From 917797bb16f24608ba65d760d32a8a28222badbbe50c3daa9e3a44d24ec690e8 Mon Sep 17 00:00:00 2001 From: wlfb Date: Fri, 17 Jul 2026 20:16:08 +0200 Subject: [PATCH] fix: Duplikat-Recheck beim Confirm nur statement-uebergreifend Zwei identische Buchungen im selben Auszug teilen sich den dedup_hash. Beim Confirm markierte die zuerst bestaetigte Buchung ihren Zwilling (autoflush + Clash-Select) als Duplikat und uebersprang ihn, wodurch der vom Preview gepruefte Saldo zerstoert wurde. Clash-Query um statement_id != tx.statement_id erweitert: der Re-Check schuetzt nur noch statement-uebergreifend. Test: Auszug mit zwei identischen Buchungen -> beide werden bestaetigt. Co-Authored-By: Claude Fable 5 --- finance/app/routers/imports.py | 5 +++++ finance/tests/test_import_api.py | 38 ++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+) diff --git a/finance/app/routers/imports.py b/finance/app/routers/imports.py index 7292ad0..b024133 100644 --- a/finance/app/routers/imports.py +++ b/finance/app/routers/imports.py @@ -133,6 +133,11 @@ def confirm(statement_id: int, session: Session = Depends(get_session)): Transaction.dedup_hash == tx.dedup_hash, Transaction.status == "confirmed", Transaction.id != tx.id, + # Only guard against duplicates from OTHER statements. Two + # genuinely identical bookings within the same statement share a + # dedup_hash; the balance the preview validated depends on both + # being confirmed, so they must not knock each other out here. + Transaction.statement_id != tx.statement_id, ) ).scalar() if clash is not None: diff --git a/finance/tests/test_import_api.py b/finance/tests/test_import_api.py index ee24842..f11fcf7 100644 --- a/finance/tests/test_import_api.py +++ b/finance/tests/test_import_api.py @@ -21,6 +21,25 @@ def fake_parse(monkeypatch): monkeypatch.setattr("app.services.importer.parse_pdf", lambda p: FAKE) +# Ein Auszug mit ZWEI identischen Buchungen (gleicher dedup_hash). Saldo bleibt +# konsistent (100 - 60 - 60 = -20). Beide muessen bestaetigt werden koennen. +FAKE_TWINS = ParsedStatement( + bank="dkb", iban="DE02120300000000202051", + period_start=date(2026, 6, 1), period_end=date(2026, 6, 30), + opening_balance=Decimal("100.00"), closing_balance=Decimal("-20.00"), + transactions=[ + ParsedTransaction(date(2026, 6, 3), date(2026, 6, 3), + Decimal("-60.00"), "Miete Juni", "Vermieter"), + ParsedTransaction(date(2026, 6, 3), date(2026, 6, 3), + Decimal("-60.00"), "Miete Juni", "Vermieter"), + ]) + + +@pytest.fixture +def fake_parse_twins(monkeypatch): + monkeypatch.setattr("app.services.importer.parse_pdf", lambda p: FAKE_TWINS) + + def _upload(client, name="auszug.pdf"): return client.post("/api/imports/upload", headers=H, files={"file": (name, b"%PDF-fake", "application/pdf")}) @@ -68,6 +87,25 @@ def test_confirm_rechecks_duplicates_across_two_drafts(client, fake_parse, tmp_p assert client.post(f"/api/imports/{sid1}/confirm", headers=H).status_code == 409 +def test_confirm_keeps_identical_twins_within_same_statement(client, fake_parse_twins, tmp_path, monkeypatch): + # Zwei identische Buchungen im SELBEN Auszug teilen sich den dedup_hash. Der + # Confirm-Re-Check darf nur statement-uebergreifende Duplikate abfangen, + # sonst wuerde die erste bestaetigte Buchung ihre Zwillingsbuchung als + # Duplikat markieren und den vom Preview geprueften Saldo zerstoeren. + monkeypatch.setenv("FB_INBOX_DIR", str(tmp_path / "inbox")) + monkeypatch.setenv("FB_UPLOADS_DIR", str(tmp_path / "uploads")) + from app.config import get_settings + get_settings.cache_clear() + sid = _upload(client).json()["id"] + prev = client.get(f"/api/imports/{sid}/preview", headers=H).json() + assert prev["balance_ok"] is True + assert prev["duplicates"] == 0 + assert client.post(f"/api/imports/{sid}/confirm", headers=H).status_code == 200 + txs = client.get("/api/transactions", headers=H).json() + assert len(txs) == 2 + assert all(t["status"] == "confirmed" for t in txs) + + def test_upload_sanitizes_path_traversal_filename(client, fake_parse, tmp_path, monkeypatch): monkeypatch.setenv("FB_INBOX_DIR", str(tmp_path / "inbox")) monkeypatch.setenv("FB_UPLOADS_DIR", str(tmp_path / "uploads"))