mirror of
https://github.com/we-promise/sure.git
synced 2026-09-04 14:21:23 +00:00
GFRandClaude Sonnet 5
455316c96b
* fix(dashboard): shorten money-flow drill-down URLs when possible The Money In / Out widget's Income/Expense links always enumerated every account id explicitly, even in the default unfiltered state. With a few dozen accounts this produces a multi-thousand-character URL that Sure handles fine but that breaks self-hosted setups using a forward-auth proxy (Authelia/Authentik/Traefik forward-auth): the full URL is sent to the auth service in a header, which can exceed its default read-buffer/header-size limit and turn a normal click into a 500. Only omit account_ids when the widget's selected accounts exactly match Current.user.accessible_accounts - the same default TransactionsController falls back to when the param is absent. This guarantees identical results either way. When a family has accounts excluded from reports/tax-advantaged (so the eligible set differs from the accessible set), the ids stay explicit as before, preserving existing scoping behavior. Fixes #2955. Reported with AI assistance (Claude); code and tests reviewed by a human before submission. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * test(dashboard): cover explicit account subset keeps account_ids in links Addresses CodeRabbit nitpick on #3018: the existing coverage only asserted omission when the default selection matches all accessible accounts. Add the complementary case so a deliberate, narrower selection is proven to keep scoping the drill-down links instead of falling back to "all". * test(dashboard): assert exact account scope in money-flow drill-down links Addresses CodeRabbit review on #3018: the subset-selection test only checked that the selected account id was present, not that no other accessible account ids leaked in alongside it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>