From e617e809c0d29ba589c18b935af49f501fae3fbe Mon Sep 17 00:00:00 2001
From: Herculino Trotta <hello@herculino.com>
Date: Thu, 12 Nov 2026 00:14:06 -0300
Subject: [PATCH] fix(import): reject archived accounts when importing through
 the API

The upload form only lists active accounts, but the API accepted any account
the user can access, archived ones included.
---
 app/apps/api/serializers/imports.py           |  4 ++--
 app/apps/import_app/tests/test_run_account.py | 10 ++++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/app/apps/api/serializers/imports.py b/app/apps/api/serializers/imports.py
index 7d06635b..e6bc020f 100644
--- a/app/apps/api/serializers/imports.py
+++ b/app/apps/api/serializers/imports.py
@@ -43,7 +43,7 @@ class ImportFileSerializer(serializers.Serializer):
     )
     file = serializers.FileField()
     account_id = serializers.PrimaryKeyRelatedField(
-        queryset=Account.objects.all(),
+        queryset=Account.objects.filter(is_archived=False),
         source="account",
         required=False,
         allow_null=True,
@@ -53,7 +53,7 @@ class ImportFileSerializer(serializers.Serializer):
         super().__init__(*args, **kwargs)
         # Reload the querysets to get an updated version with the requesting user
         self.fields["profile_id"].queryset = ImportProfile.objects.all()
-        self.fields["account_id"].queryset = Account.objects.all()
+        self.fields["account_id"].queryset = Account.objects.filter(is_archived=False)
 
     def validate(self, data):
         if data.get("account") and not data["profile"].imports_transactions:
diff --git a/app/apps/import_app/tests/test_run_account.py b/app/apps/import_app/tests/test_run_account.py
index 053ee932..a0447a5d 100644
--- a/app/apps/import_app/tests/test_run_account.py
+++ b/app/apps/import_app/tests/test_run_account.py
@@ -359,6 +359,16 @@ class ImportRunAccountAPITests(ImportRunAccountTestCase):
         self.assertIn("account_id", response.data)
         mock_defer.assert_not_called()
 
+    @patch("apps.api.views.imports.process_import.defer")
+    def test_api_rejects_an_archived_account(self, mock_defer):
+        response = self._post(
+            self.private_profile, account_id=self.archived_account.id
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertIn("account_id", response.data)
+        mock_defer.assert_not_called()
+
     @patch("apps.api.views.imports.process_import.defer")
     def test_api_rejects_an_account_for_profiles_not_importing_transactions(
         self, mock_defer