@actual-app/sync-server 26.7.0 → 26.8.0-nightly.20260704

package/build/chunks/{app-CLRlkXbY.js → app-DMyQvS9q.js}

@@ -1,5 +1,5 @@
 import { t as configSchema } from "./load-config-8NvK3qSh.js";
-import { A as getFileById, B as updateUserWithRole, C as checkFilePermission, D as deleteUserAccessByFileId, E as deleteUserAccess, F as getUserById, I as getUserByUsername, L as insertUser, M as getOwnerCount, N as getOwnerId, O as getAllUserAccess, P as getUserAccess, R as transferAllFilesFromUser, S as addUserAccess, T as deleteUser, V as validateRole, _ as changePassword, a as getActiveLoginMethod, b as validateAuthHeader, c as getUserInfo, d as needsBootstrap, f as setServerPrefs, g as loginWithOpenIdSetup, h as loginWithOpenIdFinalize, i as getAccountDb, j as getOpenIDConfig, k as getAllUsers, l as isAdmin, m as isValidRedirectUrl, n as disableOpenID, o as getLoginMethod, p as openDatabase, r as enableOpenID, s as getServerPrefs, t as bootstrap, u as listLoginMethods, v as checkPassword, w as countUserAccess, x as validateSession, y as loginWithPassword, z as updateFileOwner } from "./account-db-HkRNud0e.js";
+import { A as getFileById, B as updateUserWithRole, C as checkFilePermission, D as deleteUserAccessByFileId, E as deleteUserAccess, F as getUserById, I as getUserByUsername, L as insertUser, M as getOwnerCount, N as getOwnerId, O as getAllUserAccess, P as getUserAccess, R as transferAllFilesFromUser, S as addUserAccess, T as deleteUser, V as validateRole, _ as changePassword, a as getActiveLoginMethod, b as validateAuthHeader, c as getUserInfo, d as needsBootstrap, f as setServerPrefs, g as loginWithOpenIdSetup, h as loginWithOpenIdFinalize, i as getAccountDb, j as getOpenIDConfig, k as getAllUsers, l as isAdmin, m as isValidRedirectUrl, n as disableOpenID, o as getLoginMethod, p as openDatabase, r as enableOpenID, s as getServerPrefs, t as bootstrap, u as listLoginMethods, v as checkPassword, w as countUserAccess, x as validateSession, y as loginWithPassword, z as updateFileOwner } from "./account-db-B0u6vCZk.js";
 import { join, resolve } from "node:path";
 import fs, { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -128,7 +128,7 @@ app$11.post("/login", authRateLimiter, async (req, res) => {
 					reason: "invalid-header"
 				});
 				return;
-			} else if (validateAuthHeader(req)) tokenRes = loginWithPassword(headerVal);
+			} else if (validateAuthHeader(req)) tokenRes = await loginWithPassword(headerVal);
 			else {
 				res.send({
 					status: "error",
@@ -161,7 +161,7 @@ app$11.post("/login", authRateLimiter, async (req, res) => {
 			return;
 		}
 		default:
-			tokenRes = loginWithPassword(req.body.password);
+			tokenRes = await loginWithPassword(req.body.password);
 			break;
 	}
 	const { error, token } = tokenRes;
@@ -177,7 +177,7 @@ app$11.post("/login", authRateLimiter, async (req, res) => {
 		data: { token }
 	});
 });
-app$11.post("/change-password", (req, res) => {
+app$11.post("/change-password", async (req, res) => {
 	const session = validateSession(req, res);
 	if (!session) return;
 	if (!isAdmin(session.user_id)) {
@@ -196,7 +196,7 @@ app$11.post("/change-password", (req, res) => {
 		});
 		return;
 	}
-	const { error } = changePassword(req.body.password);
+	const { error } = await changePassword(req.body.password);
 	if (error) {
 		res.status(400).send({
 			status: "error",
@@ -590,6 +590,9 @@ var SecretName = {
 	enablebanking_applicationId: "enablebanking_applicationId",
 	enablebanking_secretKey: "enablebanking_secretKey"
 };
+function getSecretKey(name, fileId) {
+	return fileId == null ? name : `${name}:${fileId}`;
+}
 var SecretsDb = class {
 	constructor() {
 		this.debug = createDebug("actual:secrets-db");
@@ -598,49 +601,62 @@ var SecretsDb = class {
 	open() {
 		return getAccountDb();
 	}
-	set(name, value) {
+	set(name, value, fileId = null) {
 		if (!this.db) this.db = this.open();
+		const secretKey = getSecretKey(name, fileId);
 		this.debug(`setting secret '${name}' to '${value}'`);
-		return this.db.mutate(`INSERT OR REPLACE INTO secrets (name, value) VALUES (?,?)`, [name, value]);
+		return this.db.mutate(`INSERT OR REPLACE INTO secrets (name, value) VALUES (?, ?)`, [secretKey, value]);
 	}
-	get(name) {
+	get(name, fileId = null) {
 		if (!this.db) this.db = this.open();
+		const secretKey = getSecretKey(name, fileId);
 		this.debug(`getting secret '${name}'`);
-		return this.db.first(`SELECT value FROM secrets WHERE name =?`, [name]);
+		return this.db.first(`SELECT value FROM secrets WHERE name = ?`, [secretKey]);
+	}
+	reset(name, fileId = null) {
+		if (!this.db) this.db = this.open();
+		const secretKey = getSecretKey(name, fileId);
+		return {
+			...this.db.mutate(`DELETE FROM secrets WHERE name = ?`, [secretKey]),
+			deletedFrom: fileId == null ? "global" : "per-budget-file"
+		};
 	}
 };
 var secretsDb = new SecretsDb();
-var _cachedSecrets = /* @__PURE__ */ new Map();
 /**
 * A service for managing secrets stored in `secretsDb`.
 */
 var secretsService = {
 	/**
-	* Retrieves the value of a secret by name.
+	* Retrieves the active value of a secret by name.
 	* @param {SecretName} name - The name of the secret to retrieve.
+	* @param {string=} fileId - Budget file ID for this secret.
 	* @returns {string|null} The value of the secret, or null if the secret does not exist.
 	*/
-	get: (name) => {
-		return _cachedSecrets.get(name) ?? secretsDb.get(name)?.value ?? null;
+	get: (name, fileId = null) => {
+		return secretsDb.get(name, fileId)?.value ?? null;
 	},
 	/**
 	* Sets the value of a secret by name.
 	* @param {SecretName} name - The name of the secret to set.
 	* @param {string} value - The value to set for the secret.
+	* @param {string=} fileId - Budget file ID for this secret.
 	* @returns {Object}
 	*/
-	set: (name, value) => {
-		const result = secretsDb.set(name, value);
-		if (result.changes === 1) _cachedSecrets.set(name, value);
-		return result;
+	set: (name, value, fileId = null) => {
+		return secretsDb.set(name, value, fileId);
+	},
+	reset: (name, fileId = null) => {
+		return secretsDb.reset(name, fileId);
 	},
 	/**
 	* Determines whether a secret with the given name exists.
 	* @param {SecretName} name - The name of the secret to check for existence.
+	* @param {string=} fileId - Budget file ID for this secret.
 	* @returns {boolean} True if a secret with the given name exists, false otherwise.
 	*/
-	exists: (name) => {
-		return Boolean(secretsService.get(name));
+	exists: (name, fileId = null) => {
+		return secretsService.get(name, fileId) !== null;
 	}
 };
 //#endregion
@@ -3854,7 +3870,7 @@ app$5.post("/config", openIdConfigRateLimiter, async (req, res) => {
 		});
 		return;
 	}
-	if (!checkPassword(req.body.password)) {
+	if (!await checkPassword(req.body.password)) {
 		res.status(400).send({
 			status: "error",
 			reason: "invalid-password"
@@ -4035,6 +4051,8 @@ app$4.post("/transactions", handleError(async (req, res) => {
 			};
 			newTrans.transactionId = trans.id;
 			newTrans.sortOrder = transactionDate.getTime();
+			newTrans.originalDate = getDate$1(transactionDate);
+			newTrans.date = getDate$1(getTransactionDateCorrected(trans));
 			delete trans.amount;
 			const finalTrans = {
 				...flattenObject(trans),
@@ -4089,51 +4107,167 @@ function getPayeeName(trans) {
 	}
 	return "";
 }
+function addMonthsClamped(date, months) {
+	const result = new Date(date);
+	const day = result.getUTCDate();
+	result.setUTCDate(1);
+	result.setUTCMonth(result.getUTCMonth() + months);
+	const lastDay = new Date(Date.UTC(result.getUTCFullYear(), result.getUTCMonth() + 1, 0)).getUTCDate();
+	result.setUTCDate(Math.min(day, lastDay));
+	return result;
+}
+function getTransactionDateCorrected(trans) {
+	if (trans.creditCardMetadata?.installmentNumber != null) return addMonthsClamped(trans.creditCardMetadata.purchaseDate || trans.date, trans.creditCardMetadata.installmentNumber - 1);
+	return trans.date;
+}
+//#endregion
+//#region src/util/paths.ts
+var ID_REGEX = /^[a-zA-Z0-9_-]+$/;
+function isValidFileId(id) {
+	return ID_REGEX.test(id);
+}
+function isValidGroupId(id) {
+	return ID_REGEX.test(id);
+}
+function getPathForUserFile(fileId) {
+	return join(resolve(configSchema.get("userFiles")), `file-${fileId}.blob`);
+}
+function getPathForGroupFile(groupId) {
+	return join(resolve(configSchema.get("userFiles")), `group-${groupId}.sqlite`);
+}
 //#endregion
 //#region src/app-secrets.js
 var app$3 = express();
 app$3.use(express.json());
 app$3.use(requestLoggerMiddleware);
 app$3.use(validateSessionMiddleware);
-function canManageSecrets(userId) {
-	return getActiveLoginMethod() !== "openid" || isAdmin(userId);
+function canManageGlobalSecrets(userId) {
+	return isAdmin(userId);
+}
+function isBudgetFileOwner(fileId, userId) {
+	const { granted } = checkFilePermission(fileId, userId) || { granted: 0 };
+	return granted > 0;
+}
+function canManagePerBudgetFileSecrets(fileId, userId) {
+	return isAdmin(userId) || isBudgetFileOwner(fileId, userId);
 }
 app$3.post("/", async (req, res) => {
-	if (!canManageSecrets(res.locals.user_id)) {
+	const { name, value } = req.body || {};
+	const fileId = req.get("X-Actual-File-Id");
+	const perBudgetFile = fileId != null;
+	if (!(name in SecretName)) {
+		res.status(400).send({
+			status: "error",
+			reason: "invalid-secret-name",
+			details: "Unknown secret name"
+		});
+		return;
+	}
+	if (perBudgetFile) {
+		if (!isValidFileId(fileId)) {
+			res.status(400).send({
+				status: "error",
+				reason: "invalid-file-id",
+				details: "invalid fileId"
+			});
+			return;
+		}
+		if (!canManagePerBudgetFileSecrets(fileId, res.locals.user_id)) {
+			res.status(403).send({
+				status: "error",
+				reason: "file-access-denied",
+				details: "You don't have permissions over this file"
+			});
+			return;
+		}
+	} else if (!canManageGlobalSecrets(res.locals.user_id)) {
 		res.status(403).send({
 			status: "error",
 			reason: "not-admin",
-			details: "You have to be admin to set secrets"
+			details: "You have to be admin to manage global secrets"
 		});
 		return;
 	}
-	const { name, value } = req.body || {};
+	const secretFileId = perBudgetFile ? fileId : null;
+	secretsService.set(name, value, secretFileId);
+	res.status(200).send({ status: "ok" });
+});
+app$3.delete("/:name", async (req, res) => {
+	const name = req.params.name;
+	const fileId = req.get("X-Actual-File-Id");
+	const perBudgetFile = fileId != null;
 	if (!(name in SecretName)) {
+		res.status(404).send("key not found");
+		return;
+	}
+	if (!perBudgetFile) {
+		if (!canManageGlobalSecrets(res.locals.user_id)) {
+			res.status(403).send({
+				status: "error",
+				reason: "not-admin",
+				details: "You have to be admin to manage global secrets"
+			});
+			return;
+		}
+		secretsService.reset(name);
+		res.status(200).send({ status: "ok" });
+		return;
+	}
+	if (!isValidFileId(fileId)) {
 		res.status(400).send({
 			status: "error",
-			reason: "invalid-secret-name",
-			details: "Unknown secret name"
+			reason: "invalid-file-id",
+			details: "invalid fileId"
 		});
 		return;
 	}
-	secretsService.set(name, value);
-	res.status(200).send({ status: "ok" });
-});
-app$3.get("/:name", async (req, res) => {
-	if (!canManageSecrets(res.locals.user_id)) {
+	if (!canManagePerBudgetFileSecrets(fileId, res.locals.user_id)) {
 		res.status(403).send({
 			status: "error",
-			reason: "not-admin",
-			details: "You have to be admin to read secrets"
+			reason: "file-access-denied",
+			details: "You don't have permissions over this file"
 		});
 		return;
 	}
+	secretsService.reset(name, fileId);
+	res.status(200).send({ status: "ok" });
+});
+app$3.get("/:name", async (req, res) => {
 	const name = req.params.name;
+	const fileId = req.get("X-Actual-File-Id");
+	const perBudgetFile = fileId != null;
 	if (!(name in SecretName)) {
 		res.status(404).send("key not found");
 		return;
 	}
-	if (secretsService.exists(name)) res.sendStatus(204);
+	if (!perBudgetFile) {
+		if (!canManageGlobalSecrets(res.locals.user_id)) {
+			res.status(403).send({
+				status: "error",
+				reason: "not-admin",
+				details: "You have to be admin to manage global secrets"
+			});
+			return;
+		}
+	} else {
+		if (!isValidFileId(fileId)) {
+			res.status(400).send({
+				status: "error",
+				reason: "invalid-file-id",
+				details: "invalid fileId"
+			});
+			return;
+		}
+		if (!canManagePerBudgetFileSecrets(fileId, res.locals.user_id)) {
+			res.status(403).send({
+				status: "error",
+				reason: "file-access-denied",
+				details: "You don't have permissions over this file"
+			});
+			return;
+		}
+	}
+	if (secretsService.exists(name, perBudgetFile ? fileId : null)) res.sendStatus(204);
 	else res.status(404).send("key not found");
 });
 //#endregion
@@ -4660,21 +4794,6 @@ var GenericFileError = class extends Error {
 	}
 };
 //#endregion
-//#region src/util/paths.ts
-var ID_REGEX = /^[a-zA-Z0-9_-]+$/;
-function isValidFileId(id) {
-	return ID_REGEX.test(id);
-}
-function isValidGroupId(id) {
-	return ID_REGEX.test(id);
-}
-function getPathForUserFile(fileId) {
-	return join(resolve(configSchema.get("userFiles")), `file-${fileId}.blob`);
-}
-function getPathForGroupFile(groupId) {
-	return join(resolve(configSchema.get("userFiles")), `group-${groupId}.sqlite`);
-}
-//#endregion
 //#region src/app-sync/services/files-service.ts
 var FileBase = class {
 	name;
@@ -5415,4 +5534,4 @@ async function run() {
 //#endregion
 export { run };
 
-//# sourceMappingURL=app-CLRlkXbY.js.map
+//# sourceMappingURL=app-DMyQvS9q.js.map