Merge branch 'accounting' into dev

Signed-off-by: Stephan Richter <s.richter@srsoftware.de>

.gitea/workflows/docker.yaml

@@ -53,8 +53,10 @@ jobs:
         run: |
           TAGS="$(curl -s -u "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASS }}" https://${{ secrets.REGISTRY_PATH }}/v2/umbrella/tags/list | jq -r ".tags[]")"
           COUNT=$(echo "$TAGS" | wc -l)
+          echo found $COUNT tags: $TAGS
           if [ $COUNT -gt 10 ]; then
             REMAIN=$((COUNT - 10))
+            echo $REMAIN tags will be kept!
             echo "$TAGS" | head -n $REMAIN > /tmp/old_tags
           else
             echo less than 10 tags, skipping cleanup

accounting/src/main/java/de/srsoftware/umbrella/accounting/AccountDb.java

@@ -3,7 +3,6 @@ package de.srsoftware.umbrella.accounting;
 
 import de.srsoftware.umbrella.core.model.Account;
 import de.srsoftware.umbrella.core.model.Transaction;
-import de.srsoftware.umbrella.core.model.UmbrellaUser;
 import java.util.Collection;
 import java.util.List;
 import java.util.Optional;
@@ -14,8 +13,6 @@ public interface AccountDb {
 
 	void dropTransactionTag(long transactionId, String tag);
 
-	Collection<UmbrellaUser> getMembers(long accountId);
-
 	Optional<Transaction> lastTransaction(long accountId, String source, String dest, double amount);
 
 	Collection<Account> listAccounts(long userId);

accounting/src/main/java/de/srsoftware/umbrella/accounting/AccountingModule.java

@@ -7,9 +7,11 @@ import static de.srsoftware.umbrella.core.ConnectionProvider.connect;
 import static de.srsoftware.umbrella.core.ModuleRegistry.tagService;
 import static de.srsoftware.umbrella.core.ModuleRegistry.userService;
 import static de.srsoftware.umbrella.core.constants.Path.*;
-import static de.srsoftware.umbrella.core.exceptions.UmbrellaException.*;
+import static de.srsoftware.umbrella.core.exceptions.UmbrellaException.invalidField;
+import static de.srsoftware.umbrella.core.exceptions.UmbrellaException.missingField;
 import static de.srsoftware.umbrella.messagebus.MessageBus.messageBus;
 import static de.srsoftware.umbrella.messagebus.events.Event.EventType.CREATE;
+import static java.lang.System.Logger.Level.WARNING;
 
 import com.sun.net.httpserver.HttpExchange;
 import de.srsoftware.configuration.Configuration;
@@ -53,7 +55,6 @@ public class AccountingModule extends BaseHandler implements AccountingService {
 				case TRANSACTION -> {
 					try {
 						var transaction = accountDb.loadTransaction(Long.parseLong(path.pop()));
-						if (!accountDb.getMembers(transaction.accountId()).contains(user.get())) throw forbidden("You are not allowed to access account {id}",Field.ID,transaction.accountId());
 						yield dropTransaction(transaction, user.get(), path, ex);
 					} catch (NumberFormatException ignored) {
 						yield super.doDelete(path,ex);
@@ -127,7 +128,6 @@ public class AccountingModule extends BaseHandler implements AccountingService {
 				default -> {
 					try {
 						var accountId = Long.parseLong(head);
-						if (!accountDb.getMembers(accountId).contains(user.get())) throw forbidden("You are not allowed to access account {id}",Field.ID,accountId);
 						yield postToAccount(accountId,path,user.get(),ex);
 					} catch (NumberFormatException ignored) {
 						yield super.doPost(path,ex);
@@ -156,6 +156,7 @@ public class AccountingModule extends BaseHandler implements AccountingService {
 	}
 
 	private boolean dropTransactionTag(UmbrellaUser user, Transaction transaction, HttpExchange ex) throws IOException {
+		LOG.log(WARNING,"Missing permission check in AccountModule.dropTransactionTag!");
 		var json = json(ex);
 		if (!json.has(Field.TAG)) throw missingField(Field.TAG);
 		var tag = json.getString(Field.TAG);
@@ -185,7 +186,7 @@ public class AccountingModule extends BaseHandler implements AccountingService {
 	}
 
 	private boolean getAccount(UmbrellaUser user, long accountId, HttpExchange ex) throws IOException {
-		if (!accountDb.getMembers(accountId).contains(user)) throw forbidden("You are not allowed to access account {id}",Field.ID,accountId);
+		LOG.log(WARNING,"Missing authorization check in AccountingModule.getAccount(…)!");
 		return sendContent(ex, loadAccount(accountId));
 	}
 
@@ -224,7 +225,7 @@ public class AccountingModule extends BaseHandler implements AccountingService {
 
 	private boolean patchTransaction(UmbrellaUser user, long transactionId, HttpExchange ex) throws IOException {
 		var transaction = accountDb.loadTransaction(transactionId);
-		if (!accountDb.getMembers(transaction.accountId()).contains(user)) throw forbidden("You are not allowed to access account {id}",Field.ID,transaction.accountId());
+		LOG.log(WARNING,"Missing permission check in patchTransaction(…)!");
 		var oldData = transaction.toMap();
 		var json = json(ex);
 		if (json.has(Field.AMOUNT)) transaction.amount(json.getDouble(Field.AMOUNT));
@@ -336,6 +337,7 @@ public class AccountingModule extends BaseHandler implements AccountingService {
 	}
 
 	private boolean postSearchTags(long accountId, UmbrellaUser user, HttpExchange ex) throws IOException {
+		LOG.log(WARNING,"Missing authorization check in AccountingModule.getAccount(…)!");
 		var key = body(ex);
 		if (!key.trim().startsWith("{")) { // search tags that contain value of body
 			var tags = accountDb.searchTagsContaining(key, accountId);

accounting/src/main/java/de/srsoftware/umbrella/accounting/SqliteDb.java

@@ -7,7 +7,6 @@ import static de.srsoftware.tools.jdbc.Condition.*;
 import static de.srsoftware.tools.jdbc.Query.*;
 import static de.srsoftware.tools.jdbc.Query.SelectQuery.ALL;
 import static de.srsoftware.umbrella.accounting.Constants.*;
-import static de.srsoftware.umbrella.core.ModuleRegistry.userService;
 import static de.srsoftware.umbrella.core.constants.Field.*;
 import static de.srsoftware.umbrella.core.exceptions.UmbrellaException.*;
 import static de.srsoftware.umbrella.core.model.Translatable.t;
@@ -20,7 +19,6 @@ import de.srsoftware.umbrella.core.constants.Field;
 import de.srsoftware.umbrella.core.constants.Text;
 import de.srsoftware.umbrella.core.model.Account;
 import de.srsoftware.umbrella.core.model.Transaction;
-import de.srsoftware.umbrella.core.model.UmbrellaUser;
 import java.sql.Connection;
 import java.sql.SQLException;
 import java.time.ZoneOffset;
@@ -148,27 +146,6 @@ public class SqliteDb extends BaseDb implements AccountDb {
 		}
 	}
 
-	@Override
-	public Collection<UmbrellaUser> getMembers(long accountId) {
-		try {
-			var userIds = new HashSet<Long>();
-			var rs = select("DISTINCT "+ SOURCE).from(TABLE_TRANSACTIONS).where(ACCOUNT,equal(accountId)).exec(db);
-			while (rs.next()) try {
-				userIds.add(Long.parseLong(rs.getString(1)));
-			} catch (NumberFormatException ignored) {}
-			rs.close();
-			rs = select("DISTINCT "+ DESTINATION).from(TABLE_TRANSACTIONS).where(ACCOUNT,equal(accountId)).exec(db);
-			while (rs.next()) try {
-				userIds.add(Long.parseLong(rs.getString(1)));
-			} catch (NumberFormatException ignored) {}
-			rs.close();
-			var us = userService();
-			return userIds.stream().map(us::loadUser).toList();
-		} catch (SQLException e) {
-			throw failedToLoadMembers(Text.ACCOUNT);
-		}
-	}
-
 	@Override
 	public Optional<Transaction> lastTransaction(long accountId, String source, String dest, double amount) {
 		try {

frontend/src/Components/Autocomplete.svelte

@@ -132,7 +132,7 @@
         color: orange;
         border: 1px solid orange;
         border-radius: 5px;
-        z-index: 65;
+        z-index: 50;
         list-style: none;
         padding: 4px;
         margin: 0;

frontend/src/routes/notes/Index.svelte

@@ -33,7 +33,6 @@
             authors    = {...authors, ...data.authors};
             loader.offset += loader.limit;
             loader.active  = false;
-            console.log({authors});
             yikes();
             if (Object.keys(data.notes).length) onscroll(null); // when notes were received, check whether they fill up the page
 
@@ -79,4 +78,4 @@
 </svelte:head>
 
 <svelte:window {onscroll} />
-<List {notes} {authors} />
+<List {notes} />

frontend/src/routes/notes/List.svelte

@@ -64,7 +64,6 @@
     <legend class="entity" onclick={() => goToEntity(note)}>{title(note)}</legend>
     {/if}
     <legend class="time">
-        {#if !module} {authors[note.user_id].name} – {/if}
         {note.timestamp.replace('T',' ')}
         {#if user.id == note.user_id}
         <button class="symbol" onclick={() => drop(note.id)}></button>