions - Refresh brakeman.ignore fingerprint for the connect redirect after the return_to/accountable_type params were added Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y8SCCmKX6RphB5E73WSUQQ * fix(snaptrade): don't retry non-idempotent OAuth/API requests CodeRabbit flagged that Provider::Snaptrade retried OAuth token exchanges/refreshes and all API POST/DELETE calls (get_connection_url, delete_connection) after timeouts/connection failures. If the response is lost after SnapTrade already consumed a single-use auth code, rotated the refresh token, or applied a POST/DELETE, replaying the request either fails with invalid_grant on a token that actually succeeded, or risks duplicate side effects. Retries are now limited to GET requests; OAuth token requests and non-GET API calls translate a network failure straight into an ApiError without replay. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrrGkgSBEqhjjBmmH1fcXL * fix(snaptrade): stop querying non-deterministically encrypted token via empty-string compare CodeRabbit flagged that the syncable scope's where.not(oauth_access_token: [nil, ""]) re-encrypts "" with a random IV on every query, so the "" comparison can never match a stored ciphertext and is a silent no-op. No code path ever persists oauth_access_token as "" (only nil or a real token via apply_oauth_tokens!), so the exclusion is unnecessary -- narrowed the scope to a plain NULL check, which encryption handles transparently since nil is never encrypted. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrrGkgSBEqhjjBmmH1fcXL --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
94 lines
4.0 KiB
ERB
94 lines
4.0 KiB
ERB
<div class="space-y-4">
|
|
<%= render DS::Alert.new(message: t("providers.snaptrade.free_tier_warning"), variant: :warning) %>
|
|
|
|
<% error_msg = local_assigns[:error_message] || @error_message %>
|
|
<% if error_msg.present? %>
|
|
<%= render DS::Alert.new(message: error_msg, variant: :error) %>
|
|
<% end %>
|
|
|
|
<%
|
|
items = local_assigns[:snaptrade_items] || @snaptrade_items || Current.family.snaptrade_items.active.ordered
|
|
snaptrade_item = items.reject(&:scheduled_for_deletion?).first
|
|
oauth_env_configured = Provider::Snaptrade.oauth_configured?
|
|
oauth_active = snaptrade_item&.oauth_token_active?
|
|
%>
|
|
|
|
<% if !oauth_env_configured %>
|
|
<%= render "settings/providers/setup_steps",
|
|
steps: [
|
|
t("providers.snaptrade.oauth_setup_step_1_html").html_safe,
|
|
t("providers.snaptrade.oauth_setup_step_2_html", callback_url: oauth_callback_snaptrade_items_url).html_safe,
|
|
t("providers.snaptrade.oauth_setup_step_3")
|
|
] %>
|
|
<% else %>
|
|
<div class="bg-surface-inset rounded-xl p-4 space-y-3">
|
|
<div class="flex items-start gap-3">
|
|
<span class="w-9 h-9 rounded-lg bg-success/10 flex items-center justify-center shrink-0">
|
|
<%= icon "key-round", class: "w-4 h-4 text-success" %>
|
|
</span>
|
|
<div class="min-w-0">
|
|
<p class="text-sm font-medium text-primary"><%= t("providers.snaptrade.oauth_title") %></p>
|
|
<p class="text-sm text-secondary">
|
|
<% if oauth_active %>
|
|
<%= t("providers.snaptrade.oauth_status_authorized") %>
|
|
<% else %>
|
|
<%= t("providers.snaptrade.oauth_status_ready") %>
|
|
<% end %>
|
|
</p>
|
|
</div>
|
|
</div>
|
|
|
|
<%= render DS::Link.new(
|
|
text: oauth_active ? t("providers.snaptrade.oauth_reauthorize_button") : t("providers.snaptrade.oauth_connect_button"),
|
|
icon: "external-link",
|
|
variant: :primary,
|
|
full_width: true,
|
|
href: snaptrade_item&.persisted? ?
|
|
oauth_authorize_snaptrade_items_path(item_id: snaptrade_item.id) :
|
|
oauth_authorize_snaptrade_items_path
|
|
) %>
|
|
</div>
|
|
|
|
<% if snaptrade_item&.persisted? && snaptrade_item.oauth_configured? %>
|
|
<div class="border-t border-primary pt-4 mt-4">
|
|
<%= render DS::Disclosure.new(
|
|
variant: :inline,
|
|
data: {
|
|
controller: "lazy-load",
|
|
action: "toggle->lazy-load#toggled",
|
|
lazy_load_url_value: connections_snaptrade_item_path(snaptrade_item),
|
|
lazy_load_auto_open_param_value: "manage"
|
|
}
|
|
) do |disclosure| %>
|
|
<% disclosure.with_summary_content do %>
|
|
<div class="flex items-center justify-between">
|
|
<div class="flex items-center gap-2">
|
|
<p class="text-sm text-secondary">
|
|
<%= t("providers.snaptrade.status_connected", count: snaptrade_item.snaptrade_accounts.count) %>
|
|
<% if snaptrade_item.unlinked_accounts_count > 0 %>
|
|
<span class="text-warning">(<%= t("providers.snaptrade.needs_setup", count: snaptrade_item.unlinked_accounts_count) %>)</span>
|
|
<% end %>
|
|
</p>
|
|
</div>
|
|
<span class="flex items-center gap-1 text-sm text-secondary hover:text-primary">
|
|
<%= t("providers.snaptrade.manage_connections") %>
|
|
<%= icon "chevron-right", class: "w-3 h-3 group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
|
|
</span>
|
|
</div>
|
|
<% end %>
|
|
|
|
<div class="mt-3 space-y-3" data-lazy-load-target="content">
|
|
<div data-lazy-load-target="loading" class="flex items-center gap-2 text-sm text-secondary py-2">
|
|
<%= icon "loader-2", class: "w-4 h-4 animate-spin" %>
|
|
<%= t("providers.snaptrade.loading_connections") %>
|
|
</div>
|
|
|
|
<div data-lazy-load-target="frame">
|
|
</div>
|
|
</div>
|
|
<% end %>
|
|
</div>
|
|
<% end %>
|
|
<% end %>
|
|
</div>
|