mirror of
https://github.com/we-promise/sure.git
synced 2026-08-05 16:42:18 +00:00
* feat(snaptrade): replace device-flow OAuth with authorization-code + PKCE flow Squashed from 16 commits on snaptrade-oauth-apps for a clean rebase onto current upstream/main ahead of opening a PR. * fix(snaptrade): address PR #2747 review feedback on OAuth PKCE flow - Remove unreachable dead-code guard in import_latest_snaptrade_data - Guard apply_oauth_tokens! against a malformed payload missing access_token - Wrap token endpoint network errors in ApiError and retry like data calls - Remove unused Provider::Snaptrade#revoke_token! instance method - Preserve return_to/accountable_type through the SnapTrade portal callback so the account-linking flow no longer drops users back to accounts_path - Show the real absolute OAuth callback URL in self-hosted setup instructions - Refresh brakeman.ignore fingerprint for the connect redirect after the return_to/accountable_type params were added Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y8SCCmKX6RphB5E73WSUQQ * fix(snaptrade): don't retry non-idempotent OAuth/API requests CodeRabbit flagged that Provider::Snaptrade retried OAuth token exchanges/refreshes and all API POST/DELETE calls (get_connection_url, delete_connection) after timeouts/connection failures. If the response is lost after SnapTrade already consumed a single-use auth code, rotated the refresh token, or applied a POST/DELETE, replaying the request either fails with invalid_grant on a token that actually succeeded, or risks duplicate side effects. Retries are now limited to GET requests; OAuth token requests and non-GET API calls translate a network failure straight into an ApiError without replay. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrrGkgSBEqhjjBmmH1fcXL * fix(snaptrade): stop querying non-deterministically encrypted token via empty-string compare CodeRabbit flagged that the syncable scope's where.not(oauth_access_token: [nil, ""]) re-encrypts "" with a random IV on every query, so the "" comparison can never match a stored ciphertext and is a silent no-op. No code path ever persists oauth_access_token as "" (only nil or a real token via apply_oauth_tokens!), so the exclusion is unnecessary -- narrowed the scope to a plain NULL check, which encryption handles transparently since nil is never encrypted. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrrGkgSBEqhjjBmmH1fcXL --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
103 lines
2.8 KiB
Ruby
103 lines
2.8 KiB
Ruby
class Provider::SnaptradeAdapter < Provider::Base
|
|
include Provider::Syncable
|
|
include Provider::InstitutionMetadata
|
|
|
|
# Register this adapter with the factory
|
|
Provider::Factory.register("SnaptradeAccount", self)
|
|
|
|
# Define which account types this provider supports
|
|
# SnapTrade specializes in investment/brokerage accounts
|
|
def self.supported_account_types
|
|
%w[Investment Crypto]
|
|
end
|
|
|
|
# Returns connection configurations for this provider
|
|
def self.connection_configs(family:)
|
|
return [] unless family.can_connect_snaptrade?
|
|
|
|
[ {
|
|
key: "snaptrade",
|
|
name: I18n.t("providers.snaptrade.name"),
|
|
description: I18n.t("providers.snaptrade.connection_description"),
|
|
can_connect: true,
|
|
new_account_path: ->(accountable_type, return_to) {
|
|
Rails.application.routes.url_helpers.select_accounts_snaptrade_items_path(
|
|
accountable_type: accountable_type,
|
|
return_to: return_to
|
|
)
|
|
},
|
|
existing_account_path: ->(account_id) {
|
|
Rails.application.routes.url_helpers.select_existing_account_snaptrade_items_path(
|
|
account_id: account_id
|
|
)
|
|
}
|
|
} ]
|
|
end
|
|
|
|
def provider_name
|
|
"snaptrade"
|
|
end
|
|
|
|
# Build a SnapTrade provider instance for a family's authorized item
|
|
# @param family [Family] The family to get an authorized item for (required)
|
|
# @return [Provider::Snaptrade, nil] Returns nil if OAuth is not configured/authorized
|
|
def self.build_provider(family: nil)
|
|
return nil unless family.present?
|
|
return nil unless Provider::Snaptrade.oauth_configured?
|
|
|
|
snaptrade_item = family.snaptrade_items.syncable.first
|
|
return nil unless snaptrade_item
|
|
|
|
Provider::Snaptrade.new(snaptrade_item)
|
|
end
|
|
|
|
def sync_path
|
|
Rails.application.routes.url_helpers.sync_snaptrade_item_path(item)
|
|
end
|
|
|
|
def item
|
|
provider_account.snaptrade_item
|
|
end
|
|
|
|
def can_delete_holdings?
|
|
false
|
|
end
|
|
|
|
def institution_domain
|
|
metadata = provider_account.institution_metadata
|
|
return nil unless metadata.present?
|
|
|
|
domain = metadata["domain"]
|
|
url = metadata["url"]
|
|
|
|
# Derive domain from URL if missing
|
|
if domain.blank? && url.present?
|
|
begin
|
|
domain = URI.parse(url).host&.gsub(/^www\./, "")
|
|
rescue URI::InvalidURIError
|
|
Rails.logger.warn("Invalid institution URL for Snaptrade account #{provider_account.id}: #{url}")
|
|
end
|
|
end
|
|
|
|
domain
|
|
end
|
|
|
|
def institution_name
|
|
metadata = provider_account.institution_metadata
|
|
return nil unless metadata.present?
|
|
|
|
metadata["name"] || item&.institution_name
|
|
end
|
|
|
|
def institution_url
|
|
metadata = provider_account.institution_metadata
|
|
return nil unless metadata.present?
|
|
|
|
metadata["url"] || item&.institution_url
|
|
end
|
|
|
|
def institution_color
|
|
item&.institution_color
|
|
end
|
|
end
|