* fix(dashboard): shorten money-flow drill-down URLs when possible
The Money In / Out widget's Income/Expense links always enumerated every
account id explicitly, even in the default unfiltered state. With a few
dozen accounts this produces a multi-thousand-character URL that Sure
handles fine but that breaks self-hosted setups using a forward-auth proxy
(Authelia/Authentik/Traefik forward-auth): the full URL is sent to the auth
service in a header, which can exceed its default read-buffer/header-size
limit and turn a normal click into a 500.
Only omit account_ids when the widget's selected accounts exactly match
Current.user.accessible_accounts - the same default TransactionsController
falls back to when the param is absent. This guarantees identical results
either way. When a family has accounts excluded from reports/tax-advantaged
(so the eligible set differs from the accessible set), the ids stay explicit
as before, preserving existing scoping behavior.
Fixes#2955.
Reported with AI assistance (Claude); code and tests reviewed by a human
before submission.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* test(dashboard): cover explicit account subset keeps account_ids in links
Addresses CodeRabbit nitpick on #3018: the existing coverage only asserted
omission when the default selection matches all accessible accounts.
Add the complementary case so a deliberate, narrower selection is proven
to keep scoping the drill-down links instead of falling back to "all".
* test(dashboard): assert exact account scope in money-flow drill-down links
Addresses CodeRabbit review on #3018: the subset-selection test only
checked that the selected account id was present, not that no other
accessible account ids leaked in alongside it.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
