@actual-app/sync-server 26.8.0 → 26.9.0-nightly.20260803

package/build/app.js

@@ -1,7 +1,7 @@
 import { t as run } from "./chunks/migrations-DOEWw8Fg.js";
 //#region app.ts
 run().then(() => {
-	import("./chunks/app-GzHx-kED.js").then((app) => app.run());
+	import("./chunks/app-Du06KVql.js").then((app) => app.run());
 }).catch((err) => {
 	console.log("Error starting app:", err);
 	process.exit(1);

package/build/bin/actual-server.js

@@ -41,7 +41,7 @@ if (values.help) {
 	process.exit();
 }
 if (values.version) {
-	console.log("v26.8.0");
+	console.log("v26.9.0-nightly.20260803");
 	process.exit();
 }
 var setupDataDir = (dataDir) => {

package/build/bin/actual-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"actual-server.js","names":[],"sources":["../../bin/actual-server.js"],"sourcesContent":["#!/usr/bin/env node\nimport { existsSync, readFileSync } from 'node:fs';\nimport { resolve } from 'node:path';\nimport { parseArgs } from 'node:util';\n\nconst args = process.argv;\n\nconst options = {\n  help: {\n    type: 'boolean',\n    short: 'h',\n  },\n  version: {\n    type: 'boolean',\n    short: 'v',\n  },\n  'reset-password': {\n    type: 'boolean',\n  },\n  config: {\n    type: 'string',\n  },\n};\n\nconst { values } = parseArgs({\n  args,\n  options,\n  allowPositionals: true,\n});\n\nif (values.help) {\n  console.log(\n    [\n      'usage: actual-server [options]',\n      '',\n      'options:',\n      '  --config           Path to config file',\n      '',\n      '  -h --help          Print this list and exit.',\n      '  -v --version       Print the version and exit.',\n      '',\n      'Examples:',\n      '',\n      'Runs actual-server with default configuration',\n      '  actual-server',\n      '',\n      'Runs actual-server with custom configuration',\n      '  actual-server --config ./config.json',\n    ].join('\\n'),\n  );\n\n  process.exit();\n}\n\nif (values.version) {\n  console.log('v' + __APP_VERSION__);\n  process.exit();\n}\n\nconst setupDataDir = dataDir => {\n  if (process.env.ACTUAL_DATA_DIR) {\n    return; // Env variables must not be overwritten\n  }\n\n  if (dataDir) {\n    process.env.ACTUAL_DATA_DIR = dataDir; // Use the dir specified\n  } else {\n    // Setup defaults\n    if (existsSync('./data')) {\n      // The default data directory exists - use it\n      console.info('Found existing data directory');\n      process.env.ACTUAL_DATA_DIR = resolve('./data');\n    } else {\n      console.info(\n        'Using default data directory. You can specify a custom config with --config',\n      );\n      process.env.ACTUAL_DATA_DIR = resolve('./');\n    }\n\n    console.info(`Data directory: ${process.env.ACTUAL_DATA_DIR}`);\n  }\n};\n\nif (values.config) {\n  const configExists = existsSync(values.config);\n\n  if (!configExists) {\n    console.log(\n      `Please specify a valid config path. The path ${String(values.config)} does not exist.`,\n    );\n\n    process.exit();\n  } else {\n    console.log(`Loading config from ${String(values.config)}`);\n    const configJson = JSON.parse(readFileSync(values.config, 'utf-8'));\n    process.env.ACTUAL_CONFIG_PATH = values.config;\n    setupDataDir(configJson.dataDir);\n  }\n} else {\n  // If no config is specified, check for a default config in the current directory\n  const defaultConfigJsonFile = './config.json';\n  const configExists = existsSync(defaultConfigJsonFile);\n\n  if (configExists) {\n    console.info('Found config.json in the current directory');\n    const configJson = JSON.parse(readFileSync(defaultConfigJsonFile, 'utf-8'));\n    process.env.ACTUAL_CONFIG_PATH = defaultConfigJsonFile;\n    setupDataDir(configJson.dataDir);\n  } else {\n    setupDataDir(); // No default config exists - setup data dir with defaults\n  }\n}\n\nif (values['reset-password']) {\n  console.info('Running reset password script...');\n  await import('../src/scripts/reset-password.js');\n  process.exit();\n}\n\n// start the sync server\nvoid import('../app.js');\n"],"mappings":";;;;;AAKA,IAAM,OAAO,QAAQ;AAmBrB,IAAM,EAAE,WAAW,UAAU;CAC3B;CACA,SAAA;EAlBA,MAAM;GACJ,MAAM;GACN,OAAO;EACT;EACA,SAAS;GACP,MAAM;GACN,OAAO;EACT;EACA,kBAAkB,EAChB,MAAM,UACR;EACA,QAAQ,EACN,MAAM,SACR;CAKM;CACN,kBAAkB;AACpB,CAAC;AAED,IAAI,OAAO,MAAM;CACf,QAAQ,IACN;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI,CACb;CAEA,QAAQ,KAAK;AACf;AAEA,IAAI,OAAO,SAAS;CAClB,QAAQ,IAAI,SAAqB;CACjC,QAAQ,KAAK;AACf;AAEA,IAAM,gBAAe,YAAW;CAC9B,IAAI,QAAQ,IAAI,iBACd;CAGF,IAAI,SACF,QAAQ,IAAI,kBAAkB;MACzB;EAEL,IAAI,WAAW,QAAQ,GAAG;GAExB,QAAQ,KAAK,+BAA+B;GAC5C,QAAQ,IAAI,kBAAkB,QAAQ,QAAQ;EAChD,OAAO;GACL,QAAQ,KACN,6EACF;GACA,QAAQ,IAAI,kBAAkB,QAAQ,IAAI;EAC5C;EAEA,QAAQ,KAAK,mBAAmB,QAAQ,IAAI,iBAAiB;CAC/D;AACF;AAEA,IAAI,OAAO,QAGT,IAAI,CAFiB,WAAW,OAAO,MAEvB,GAAG;CACjB,QAAQ,IACN,gDAAgD,OAAO,OAAO,MAAM,EAAE,iBACxE;CAEA,QAAQ,KAAK;AACf,OAAO;CACL,QAAQ,IAAI,uBAAuB,OAAO,OAAO,MAAM,GAAG;CAC1D,MAAM,aAAa,KAAK,MAAM,aAAa,OAAO,QAAQ,OAAO,CAAC;CAClE,QAAQ,IAAI,qBAAqB,OAAO;CACxC,aAAa,WAAW,OAAO;AACjC;KACK;CAEL,MAAM,wBAAwB;CAG9B,IAFqB,WAAW,qBAEjB,GAAG;EAChB,QAAQ,KAAK,4CAA4C;EACzD,MAAM,aAAa,KAAK,MAAM,aAAa,uBAAuB,OAAO,CAAC;EAC1E,QAAQ,IAAI,qBAAqB;EACjC,aAAa,WAAW,OAAO;CACjC,OACE,aAAa;AAEjB;AAEA,IAAI,OAAO,mBAAmB;CAC5B,QAAQ,KAAK,kCAAkC;CAC/C,MAAM,OAAO;CACb,QAAQ,KAAK;AACf;AAGK,OAAO"}
+{"version":3,"file":"actual-server.js","names":[],"sources":["../../bin/actual-server.js"],"sourcesContent":["#!/usr/bin/env node\nimport { existsSync, readFileSync } from 'node:fs';\nimport { resolve } from 'node:path';\nimport { parseArgs } from 'node:util';\n\nconst args = process.argv;\n\nconst options = {\n  help: {\n    type: 'boolean',\n    short: 'h',\n  },\n  version: {\n    type: 'boolean',\n    short: 'v',\n  },\n  'reset-password': {\n    type: 'boolean',\n  },\n  config: {\n    type: 'string',\n  },\n};\n\nconst { values } = parseArgs({\n  args,\n  options,\n  allowPositionals: true,\n});\n\nif (values.help) {\n  console.log(\n    [\n      'usage: actual-server [options]',\n      '',\n      'options:',\n      '  --config           Path to config file',\n      '',\n      '  -h --help          Print this list and exit.',\n      '  -v --version       Print the version and exit.',\n      '',\n      'Examples:',\n      '',\n      'Runs actual-server with default configuration',\n      '  actual-server',\n      '',\n      'Runs actual-server with custom configuration',\n      '  actual-server --config ./config.json',\n    ].join('\\n'),\n  );\n\n  process.exit();\n}\n\nif (values.version) {\n  console.log('v' + __APP_VERSION__);\n  process.exit();\n}\n\nconst setupDataDir = dataDir => {\n  if (process.env.ACTUAL_DATA_DIR) {\n    return; // Env variables must not be overwritten\n  }\n\n  if (dataDir) {\n    process.env.ACTUAL_DATA_DIR = dataDir; // Use the dir specified\n  } else {\n    // Setup defaults\n    if (existsSync('./data')) {\n      // The default data directory exists - use it\n      console.info('Found existing data directory');\n      process.env.ACTUAL_DATA_DIR = resolve('./data');\n    } else {\n      console.info(\n        'Using default data directory. You can specify a custom config with --config',\n      );\n      process.env.ACTUAL_DATA_DIR = resolve('./');\n    }\n\n    console.info(`Data directory: ${process.env.ACTUAL_DATA_DIR}`);\n  }\n};\n\nif (values.config) {\n  const configExists = existsSync(values.config);\n\n  if (!configExists) {\n    console.log(\n      `Please specify a valid config path. The path ${String(values.config)} does not exist.`,\n    );\n\n    process.exit();\n  } else {\n    console.log(`Loading config from ${String(values.config)}`);\n    const configJson = JSON.parse(readFileSync(values.config, 'utf-8'));\n    process.env.ACTUAL_CONFIG_PATH = values.config;\n    setupDataDir(configJson.dataDir);\n  }\n} else {\n  // If no config is specified, check for a default config in the current directory\n  const defaultConfigJsonFile = './config.json';\n  const configExists = existsSync(defaultConfigJsonFile);\n\n  if (configExists) {\n    console.info('Found config.json in the current directory');\n    const configJson = JSON.parse(readFileSync(defaultConfigJsonFile, 'utf-8'));\n    process.env.ACTUAL_CONFIG_PATH = defaultConfigJsonFile;\n    setupDataDir(configJson.dataDir);\n  } else {\n    setupDataDir(); // No default config exists - setup data dir with defaults\n  }\n}\n\nif (values['reset-password']) {\n  console.info('Running reset password script...');\n  await import('../src/scripts/reset-password.js');\n  process.exit();\n}\n\n// start the sync server\nvoid import('../app.js');\n"],"mappings":";;;;;AAKA,IAAM,OAAO,QAAQ;AAmBrB,IAAM,EAAE,WAAW,UAAU;CAC3B;CACA,SAAA;EAlBA,MAAM;GACJ,MAAM;GACN,OAAO;EACT;EACA,SAAS;GACP,MAAM;GACN,OAAO;EACT;EACA,kBAAkB,EAChB,MAAM,UACR;EACA,QAAQ,EACN,MAAM,SACR;CAKM;CACN,kBAAkB;AACpB,CAAC;AAED,IAAI,OAAO,MAAM;CACf,QAAQ,IACN;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI,CACb;CAEA,QAAQ,KAAK;AACf;AAEA,IAAI,OAAO,SAAS;CAClB,QAAQ,IAAI,0BAAqB;CACjC,QAAQ,KAAK;AACf;AAEA,IAAM,gBAAe,YAAW;CAC9B,IAAI,QAAQ,IAAI,iBACd;CAGF,IAAI,SACF,QAAQ,IAAI,kBAAkB;MACzB;EAEL,IAAI,WAAW,QAAQ,GAAG;GAExB,QAAQ,KAAK,+BAA+B;GAC5C,QAAQ,IAAI,kBAAkB,QAAQ,QAAQ;EAChD,OAAO;GACL,QAAQ,KACN,6EACF;GACA,QAAQ,IAAI,kBAAkB,QAAQ,IAAI;EAC5C;EAEA,QAAQ,KAAK,mBAAmB,QAAQ,IAAI,iBAAiB;CAC/D;AACF;AAEA,IAAI,OAAO,QAGT,IAAI,CAFiB,WAAW,OAAO,MAEvB,GAAG;CACjB,QAAQ,IACN,gDAAgD,OAAO,OAAO,MAAM,EAAE,iBACxE;CAEA,QAAQ,KAAK;AACf,OAAO;CACL,QAAQ,IAAI,uBAAuB,OAAO,OAAO,MAAM,GAAG;CAC1D,MAAM,aAAa,KAAK,MAAM,aAAa,OAAO,QAAQ,OAAO,CAAC;CAClE,QAAQ,IAAI,qBAAqB,OAAO;CACxC,aAAa,WAAW,OAAO;AACjC;KACK;CAEL,MAAM,wBAAwB;CAG9B,IAFqB,WAAW,qBAEjB,GAAG;EAChB,QAAQ,KAAK,4CAA4C;EACzD,MAAM,aAAa,KAAK,MAAM,aAAa,uBAAuB,OAAO,CAAC;EAC1E,QAAQ,IAAI,qBAAqB;EACjC,aAAa,WAAW,OAAO;CACjC,OACE,aAAa;AAEjB;AAEA,IAAI,OAAO,mBAAmB;CAC5B,QAAQ,KAAK,kCAAkC;CAC/C,MAAM,OAAO;CACb,QAAQ,KAAK;AACf;AAGK,OAAO"}

package/build/chunks/{app-GzHx-kED.js → app-Du06KVql.js}

@@ -4437,19 +4437,31 @@ app$2.post("/status", handleError(async (req, res) => {
 }));
 app$2.post("/accounts", handleError(async (req, res) => {
 	let accessKey = secretsService.get(SecretName.simplefin_accessKey);
-	try {
+	if (isInvalidAccessKey(accessKey)) {
+		const token = secretsService.get(SecretName.simplefin_token);
+		if (token == null || isForbidden(token)) {
+			invalidToken(res);
+			return;
+		}
+		const claimUrl = decodeClaimUrl(token);
+		if (claimUrl == null) {
+			console.log("SimpleFIN setup token does not decode to a claim URL - re-enter the token");
+			invalidToken(res);
+			return;
+		}
+		try {
+			accessKey = await claimAccessKey(claimUrl);
+		} catch (e) {
+			console.log("Failed to claim the SimpleFIN setup token:");
+			serverDown(e, res);
+			return;
+		}
 		if (isInvalidAccessKey(accessKey)) {
-			const token = secretsService.get(SecretName.simplefin_token);
-			if (token == null || isForbidden(token)) throw new Error("No token");
-			else {
-				accessKey = await getAccessKey(token);
-				if (isInvalidAccessKey(accessKey)) throw new Error("No access key");
-				secretsService.set(SecretName.simplefin_accessKey, accessKey);
-			}
+			console.log(`SimpleFIN rejected the setup token claim: ${accessKey.slice(0, 200) || "(empty response)"}`);
+			invalidToken(res);
+			return;
 		}
-	} catch {
-		invalidToken(res);
-		return;
+		secretsService.set(SecretName.simplefin_accessKey, accessKey);
 	}
 	try {
 		const accounts = await getAccounts(accessKey, null, null, null, true);
@@ -4620,6 +4632,7 @@ function serverDown(e, res) {
 		}
 	});
 }
+var ACCESS_KEY_FORMAT = /^.*\/\/.*:.*@.*$/;
 function parseAccessKey(accessKey) {
 	let scheme = null;
 	let rest = null;
@@ -4627,7 +4640,7 @@ function parseAccessKey(accessKey) {
 	let username = null;
 	let password = null;
 	let baseUrl = null;
-	if (!accessKey || !accessKey.match(/^.*\/\/.*:.*@.*$/)) {
+	if (!accessKey || !ACCESS_KEY_FORMAT.test(accessKey)) {
 		console.log("Invalid SimpleFIN access key");
 		throw new Error(`Invalid access key`);
 	}
@@ -4641,19 +4654,31 @@ function parseAccessKey(accessKey) {
 		password
 	};
 }
-async function getAccessKey(base64Token) {
-	const token = Buffer.from(base64Token, "base64").toString();
-	await assertUrlAllowed(token, { allowPrivateNetwork: true });
-	return (await (await fetch(token, {
+function decodeClaimUrl(base64Token) {
+	const decoded = Buffer.from(base64Token, "base64").toString();
+	let url;
+	try {
+		url = new URL(decoded);
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+	return decoded;
+}
+async function claimAccessKey(claimUrl) {
+	await assertUrlAllowed(claimUrl, { allowPrivateNetwork: true });
+	const response = await fetch(claimUrl, {
 		method: "POST",
 		redirect: "manual"
-	})).text()).trim();
+	});
+	if (!response.ok && response.status !== 403) throw new Error(`SimpleFIN claim failed with HTTP ${response.status}`);
+	return (await response.text()).trim();
 }
 function isForbidden(value) {
 	return typeof value === "string" && value.startsWith("Forbidden");
 }
 function isInvalidAccessKey(accessKey) {
-	return typeof accessKey !== "string" || accessKey.trim() === "" || isForbidden(accessKey);
+	return typeof accessKey !== "string" || isForbidden(accessKey) || !ACCESS_KEY_FORMAT.test(accessKey);
 }
 async function getTransactions(accessKey, accounts, startDate, endDate) {
 	const now = /* @__PURE__ */ new Date();
@@ -5685,4 +5710,4 @@ async function run() {
 //#endregion
 export { run };
 
-//# sourceMappingURL=app-GzHx-kED.js.map
+//# sourceMappingURL=app-Du06KVql.js.map