mirror of
https://github.com/we-promise/sure.git
synced 2026-08-05 08:32:15 +00:00
* feat(snaptrade): replace device-flow OAuth with authorization-code + PKCE flow Squashed from 16 commits on snaptrade-oauth-apps for a clean rebase onto current upstream/main ahead of opening a PR. * fix(snaptrade): address PR #2747 review feedback on OAuth PKCE flow - Remove unreachable dead-code guard in import_latest_snaptrade_data - Guard apply_oauth_tokens! against a malformed payload missing access_token - Wrap token endpoint network errors in ApiError and retry like data calls - Remove unused Provider::Snaptrade#revoke_token! instance method - Preserve return_to/accountable_type through the SnapTrade portal callback so the account-linking flow no longer drops users back to accounts_path - Show the real absolute OAuth callback URL in self-hosted setup instructions - Refresh brakeman.ignore fingerprint for the connect redirect after the return_to/accountable_type params were added Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y8SCCmKX6RphB5E73WSUQQ * fix(snaptrade): don't retry non-idempotent OAuth/API requests CodeRabbit flagged that Provider::Snaptrade retried OAuth token exchanges/refreshes and all API POST/DELETE calls (get_connection_url, delete_connection) after timeouts/connection failures. If the response is lost after SnapTrade already consumed a single-use auth code, rotated the refresh token, or applied a POST/DELETE, replaying the request either fails with invalid_grant on a token that actually succeeded, or risks duplicate side effects. Retries are now limited to GET requests; OAuth token requests and non-GET API calls translate a network failure straight into an ApiError without replay. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrrGkgSBEqhjjBmmH1fcXL * fix(snaptrade): stop querying non-deterministically encrypted token via empty-string compare CodeRabbit flagged that the syncable scope's where.not(oauth_access_token: [nil, ""]) re-encrypts "" with a random IV on every query, so the "" comparison can never match a stored ciphertext and is a silent no-op. No code path ever persists oauth_access_token as "" (only nil or a real token via apply_oauth_tokens!), so the exclusion is unnecessary -- narrowed the scope to a plain NULL check, which encryption handles transparently since nil is never encrypted. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrrGkgSBEqhjjBmmH1fcXL --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
36 lines
1.3 KiB
Ruby
36 lines
1.3 KiB
Ruby
require "test_helper"
|
|
|
|
class Provider::SnaptradeAdapterTest < ActiveSupport::TestCase
|
|
test "supports Investment and Crypto accounts" do
|
|
assert_includes Provider::SnaptradeAdapter.supported_account_types, "Investment"
|
|
assert_includes Provider::SnaptradeAdapter.supported_account_types, "Crypto"
|
|
end
|
|
|
|
test "build_provider returns nil when family is nil" do
|
|
assert_nil Provider::SnaptradeAdapter.build_provider(family: nil)
|
|
end
|
|
|
|
test "build_provider returns nil when OAuth app is not configured" do
|
|
Provider::Snaptrade.stubs(:oauth_configured?).returns(false)
|
|
|
|
assert_nil Provider::SnaptradeAdapter.build_provider(family: families(:dylan_family))
|
|
end
|
|
|
|
test "build_provider returns nil when family has no authorized snaptrade item" do
|
|
Provider::Snaptrade.stubs(:oauth_configured?).returns(true)
|
|
|
|
assert_nil Provider::SnaptradeAdapter.build_provider(family: families(:empty))
|
|
end
|
|
|
|
test "build_provider returns a Provider::Snaptrade wrapping the authorized item" do
|
|
Provider::Snaptrade.stubs(:oauth_configured?).returns(true)
|
|
family = families(:dylan_family)
|
|
item = snaptrade_items(:configured_item)
|
|
|
|
provider = Provider::SnaptradeAdapter.build_provider(family: family)
|
|
|
|
assert_instance_of Provider::Snaptrade, provider
|
|
assert_equal item, provider.snaptrade_item
|
|
end
|
|
end
|