mirror of
https://github.com/we-promise/sure.git
synced 2026-08-05 08:32:15 +00:00
* Add native Questrade brokerage provider integration Adds a per-family Questrade provider so users can sync their Questrade investment accounts (TFSA, FHSA, RRSP, margin, etc.) directly via Questrade's free personal API, with no paid aggregator. - OAuth2 refresh-token flow with single-use token rotation, persisted under a row lock. Tokens self-renew on each sync; the connected panel lets users paste a fresh token if a connection goes stale (no need to disconnect and re-link). - Imports accounts, balances, positions and activities; multi-currency holdings with per-currency cash holdings; Norbert's Gambit journals. - New-account and link-existing-account flows, settings card with desktop-only setup steps, and connect/update/disconnect. - Restricted to Investment account types. Registered in the provider connection-status registry with a syncable scope so it participates in nightly family sync. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: linting error * fix: refresh token encrypted The OAuth token exchange passed the single-use refresh token as a GET query parameter, so it could leak into URL-based logs (Sentry breadcrumbs, APM spans, debug output). Switch to POST with a form-encoded body (RFC 6749 3.2) so the credential stays out of URLs. Verified Questrade's token endpoint accepts POST (returns 400 for a bad token, not 405). Adds a test asserting the token travels in the body. * Address PR review: authz, data integrity, retries, logging Batch of fixes from the automated PR review: - Require admin for all mutating/linking Questrade actions, and gate existing-account linking through accessible_accounts + write permission (was only Current.family scoped). - Clear requires_update when a fresh token is accepted; use a real 302 redirect (not 422) on full-page failures. - Require refresh_token on all saves (not just create) unless the item is scheduled for deletion. - Migrations target Rails 7.2; questrade_items state columns are NOT NULL. - Background activity dedup keys on Questrade fields (matches the importer) so multiple activities no longer collapse to one. - Persist the normalized account payload; date-scope synthetic cash holdings so daily history is not overwritten. - Retry 429/5xx via a RetryableResponseError instead of hard-failing. - Route provider error bodies to DebugLogEntry instead of Rails.logger / exception messages, so payloads do not leak into application logs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Address PR review: atomic linking, sync health, retry loop, USD cash - Wrap account creation + provider linking (+ sync_start_date) in a transaction in both link paths so a link failure rolls back the orphan account. - Surface per-account process/schedule failures in the item sync health instead of always reporting healthy. - Always stamp last_activities_sync once the background fetch completes, so legitimately empty accounts stop being re-queued every sync. - Treat only the account-currency (CAD) balance as primary cash; other currencies (e.g. USD) now surface as separate cash holdings instead of being hidden as primary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Address PR review: serialize token exchange, real processor tests - Single-use token race: the SDK now wraps every token exchange (initial and 401 re-auth) in a model-supplied lock that reloads and spends the freshest persisted token (provided.rb#synchronize_exchange). Two concurrent syncs/jobs can no longer double-spend the same refresh token. Adds a test asserting the exchange runs inside the lock with the fresh token. - Replace the all-skipped QuestradeAccount processor test stubs with real fixture-backed tests covering balance anchoring, holdings import, and Buy-trade import (plus blank-symbol / blank-type guards). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Fix indentation of spliced Questrade schema blocks The manually added questrade_accounts/questrade_items create_table blocks sat at column 0 instead of the file 2-space indent, so rubocop flagged them as inconsistent. Re-indent to match the rest of the schema. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Include currency and type in the Questrade activity merge key Two activities that differ only by currency or type could collapse to a single row in merge_activities. Add both fields to activity_key in the importer and the background fetch job so multi-currency imports dedup correctly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Address review: infer account currency, Encryptable, safer flag clear From @jjmata's review: - Currency: QuestradeAccount#upsert_from_questrade! no longer hardcodes CAD for every account. upsert_balances! now infers the home currency from the per-currency balances (the currency holding the cash wins, ties broken by total equity, default CAD) so USD-denominated accounts are labelled USD and match the right combinedBalances anchor. Adds tests for USD and CAD cases. - QuestradeItem now includes the shared Encryptable concern instead of reimplementing encryption_ready? inline. - QuestradeActivitiesFetchJob#clear_pending_flag is now best-effort so it can never mask (and swallow) the original error in perform's rescue. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Fix review issues: safe_return_to_path, DebugLogEntry, financial reset, turbo_prefetch, N+1 counts - Add safe_return_to_path to QuestradeItemsController (blocks //evil.com protocol-relative open redirect; same 3-check guard as PR #2591 Wise provider) - Pass return_to through select_accounts and complete_account_setup so users land back on the account they were linking from - Replace Rails.logger.error/warn with DebugLogEntry.capture in controller and unlinking concern (surface errors in the app debug log UI) - Add questrade_items to Family::FinancialDataReset::PROVIDER_ITEM_ASSOCIATIONS so Reset Financial Data actually removes Questrade data - Add when "questrade" case to load_provider_items in providers_controller so the settings panel lazy-load refresh works - Fix turbo_prefetch: false on non-lunchflow provider links in _method_selector.html.erb and select_provider.html.erb (prevents prefetch-cache blank-modal bug for all generic sync providers) - Preload questrade_accounts: :account_provider and build @questrade_account_counts_map in AccountsController; read from map in partial instead of calling .count on associations (eliminates N+1) - Localize default connection name via I18n.t(questrade_items.default_name) - Add default_name key to questrade_items locale Patterns and bugs surfaced during review of PR #2591 (Wise provider). * Cross-apply Wise learnings to Questrade provider Encryption (matched convention from Wise/jjmata review): - Add deterministic: true to QuestradeItem#refresh_token - Add encrypts :raw_payload + :raw_institution_payload to QuestradeItem - Add Encryptable + encrypts :raw_payload, :raw_holdings_payload, :raw_activities_payload, :raw_balances_payload to QuestradeAccount (brokerage-specific columns; matches MercuryAccount/UpAccount pattern) Bug fix: - Add missing RetryableResponseError class to Provider::Questrade (used in with_retries rescue clause but never defined — would cause NameError on any rate-limited or 5xx response) Logging: - Replace Rails.logger.error with DebugLogEntry.capture in QuestradeItem#import_latest_questrade_data, #process_accounts, and #schedule_account_syncs to surface errors in the support UI Consistency: - Extract update_sync_status(sync, key, **i18n_options) helper in QuestradeItem::Syncer, replacing 5 inline sync.update! guard calls - Use blank? instead of ||= for default name fallback in create action Tests: - Add QuestradeItemsControllerTest (18 tests: CRUD, sync, account linking/setup flows, admin guard enforcement) - Add questrade fixtures: questrade_items.yml, questrade_accounts.yml - Add retry/backoff tests to Provider::QuestradeTest (network error, 429, 5xx — all verify MAX_RETRIES exhaustion raises Error) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Signed-off-by: Jestin Palamuttam <34907800+jestinjoshi@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
110 lines
5.8 KiB
Plaintext
110 lines
5.8 KiB
Plaintext
<%# locals: (questrade_item:) %>
|
|
|
|
<%= tag.div id: dom_id(questrade_item) do %>
|
|
<%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
|
|
<% disclosure.with_summary_content do %>
|
|
<div class="flex items-center justify-between gap-2">
|
|
<div class="flex items-center gap-2">
|
|
<%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
|
|
|
|
<div class="flex items-center justify-center h-8 w-8 bg-surface rounded-full">
|
|
<% if questrade_item.logo.attached? %>
|
|
<%= image_tag questrade_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
|
|
<% else %>
|
|
<%= tag.p "Q", class: "text-primary text-xs font-medium" %>
|
|
<% end %>
|
|
</div>
|
|
|
|
<div class="pl-1 text-sm">
|
|
<div class="flex items-center gap-2">
|
|
<%= tag.p "Questrade", class: "font-medium text-primary" %>
|
|
<% if questrade_item.scheduled_for_deletion? %>
|
|
<p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress", default: "Removing…") %></p>
|
|
<% end %>
|
|
</div>
|
|
<p class="text-xs text-secondary"><%= t(".kind", default: "Brokerage") %></p>
|
|
<% if questrade_item.syncing? %>
|
|
<div class="text-secondary flex items-center gap-1">
|
|
<%= icon "loader", size: "sm", class: "animate-spin" %>
|
|
<%= tag.span t(".syncing", default: "Syncing…") %>
|
|
</div>
|
|
<% elsif questrade_item.sync_error.present? %>
|
|
<div class="text-secondary flex items-center gap-1">
|
|
<%= render DS::Tooltip.new(text: questrade_item.sync_error, icon: "alert-circle", size: "sm", color: "destructive", as: :span) %>
|
|
<%= tag.span t(".error", default: "Sync error"), class: "text-destructive" %>
|
|
</div>
|
|
<% else %>
|
|
<p class="text-secondary">
|
|
<% if questrade_item.last_synced_at %>
|
|
<% if questrade_item.sync_status_summary %>
|
|
<%= t(".status_with_summary", default: "Synced %{timestamp} ago · %{summary}", timestamp: time_ago_in_words(questrade_item.last_synced_at), summary: questrade_item.sync_status_summary) %>
|
|
<% else %>
|
|
<%= t(".status", default: "Synced %{timestamp} ago", timestamp: time_ago_in_words(questrade_item.last_synced_at)) %>
|
|
<% end %>
|
|
<% else %>
|
|
<%= t(".status_never", default: "Not synced yet") %>
|
|
<% end %>
|
|
</p>
|
|
<% end %>
|
|
</div>
|
|
</div>
|
|
|
|
<% if Current.user&.admin? %>
|
|
<div class="flex items-center gap-2">
|
|
<%= icon("refresh-cw", as_button: true, href: sync_questrade_item_path(questrade_item), disabled: questrade_item.syncing?) %>
|
|
|
|
<%= render DS::Menu.new do |menu| %>
|
|
<% menu.with_item(
|
|
variant: "button",
|
|
text: t(".delete", default: "Delete"),
|
|
icon: "trash-2",
|
|
href: questrade_item_path(questrade_item),
|
|
method: :delete,
|
|
confirm: CustomConfirm.for_resource_deletion("Questrade", high_severity: true)
|
|
) %>
|
|
<% end %>
|
|
</div>
|
|
<% end %>
|
|
</div>
|
|
<% end %>
|
|
|
|
<% unless questrade_item.scheduled_for_deletion? %>
|
|
<div class="space-y-4 mt-4">
|
|
<% if questrade_item.accounts.any? %>
|
|
<%= render "accounts/index/account_groups", accounts: questrade_item.accounts %>
|
|
<% end %>
|
|
|
|
<% stats = if defined?(@questrade_sync_stats_map) && @questrade_sync_stats_map
|
|
@questrade_sync_stats_map[questrade_item.id] || {}
|
|
else
|
|
questrade_item.syncs.ordered.first&.sync_stats || {}
|
|
end %>
|
|
<%= render ProviderSyncSummary.new(
|
|
stats: stats,
|
|
provider_item: questrade_item,
|
|
institutions_count: questrade_item.connected_institutions.size
|
|
) %>
|
|
|
|
<% counts = defined?(@questrade_account_counts_map) && @questrade_account_counts_map ? @questrade_account_counts_map[questrade_item.id] : nil %>
|
|
<% unlinked_count = counts ? counts[:unlinked] : questrade_item.unlinked_accounts_count %>
|
|
<% linked_count = counts ? counts[:linked] : questrade_item.linked_accounts_count %>
|
|
<% total_count = counts ? counts[:total] : questrade_item.total_accounts_count %>
|
|
|
|
<% if unlinked_count > 0 %>
|
|
<div class="p-4 flex flex-col gap-3 items-center justify-center">
|
|
<p class="text-primary font-medium text-sm"><%= t(".setup_needed", default: "Accounts need setup") %></p>
|
|
<p class="text-secondary text-sm"><%= t(".setup_description", default: "%{linked} of %{total} accounts linked", linked: linked_count, total: total_count) %></p>
|
|
<%= render DS::Link.new(text: t(".setup_action", default: "Set up accounts"), icon: "settings", variant: "primary", href: setup_accounts_questrade_item_path(questrade_item), frame: :modal) %>
|
|
</div>
|
|
<% elsif questrade_item.accounts.empty? && total_count == 0 %>
|
|
<div class="p-4 flex flex-col gap-3 items-center justify-center">
|
|
<p class="text-primary font-medium text-sm"><%= t(".no_accounts_title", default: "No accounts found") %></p>
|
|
<p class="text-secondary text-sm"><%= t(".no_accounts_description", default: "We could not find any Questrade accounts to import.") %></p>
|
|
<%= render DS::Link.new(text: t(".setup_action", default: "Set up accounts"), icon: "settings", variant: "primary", href: setup_accounts_questrade_item_path(questrade_item), frame: :modal) %>
|
|
</div>
|
|
<% end %>
|
|
</div>
|
|
<% end %>
|
|
<% end %>
|
|
<% end %>
|