bradenrayhorn / beans Goto Github PK

Total money available to budget in a given month should be displayed on the budget page.

The money available should be equal to:

+ sum of all transactions with "income" category in current and previous months
- currently assigned money in all months, including future

Requires #138 to be complete first. ✅

Recommended by OWASP: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#introduction.

Categories and category groups should be limited to some fixed amount per budget.

Proposed limits:

• Categories: 250
• Category Groups: 50

Errors should be wrapped and transformed into HTTP errors if needed. A message should be included in response.

Limit the number of accounts that can be created per budget. First suggestion: 50.

Validate API response JSON to make sure they fit the defined Typescript types.

Review CORS and cookie policies (SameSite, etc) for security.

And credentials: include on frontend.

Look into what happens to a pgx db transaction when a context is cancelled. Is the transaction rolled back?

The balance on the accounts page should be reflect the sum of all transactions for each account.

Some thoughts from GitLab:

• https://docs.gitlab.com/ee/development/database/avoiding_downtime_in_migrations.html
• https://docs.gitlab.com/ee/update/zero_downtime.html

Remove status task and just require all 4 shards to complete. Keeps things simpler.

Amount arithmetic is a bit all over the place in beans/currency.go. It should be refactored to just be functions, not functions on a struct.

Also check it matters whether apd.Decimal is a pointer.

Fix login page becoming stuck if you input wrong password or other network error occurs.

Should do #240 first.

Very large amounts should either be impossible to be saved or be handled correctly. Make sure both backend and frontend can handle large numbers.

Limiting transactions to a certain amount may be the simplest way to accomplish. Even a $1,000,000 limit should be enough to prevent running into limits.

Javascript max number with precision of 2 decimal digits is 70368744177663 (https://stackoverflow.com/a/57225494). So it would take 70 million transaction of one million dollars to hit that limit.

Current amount available to budget for the month should be displayed on the budget page.

Example:

, May --- June --- February
Income: 0 --- 500 --- 0
To budget: 0 --- 0 --- 380
Electric assigned: 0 --- 50 --- 50
Shopping assigned: 0 --- 20 --- 0
Carryover: 0 --- 430 --- 0

, May --- June --- February
Income: 0 --- 500 --- 0
To budget: 0 --- 430 --- 0
Electric assigned: 0 --- 50 --- 0
Shopping assigned: 0 --- 20 --- 0
Carryover: 0 --- 0 --- 0

When creating the default month for a budget on the get single budget endpoint, server timezone is used to get the current month.

Timezone (or current local time) should be passed in a header and read by the server. This timezone should be used to find the current time and default month.

This prevents the wrong month from being created for the user when calling the endpoint near the end of a month and in a different timezone than the server.

The TestMonth/can_create_and_get test seems to have a case where it can fail.

https://github.com/bradenrayhorn/beans/actions/runs/3817487468/jobs/6493776991

Logout functionality should be implemented

Amounts that have a comma in them fail to save as transactions, as the frontend is sending a comma.

The amount should be sent as a number, much like the category assigned amount editing on the budget page.

Sending a request with an invalid date format (i.e. 2022-12-0) results in a 500 error. This should instead return a 422 saying the date (and which json field) was in an invalid format.

https://github.com/ArnaudBarre/eslint-plugin-react-refresh

https://github.com/jackc/pgx/blob/master/CHANGELOG.md#v500-september-17-2022

Depends on sqlc supporting v5 https://www.github.com/kyleconroy/sqlc/issues/1823

Most contract functions do not do access validation.

For example, MonthContract.setCategoryAmount does not validate the month belongs to a budget that the user has access to.

To meet the goal of having the HTTP packing simply handle translate contracts to JSON and HTTP results, the contract package could handle access validation.

However, a logical place to write this access validation must be found.

Also consider how testing access control and whether this ends up in full HTTP integration tests

Potential:

type AuthContext struct {
}

func (auth *AuthContext) User() User {
	return User{}
}

type BudgetAuthContext struct {
	AuthContext
}

type MonthAuthContext struct {
	BudgetAuthContext
}

var x = func() {
	auth := AuthContext{}
	budget := BudgetAuthContext{auth}

	budget.User()
}

Properly handle signals to process and gracefully shutdown

Standard log format should be figured out.

User logic should be replace with a user contract and appropriate tests.

Add some more unit tests.

• Authentication middleware
• Logic services
• Postgres repositories?

Include sqlc and migrate docs

Having some problems with the node fetch implementation in tests (remix-run/react-router#10118).

Try update to node 18 at some point in future, it will apparently be fixed.

For now, sticking with node 16 and polyfilling the fetch API.

Eslint, prettier format

Add tests for SPA served from http/frontend.go. Need to mock the embedded FS.

Probably could setup a mock dist directory somewhere, then change embed_mock.go to read from there. The prefix "dist" hardcoded in frontend.go might need to be imported from the web/embed*.go files to allow it to be customized.

Add tests for Beans CLI (only command is currently beans migrate. Potentially improve the structure of the code to help with testability.

See post: https://tkdodo.eu/blog/react-query-meets-react-router.

This could result in no changes for the frontend, but worth reviewing.

Look into running Jest (and nextjs build process) in ES modules mode. https://jestjs.io/docs/ecmascript-modules

This would be beneficial as some dependencies (namely ky) are exclusively ES modules. If Jest was running in ESM mode, extra rules to setup proper transformations in the config would not be needed.

Add workflows for go code quality:

• Go format, lint
  • https://github.com/marketplace/actions/run-golangci-lint
  • gofmt

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Pending Status Checks

These updates await pending status checks. To force their creation now, click the checkbox below.

• Update dependency @playwright/test to v1.36.1
• Update dependency @tanstack/react-query to v4.29.25
• Update dependency downshift to v7.6.2
• Update dependency framer-motion to v10.12.22
• Update dependency react-hook-form to v7.45.2
• Update typescript-eslint monorepo to v6.1.0 (@typescript-eslint/eslint-plugin, @typescript-eslint/parser)
• Update dependency downshift to v8

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update dependency react-focus-lock to v2.9.5
• Update dependency eslint to v8.45.0
• Update postgres Docker tag to v15.3
• Update dependency prettier to v3
• Click on this checkbox to rebase all open PRs at once

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

• Update module github.com/jackc/pgx/v4 to v5

Detected dependencies

• Check this box to trigger a request for Renovate to run again on this repository

Certain categories need to have the ability to be marked as "income" categories. This lets us determine if the category should be included in "budgetable" money.

• Move additional user endpoints to user contract.
• Add HTTP unit test coverage for user endpoints
  • Keep one integration for register/login/me flow
• Test auth middleware?

Validate incoming user data.

Ex: cannot create user with no username or no password

All errors should appear at once, not one message at a time.

Left over available money from the previous month in a category should be included in the available total in next month's budget for that same category.

Currently code is bundled into one big index.js file, Vite/React should be configured to split this into multiple files.

Write test structure. Maybe use https://github.com/orlangure/gnomock

Add a DateInput component that can be used for date inputs.

Only allow valid dates can be entered.

Setup automated action to automatically check for dependency updates. Something like dependabot or renovate.

There is no transition when switching months which can be a little jarring.

Maybe something could slide in/out? At the very least need to get rid of the budget numbers flashing on screen.

Database, http port, etc should be pulled from env config or similar.

beansd and beans should both utilize this config.

Cleanup ky setup. Remove extra query parameters (cookie on get me).

Better organize error handling. Add error logger.