Each word of the query must match something, and words can match
different fields: description, notes, category, tags, entities, account
and account group, a date in the user's format (the year is optional),
or an amount in the user's number format, where a whole number like 234
matches 234.00 to 234.99.
Matching through an id subquery also stops transactions with several
matching tags from showing up more than once.
Results come back as today, tomorrow, yesterday, upcoming (soonest first)
and then past (newest first); past dates used to be oldest first. The
endpoint is now capped at 100 results, as its docstring already claimed.
tom-select also re-scored and re-sorted the server's results on the
client, which scrambled the order while searching. Load-based selects now
keep the server's order, drop the previous query's results, and preload
recent transactions on focus.
TransactionSelect options now look like a compact version of the
transaction item: paid state, type colour, date, description, category,
tags, entities, amount and account. The search endpoint returns that data
as JSON, and pre-selected options carry it in data-data so edit forms
render the same way.
Nesting Row(Column(Row(Column))) shrank every field to a quarter of the
width, since Column defaults to half, and rounded-3 is a Bootstrap class
that doesn't exist here. Use the same card layout as the transfer form:
account at full width with category and tags side by side.
Lay the alert out as an icon | text | button grid so the close button gets
a consistent gap from the message and the same visual inset as the icon.
Long messages now wrap instead of pushing the button, and the aria-label
is quoted.
The temp root is resolve()d in settings but the file path was only
abspath()ed, so a symlink inside the temp folder could point outside it
and still pass the check. Resolve both sides the same way.
Also drop the unused /temp folder from the prod image.
A non-numeric, NaN or infinite value raised while parsing and threw away
the whole table. Each bad row is now skipped on its own.
Log a warning when a table has rows but none of a usable rate type, so a
bank with unknown types does not fail silently.
Add an Options field to exchange rate services. Providers get the raw
text, can validate it on save through clean_options, and describe it
with options_help.
The service form now shows API Key only for providers that require one,
and Options only for providers that read it, with that provider's help.
AllRatesToday reads its bank code from Options instead of API Key.
Drop fixed container names so each worktree gets its own containers,
add docker/dev/worktree.sh to set up and tear down a worktree, and
document it under a new Development section in the README.
Restore asset classes before accounts and take a second pass over accounts
once categories, tags and entities exist, so their links survive a restore
into a fresh install.
- Asset classes (name, optional target %) managed under Management > Investments,
chosen per account
- Charts tab: allocation by asset class and currency, value against invested,
return by investment; off-target classes flagged by the 5/25 rule
- Rebalance tab: what to buy or sell per class to reach the targets
- Investment page: price against average cost with trades, monthly earnings
and income
A value the default manager hides, such as another user's object already set
on a shared record, was taken as a new name and created a duplicate named
after its id.
Navigating back while a mobile picker was open reattached its overlay still
active, leaving the page covered by an overlay nothing could close. Also skip
the reattach when the global container doesn't exist yet.
Import uploads were always written to /usr/src/app/temp, presets were
read from /usr/src/app/import_presets and the caches lived in /var/tmp,
so WYGIWYH only worked from the Docker image's layout. Running it as a
systemd service with a strict sandbox, or on an immutable distro like
NixOS, needs these folders to follow the app or be configurable.
- Presets are read from IMPORT_PRESETS_ROOT, the import_presets folder
next to the app.
- Uploads wait in IMPORT_TEMP_ROOT, the temp folder next to the app by
default, and movable with the IMPORT_TEMP_ROOT env var. The web views,
the API and the import service all use it.
- The file-based caches live under CACHE_ROOT, /var/tmp by default, and
movable with the CACHE_ROOT env var.
In the Docker image the app sits in /usr/src/app, so every default
resolves to the same folder as before.
The import service checked that a file was inside the temp folder with a
plain string prefix, which also accepted sibling folders such as
/usr/src/app/temp-other. It now compares paths.
CI no longer needs to create /usr/src/app before running the tests.
Fixes#472
On touch devices AirDatepicker opens pickers in mobile mode, which closes
them through a shared overlay rather than on blur. The library keeps that
overlay in its module scope, inside a global container appended to the
body. Boosted navigation swaps the body, so the container and overlay are
removed: the library notices the missing container and builds a new one
for the next picker, but keeps reusing the detached overlay. From then on
nothing receives the outside click, and an open picker stays on screen
over the form until the page is fully reloaded.
Create every picker through a helper that remembers the overlay and moves
it back into the current global container whenever it was left detached.
Fixes#227
Unlinked transactions on value-tracked accounts counted as gains and losses,
so a salary was yield and a bill was a loss. They now count as money in and
out, unless they match the account's new income categories or tags, or its
income entities. Those three define the account's result; only entities also
match income paid into other accounts.
Replace the single exchange rate option with a limit of rates kept per
currency pair (oldest deleted first) and an option to keep one rate per
day. Services that kept a single rate migrate to a limit of 1.
Investments are accounts flagged as investments; performance is derived from their transactions. Linked transfers are contributions and withdrawals (average cost, realized gains), unlinked transactions are gains or losses, and income comes from the accounts' income entities.
- Unit-priced (exchange currency) or value-tracked accounts
- Money-weighted return (XIRR), annualized after a year
- Totals converted along each currency's exchange chain, with currency effect
- Investments list and detail pages; buy/sell/income use the transfer and transaction forms
- GET /api/accounts/<id>/performance/
Transactions created from a DCA entry, or picked from existing ones, are now linked as a transfer, so investment tracking sees the purchase. A data migration links the pairs of existing entries when valid.
The update check shared the file-based default cache with cachalot, whose culling randomly deleted the key as pages loaded. Store only the latest release in a dedicated cache, compare it to APP_VERSION at render time, and drop the startup delete. Hide the banner when CHECK_FOR_UPDATES is off or APP_VERSION isn't a valid version.
- Add flag-off login page and admin password tests so the refusal tests can't pass for unrelated reasons
- Expect exactly 401 from refused basic auth
- Gate OIDC_DISABLE_LOCAL_LOGIN on an explicit OIDC_CONFIGURED flag
- Realign the README OIDC table, use "email" consistently, and warn about lockout with OIDC_ALLOW_SIGNUP=false
Herculino Trotta
eitchtee
Herculino Trotta
Asish Kumar
cahthuranag
dependabot[bot]
Weblate
sorcierwax