Files
sure/app/models
Guillem Arias 839d6b36ad fix(retirement): isolate retirement goals from savings goal routes
Addresses Codex P2 on #2044. A Goal::Retirement row lives in
Current.family.goals, so the shared GoalsController and
GoalPledgesController loaded it through `family.goals.find(...)` —
never calling Goal::Retirement#editable_by?. Any preview-enabled
family member could therefore open /goals/:id and edit/archive/delete
another member's owner-scoped retirement plan, hit its pledge routes,
and see it listed in the savings Goals grid.

Adds `Goal.savings` (base type only) and scopes both savings
controllers to it, so retirement goals are unreachable through the
shared routes (RecordNotFound -> goals_path redirect) and absent from
the savings index. Owner-only retirement access stays in
RetirementController; editable_by? is retained for it.

Tests: savings scope excludes retirement; retirement goal absent from
goals index; show + pledge routes redirect not-found for retirement.

(The Codex schema.rb null:false finding is a false positive — this
branch's schema.rb retains null:false on all IBKR payload columns and
the diff vs the base branch touches no IBKR lines; Codex compared
against main rather than the PR base.)
2026-05-29 10:25:05 +02:00
..
2025-03-28 13:08:22 -04:00
2026-01-09 19:38:04 +01:00
2026-01-22 20:37:07 +01:00
2026-01-22 20:37:07 +01:00
2026-03-25 17:47:04 +01:00
2026-03-25 17:47:04 +01:00
2026-04-09 18:33:59 +02:00
2026-03-25 10:50:23 +01:00
2024-02-02 09:05:04 -06:00
2026-03-25 10:50:23 +01:00
2026-03-25 10:50:23 +01:00
2024-10-18 11:26:58 -05:00
2026-03-25 10:50:23 +01:00
2026-01-23 22:05:28 +01:00
2024-08-23 09:33:42 -04:00
2025-11-01 09:12:42 +01:00
2026-04-10 17:42:16 +02:00
2026-01-23 22:05:28 +01:00
2024-05-23 08:09:33 -04:00
2025-03-28 13:08:22 -04:00