Compare commits

...

2 Commits

Author SHA1 Message Date
Thomas Kaul 108e29444a
Task/add scopes to access (#7603) 3 days ago
David Requeno 9d2e4b732c
Feature/add stock splits logic (#7568) 3 days ago
  1. 15
      CHANGELOG.md
  2. 42
      apps/api/src/app/access/access.controller.ts
  3. 9
      apps/api/src/app/account/account.controller.ts
  4. 7
      apps/api/src/app/activities/activities.controller.ts
  5. 2
      apps/api/src/app/activities/activities.module.ts
  6. 337
      apps/api/src/app/activities/activities.service.spec.ts
  7. 48
      apps/api/src/app/activities/activities.service.ts
  8. 7
      apps/api/src/app/endpoints/asset-profiles/asset-profiles.controller.ts
  9. 179
      apps/api/src/app/endpoints/asset-profiles/asset-profiles.service.spec.ts
  10. 56
      apps/api/src/app/endpoints/asset-profiles/asset-profiles.service.ts
  11. 5
      apps/api/src/app/endpoints/benchmarks/benchmarks.controller.ts
  12. 5
      apps/api/src/app/endpoints/watchlist/watchlist.controller.ts
  13. 4
      apps/api/src/app/portfolio/calculator/roai/portfolio-calculator-cash.spec.ts
  14. 276
      apps/api/src/app/portfolio/calculator/roai/portfolio-calculator-stock-split.spec.ts
  15. 70
      apps/api/src/app/portfolio/portfolio.controller.ts
  16. 2
      apps/api/src/app/portfolio/portfolio.service.spec.ts
  17. 3
      apps/api/src/app/user/user.controller.ts
  18. 10
      apps/api/src/app/user/user.service.ts
  19. 2
      apps/api/src/decorators/impersonation.decorator.ts
  20. 41
      apps/api/src/decorators/requires-scope.decorator.spec.ts
  21. 26
      apps/api/src/decorators/requires-scope.decorator.ts
  22. 50
      apps/api/src/guards/scope.guard.ts
  23. 29
      apps/api/src/interceptors/redact-values-in-response/redact-values-in-response.interceptor.ts
  24. 114
      apps/api/src/services/asset-profile-split/asset-profile-split.helper.spec.ts
  25. 58
      apps/api/src/services/asset-profile-split/asset-profile-split.helper.ts
  26. 161
      apps/api/src/services/asset-profile-split/asset-profile-split.service.spec.ts
  27. 27
      apps/api/src/services/asset-profile-split/asset-profile-split.service.ts
  28. 32
      apps/api/src/services/impersonation/impersonation.service.ts
  29. 8
      apps/api/src/services/queues/data-gathering/data-gathering.service.ts
  30. 4
      apps/client/src/app/components/access-table/access-table.component.html
  31. 5
      apps/client/src/app/components/access-table/access-table.component.ts
  32. 13
      apps/client/src/app/components/account-detail-dialog/account-detail-dialog.component.ts
  33. 4
      apps/client/src/app/components/admin-market-data/asset-profile-dialog/asset-profile-dialog.html
  34. 3
      apps/client/src/app/components/user-account-access/create-or-update-access-dialog/interfaces/interfaces.ts
  35. 21
      apps/client/src/app/components/user-account-access/user-account-access.component.ts
  36. 13
      apps/client/src/app/pages/portfolio/allocations/allocations-page.component.ts
  37. 27
      apps/client/src/app/pages/portfolio/analysis/analysis-page.component.ts
  38. 3
      libs/common/src/lib/dtos/create-access.dto.ts
  39. 3
      libs/common/src/lib/dtos/update-access.dto.ts
  40. 6
      libs/common/src/lib/interfaces/access.interface.ts
  41. 3
      libs/common/src/lib/interfaces/user.interface.ts
  42. 25
      libs/common/src/lib/permissions.ts
  43. 130
      libs/common/src/lib/scopes.spec.ts
  44. 78
      libs/common/src/lib/scopes.ts
  45. 1
      libs/common/src/lib/types/impersonation-context.type.ts
  46. 3
      libs/common/src/lib/types/user-with-settings.type.ts
  47. 2
      prisma/migrations/20260815120000_added_symbol_profile_id_index_to_order/migration.sql
  48. 24
      prisma/migrations/20260815130000_added_scopes_to_access/migration.sql
  49. 3
      prisma/schema.prisma

15
CHANGELOG.md

@ -5,6 +5,21 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## Unreleased
### Added
- Added the business logic and tests for stock splits of an asset profile (experimental)
- Added the scopes to the access
- Added an index for `symbolProfileId` to the order database table
### Changed
- Changed the redaction of the monetary values in impersonation mode to be based on the scopes of the access
- Deprecated the `permissions` attribute of the access in favor of the scopes
- Extended the `GET api/v1/access` endpoint by the scopes
- Extended the `GET api/v1/user` endpoint by the scopes
## 3.51.0 - 2026-08-14 ## 3.51.0 - 2026-08-14
### Changed ### Changed

42
apps/api/src/app/access/access.controller.ts

@ -6,6 +6,7 @@ import { CreateAccessDto, UpdateAccessDto } from '@ghostfolio/common/dtos';
import { SubscriptionType } from '@ghostfolio/common/enums'; import { SubscriptionType } from '@ghostfolio/common/enums';
import { Access, AccessSettings } from '@ghostfolio/common/interfaces'; import { Access, AccessSettings } from '@ghostfolio/common/interfaces';
import { permissions } from '@ghostfolio/common/permissions'; import { permissions } from '@ghostfolio/common/permissions';
import { getScopesOfAccess } from '@ghostfolio/common/scopes';
import type { RequestWithUser } from '@ghostfolio/common/types'; import type { RequestWithUser } from '@ghostfolio/common/types';
import { import {
@ -47,29 +48,32 @@ export class AccessController {
where: { userId: this.request.user.id } where: { userId: this.request.user.id }
}); });
return accessesWithGranteeUser.map( return accessesWithGranteeUser.map((accessItem) => {
({ alias, granteeUser, id, permissions, settings }) => { const { alias, granteeUser, id, permissions, settings } = accessItem;
if (granteeUser) { const scopes = getScopesOfAccess(accessItem);
return {
alias,
id,
permissions,
grantee: granteeUser?.id,
settings: settings as AccessSettings,
type: 'PRIVATE'
};
}
if (granteeUser) {
return { return {
alias, alias,
id, id,
permissions, permissions,
grantee: 'Public', scopes,
grantee: granteeUser?.id,
settings: settings as AccessSettings, settings: settings as AccessSettings,
type: 'PUBLIC' type: 'PRIVATE'
}; };
} }
);
return {
alias,
id,
permissions,
scopes,
grantee: 'Public',
settings: settings as AccessSettings,
type: 'PUBLIC'
};
});
} }
@HasPermission(permissions.createAccess) @HasPermission(permissions.createAccess)
@ -95,6 +99,10 @@ export class AccessController {
? { connect: { id: data.granteeUserId } } ? { connect: { id: data.granteeUserId } }
: undefined, : undefined,
permissions: data.permissions, permissions: data.permissions,
scopes: getScopesOfAccess({
granteeUserId: data.granteeUserId,
permissions: data.permissions
}),
settings: this.accessService.buildSettings(data.filters), settings: this.accessService.buildSettings(data.filters),
user: { connect: { id: this.request.user.id } } user: { connect: { id: this.request.user.id } }
}); });
@ -164,6 +172,10 @@ export class AccessController {
? { connect: { id: data.granteeUserId } } ? { connect: { id: data.granteeUserId } }
: { disconnect: true }, : { disconnect: true },
permissions: data.permissions, permissions: data.permissions,
scopes: getScopesOfAccess({
granteeUserId: data.granteeUserId,
permissions: data.permissions ?? originalAccess.permissions
}),
settings: this.accessService.buildSettings(data.filters) settings: this.accessService.buildSettings(data.filters)
}, },
where: { id } where: { id }

9
apps/api/src/app/account/account.controller.ts

@ -2,8 +2,8 @@ import { AccountBalanceService } from '@ghostfolio/api/app/account-balance/accou
import { PortfolioService } from '@ghostfolio/api/app/portfolio/portfolio.service'; import { PortfolioService } from '@ghostfolio/api/app/portfolio/portfolio.service';
import { HasPermission } from '@ghostfolio/api/decorators/has-permission.decorator'; import { HasPermission } from '@ghostfolio/api/decorators/has-permission.decorator';
import { Impersonation } from '@ghostfolio/api/decorators/impersonation.decorator'; import { Impersonation } from '@ghostfolio/api/decorators/impersonation.decorator';
import { RequiresScope } from '@ghostfolio/api/decorators/requires-scope.decorator';
import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard'; import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard';
import { ImpersonationGuard } from '@ghostfolio/api/guards/impersonation.guard';
import { RedactValuesInResponseInterceptor } from '@ghostfolio/api/interceptors/redact-values-in-response/redact-values-in-response.interceptor'; import { RedactValuesInResponseInterceptor } from '@ghostfolio/api/interceptors/redact-values-in-response/redact-values-in-response.interceptor';
import { TransformDataSourceInRequestInterceptor } from '@ghostfolio/api/interceptors/transform-data-source-in-request/transform-data-source-in-request.interceptor'; import { TransformDataSourceInRequestInterceptor } from '@ghostfolio/api/interceptors/transform-data-source-in-request/transform-data-source-in-request.interceptor';
import { ApiService } from '@ghostfolio/api/services/api/api.service'; import { ApiService } from '@ghostfolio/api/services/api/api.service';
@ -18,6 +18,7 @@ import {
AccountsResponse AccountsResponse
} from '@ghostfolio/common/interfaces'; } from '@ghostfolio/common/interfaces';
import { permissions } from '@ghostfolio/common/permissions'; import { permissions } from '@ghostfolio/common/permissions';
import { scopes } from '@ghostfolio/common/scopes';
import type { import type {
ImpersonationContext, ImpersonationContext,
RequestWithUser RequestWithUser
@ -84,7 +85,7 @@ export class AccountController {
} }
@Get() @Get()
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @RequiresScope(scopes.accountRead)
@UseInterceptors(RedactValuesInResponseInterceptor) @UseInterceptors(RedactValuesInResponseInterceptor)
@UseInterceptors(TransformDataSourceInRequestInterceptor) @UseInterceptors(TransformDataSourceInRequestInterceptor)
public async getAllAccounts( public async getAllAccounts(
@ -107,7 +108,7 @@ export class AccountController {
} }
@Get(':id') @Get(':id')
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @RequiresScope(scopes.accountRead)
@UseInterceptors(RedactValuesInResponseInterceptor) @UseInterceptors(RedactValuesInResponseInterceptor)
public async getAccountById( public async getAccountById(
@Impersonation() { userId }: ImpersonationContext, @Impersonation() { userId }: ImpersonationContext,
@ -124,7 +125,7 @@ export class AccountController {
} }
@Get(':id/balances') @Get(':id/balances')
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @RequiresScope(scopes.accountRead)
@UseInterceptors(RedactValuesInResponseInterceptor) @UseInterceptors(RedactValuesInResponseInterceptor)
public async getAccountBalancesById( public async getAccountBalancesById(
@Impersonation() { userId, userSettings }: ImpersonationContext, @Impersonation() { userId, userSettings }: ImpersonationContext,

7
apps/api/src/app/activities/activities.controller.ts

@ -1,7 +1,7 @@
import { HasPermission } from '@ghostfolio/api/decorators/has-permission.decorator'; import { HasPermission } from '@ghostfolio/api/decorators/has-permission.decorator';
import { Impersonation } from '@ghostfolio/api/decorators/impersonation.decorator'; import { Impersonation } from '@ghostfolio/api/decorators/impersonation.decorator';
import { RequiresScope } from '@ghostfolio/api/decorators/requires-scope.decorator';
import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard'; import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard';
import { ImpersonationGuard } from '@ghostfolio/api/guards/impersonation.guard';
import { isActivityInFuture } from '@ghostfolio/api/helper/activity.helper'; import { isActivityInFuture } from '@ghostfolio/api/helper/activity.helper';
import { RedactValuesInResponseInterceptor } from '@ghostfolio/api/interceptors/redact-values-in-response/redact-values-in-response.interceptor'; import { RedactValuesInResponseInterceptor } from '@ghostfolio/api/interceptors/redact-values-in-response/redact-values-in-response.interceptor';
import { TransformDataSourceInRequestInterceptor } from '@ghostfolio/api/interceptors/transform-data-source-in-request/transform-data-source-in-request.interceptor'; import { TransformDataSourceInRequestInterceptor } from '@ghostfolio/api/interceptors/transform-data-source-in-request/transform-data-source-in-request.interceptor';
@ -17,6 +17,7 @@ import {
ActivityResponse ActivityResponse
} from '@ghostfolio/common/interfaces'; } from '@ghostfolio/common/interfaces';
import { permissions } from '@ghostfolio/common/permissions'; import { permissions } from '@ghostfolio/common/permissions';
import { scopes } from '@ghostfolio/common/scopes';
import type { import type {
ImpersonationContext, ImpersonationContext,
RequestWithUser RequestWithUser
@ -120,7 +121,7 @@ export class ActivitiesController {
} }
@Get() @Get()
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @RequiresScope(scopes.activityRead)
@UseInterceptors(RedactValuesInResponseInterceptor) @UseInterceptors(RedactValuesInResponseInterceptor)
@UseInterceptors(TransformDataSourceInRequestInterceptor) @UseInterceptors(TransformDataSourceInRequestInterceptor)
@UseInterceptors(TransformDataSourceInResponseInterceptor) @UseInterceptors(TransformDataSourceInResponseInterceptor)
@ -177,7 +178,7 @@ export class ActivitiesController {
} }
@Get(':id') @Get(':id')
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @RequiresScope(scopes.activityRead)
@UseInterceptors(RedactValuesInResponseInterceptor) @UseInterceptors(RedactValuesInResponseInterceptor)
@UseInterceptors(TransformDataSourceInResponseInterceptor) @UseInterceptors(TransformDataSourceInResponseInterceptor)
public async getActivityById( public async getActivityById(

2
apps/api/src/app/activities/activities.module.ts

@ -6,6 +6,7 @@ import { RedactValuesInResponseModule } from '@ghostfolio/api/interceptors/redac
import { TransformDataSourceInRequestModule } from '@ghostfolio/api/interceptors/transform-data-source-in-request/transform-data-source-in-request.module'; import { TransformDataSourceInRequestModule } from '@ghostfolio/api/interceptors/transform-data-source-in-request/transform-data-source-in-request.module';
import { TransformDataSourceInResponseModule } from '@ghostfolio/api/interceptors/transform-data-source-in-response/transform-data-source-in-response.module'; import { TransformDataSourceInResponseModule } from '@ghostfolio/api/interceptors/transform-data-source-in-response/transform-data-source-in-response.module';
import { ApiModule } from '@ghostfolio/api/services/api/api.module'; import { ApiModule } from '@ghostfolio/api/services/api/api.module';
import { AssetProfileSplitModule } from '@ghostfolio/api/services/asset-profile-split/asset-profile-split.module';
import { BenchmarkModule } from '@ghostfolio/api/services/benchmark/benchmark.module'; import { BenchmarkModule } from '@ghostfolio/api/services/benchmark/benchmark.module';
import { DataProviderModule } from '@ghostfolio/api/services/data-provider/data-provider.module'; import { DataProviderModule } from '@ghostfolio/api/services/data-provider/data-provider.module';
import { ExchangeRateDataModule } from '@ghostfolio/api/services/exchange-rate-data/exchange-rate-data.module'; import { ExchangeRateDataModule } from '@ghostfolio/api/services/exchange-rate-data/exchange-rate-data.module';
@ -26,6 +27,7 @@ import { ActivitiesService } from './activities.service';
exports: [ActivitiesService], exports: [ActivitiesService],
imports: [ imports: [
ApiModule, ApiModule,
AssetProfileSplitModule,
BenchmarkModule, BenchmarkModule,
CacheModule, CacheModule,
DataGatheringQueueModule, DataGatheringQueueModule,

337
apps/api/src/app/activities/activities.service.spec.ts

@ -0,0 +1,337 @@
import { AccountService } from '@ghostfolio/api/app/account/account.service';
import {
activityDummyData,
assetProfileDummyData
} from '@ghostfolio/api/app/portfolio/calculator/portfolio-calculator-test-utils';
import { AssetProfileSplitService } from '@ghostfolio/api/services/asset-profile-split/asset-profile-split.service';
import {
INVESTMENT_ACTIVITY_TYPES,
NON_INVESTMENT_ACTIVITY_TYPES
} from '@ghostfolio/common/config';
import { parseDate } from '@ghostfolio/common/helper';
import { Activity, Filter } from '@ghostfolio/common/interfaces';
import { AssetProfileSplit, DataSource } from '@prisma/client';
import { Big } from 'big.js';
import { ActivitiesService } from './activities.service';
describe('ActivitiesService', () => {
let activitiesService: ActivitiesService;
let getSplitsByUserId: jest.Mock;
let accountService: { getCashDetails: jest.Mock };
beforeEach(() => {
getSplitsByUserId = jest.fn().mockResolvedValue([]);
accountService = { getCashDetails: jest.fn() };
activitiesService = new ActivitiesService(
null,
accountService as unknown as AccountService,
{ getSplitsByUserId } as unknown as AssetProfileSplitService,
null,
null,
null,
null,
null,
null,
null,
null,
null
);
});
describe('getActivitiesForPortfolioCalculator', () => {
it('leaves an activity unchanged when no splits exist', async () => {
const activity = createActivity({ symbol: 'AAPL' });
const result = await getAdjustedActivity(activity, []);
expect(result).toEqual(activity);
expect(result).toBe(activity);
});
it.each([
{ denominator: 1, expectedPrice: 50, expectedQuantity: 20, numerator: 2 },
{
denominator: 10,
expectedPrice: 1000,
expectedQuantity: 1,
numerator: 1
}
])(
'applies a $numerator:$denominator split to quantity and price',
async ({ denominator, expectedPrice, expectedQuantity, numerator }) => {
const result = await getAdjustedActivity(
createActivity({ symbol: 'AAPL' }),
[createSplit('2021-01-01', numerator, denominator)]
);
expect(result.quantity).toBe(expectedQuantity);
expect(result.unitPrice).toBe(expectedPrice);
expect(result.unitPriceInAssetProfileCurrency).toBe(expectedPrice);
}
);
it('adjusts only activities before the split calendar date', async () => {
const split = createSplit('2021-01-01', 2, 1);
const activityBeforeSplit = createActivity({
date: '2020-12-31T23:00:00.000Z',
symbol: 'AAPL'
});
const activityOnSplitDate = createActivity({
date: '2021-01-01T23:00:00.000Z',
symbol: 'AAPL'
});
const activityAfterSplit = createActivity({
date: '2021-01-02T00:00:00.000Z',
symbol: 'AAPL'
});
expect(
(await getAdjustedActivity(activityBeforeSplit, [split])).quantity
).toBe(20);
expect(
(await getAdjustedActivity(activityOnSplitDate, [split])).quantity
).toBe(10);
expect(
(await getAdjustedActivity(activityAfterSplit, [split])).quantity
).toBe(10);
});
it('applies multiple splits cumulatively with exact ratio arithmetic', async () => {
const result = await getAdjustedActivity(
createActivity({ symbol: 'AAPL' }),
[createSplit('2021-01-01', 2, 1), createSplit('2022-01-01', 1, 3)]
);
expect(new Big(result.quantity).toFixed(15)).toBe(
new Big(20).div(3).toFixed(15)
);
expect(result.unitPrice).toBe(150);
});
it('preserves fees and total activity value', async () => {
const activity = createActivity({ symbol: 'AAPL' });
activity.feeInAssetProfileCurrency = 12;
activity.feeInBaseCurrency = 15;
const result = await getAdjustedActivity(activity, [
createSplit('2021-01-01', 2, 1)
]);
expect(result).toMatchObject({
feeInAssetProfileCurrency: 12,
feeInBaseCurrency: 15,
value: 1000,
valueInBaseCurrency: 1000
});
expect(result.quantity * result.unitPrice).toBe(1000);
});
it('does not apply splits from another symbol or data source', async () => {
const activity = createActivity({ symbol: 'AAPL' });
const split = createSplit('2021-01-01', 2, 1);
jest.spyOn(activitiesService, 'getActivities').mockResolvedValue({
activities: [activity],
count: 1
});
getSplitsByUserId.mockResolvedValue([
{ ...split, symbolProfileId: 'YAHOO-MSFT-profile' },
{ ...split, symbolProfileId: 'MANUAL-AAPL-profile' }
]);
const result =
await activitiesService.getActivitiesForPortfolioCalculator({
userCurrency: 'USD',
userId: 'user-id'
});
expect(result.activities[0].quantity).toBe(10);
expect(result.activities[0].unitPrice).toBe(100);
});
it.each(INVESTMENT_ACTIVITY_TYPES)(
'adjusts %s activities',
async (type) => {
const activity = createActivity({ symbol: 'AAPL' });
activity.type = type as Activity['type'];
const result = await getAdjustedActivity(activity, [
createSplit('2021-01-01', 2, 1)
]);
expect(result.quantity).toBe(20);
expect(result.unitPrice).toBe(50);
expect(result.quantity * result.unitPrice).toBe(1000);
}
);
it.each(NON_INVESTMENT_ACTIVITY_TYPES)(
'leaves %s activities unchanged',
async (type) => {
const activity = createActivity({ symbol: 'AAPL' });
activity.type = type as Activity['type'];
const result = await getAdjustedActivity(activity, [
createSplit('2021-01-01', 2, 1)
]);
expect(result).toBe(activity);
expect(result.quantity).toBe(10);
expect(result.unitPrice).toBe(100);
}
);
it('loads and applies splits to standard activities while preserving filters', async () => {
const activity = createActivity({ symbol: 'AAPL' });
const filters = [{ id: 'AAPL', type: 'SYMBOL' }] as Filter[];
const split = createSplit();
jest.spyOn(activitiesService, 'getActivities').mockResolvedValue({
activities: [activity],
count: 1
});
getSplitsByUserId.mockResolvedValue([split]);
const result =
await activitiesService.getActivitiesForPortfolioCalculator({
filters,
userCurrency: 'USD',
userId: 'user-id'
});
expect(activitiesService.getActivities).toHaveBeenCalledWith({
filters,
userCurrency: 'USD',
userId: 'user-id',
withExcludedAccountsAndActivities: false
});
expect(getSplitsByUserId).toHaveBeenCalledWith({ userId: 'user-id' });
expect(result.activities[0]).toMatchObject({
quantity: 20,
unitPrice: 50,
unitPriceInAssetProfileCurrency: 50
});
});
it('does not adjust synthetic cash activities', async () => {
const activity = createActivity({ symbol: 'AAPL' });
const cashActivity = createActivity({
assetSubClass: 'CASH',
currency: 'USD',
dataSource: DataSource.YAHOO,
quantity: 100,
symbol: 'USD',
unitPrice: 1
});
const split = createSplit();
jest.spyOn(activitiesService, 'getActivities').mockResolvedValue({
activities: [activity],
count: 1
});
jest.spyOn(activitiesService, 'getCashActivities').mockResolvedValue({
activities: [cashActivity],
count: 1
});
accountService.getCashDetails.mockResolvedValue({ accounts: [] });
getSplitsByUserId.mockResolvedValue([split]);
const result =
await activitiesService.getActivitiesForPortfolioCalculator({
userCurrency: 'USD',
userId: 'user-id',
withCash: true
});
expect(getSplitsByUserId).toHaveBeenCalledWith({ userId: 'user-id' });
expect(result.activities).toEqual([
expect.objectContaining({
assetProfile: expect.objectContaining({ symbol: 'AAPL' }),
quantity: 20
}),
cashActivity
]);
});
async function getAdjustedActivity(
activity: Activity,
splits: AssetProfileSplit[]
) {
jest.spyOn(activitiesService, 'getActivities').mockResolvedValue({
activities: [activity],
count: 1
});
getSplitsByUserId.mockResolvedValue(
splits.map((split) => {
return { ...split, symbolProfileId: activity.assetProfile.id };
})
);
const result =
await activitiesService.getActivitiesForPortfolioCalculator({
userCurrency: 'USD',
userId: 'user-id'
});
return result.activities[0];
}
});
});
function createActivity({
assetSubClass,
currency,
dataSource = DataSource.YAHOO,
date = '2020-01-01',
quantity = 10,
symbol,
unitPrice = 100
}: {
assetSubClass?: string;
currency?: string;
dataSource?: DataSource;
date?: string;
quantity?: number;
symbol: string;
unitPrice?: number;
}): Activity {
return {
...activityDummyData,
assetProfile: {
...assetProfileDummyData,
assetSubClass,
currency,
dataSource,
id: `${dataSource}-${symbol}-profile`,
symbol
},
date: parseDate(date),
quantity,
type: 'BUY',
unitPrice,
unitPriceInAssetProfileCurrency: unitPrice,
value: quantity * unitPrice,
valueInBaseCurrency: quantity * unitPrice
} as Activity;
}
function createSplit(
dateString = '2021-01-01',
numerator = 2,
denominator = 1
): AssetProfileSplit {
const date = parseDate(dateString);
return {
createdAt: date,
date,
denominator,
id: `${dateString}-${numerator}-${denominator}`,
numerator,
symbolProfileId: 'YAHOO-AAPL-profile',
updatedAt: date
};
}

48
apps/api/src/app/activities/activities.service.ts

@ -14,6 +14,8 @@ import {
WHERE_ACTIVITY_NOT_DRAFT WHERE_ACTIVITY_NOT_DRAFT
} from '@ghostfolio/api/helper/activity.helper'; } from '@ghostfolio/api/helper/activity.helper';
import { LogPerformance } from '@ghostfolio/api/interceptors/performance-logging/performance-logging.interceptor'; import { LogPerformance } from '@ghostfolio/api/interceptors/performance-logging/performance-logging.interceptor';
import { adjustActivityBySplits } from '@ghostfolio/api/services/asset-profile-split/asset-profile-split.helper';
import { AssetProfileSplitService } from '@ghostfolio/api/services/asset-profile-split/asset-profile-split.service';
import { BenchmarkService } from '@ghostfolio/api/services/benchmark/benchmark.service'; import { BenchmarkService } from '@ghostfolio/api/services/benchmark/benchmark.service';
import { DataProviderService } from '@ghostfolio/api/services/data-provider/data-provider.service'; import { DataProviderService } from '@ghostfolio/api/services/data-provider/data-provider.service';
import { ExchangeRateDataService } from '@ghostfolio/api/services/exchange-rate-data/exchange-rate-data.service'; import { ExchangeRateDataService } from '@ghostfolio/api/services/exchange-rate-data/exchange-rate-data.service';
@ -66,6 +68,7 @@ export class ActivitiesService {
public constructor( public constructor(
private readonly accountBalanceService: AccountBalanceService, private readonly accountBalanceService: AccountBalanceService,
private readonly accountService: AccountService, private readonly accountService: AccountService,
private readonly assetProfileSplitService: AssetProfileSplitService,
private readonly benchmarkService: BenchmarkService, private readonly benchmarkService: BenchmarkService,
private readonly dataGatheringService: DataGatheringService, private readonly dataGatheringService: DataGatheringService,
private readonly dataProviderService: DataProviderService, private readonly dataProviderService: DataProviderService,
@ -915,12 +918,26 @@ export class ActivitiesService {
/** Whether to include cash activities in the result. */ /** Whether to include cash activities in the result. */
withCash?: boolean; withCash?: boolean;
}) { }) {
const activities = await this.getActivities({ const [activities, splits] = await Promise.all([
filters, this.getActivities({
userCurrency, filters,
userId, userCurrency,
withExcludedAccountsAndActivities: false // TODO userId,
}); withExcludedAccountsAndActivities: false // TODO
}),
this.assetProfileSplitService.getSplitsByUserId({ userId })
]);
if (splits.length > 0) {
const splitsBySymbolProfileId = groupBy(splits, 'symbolProfileId');
activities.activities = activities.activities.map((activity) => {
return adjustActivityBySplits(
activity,
splitsBySymbolProfileId[activity.assetProfile.id] ?? []
);
});
}
if (withCash && !this.areCashActivitiesExcludedByFilters(filters)) { if (withCash && !this.areCashActivitiesExcludedByFilters(filters)) {
const cashDetails = await this.accountService.getCashDetails({ const cashDetails = await this.accountService.getCashDetails({
@ -963,6 +980,25 @@ export class ActivitiesService {
}; };
} }
/**
* Returns the id of every user who has an activity for the given asset
* profile, including draft activities and activities of excluded accounts
*/
public async getUserIdsBySymbolProfileId(
symbolProfileId: string
): Promise<string[]> {
const activitiesByUser = await this.prismaService.order.groupBy({
by: ['userId'],
where: {
symbolProfileId
}
});
return activitiesByUser.map(({ userId }) => {
return userId;
});
}
public async order( public async order(
orderWhereUniqueInput: Prisma.OrderWhereUniqueInput orderWhereUniqueInput: Prisma.OrderWhereUniqueInput
): Promise<Order | null> { ): Promise<Order | null> {

7
apps/api/src/app/endpoints/asset-profiles/asset-profiles.controller.ts

@ -169,7 +169,12 @@ export class AssetProfilesController {
permissions.deleteAssetProfileSplitOfOwnAssetProfile permissions.deleteAssetProfileSplitOfOwnAssetProfile
}); });
return this.assetProfilesService.deleteSplit({ id, symbolProfileId }); return this.assetProfilesService.deleteSplit({
dataSource,
id,
symbol,
symbolProfileId
});
} }
@HasPermission(permissions.accessAdminControl) @HasPermission(permissions.accessAdminControl)

179
apps/api/src/app/endpoints/asset-profiles/asset-profiles.service.spec.ts

@ -0,0 +1,179 @@
import { ActivitiesService } from '@ghostfolio/api/app/activities/activities.service';
import { PortfolioChangedEvent } from '@ghostfolio/api/events/portfolio-changed.event';
import { AssetProfileSplitService } from '@ghostfolio/api/services/asset-profile-split/asset-profile-split.service';
import { DataGatheringService } from '@ghostfolio/api/services/queues/data-gathering/data-gathering.service';
import { NotFoundException } from '@nestjs/common';
import { EventEmitter2 } from '@nestjs/event-emitter';
import { AssetProfileSplit, DataSource } from '@prisma/client';
import { AssetProfilesService } from './asset-profiles.service';
describe('AssetProfilesService', () => {
let assetProfilesService: AssetProfilesService;
let deleteById: jest.Mock;
let emit: jest.Mock;
let finished: jest.Mock;
let gatherSymbol: jest.Mock;
let getUserIdsBySymbolProfileId: jest.Mock;
let upsert: jest.Mock;
beforeEach(() => {
deleteById = jest.fn();
emit = jest.fn();
finished = jest.fn().mockResolvedValue(undefined);
gatherSymbol = jest.fn().mockResolvedValue([{ finished }]);
getUserIdsBySymbolProfileId = jest.fn().mockResolvedValue([]);
upsert = jest.fn();
assetProfilesService = new AssetProfilesService(
{ getUserIdsBySymbolProfileId } as unknown as ActivitiesService,
{
deleteById,
upsert
} as unknown as AssetProfileSplitService,
null,
{ gatherSymbol } as unknown as DataGatheringService,
null,
{ emit } as unknown as EventEmitter2,
null,
null,
null,
null
);
});
describe('createSplit', () => {
it('upserts the split and refreshes the asset profile data', async () => {
const split = {} as AssetProfileSplit;
const data = {
dataSource: DataSource.YAHOO,
date: new Date('2024-06-15T18:30:00.000Z'),
denominator: 1,
numerator: 2,
symbol: 'AAPL',
symbolProfileId: 'profile-id'
};
upsert.mockResolvedValue(split);
const result = await assetProfilesService.createSplit(data);
expect(upsert).toHaveBeenCalledWith({
date: data.date,
denominator: data.denominator,
numerator: data.numerator,
symbolProfileId: data.symbolProfileId
});
expect(gatherSymbol).toHaveBeenCalledWith({
dataSource: data.dataSource,
symbol: data.symbol
});
expect(result).toBe(split);
});
it('invalidates portfolio snapshots for users holding the asset', async () => {
upsert.mockResolvedValue({} as AssetProfileSplit);
getUserIdsBySymbolProfileId.mockResolvedValue(['user-1', 'user-2']);
await assetProfilesService.createSplit({
dataSource: DataSource.YAHOO,
date: new Date('2024-06-15T18:30:00.000Z'),
denominator: 1,
numerator: 2,
symbol: 'AAPL',
symbolProfileId: 'profile-id'
});
await flushPendingPromises();
expect(getUserIdsBySymbolProfileId).toHaveBeenCalledWith('profile-id');
expect(emit.mock.calls.map(([, event]) => event.getUserId())).toEqual([
'user-1',
'user-2'
]);
expect(emit.mock.calls[0][0]).toBe(PortfolioChangedEvent.getName());
});
it('emits the events only once the market data has been gathered', async () => {
let completeJob: () => void;
finished.mockReturnValue(
new Promise<void>((resolve) => {
completeJob = resolve;
})
);
upsert.mockResolvedValue({} as AssetProfileSplit);
getUserIdsBySymbolProfileId.mockResolvedValue(['user-1']);
await assetProfilesService.createSplit({
dataSource: DataSource.YAHOO,
date: new Date('2024-06-15T18:30:00.000Z'),
denominator: 1,
numerator: 2,
symbol: 'AAPL',
symbolProfileId: 'profile-id'
});
await flushPendingPromises();
expect(emit).not.toHaveBeenCalled();
completeJob();
await flushPendingPromises();
expect(emit.mock.calls.map(([, event]) => event.getUserId())).toEqual([
'user-1'
]);
});
});
describe('deleteSplit', () => {
it('throws NotFoundException when the scoped split does not exist', async () => {
deleteById.mockResolvedValue(false);
await expect(
assetProfilesService.deleteSplit({
dataSource: DataSource.YAHOO,
id: 'split-id',
symbol: 'AAPL',
symbolProfileId: 'profile-id'
})
).rejects.toBeInstanceOf(NotFoundException);
await flushPendingPromises();
expect(gatherSymbol).not.toHaveBeenCalled();
expect(emit).not.toHaveBeenCalled();
});
it('deletes an existing split using its profile scope', async () => {
deleteById.mockResolvedValue(true);
getUserIdsBySymbolProfileId.mockResolvedValue(['user-1']);
await expect(
assetProfilesService.deleteSplit({
dataSource: DataSource.YAHOO,
id: 'split-id',
symbol: 'AAPL',
symbolProfileId: 'profile-id'
})
).resolves.toBeUndefined();
await flushPendingPromises();
expect(deleteById).toHaveBeenCalledWith({
id: 'split-id',
symbolProfileId: 'profile-id'
});
expect(emit.mock.calls.map(([, event]) => event.getUserId())).toEqual([
'user-1'
]);
expect(gatherSymbol).toHaveBeenCalledWith({
dataSource: DataSource.YAHOO,
symbol: 'AAPL'
});
});
});
});
function flushPendingPromises() {
return new Promise((resolve) => {
setImmediate(resolve);
});
}

56
apps/api/src/app/endpoints/asset-profiles/asset-profiles.service.ts

@ -1,4 +1,5 @@
import { ActivitiesService } from '@ghostfolio/api/app/activities/activities.service'; import { ActivitiesService } from '@ghostfolio/api/app/activities/activities.service';
import { PortfolioChangedEvent } from '@ghostfolio/api/events/portfolio-changed.event';
import { AssetProfileSplitService } from '@ghostfolio/api/services/asset-profile-split/asset-profile-split.service'; import { AssetProfileSplitService } from '@ghostfolio/api/services/asset-profile-split/asset-profile-split.service';
import { BenchmarkService } from '@ghostfolio/api/services/benchmark/benchmark.service'; import { BenchmarkService } from '@ghostfolio/api/services/benchmark/benchmark.service';
import { DataProviderService } from '@ghostfolio/api/services/data-provider/data-provider.service'; import { DataProviderService } from '@ghostfolio/api/services/data-provider/data-provider.service';
@ -25,6 +26,7 @@ import {
import { MarketDataPreset } from '@ghostfolio/common/types'; import { MarketDataPreset } from '@ghostfolio/common/types';
import { Injectable, NotFoundException } from '@nestjs/common'; import { Injectable, NotFoundException } from '@nestjs/common';
import { EventEmitter2 } from '@nestjs/event-emitter';
import { AssetClass, AssetSubClass, DataSource, Prisma } from '@prisma/client'; import { AssetClass, AssetSubClass, DataSource, Prisma } from '@prisma/client';
import { groupBy } from 'lodash'; import { groupBy } from 'lodash';
@ -36,6 +38,7 @@ export class AssetProfilesService {
private readonly benchmarkService: BenchmarkService, private readonly benchmarkService: BenchmarkService,
private readonly dataGatheringService: DataGatheringService, private readonly dataGatheringService: DataGatheringService,
private readonly dataProviderService: DataProviderService, private readonly dataProviderService: DataProviderService,
private readonly eventEmitter: EventEmitter2,
private readonly exchangeRateDataService: ExchangeRateDataService, private readonly exchangeRateDataService: ExchangeRateDataService,
private readonly marketDataService: MarketDataService, private readonly marketDataService: MarketDataService,
private readonly prismaService: PrismaService, private readonly prismaService: PrismaService,
@ -62,18 +65,24 @@ export class AssetProfilesService {
symbolProfileId symbolProfileId
}); });
await this.dataGatheringService.gatherSymbol({ dataSource, symbol }); await this.gatherSymbolAndEmitPortfolioChangedEvents({
dataSource,
symbol,
symbolProfileId
});
return assetProfileSplit; return assetProfileSplit;
} }
public async deleteSplit({ public async deleteSplit({
dataSource,
id, id,
symbol,
symbolProfileId symbolProfileId
}: { }: {
id: string; id: string;
symbolProfileId: string; symbolProfileId: string;
}) { } & AssetProfileIdentifier) {
const isDeleted = await this.assetProfileSplitService.deleteById({ const isDeleted = await this.assetProfileSplitService.deleteById({
id, id,
symbolProfileId symbolProfileId
@ -82,6 +91,12 @@ export class AssetProfilesService {
if (!isDeleted) { if (!isDeleted) {
throw new NotFoundException(); throw new NotFoundException();
} }
await this.gatherSymbolAndEmitPortfolioChangedEvents({
dataSource,
symbol,
symbolProfileId
});
} }
public async getAssetProfile({ public async getAssetProfile({
@ -425,6 +440,43 @@ export class AssetProfilesService {
return assetProfile; return assetProfile;
} }
private async emitPortfolioChangedEvents(symbolProfileId: string) {
const userIds =
await this.activitiesService.getUserIdsBySymbolProfileId(symbolProfileId);
for (const userId of userIds) {
this.eventEmitter.emit(
PortfolioChangedEvent.getName(),
new PortfolioChangedEvent({ userId })
);
}
}
/**
* Gathers the market data of the given asset profile and invalidates the
* portfolio snapshots of the affected users as soon as it is available.
* Emitting the events earlier would recompute the snapshots from
* split-adjusted quantities and not yet split-adjusted market prices.
*/
private async gatherSymbolAndEmitPortfolioChangedEvents({
dataSource,
symbol,
symbolProfileId
}: { symbolProfileId: string } & AssetProfileIdentifier) {
const jobs = await this.dataGatheringService.gatherSymbol({
dataSource,
symbol
});
void Promise.allSettled(
jobs.map((job) => {
return job.finished();
})
).then(() => {
return this.emitPortfolioChangedEvents(symbolProfileId);
});
}
private getAssetProfileDataUpdate({ private getAssetProfileDataUpdate({
countries, countries,
holdings, holdings,

5
apps/api/src/app/endpoints/benchmarks/benchmarks.controller.ts

@ -1,8 +1,8 @@
import { AllowDuringImpersonation } from '@ghostfolio/api/decorators/allow-during-impersonation.decorator'; import { AllowDuringImpersonation } from '@ghostfolio/api/decorators/allow-during-impersonation.decorator';
import { HasPermission } from '@ghostfolio/api/decorators/has-permission.decorator'; import { HasPermission } from '@ghostfolio/api/decorators/has-permission.decorator';
import { Impersonation } from '@ghostfolio/api/decorators/impersonation.decorator'; import { Impersonation } from '@ghostfolio/api/decorators/impersonation.decorator';
import { RequiresScope } from '@ghostfolio/api/decorators/requires-scope.decorator';
import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard'; import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard';
import { ImpersonationGuard } from '@ghostfolio/api/guards/impersonation.guard';
import { TransformDataSourceInRequestInterceptor } from '@ghostfolio/api/interceptors/transform-data-source-in-request/transform-data-source-in-request.interceptor'; import { TransformDataSourceInRequestInterceptor } from '@ghostfolio/api/interceptors/transform-data-source-in-request/transform-data-source-in-request.interceptor';
import { TransformDataSourceInResponseInterceptor } from '@ghostfolio/api/interceptors/transform-data-source-in-response/transform-data-source-in-response.interceptor'; import { TransformDataSourceInResponseInterceptor } from '@ghostfolio/api/interceptors/transform-data-source-in-response/transform-data-source-in-response.interceptor';
import { ApiService } from '@ghostfolio/api/services/api/api.service'; import { ApiService } from '@ghostfolio/api/services/api/api.service';
@ -14,6 +14,7 @@ import type {
BenchmarkResponse BenchmarkResponse
} from '@ghostfolio/common/interfaces'; } from '@ghostfolio/common/interfaces';
import { permissions } from '@ghostfolio/common/permissions'; import { permissions } from '@ghostfolio/common/permissions';
import { scopes } from '@ghostfolio/common/scopes';
import type { ImpersonationContext } from '@ghostfolio/common/types'; import type { ImpersonationContext } from '@ghostfolio/common/types';
import { import {
@ -111,7 +112,7 @@ export class BenchmarksController {
} }
@Get(':dataSource/:symbol/:startDateString') @Get(':dataSource/:symbol/:startDateString')
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @RequiresScope(scopes.portfolioRead)
@UseInterceptors(TransformDataSourceInRequestInterceptor) @UseInterceptors(TransformDataSourceInRequestInterceptor)
public async getBenchmarkMarketDataForUser( public async getBenchmarkMarketDataForUser(
@Impersonation() { userId, userSettings }: ImpersonationContext, @Impersonation() { userId, userSettings }: ImpersonationContext,

5
apps/api/src/app/endpoints/watchlist/watchlist.controller.ts

@ -1,12 +1,13 @@
import { HasPermission } from '@ghostfolio/api/decorators/has-permission.decorator'; import { HasPermission } from '@ghostfolio/api/decorators/has-permission.decorator';
import { Impersonation } from '@ghostfolio/api/decorators/impersonation.decorator'; import { Impersonation } from '@ghostfolio/api/decorators/impersonation.decorator';
import { RequiresScope } from '@ghostfolio/api/decorators/requires-scope.decorator';
import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard'; import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard';
import { ImpersonationGuard } from '@ghostfolio/api/guards/impersonation.guard';
import { TransformDataSourceInRequestInterceptor } from '@ghostfolio/api/interceptors/transform-data-source-in-request/transform-data-source-in-request.interceptor'; import { TransformDataSourceInRequestInterceptor } from '@ghostfolio/api/interceptors/transform-data-source-in-request/transform-data-source-in-request.interceptor';
import { TransformDataSourceInResponseInterceptor } from '@ghostfolio/api/interceptors/transform-data-source-in-response/transform-data-source-in-response.interceptor'; import { TransformDataSourceInResponseInterceptor } from '@ghostfolio/api/interceptors/transform-data-source-in-response/transform-data-source-in-response.interceptor';
import { CreateWatchlistItemDto } from '@ghostfolio/common/dtos'; import { CreateWatchlistItemDto } from '@ghostfolio/common/dtos';
import { WatchlistResponse } from '@ghostfolio/common/interfaces'; import { WatchlistResponse } from '@ghostfolio/common/interfaces';
import { permissions } from '@ghostfolio/common/permissions'; import { permissions } from '@ghostfolio/common/permissions';
import { scopes } from '@ghostfolio/common/scopes';
import { import {
ImpersonationContext, ImpersonationContext,
RequestWithUser RequestWithUser
@ -82,7 +83,7 @@ export class WatchlistController {
@Get() @Get()
@HasPermission(permissions.readWatchlist) @HasPermission(permissions.readWatchlist)
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @RequiresScope(scopes.watchlistRead)
@UseInterceptors(TransformDataSourceInResponseInterceptor) @UseInterceptors(TransformDataSourceInResponseInterceptor)
public async getWatchlistItems( public async getWatchlistItems(
@Impersonation() { userId }: ImpersonationContext @Impersonation() { userId }: ImpersonationContext

4
apps/api/src/app/portfolio/calculator/roai/portfolio-calculator-cash.spec.ts

@ -11,6 +11,7 @@ import { CurrentRateService } from '@ghostfolio/api/app/portfolio/current-rate.s
import { CurrentRateServiceMock } from '@ghostfolio/api/app/portfolio/current-rate.service.mock'; import { CurrentRateServiceMock } from '@ghostfolio/api/app/portfolio/current-rate.service.mock';
import { RedisCacheService } from '@ghostfolio/api/app/redis-cache/redis-cache.service'; import { RedisCacheService } from '@ghostfolio/api/app/redis-cache/redis-cache.service';
import { RedisCacheServiceMock } from '@ghostfolio/api/app/redis-cache/redis-cache.service.mock'; import { RedisCacheServiceMock } from '@ghostfolio/api/app/redis-cache/redis-cache.service.mock';
import { AssetProfileSplitService } from '@ghostfolio/api/services/asset-profile-split/asset-profile-split.service';
import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service'; import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
import { DataProviderService } from '@ghostfolio/api/services/data-provider/data-provider.service'; import { DataProviderService } from '@ghostfolio/api/services/data-provider/data-provider.service';
import { ExchangeRateDataService } from '@ghostfolio/api/services/exchange-rate-data/exchange-rate-data.service'; import { ExchangeRateDataService } from '@ghostfolio/api/services/exchange-rate-data/exchange-rate-data.service';
@ -124,6 +125,9 @@ describe('PortfolioCalculator', () => {
activitiesService = new ActivitiesService( activitiesService = new ActivitiesService(
accountBalanceService, accountBalanceService,
accountService, accountService,
{
getSplitsByUserId: jest.fn().mockResolvedValue([])
} as unknown as AssetProfileSplitService,
null, null,
null, null,
dataProviderService, dataProviderService,

276
apps/api/src/app/portfolio/calculator/roai/portfolio-calculator-stock-split.spec.ts

@ -0,0 +1,276 @@
import {
activityDummyData,
assetProfileDummyData,
userDummyData
} from '@ghostfolio/api/app/portfolio/calculator/portfolio-calculator-test-utils';
import { PortfolioCalculatorFactory } from '@ghostfolio/api/app/portfolio/calculator/portfolio-calculator.factory';
import { CurrentRateService } from '@ghostfolio/api/app/portfolio/current-rate.service';
import { CurrentRateServiceMock } from '@ghostfolio/api/app/portfolio/current-rate.service.mock';
import { RedisCacheService } from '@ghostfolio/api/app/redis-cache/redis-cache.service';
import { RedisCacheServiceMock } from '@ghostfolio/api/app/redis-cache/redis-cache.service.mock';
import { adjustActivityBySplits } from '@ghostfolio/api/services/asset-profile-split/asset-profile-split.helper';
import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
import { ExchangeRateDataService } from '@ghostfolio/api/services/exchange-rate-data/exchange-rate-data.service';
import { PortfolioSnapshotService } from '@ghostfolio/api/services/queues/portfolio-snapshot/portfolio-snapshot.service';
import { PortfolioSnapshotServiceMock } from '@ghostfolio/api/services/queues/portfolio-snapshot/portfolio-snapshot.service.mock';
import { parseDate } from '@ghostfolio/common/helper';
import { Activity } from '@ghostfolio/common/interfaces';
import { PerformanceCalculationType } from '@ghostfolio/common/types/performance-calculation-type.type';
import { AssetProfileSplit, DataSource } from '@prisma/client';
import { Big } from 'big.js';
jest.mock('@ghostfolio/api/app/portfolio/current-rate.service', () => {
return {
CurrentRateService: jest.fn().mockImplementation(() => {
return CurrentRateServiceMock;
})
};
});
jest.mock(
'@ghostfolio/api/services/queues/portfolio-snapshot/portfolio-snapshot.service',
() => {
return {
PortfolioSnapshotService: jest.fn().mockImplementation(() => {
return PortfolioSnapshotServiceMock;
})
};
}
);
jest.mock('@ghostfolio/api/app/redis-cache/redis-cache.service', () => {
return {
RedisCacheService: jest.fn().mockImplementation(() => {
return RedisCacheServiceMock;
})
};
});
describe('RoaiPortfolioCalculator stock splits', () => {
let configurationService: ConfigurationService;
let currentRateService: CurrentRateService;
let exchangeRateDataService: ExchangeRateDataService;
let portfolioCalculatorFactory: PortfolioCalculatorFactory;
let portfolioSnapshotService: PortfolioSnapshotService;
let redisCacheService: RedisCacheService;
beforeEach(() => {
PortfolioSnapshotServiceMock.reset();
RedisCacheServiceMock.reset();
configurationService = new ConfigurationService();
currentRateService = new CurrentRateService(null, null, null, null);
exchangeRateDataService = new ExchangeRateDataService(
null,
null,
null,
null
);
portfolioSnapshotService = new PortfolioSnapshotService(null, null);
redisCacheService = new RedisCacheService(null, null);
portfolioCalculatorFactory = new PortfolioCalculatorFactory(
configurationService,
currentRateService,
exchangeRateDataService,
portfolioSnapshotService,
redisCacheService
);
});
it('doubles the position and halves the average price for a 2:1 split', () => {
const activity = adjustActivityBySplits(
createActivity({ unitPrice: 100 }),
[createSplit({ denominator: 1, numerator: 2 })]
);
const position = getLastPosition(portfolioCalculatorFactory, [activity]);
expect(position).toMatchObject({
averagePrice: new Big(50),
investment: new Big(1000),
quantity: new Big(20)
});
});
it('applies the inverse quantity and price changes for a reverse split', () => {
const activity = adjustActivityBySplits(
createActivity({ unitPrice: 100 }),
[createSplit({ denominator: 10, numerator: 1 })]
);
const position = getLastPosition(portfolioCalculatorFactory, [activity]);
expect(position).toMatchObject({
averagePrice: new Big(1000),
investment: new Big(1000),
quantity: new Big(1)
});
});
it('uses adjusted quantities when selling after a split', () => {
const buy = adjustActivityBySplits(
createActivity({ date: '2020-01-01', unitPrice: 100 }),
[createSplit({ denominator: 1, numerator: 2 })]
);
const sell = createActivity({
date: '2021-01-01',
quantity: 5,
type: 'SELL',
unitPrice: 60
});
const position = getLastPosition(portfolioCalculatorFactory, [buy, sell]);
expect(position).toMatchObject({
averagePrice: new Big(50),
investment: new Big(750),
quantity: new Big(15)
});
});
it('applies multiple splits while preserving fractional precision', () => {
const activity = adjustActivityBySplits(
createActivity({ unitPrice: 100 }),
[
createSplit({ denominator: 1, numerator: 2 }),
createSplit({ denominator: 3, numerator: 1, date: '2022-01-01' })
]
);
const position = getLastPosition(portfolioCalculatorFactory, [activity]);
expect(position.averagePrice).toEqual(new Big(150));
expect(position.quantity.toFixed(15)).toBe(new Big(20).div(3).toFixed(15));
expect(position.investment.toNumber()).toBeCloseTo(1000, 12);
});
it('resets quantity and investment when the adjusted position is closed', () => {
const buy = adjustActivityBySplits(
createActivity({ date: '2020-01-01', unitPrice: 100 }),
[createSplit({ denominator: 1, numerator: 2 })]
);
const sell = createActivity({
date: '2021-01-01',
quantity: 20,
type: 'SELL',
unitPrice: 60
});
const position = getLastPosition(portfolioCalculatorFactory, [buy, sell]);
expect(position.quantity).toEqual(new Big(0));
expect(position.investment).toEqual(new Big(0));
});
it('preserves existing behavior when no splits exist', () => {
const position = getLastPosition(portfolioCalculatorFactory, [
createActivity({ unitPrice: 100 })
]);
expect(position).toMatchObject({
averagePrice: new Big(100),
investment: new Big(1000),
quantity: new Big(10)
});
});
it('uses provider market data without adjusting it a second time', async () => {
jest.useFakeTimers().setSystemTime(parseDate('2023-07-10').getTime());
const activity = adjustActivityBySplits(
createActivity({ date: '2023-07-09', unitPrice: 674.44 }),
[
createSplit({
date: '2023-07-10',
denominator: 1,
numerator: 2
})
]
);
const calculator = portfolioCalculatorFactory.createCalculator({
activities: [activity],
calculationType: PerformanceCalculationType.ROAI,
currency: 'USD',
userId: userDummyData.id
});
const snapshot = await calculator.computeSnapshot();
const [position] = snapshot.positions;
expect(position).toMatchObject({
investment: new Big(6744.4),
marketPrice: 331.83,
quantity: new Big(20),
valueInBaseCurrency: new Big(6636.6)
});
});
});
function getLastPosition(
portfolioCalculatorFactory: PortfolioCalculatorFactory,
activities: Activity[]
) {
const calculator = portfolioCalculatorFactory.createCalculator({
activities,
calculationType: PerformanceCalculationType.ROAI,
currency: 'USD',
userId: userDummyData.id
});
return calculator.getTransactionPoints().at(-1).items[0];
}
function createActivity({
date = '2020-01-01',
quantity = 10,
type = 'BUY',
unitPrice = 100
}: {
date?: string;
quantity?: number;
type?: Activity['type'];
unitPrice?: number;
}): Activity {
return {
...activityDummyData,
assetProfile: {
...assetProfileDummyData,
currency: 'USD',
dataSource: DataSource.YAHOO,
name: 'Microsoft Inc.',
symbol: 'MSFT'
},
date: parseDate(date),
feeInAssetProfileCurrency: 0,
feeInBaseCurrency: 0,
quantity,
type,
unitPrice,
unitPriceInAssetProfileCurrency: unitPrice,
value: quantity * unitPrice,
valueInBaseCurrency: quantity * unitPrice
} as Activity;
}
function createSplit({
date = '2021-01-01',
denominator,
numerator
}: {
date?: string;
denominator: number;
numerator: number;
}): AssetProfileSplit {
const splitDate = parseDate(date);
return {
denominator,
numerator,
createdAt: splitDate,
date: splitDate,
id: `${date}-${numerator}-${denominator}`,
symbolProfileId: 'msft-profile',
updatedAt: splitDate
};
}

70
apps/api/src/app/portfolio/portfolio.controller.ts

@ -1,8 +1,8 @@
import { ActivitiesService } from '@ghostfolio/api/app/activities/activities.service'; import { ActivitiesService } from '@ghostfolio/api/app/activities/activities.service';
import { HasPermission } from '@ghostfolio/api/decorators/has-permission.decorator'; import { HasPermission } from '@ghostfolio/api/decorators/has-permission.decorator';
import { Impersonation } from '@ghostfolio/api/decorators/impersonation.decorator'; import { Impersonation } from '@ghostfolio/api/decorators/impersonation.decorator';
import { RequiresScope } from '@ghostfolio/api/decorators/requires-scope.decorator';
import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard'; import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard';
import { ImpersonationGuard } from '@ghostfolio/api/guards/impersonation.guard';
import { import {
hasNotDefinedValuesInObject, hasNotDefinedValuesInObject,
nullifyValuesInObject nullifyValuesInObject
@ -25,11 +25,8 @@ import {
PortfolioPerformanceResponse, PortfolioPerformanceResponse,
PortfolioReportResponse PortfolioReportResponse
} from '@ghostfolio/common/interfaces'; } from '@ghostfolio/common/interfaces';
import { import { isRestrictedView, permissions } from '@ghostfolio/common/permissions';
hasReadRestrictedAccessPermission, import { hasScope, scopes } from '@ghostfolio/common/scopes';
isRestrictedView,
permissions
} from '@ghostfolio/common/permissions';
import type { import type {
ImpersonationContext, ImpersonationContext,
RequestWithUser RequestWithUser
@ -73,12 +70,13 @@ export class PortfolioController {
) {} ) {}
@Get('details') @Get('details')
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @RequiresScope(scopes.portfolioRead)
@UseInterceptors(RedactValuesInResponseInterceptor) @UseInterceptors(RedactValuesInResponseInterceptor)
@UseInterceptors(TransformDataSourceInRequestInterceptor) @UseInterceptors(TransformDataSourceInRequestInterceptor)
@UseInterceptors(TransformDataSourceInResponseInterceptor) @UseInterceptors(TransformDataSourceInResponseInterceptor)
public async getDetails( public async getDetails(
@Impersonation() { accessId, userId }: ImpersonationContext, @Impersonation()
{ scopes: impersonationScopes, userId }: ImpersonationContext,
@Query() @Query()
{ {
accounts: filterByAccounts, accounts: filterByAccounts,
@ -130,10 +128,7 @@ export class PortfolioController {
let portfolioSummary = summary; let portfolioSummary = summary;
if ( if (
hasReadRestrictedAccessPermission({ !hasScope(impersonationScopes, scopes.portfolioReadValues) ||
accesses: this.request.user?.accessesGet,
impersonationId: accessId
}) ||
isRestrictedView(this.request.user) isRestrictedView(this.request.user)
) { ) {
const totalInvestment = Object.values(holdings) const totalInvestment = Object.values(holdings)
@ -174,10 +169,7 @@ export class PortfolioController {
if ( if (
hasDetails === false || hasDetails === false ||
hasReadRestrictedAccessPermission({ !hasScope(impersonationScopes, scopes.portfolioReadValues) ||
accesses: this.request.user?.accessesGet,
impersonationId: accessId
}) ||
isRestrictedView(this.request.user) isRestrictedView(this.request.user)
) { ) {
Object.values(markets ?? {}).forEach((market) => { Object.values(markets ?? {}).forEach((market) => {
@ -319,10 +311,11 @@ export class PortfolioController {
} }
@Get('dividends') @Get('dividends')
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @RequiresScope(scopes.portfolioRead)
@UseInterceptors(TransformDataSourceInRequestInterceptor) @UseInterceptors(TransformDataSourceInRequestInterceptor)
public async getDividends( public async getDividends(
@Impersonation() { accessId, userId, userSettings }: ImpersonationContext, @Impersonation()
{ scopes: impersonationScopes, userId, userSettings }: ImpersonationContext,
@Query() @Query()
{ {
accounts, accounts,
@ -364,10 +357,7 @@ export class PortfolioController {
}); });
if ( if (
hasReadRestrictedAccessPermission({ !hasScope(impersonationScopes, scopes.portfolioReadValues) ||
accesses: this.request.user?.accessesGet,
impersonationId: accessId
}) ||
isRestrictedView(this.request.user) isRestrictedView(this.request.user)
) { ) {
const maxDividend = dividends.reduce( const maxDividend = dividends.reduce(
@ -397,7 +387,7 @@ export class PortfolioController {
@UseInterceptors(RedactValuesInResponseInterceptor) @UseInterceptors(RedactValuesInResponseInterceptor)
@UseInterceptors(TransformDataSourceInRequestInterceptor) @UseInterceptors(TransformDataSourceInRequestInterceptor)
@UseInterceptors(TransformDataSourceInResponseInterceptor) @UseInterceptors(TransformDataSourceInResponseInterceptor)
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @RequiresScope(scopes.portfolioRead)
public async getHolding( public async getHolding(
@Impersonation() { userId }: ImpersonationContext, @Impersonation() { userId }: ImpersonationContext,
@Param('dataSource') dataSource: DataSource, @Param('dataSource') dataSource: DataSource,
@ -420,7 +410,7 @@ export class PortfolioController {
} }
@Get('holdings') @Get('holdings')
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @RequiresScope(scopes.portfolioRead)
@UseInterceptors(RedactValuesInResponseInterceptor) @UseInterceptors(RedactValuesInResponseInterceptor)
@UseInterceptors(TransformDataSourceInRequestInterceptor) @UseInterceptors(TransformDataSourceInRequestInterceptor)
@UseInterceptors(TransformDataSourceInResponseInterceptor) @UseInterceptors(TransformDataSourceInResponseInterceptor)
@ -458,10 +448,11 @@ export class PortfolioController {
} }
@Get('investments') @Get('investments')
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @RequiresScope(scopes.portfolioRead)
@UseInterceptors(TransformDataSourceInRequestInterceptor) @UseInterceptors(TransformDataSourceInRequestInterceptor)
public async getInvestments( public async getInvestments(
@Impersonation() { accessId, userId }: ImpersonationContext, @Impersonation()
{ scopes: impersonationScopes, userId }: ImpersonationContext,
@Query() @Query()
{ {
accounts, accounts,
@ -490,10 +481,7 @@ export class PortfolioController {
}); });
if ( if (
hasReadRestrictedAccessPermission({ !hasScope(impersonationScopes, scopes.portfolioReadValues) ||
accesses: this.request.user?.accessesGet,
impersonationId: accessId
}) ||
isRestrictedView(this.request.user) isRestrictedView(this.request.user)
) { ) {
const maxInvestment = investments.reduce( const maxInvestment = investments.reduce(
@ -532,13 +520,14 @@ export class PortfolioController {
} }
@Get('performance') @Get('performance')
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @RequiresScope(scopes.portfolioRead)
@UseInterceptors(PerformanceLoggingInterceptor) @UseInterceptors(PerformanceLoggingInterceptor)
@UseInterceptors(TransformDataSourceInRequestInterceptor) @UseInterceptors(TransformDataSourceInRequestInterceptor)
@UseInterceptors(TransformDataSourceInResponseInterceptor) @UseInterceptors(TransformDataSourceInResponseInterceptor)
@Version('2') @Version('2')
public async getPerformanceV2( public async getPerformanceV2(
@Impersonation() { accessId, userId }: ImpersonationContext, @Impersonation()
{ scopes: impersonationScopes, userId }: ImpersonationContext,
@Query() @Query()
{ {
accounts, accounts,
@ -566,10 +555,7 @@ export class PortfolioController {
}); });
if ( if (
hasReadRestrictedAccessPermission({ !hasScope(impersonationScopes, scopes.portfolioReadValues) ||
accesses: this.request.user?.accessesGet,
impersonationId: accessId
}) ||
isRestrictedView(this.request.user) || isRestrictedView(this.request.user) ||
this.request.user.settings.settings.viewMode === 'ZEN' this.request.user.settings.settings.viewMode === 'ZEN'
) { ) {
@ -645,17 +631,15 @@ export class PortfolioController {
} }
@Get('report') @Get('report')
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @RequiresScope(scopes.portfolioRead)
public async getReport( public async getReport(
@Impersonation() { accessId, userId }: ImpersonationContext @Impersonation()
{ scopes: impersonationScopes, userId }: ImpersonationContext
): Promise<PortfolioReportResponse> { ): Promise<PortfolioReportResponse> {
const report = await this.portfolioService.getReport({ userId }); const report = await this.portfolioService.getReport({ userId });
if ( if (
hasReadRestrictedAccessPermission({ !hasScope(impersonationScopes, scopes.portfolioReadValues) ||
accesses: this.request.user?.accessesGet,
impersonationId: accessId
}) ||
isRestrictedView(this.request.user) || isRestrictedView(this.request.user) ||
(this.configurationService.get('ENABLE_FEATURE_SUBSCRIPTION') && (this.configurationService.get('ENABLE_FEATURE_SUBSCRIPTION') &&
this.request.user.subscription?.type === SubscriptionType.Basic) this.request.user.subscription?.type === SubscriptionType.Basic)
@ -676,7 +660,7 @@ export class PortfolioController {
@HasPermission(permissions.updateActivity) @HasPermission(permissions.updateActivity)
@Put('holding/:dataSource/:symbol/tags') @Put('holding/:dataSource/:symbol/tags')
@UseInterceptors(TransformDataSourceInRequestInterceptor) @UseInterceptors(TransformDataSourceInRequestInterceptor)
@UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard) @UseGuards(AuthGuard('jwt'), HasPermissionGuard)
public async updateHoldingTags( public async updateHoldingTags(
@Body() data: UpdateHoldingTagsDto, @Body() data: UpdateHoldingTagsDto,
@Param('dataSource') dataSource: DataSource, @Param('dataSource') dataSource: DataSource,

2
apps/api/src/app/portfolio/portfolio.service.spec.ts

@ -66,6 +66,7 @@ describe('PortfolioService', () => {
accountService, accountService,
null, null,
null, null,
null,
dataProviderService, dataProviderService,
null, null,
exchangeRateDataService, exchangeRateDataService,
@ -245,7 +246,6 @@ describe('PortfolioService', () => {
.mockResolvedValue([]); .mockResolvedValue([]);
jest.spyOn(userService, 'user').mockResolvedValue({ jest.spyOn(userService, 'user').mockResolvedValue({
accessesGet: [],
accounts: [], accounts: [],
activityCount: 0, activityCount: 0,
dataProviderGhostfolioDailyRequests: 0, dataProviderGhostfolioDailyRequests: 0,

3
apps/api/src/app/user/user.controller.ts

@ -129,9 +129,10 @@ export class UserController {
@UseInterceptors(TransformDataSourceInResponseInterceptor) @UseInterceptors(TransformDataSourceInResponseInterceptor)
public async getUser( public async getUser(
@Headers('accept-language') acceptLanguage: string, @Headers('accept-language') acceptLanguage: string,
@Impersonation() { isActive, userId }: ImpersonationContext @Impersonation() { isActive, scopes, userId }: ImpersonationContext
): Promise<User> { ): Promise<User> {
return this.userService.getUser({ return this.userService.getUser({
scopes,
impersonationUserId: isActive ? userId : undefined, impersonationUserId: isActive ? userId : undefined,
locale: acceptLanguage?.split(',')?.[0], locale: acceptLanguage?.split(',')?.[0],
user: this.request.user user: this.request.user

10
apps/api/src/app/user/user.service.ts

@ -53,6 +53,7 @@ import {
hasRole, hasRole,
permissions permissions
} from '@ghostfolio/common/permissions'; } from '@ghostfolio/common/permissions';
import { getScopesOfAccess } from '@ghostfolio/common/scopes';
import { UserWithSettings } from '@ghostfolio/common/types'; import { UserWithSettings } from '@ghostfolio/common/types';
import { PerformanceCalculationType } from '@ghostfolio/common/types/performance-calculation-type.type'; import { PerformanceCalculationType } from '@ghostfolio/common/types/performance-calculation-type.type';
@ -115,10 +116,12 @@ export class UserService {
public async getUser({ public async getUser({
impersonationUserId, impersonationUserId,
locale = DEFAULT_LOCALE, locale = DEFAULT_LOCALE,
scopes,
user user
}: { }: {
impersonationUserId: string; impersonationUserId: string;
locale?: string; locale?: string;
scopes: string[];
user: UserWithSettings; user: UserWithSettings;
}): Promise<IUser> { }): Promise<IUser> {
const { id, permissions, settings, subscription } = user; const { id, permissions, settings, subscription } = user;
@ -206,6 +209,7 @@ export class UserService {
id, id,
permissions, permissions,
referralPartners, referralPartners,
scopes,
subscription, subscription,
systemMessage, systemMessage,
tags, tags,
@ -213,7 +217,8 @@ export class UserService {
return { return {
alias: accessItem.alias, alias: accessItem.alias,
id: accessItem.id, id: accessItem.id,
permissions: accessItem.permissions permissions: accessItem.permissions,
scopes: getScopesOfAccess(accessItem)
}; };
}), }),
accounts: accounts.sort((a, b) => { accounts: accounts.sort((a, b) => {
@ -282,7 +287,6 @@ export class UserService {
activities: true activities: true
} }
}, },
accessesGet: true,
accounts: { accounts: {
include: { platform: true } include: { platform: true }
}, },
@ -299,7 +303,6 @@ export class UserService {
const { const {
_count, _count,
accessesGet,
accessToken, accessToken,
accounts, accounts,
analytics, analytics,
@ -317,7 +320,6 @@ export class UserService {
const activitiesCount = _count?.activities ?? 0; const activitiesCount = _count?.activities ?? 0;
const user: UserWithSettings = { const user: UserWithSettings = {
accessesGet,
accessToken, accessToken,
accounts, accounts,
authChallenge, authChallenge,

2
apps/api/src/decorators/impersonation.decorator.ts

@ -1,3 +1,4 @@
import { getScopesOfOwnAccess } from '@ghostfolio/common/scopes';
import type { import type {
ImpersonationContext, ImpersonationContext,
RequestWithUser RequestWithUser
@ -18,6 +19,7 @@ export const Impersonation = createParamDecorator(
return ( return (
impersonation ?? { impersonation ?? {
isActive: false, isActive: false,
scopes: getScopesOfOwnAccess(),
userId: user?.id, userId: user?.id,
userSettings: user?.settings?.settings ?? {} userSettings: user?.settings?.settings ?? {}
} }

41
apps/api/src/decorators/requires-scope.decorator.spec.ts

@ -0,0 +1,41 @@
import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard';
import { ImpersonationGuard } from '@ghostfolio/api/guards/impersonation.guard';
import { ScopeGuard } from '@ghostfolio/api/guards/scope.guard';
import { scopes } from '@ghostfolio/common/scopes';
import { GUARDS_METADATA } from '@nestjs/common/constants';
import { AuthGuard } from '@nestjs/passport';
import { REQUIRES_SCOPE_KEY, RequiresScope } from './requires-scope.decorator';
class TestController {
@RequiresScope(scopes.portfolioRead)
public getPortfolio() {
return null;
}
}
describe('Requires scope', () => {
it('Sets the required scopes', () => {
expect(
Reflect.getMetadata(
REQUIRES_SCOPE_KEY,
TestController.prototype.getPortfolio
)
).toEqual([scopes.portfolioRead]);
});
it('Applies the guards in the required order', () => {
expect(
Reflect.getMetadata(
GUARDS_METADATA,
TestController.prototype.getPortfolio
)
).toEqual([
AuthGuard('jwt'),
HasPermissionGuard,
ImpersonationGuard,
ScopeGuard
]);
});
});

26
apps/api/src/decorators/requires-scope.decorator.ts

@ -0,0 +1,26 @@
import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard';
import { ImpersonationGuard } from '@ghostfolio/api/guards/impersonation.guard';
import { ScopeGuard } from '@ghostfolio/api/guards/scope.guard';
import { Scope } from '@ghostfolio/common/scopes';
import { applyDecorators, SetMetadata, UseGuards } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';
export const REQUIRES_SCOPE_KEY = 'requires_scope';
/**
* Marks a route which requires the given scopes and applies the guards which
* resolve the impersonation context and evaluate it, hence the ScopeGuard
* cannot be applied without the ImpersonationGuard preceding it
*/
export function RequiresScope(...requiredScopes: Scope[]) {
return applyDecorators(
SetMetadata(REQUIRES_SCOPE_KEY, requiredScopes),
UseGuards(
AuthGuard('jwt'),
HasPermissionGuard,
ImpersonationGuard,
ScopeGuard
)
);
}

50
apps/api/src/guards/scope.guard.ts

@ -0,0 +1,50 @@
import { REQUIRES_SCOPE_KEY } from '@ghostfolio/api/decorators/requires-scope.decorator';
import { hasScope, Scope } from '@ghostfolio/common/scopes';
import type { RequestWithUser } from '@ghostfolio/common/types';
import {
CanActivate,
ExecutionContext,
HttpException,
Injectable
} from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { StatusCodes, getReasonPhrase } from 'http-status-codes';
/**
* Denies a request whose impersonation context does not cover the scopes
* required by the route. It has to be applied after the ImpersonationGuard,
* which resolves the context, hence the RequiresScope decorator applies both.
*/
@Injectable()
export class ScopeGuard implements CanActivate {
public constructor(private readonly reflector: Reflector) {}
public canActivate(context: ExecutionContext): boolean {
const requiredScopes = this.reflector.getAllAndOverride<Scope[]>(
REQUIRES_SCOPE_KEY,
[context.getHandler(), context.getClass()]
);
if (!requiredScopes?.length) {
return true;
}
const { impersonation } = context
.switchToHttp()
.getRequest<RequestWithUser>();
const hasRequiredScopes = requiredScopes.every((scope) => {
return hasScope(impersonation?.scopes, scope);
});
if (!hasRequiredScopes) {
throw new HttpException(
getReasonPhrase(StatusCodes.FORBIDDEN),
StatusCodes.FORBIDDEN
);
}
return true;
}
}

29
apps/api/src/interceptors/redact-values-in-response/redact-values-in-response.interceptor.ts

@ -1,13 +1,8 @@
import { redactPaths } from '@ghostfolio/api/helper/object.helper'; import { redactPaths } from '@ghostfolio/api/helper/object.helper';
import { import { DEFAULT_REDACTED_PATHS } from '@ghostfolio/common/config';
DEFAULT_REDACTED_PATHS, import { isRestrictedView } from '@ghostfolio/common/permissions';
HEADER_KEY_IMPERSONATION import { hasScope, scopes } from '@ghostfolio/common/scopes';
} from '@ghostfolio/common/config'; import type { RequestWithUser } from '@ghostfolio/common/types';
import {
hasReadRestrictedAccessPermission,
isRestrictedView
} from '@ghostfolio/common/permissions';
import { UserWithSettings } from '@ghostfolio/common/types';
import { import {
CallHandler, CallHandler,
@ -29,17 +24,15 @@ export class RedactValuesInResponseInterceptor<T> implements NestInterceptor<
): Observable<any> { ): Observable<any> {
return next.handle().pipe( return next.handle().pipe(
map((data: any) => { map((data: any) => {
const { headers, user }: { headers: Headers; user: UserWithSettings } = const { impersonation, user } = context
context.switchToHttp().getRequest(); .switchToHttp()
.getRequest<RequestWithUser>();
const impersonationId =
headers?.[HEADER_KEY_IMPERSONATION.toLowerCase()];
// A missing impersonation context originates from a public request or
// from a route without the ImpersonationGuard, hence the monetary
// values are redacted to never expose them unintentionally
if ( if (
hasReadRestrictedAccessPermission({ !hasScope(impersonation?.scopes, scopes.portfolioReadValues) ||
impersonationId,
accesses: user?.accessesGet
}) ||
isRestrictedView(user) isRestrictedView(user)
) { ) {
data = redactPaths({ data = redactPaths({

114
apps/api/src/services/asset-profile-split/asset-profile-split.helper.spec.ts

@ -0,0 +1,114 @@
import {
activityDummyData,
assetProfileDummyData
} from '@ghostfolio/api/app/portfolio/calculator/portfolio-calculator-test-utils';
import * as commonHelper from '@ghostfolio/common/helper';
import { parseDate } from '@ghostfolio/common/helper';
import { Activity } from '@ghostfolio/common/interfaces';
import { AssetProfileSplit, DataSource } from '@prisma/client';
import { Big } from 'big.js';
import { adjustActivityBySplits } from './asset-profile-split.helper';
describe('adjustActivityBySplits', () => {
it('adjusts quantity and prices using the cumulative split factor', () => {
const activity = createActivity('2020-01-01');
const splits = [
createSplit('2021-01-01', 2, 1),
createSplit('2022-01-01', 1, 3)
];
const adjustedActivity = adjustActivityBySplits(activity, splits);
expect(adjustedActivity).not.toBe(activity);
expect(adjustedActivity).toMatchObject({
quantity: 20 / 3,
unitPrice: 150,
unitPriceInAssetProfileCurrency: 150,
value: 1000,
valueInBaseCurrency: 1000
});
expect(new Big(adjustedActivity.quantity).toFixed(15)).toBe(
new Big(20).div(3).toFixed(15)
);
expect(activity).toMatchObject({
quantity: 10,
unitPrice: 100,
unitPriceInAssetProfileCurrency: 100
});
});
it('only adjusts activities before the split calendar date', () => {
const split = createSplit('2024-06-15T00:00:00Z', 2, 1);
const activityOnSplitDate = createActivity('2024-06-15T18:00:00Z');
const activityAfterSplit = createActivity('2024-06-16T00:00:00Z');
const adjustedActivityOnSplitDate = adjustActivityBySplits(
activityOnSplitDate,
[split]
);
const adjustedActivityAfterSplit = adjustActivityBySplits(
activityAfterSplit,
[split]
);
expect(adjustedActivityOnSplitDate).toEqual(activityOnSplitDate);
expect(adjustedActivityOnSplitDate).toBe(activityOnSplitDate);
expect(adjustedActivityAfterSplit).toEqual(activityAfterSplit);
expect(adjustedActivityAfterSplit).toBe(activityAfterSplit);
});
it('compares stored UTC split dates without normalizing them locally', () => {
const resetHoursSpy = jest
.spyOn(commonHelper, 'resetHours')
.mockReturnValue(new Date('2024-06-14T00:00:00Z'));
try {
const activity = createActivity('2024-06-14T12:00:00Z');
const split = createSplit('2024-06-15T00:00:00Z', 2, 1);
const adjustedActivity = adjustActivityBySplits(activity, [split]);
expect(adjustedActivity.quantity).toBe(20);
} finally {
resetHoursSpy.mockRestore();
}
});
});
function createActivity(date: string): Activity {
return {
...activityDummyData,
assetProfile: {
...assetProfileDummyData,
dataSource: DataSource.YAHOO,
symbol: 'AAPL'
},
date: parseDate(date),
quantity: 10,
type: 'BUY',
unitPrice: 100,
unitPriceInAssetProfileCurrency: 100,
value: 1000,
valueInBaseCurrency: 1000
} as Activity;
}
function createSplit(
date: string,
numerator: number,
denominator: number
): AssetProfileSplit {
const splitDate = new Date(date);
return {
denominator,
numerator,
createdAt: splitDate,
date: splitDate,
id: `${date}-${numerator}-${denominator}`,
symbolProfileId: 'aapl-profile',
updatedAt: splitDate
};
}

58
apps/api/src/services/asset-profile-split/asset-profile-split.helper.ts

@ -0,0 +1,58 @@
import { INVESTMENT_ACTIVITY_TYPES } from '@ghostfolio/common/config';
import { resetHours } from '@ghostfolio/common/helper';
import { Activity } from '@ghostfolio/common/interfaces';
import { AssetProfileSplit } from '@prisma/client';
import { Big } from 'big.js';
import { isBefore } from 'date-fns';
export function adjustActivityBySplits(
activity: Activity,
splits: AssetProfileSplit[]
): Activity {
if (!INVESTMENT_ACTIVITY_TYPES.includes(activity.type)) {
return activity;
}
const activityDate = resetHours(activity.date);
// Accumulate both parts of the ratio and divide only once, so that the
// cumulative split factor of consecutive splits stays exact
let denominator = new Big(1);
let numerator = new Big(1);
for (const split of splits) {
// Skip malformed splits to not break the portfolio calculation of every
// user holding this asset profile
if (split.denominator <= 0 || split.numerator <= 0) {
continue;
}
if (isBefore(activityDate, split.date)) {
denominator = denominator.mul(split.denominator);
numerator = numerator.mul(split.numerator);
}
}
if (numerator.eq(denominator)) {
return activity;
}
return {
...activity,
quantity: new Big(activity.quantity)
.mul(numerator)
.div(denominator)
.toNumber(),
unitPrice: new Big(activity.unitPrice)
.mul(denominator)
.div(numerator)
.toNumber(),
unitPriceInAssetProfileCurrency: new Big(
activity.unitPriceInAssetProfileCurrency
)
.mul(denominator)
.div(numerator)
.toNumber()
};
}

161
apps/api/src/services/asset-profile-split/asset-profile-split.service.spec.ts

@ -0,0 +1,161 @@
import { PrismaService } from '@ghostfolio/api/services/prisma/prisma.service';
import { AssetProfileSplit, DataSource } from '@prisma/client';
import { AssetProfileSplitService } from './asset-profile-split.service';
describe('AssetProfileSplitService', () => {
let assetProfileSplitService: AssetProfileSplitService;
let deleteMany: jest.Mock;
let findMany: jest.Mock;
let upsert: jest.Mock;
beforeEach(() => {
deleteMany = jest.fn();
findMany = jest.fn();
upsert = jest.fn();
assetProfileSplitService = new AssetProfileSplitService({
assetProfileSplit: { deleteMany, findMany, upsert }
} as unknown as PrismaService);
});
describe('deleteById', () => {
it('scopes deletion by split and asset profile identifiers', async () => {
deleteMany.mockResolvedValue({ count: 1 });
const result = await assetProfileSplitService.deleteById({
id: 'split-id',
symbolProfileId: 'profile-id'
});
expect(result).toBe(true);
expect(deleteMany).toHaveBeenCalledWith({
where: {
id: 'split-id',
symbolProfileId: 'profile-id'
}
});
});
it('returns false when the split belongs to another asset profile', async () => {
deleteMany.mockResolvedValue({ count: 0 });
const result = await assetProfileSplitService.deleteById({
id: 'split-id',
symbolProfileId: 'other-profile-id'
});
expect(result).toBe(false);
expect(deleteMany).toHaveBeenCalledWith({
where: {
id: 'split-id',
symbolProfileId: 'other-profile-id'
}
});
});
});
describe('getSplitsByUserId', () => {
it('fetches the splits of the asset profiles held by the user with one ordered query', async () => {
const splits = [
createStoredSplit('2020-08-31'),
createStoredSplit('2021-09-16')
];
findMany.mockResolvedValue(splits);
const result = await assetProfileSplitService.getSplitsByUserId({
userId: 'user-id'
});
expect(result).toBe(splits);
expect(findMany).toHaveBeenCalledTimes(1);
expect(findMany).toHaveBeenCalledWith({
orderBy: [{ date: 'asc' }],
where: {
symbolProfile: {
activities: {
some: {
userId: 'user-id'
}
}
}
}
});
});
});
describe('upsert', () => {
it('normalizes the split date before persisting it', async () => {
const date = new Date('2024-06-15T18:30:00.000Z');
const normalizedDate = new Date('2024-06-15T00:00:00.000Z');
await assetProfileSplitService.upsert({
date,
denominator: 1,
numerator: 2,
symbolProfileId: 'profile-id'
});
expect(upsert).toHaveBeenCalledWith({
create: {
date: normalizedDate,
denominator: 1,
numerator: 2,
symbolProfileId: 'profile-id'
},
update: {
denominator: 1,
numerator: 2
},
where: {
symbolProfileId_date: {
date: normalizedDate,
symbolProfileId: 'profile-id'
}
}
});
});
});
describe('getSplits', () => {
it('filters by asset profile and orders splits by date ascending', async () => {
const splits = [
createStoredSplit('2020-01-01'),
createStoredSplit('2021-01-01')
];
findMany.mockResolvedValue(splits);
const result = await assetProfileSplitService.getSplits({
dataSource: DataSource.YAHOO,
symbol: 'AAPL'
});
expect(result).toBe(splits);
expect(findMany).toHaveBeenCalledWith({
orderBy: [{ date: 'asc' }],
where: {
symbolProfile: {
dataSource: DataSource.YAHOO,
symbol: 'AAPL'
}
}
});
});
});
});
function createStoredSplit(date: string): AssetProfileSplit {
const splitDate = new Date(date);
return {
createdAt: splitDate,
date: splitDate,
denominator: 1,
id: `${date}-split`,
numerator: 2,
symbolProfileId: 'aapl-profile',
updatedAt: splitDate
};
}

27
apps/api/src/services/asset-profile-split/asset-profile-split.service.ts

@ -52,6 +52,33 @@ export class AssetProfileSplitService {
}); });
} }
/**
* Returns the splits of all asset profiles the given user has activities
* for, in ascending order by date
*/
public async getSplitsByUserId({
userId
}: {
userId: string;
}): Promise<AssetProfileSplit[]> {
return this.prismaService.assetProfileSplit.findMany({
orderBy: [
{
date: 'asc'
}
],
where: {
symbolProfile: {
activities: {
some: {
userId
}
}
}
}
});
}
public async upsert({ public async upsert({
date, date,
denominator, denominator,

32
apps/api/src/services/impersonation/impersonation.service.ts

@ -2,12 +2,18 @@ import { PrismaService } from '@ghostfolio/api/services/prisma/prisma.service';
import { DEFAULT_CURRENCY } from '@ghostfolio/common/config'; import { DEFAULT_CURRENCY } from '@ghostfolio/common/config';
import { UserSettings } from '@ghostfolio/common/interfaces'; import { UserSettings } from '@ghostfolio/common/interfaces';
import { hasPermission, permissions } from '@ghostfolio/common/permissions'; import { hasPermission, permissions } from '@ghostfolio/common/permissions';
import {
getScopesOfAccess,
getScopesOfOwnAccess,
getScopesOfUnrestrictedImpersonation
} from '@ghostfolio/common/scopes';
import type { import type {
ImpersonationContext, ImpersonationContext,
UserWithSettings UserWithSettings
} from '@ghostfolio/common/types'; } from '@ghostfolio/common/types';
import { Injectable } from '@nestjs/common'; import { Injectable } from '@nestjs/common';
import { Access } from '@prisma/client';
@Injectable() @Injectable()
export class ImpersonationService { export class ImpersonationService {
@ -20,14 +26,13 @@ export class ImpersonationService {
impersonationId?: string; impersonationId?: string;
user?: UserWithSettings; user?: UserWithSettings;
}): Promise<ImpersonationContext> { }): Promise<ImpersonationContext> {
const impersonatedUserId = await this.validateImpersonationId({ const { access, userId: impersonatedUserId } =
impersonationId, await this.validateImpersonation({ impersonationId, user });
user
});
if (!impersonatedUserId) { if (!impersonatedUserId) {
return { return {
isActive: false, isActive: false,
scopes: getScopesOfOwnAccess(),
userId: user?.id, userId: user?.id,
userSettings: user?.settings?.settings ?? {} userSettings: user?.settings?.settings ?? {}
}; };
@ -40,6 +45,11 @@ export class ImpersonationService {
return { return {
accessId: impersonationId, accessId: impersonationId,
isActive: true, isActive: true,
// An access which has not been granted explicitly originates from the
// permission to impersonate all users
scopes: access
? getScopesOfAccess(access)
: getScopesOfUnrestrictedImpersonation(),
userId: impersonatedUserId, userId: impersonatedUserId,
userSettings: { userSettings: {
...((settings?.settings ?? {}) as UserSettings), ...((settings?.settings ?? {}) as UserSettings),
@ -49,15 +59,15 @@ export class ImpersonationService {
}; };
} }
public async validateImpersonationId({ private async validateImpersonation({
impersonationId, impersonationId,
user user
}: { }: {
impersonationId?: string; impersonationId?: string;
user?: UserWithSettings; user?: UserWithSettings;
}) { }): Promise<{ access?: Access; userId: string | null }> {
if (!impersonationId) { if (!impersonationId) {
return null; return { userId: null };
} }
if (user) { if (user) {
@ -69,7 +79,7 @@ export class ImpersonationService {
}); });
if (accessObject?.userId) { if (accessObject?.userId) {
return accessObject.userId; return { access: accessObject, userId: accessObject.userId };
} else if ( } else if (
hasPermission(user.permissions, permissions.impersonateAllUsers) hasPermission(user.permissions, permissions.impersonateAllUsers)
) { ) {
@ -79,7 +89,7 @@ export class ImpersonationService {
where: { id: impersonationId } where: { id: impersonationId }
}); });
return impersonatedUser?.id ?? null; return { userId: impersonatedUser?.id ?? null };
} }
} else { } else {
// Public access // Public access
@ -91,10 +101,10 @@ export class ImpersonationService {
}); });
if (accessObject?.userId) { if (accessObject?.userId) {
return accessObject.userId; return { access: accessObject, userId: accessObject.userId };
} }
} }
return null; return { userId: null };
} }
} }

8
apps/api/src/services/queues/data-gathering/data-gathering.service.ts

@ -29,7 +29,7 @@ import {
import { InjectQueue } from '@nestjs/bull'; import { InjectQueue } from '@nestjs/bull';
import { Inject, Injectable, Logger } from '@nestjs/common'; import { Inject, Injectable, Logger } from '@nestjs/common';
import { Prisma } from '@prisma/client'; import { Prisma } from '@prisma/client';
import { JobOptions, Queue } from 'bull'; import { Job, JobOptions, Queue } from 'bull';
import { format, min, subDays, subMilliseconds, subYears } from 'date-fns'; import { format, min, subDays, subMilliseconds, subYears } from 'date-fns';
import { isEmpty } from 'lodash'; import { isEmpty } from 'lodash';
import ms, { StringValue } from 'ms'; import ms, { StringValue } from 'ms';
@ -285,7 +285,7 @@ export class DataGatheringService {
date: date ?? item.date date: date ?? item.date
})); }));
await this.gatherSymbols({ return this.gatherSymbols({
dataGatheringItems, dataGatheringItems,
force: true, force: true,
priority: DATA_GATHERING_QUEUE_PRIORITY_HIGH priority: DATA_GATHERING_QUEUE_PRIORITY_HIGH
@ -336,8 +336,8 @@ export class DataGatheringService {
dataGatheringItems: DataGatheringItem[]; dataGatheringItems: DataGatheringItem[];
force?: boolean; force?: boolean;
priority: number; priority: number;
}) { }): Promise<Job[]> {
await this.addJobsToQueue( return this.addJobsToQueue(
dataGatheringItems.map(({ dataSource, date, symbol }) => { dataGatheringItems.map(({ dataSource, date, symbol }) => {
return { return {
data: { data: {

4
apps/client/src/app/components/access-table/access-table.component.html

@ -18,10 +18,10 @@
<th *matHeaderCellDef class="px-1" i18n mat-header-cell>Permission</th> <th *matHeaderCellDef class="px-1" i18n mat-header-cell>Permission</th>
<td *matCellDef="let element" class="px-1 text-nowrap" mat-cell> <td *matCellDef="let element" class="px-1 text-nowrap" mat-cell>
<div class="align-items-center d-flex"> <div class="align-items-center d-flex">
@if (element.permissions.includes('READ')) { @if (hasScopeToReadValues(element)) {
<ion-icon class="mr-1" name="lock-open-outline" /> <ion-icon class="mr-1" name="lock-open-outline" />
<ng-container i18n>View</ng-container> <ng-container i18n>View</ng-container>
} @else if (element.permissions.includes('READ_RESTRICTED')) { } @else {
<ion-icon class="mr-1" name="lock-closed-outline" /> <ion-icon class="mr-1" name="lock-closed-outline" />
<ng-container i18n>Restricted view</ng-container> <ng-container i18n>Restricted view</ng-container>
} }

5
apps/client/src/app/components/access-table/access-table.component.ts

@ -1,6 +1,7 @@
import { ConfirmationDialogType } from '@ghostfolio/common/enums'; import { ConfirmationDialogType } from '@ghostfolio/common/enums';
import { Access, User } from '@ghostfolio/common/interfaces'; import { Access, User } from '@ghostfolio/common/interfaces';
import { publicRoutes } from '@ghostfolio/common/routes/routes'; import { publicRoutes } from '@ghostfolio/common/routes/routes';
import { hasScope, scopes } from '@ghostfolio/common/scopes';
import { NotificationService } from '@ghostfolio/ui/notifications'; import { NotificationService } from '@ghostfolio/ui/notifications';
import { Clipboard, ClipboardModule } from '@angular/cdk/clipboard'; import { Clipboard, ClipboardModule } from '@angular/cdk/clipboard';
@ -100,6 +101,10 @@ export class GfAccessTableComponent {
return `${this.baseUrl}/${languageCode}/${publicRoutes.public.path}/${aId}`; return `${this.baseUrl}/${languageCode}/${publicRoutes.public.path}/${aId}`;
} }
protected hasScopeToReadValues({ scopes: scopesOfAccess }: Access) {
return hasScope(scopesOfAccess, scopes.portfolioReadValues);
}
protected onCopyUrlToClipboard(aId: string) { protected onCopyUrlToClipboard(aId: string) {
this.clipboard.copy(this.getPublicUrl(aId)); this.clipboard.copy(this.getPublicUrl(aId));

13
apps/client/src/app/components/account-detail-dialog/account-detail-dialog.component.ts

@ -14,11 +14,8 @@ import {
PortfolioPosition, PortfolioPosition,
User User
} from '@ghostfolio/common/interfaces'; } from '@ghostfolio/common/interfaces';
import { import { hasPermission, permissions } from '@ghostfolio/common/permissions';
hasPermission, import { hasScope, scopes } from '@ghostfolio/common/scopes';
hasReadRestrictedAccessPermission,
permissions
} from '@ghostfolio/common/permissions';
import { GfAccountBalancesComponent } from '@ghostfolio/ui/account-balances'; import { GfAccountBalancesComponent } from '@ghostfolio/ui/account-balances';
import { GfActivitiesTableComponent } from '@ghostfolio/ui/activities-table'; import { GfActivitiesTableComponent } from '@ghostfolio/ui/activities-table';
import { GfDialogFooterComponent } from '@ghostfolio/ui/dialog-footer'; import { GfDialogFooterComponent } from '@ghostfolio/ui/dialog-footer';
@ -233,10 +230,8 @@ export class GfAccountDetailDialogComponent implements OnInit {
protected showValuesInPercentage() { protected showValuesInPercentage() {
return ( return (
hasReadRestrictedAccessPermission({ !hasScope(this.user?.scopes, scopes.portfolioReadValues) ||
accesses: this.user?.access, this.user?.settings?.isRestrictedView
impersonationId: this.data.impersonationId
}) || this.user?.settings?.isRestrictedView
); );
} }

4
apps/client/src/app/components/admin-market-data/asset-profile-dialog/asset-profile-dialog.html

@ -511,9 +511,7 @@
</div> </div>
</div> </div>
</mat-tab> </mat-tab>
<!-- Splits are not applied to the portfolio calculation yet, hence the @if (user?.settings?.isExperimentalFeatures) {
tab to manage them is disabled -->
@if (false && user?.settings?.isExperimentalFeatures) {
<mat-tab> <mat-tab>
<ng-template mat-tab-label> <ng-template mat-tab-label>
<ion-icon name="git-compare-outline" /> <ion-icon name="git-compare-outline" />

3
apps/client/src/app/components/user-account-access/create-or-update-access-dialog/interfaces/interfaces.ts

@ -1,5 +1,6 @@
import { Access } from '@ghostfolio/common/interfaces'; import { Access } from '@ghostfolio/common/interfaces';
export interface CreateOrUpdateAccessDialogParams { export interface CreateOrUpdateAccessDialogParams {
access?: Access; // TODO: Include the scopes once the dialog allows to configure them
access?: Omit<Access, 'scopes'>;
} }

21
apps/client/src/app/components/user-account-access/user-account-access.component.ts

@ -247,15 +247,18 @@ export class GfUserAccountAccessComponent implements OnInit {
} }
private update() { private update() {
this.accessesGet = this.user.access.map(({ alias, id, permissions }) => { this.accessesGet = this.user.access.map(
return { ({ alias, id, permissions, scopes }) => {
id, return {
permissions, id,
alias: alias ?? '', permissions,
grantee: $localize`Me`, scopes,
type: 'PRIVATE' alias: alias ?? '',
}; grantee: $localize`Me`,
}); type: 'PRIVATE'
};
}
);
this.dataService this.dataService
.fetchAccesses() .fetchAccesses()

13
apps/client/src/app/pages/portfolio/allocations/allocations-page.component.ts

@ -17,11 +17,8 @@ import {
PortfolioPosition, PortfolioPosition,
User User
} from '@ghostfolio/common/interfaces'; } from '@ghostfolio/common/interfaces';
import { import { hasPermission, permissions } from '@ghostfolio/common/permissions';
hasPermission, import { hasScope, scopes } from '@ghostfolio/common/scopes';
hasReadRestrictedAccessPermission,
permissions
} from '@ghostfolio/common/permissions';
import { MarketAdvanced } from '@ghostfolio/common/types'; import { MarketAdvanced } from '@ghostfolio/common/types';
import { translate } from '@ghostfolio/ui/i18n'; import { translate } from '@ghostfolio/ui/i18n';
import { GfPortfolioProportionChartComponent } from '@ghostfolio/ui/portfolio-proportion-chart'; import { GfPortfolioProportionChartComponent } from '@ghostfolio/ui/portfolio-proportion-chart';
@ -229,10 +226,8 @@ export class GfAllocationsPageComponent implements OnInit {
protected showValuesInPercentage() { protected showValuesInPercentage() {
return ( return (
hasReadRestrictedAccessPermission({ !hasScope(this.user?.scopes, scopes.portfolioReadValues) ||
accesses: this.user?.access, this.user?.settings?.isRestrictedView
impersonationId: this.impersonationId
}) || this.user?.settings?.isRestrictedView
); );
} }

27
apps/client/src/app/pages/portfolio/analysis/analysis-page.component.ts

@ -1,6 +1,5 @@
import { GfBenchmarkComparatorComponent } from '@ghostfolio/client/components/benchmark-comparator/benchmark-comparator.component'; import { GfBenchmarkComparatorComponent } from '@ghostfolio/client/components/benchmark-comparator/benchmark-comparator.component';
import { GfInvestmentChartComponent } from '@ghostfolio/client/components/investment-chart/investment-chart.component'; import { GfInvestmentChartComponent } from '@ghostfolio/client/components/investment-chart/investment-chart.component';
import { ImpersonationStorageService } from '@ghostfolio/client/services/impersonation-storage.service';
import { UserService } from '@ghostfolio/client/services/user/user.service'; import { UserService } from '@ghostfolio/client/services/user/user.service';
import { import {
DEFAULT_DATE_RANGE, DEFAULT_DATE_RANGE,
@ -15,11 +14,8 @@ import {
PortfolioPosition, PortfolioPosition,
User User
} from '@ghostfolio/common/interfaces'; } from '@ghostfolio/common/interfaces';
import { import { hasPermission, permissions } from '@ghostfolio/common/permissions';
hasPermission, import { hasScope, scopes } from '@ghostfolio/common/scopes';
hasReadRestrictedAccessPermission,
permissions
} from '@ghostfolio/common/permissions';
import type { import type {
AiPromptMode, AiPromptMode,
GroupBy, GroupBy,
@ -88,7 +84,6 @@ export class GfAnalysisPageComponent implements OnInit {
protected dividendsByGroup: InvestmentItem[]; protected dividendsByGroup: InvestmentItem[];
protected readonly dividendTimelineDataLabel = $localize`Dividend`; protected readonly dividendTimelineDataLabel = $localize`Dividend`;
protected hasPermissionToReadAiPrompt: boolean; protected hasPermissionToReadAiPrompt: boolean;
protected impersonationId: string | null;
protected investments: InvestmentItem[]; protected investments: InvestmentItem[];
protected readonly investmentTimelineDataLabel = $localize`Invested Capital`; protected readonly investmentTimelineDataLabel = $localize`Invested Capital`;
protected investmentsByGroup: InvestmentItem[]; protected investmentsByGroup: InvestmentItem[];
@ -126,9 +121,6 @@ export class GfAnalysisPageComponent implements OnInit {
private readonly dataService = inject(DataService); private readonly dataService = inject(DataService);
private readonly destroyRef = inject(DestroyRef); private readonly destroyRef = inject(DestroyRef);
private readonly deviceDetectorService = inject(DeviceDetectorService); private readonly deviceDetectorService = inject(DeviceDetectorService);
private readonly impersonationStorageService = inject(
ImpersonationStorageService
);
private readonly snackBar = inject(MatSnackBar); private readonly snackBar = inject(MatSnackBar);
private readonly userService = inject(UserService); private readonly userService = inject(UserService);
@ -150,15 +142,6 @@ export class GfAnalysisPageComponent implements OnInit {
} }
public ngOnInit() { public ngOnInit() {
this.impersonationStorageService
.onChangeHasImpersonation()
.pipe(takeUntilDestroyed(this.destroyRef))
.subscribe((impersonationId) => {
this.impersonationId = impersonationId;
this.changeDetectorRef.markForCheck();
});
this.userService.stateChanged this.userService.stateChanged
.pipe(takeUntilDestroyed(this.destroyRef)) .pipe(takeUntilDestroyed(this.destroyRef))
.subscribe((state) => { .subscribe((state) => {
@ -247,10 +230,8 @@ export class GfAnalysisPageComponent implements OnInit {
protected showValuesInPercentage() { protected showValuesInPercentage() {
return ( return (
hasReadRestrictedAccessPermission({ !hasScope(this.user?.scopes, scopes.portfolioReadValues) ||
accesses: this.user?.access, this.user?.settings?.isRestrictedView
impersonationId: this.impersonationId
}) || this.user?.settings?.isRestrictedView
); );
} }

3
libs/common/src/lib/dtos/create-access.dto.ts

@ -16,6 +16,9 @@ export class CreateAccessDto {
@IsUUID() @IsUUID()
granteeUserId?: string; granteeUserId?: string;
/**
* @deprecated Use the scopes instead
*/
@IsEnum(AccessPermission, { each: true }) @IsEnum(AccessPermission, { each: true })
@IsOptional() @IsOptional()
permissions?: AccessPermission[]; permissions?: AccessPermission[];

3
libs/common/src/lib/dtos/update-access.dto.ts

@ -19,6 +19,9 @@ export class UpdateAccessDto {
@IsString() @IsString()
id: string; id: string;
/**
* @deprecated Use the scopes instead
*/
@IsEnum(AccessPermission, { each: true }) @IsEnum(AccessPermission, { each: true })
@IsOptional() @IsOptional()
permissions?: AccessPermission[]; permissions?: AccessPermission[];

6
libs/common/src/lib/interfaces/access.interface.ts

@ -8,7 +8,13 @@ export interface Access {
alias: string | null; alias: string | null;
grantee?: string; grantee?: string;
id: string; id: string;
/**
* @deprecated Use the scopes instead
*/
permissions: AccessPermission[]; permissions: AccessPermission[];
scopes: string[];
settings?: AccessSettings; settings?: AccessSettings;
type: AccessType; type: AccessType;
} }

3
libs/common/src/lib/interfaces/user.interface.ts

@ -10,13 +10,14 @@ import { UserSettings } from './user-settings.interface';
// TODO: Compare with UserWithSettings // TODO: Compare with UserWithSettings
export interface User { export interface User {
access: Pick<Access, 'alias' | 'id' | 'permissions'>[]; access: Pick<Access, 'alias' | 'id' | 'permissions' | 'scopes'>[];
accounts: AccountWithPlatform[]; accounts: AccountWithPlatform[];
activitiesCount: number; activitiesCount: number;
dateOfFirstActivity: Date; dateOfFirstActivity: Date;
id: string; id: string;
permissions: string[]; permissions: string[];
referralPartners?: ReferralPartner[]; referralPartners?: ReferralPartner[];
scopes: string[];
settings: UserSettings; settings: UserSettings;
systemMessage?: SystemMessage; systemMessage?: SystemMessage;
subscription: { subscription: {

25
libs/common/src/lib/permissions.ts

@ -1,6 +1,6 @@
import { UserWithSettings } from '@ghostfolio/common/types'; import { UserWithSettings } from '@ghostfolio/common/types';
import { Access, Role } from '@prisma/client'; import { Role } from '@prisma/client';
export const permissions = { export const permissions = {
accessAdminControl: 'accessAdminControl', accessAdminControl: 'accessAdminControl',
@ -138,7 +138,9 @@ export function getPermissions(aRole: Role): string[] {
permissions.createAccount, permissions.createAccount,
permissions.createAccountBalance, permissions.createAccountBalance,
permissions.createActivity, permissions.createActivity,
permissions.createAssetProfileSplitOfOwnAssetProfile, // TODO: Grant createAssetProfileSplitOfOwnAssetProfile and
// deleteAssetProfileSplitOfOwnAssetProfile once the stock splits
// feature is no longer experimental
permissions.createMarketDataOfOwnAssetProfile, permissions.createMarketDataOfOwnAssetProfile,
permissions.createOwnTag, permissions.createOwnTag,
permissions.createWatchlistItem, permissions.createWatchlistItem,
@ -146,7 +148,6 @@ export function getPermissions(aRole: Role): string[] {
permissions.deleteAccount, permissions.deleteAccount,
permissions.deleteAccountBalance, permissions.deleteAccountBalance,
permissions.deleteActivity, permissions.deleteActivity,
permissions.deleteAssetProfileSplitOfOwnAssetProfile,
permissions.deleteAuthDevice, permissions.deleteAuthDevice,
permissions.deleteWatchlistItem, permissions.deleteWatchlistItem,
permissions.readAiPrompt, permissions.readAiPrompt,
@ -197,24 +198,6 @@ export function hasPermission(
return aPermissions.includes(aPermission); return aPermissions.includes(aPermission);
} }
export function hasReadRestrictedAccessPermission({
accesses = [],
impersonationId
}: {
accesses?: Pick<Access, 'id' | 'permissions'>[];
impersonationId: string | null;
}) {
if (!impersonationId) {
return false;
}
const access = accesses.find(({ id }) => {
return id === impersonationId;
});
return access?.permissions?.includes('READ_RESTRICTED') ?? true;
}
export function hasRole(aUser: UserWithSettings, aRole: Role) { export function hasRole(aUser: UserWithSettings, aRole: Role) {
return aUser?.role === aRole; return aUser?.role === aRole;
} }

130
libs/common/src/lib/scopes.spec.ts

@ -0,0 +1,130 @@
import {
getScopesOfAccess,
getScopesOfOwnAccess,
getScopesOfUnrestrictedImpersonation,
hasScope,
scopes
} from '@ghostfolio/common/scopes';
describe('Scopes', () => {
describe('Get scopes of access', () => {
it('Scopes take precedence over the permissions', () => {
expect(
getScopesOfAccess({
granteeUserId: 'ffb08949-2f8a-4b6e-88fd-0f1e6b6b5f5d',
permissions: ['READ'],
scopes: [scopes.portfolioRead]
})
).toEqual([scopes.portfolioRead]);
});
it('Derive from the permission to read', () => {
// An access created before the scopes have been introduced has no scopes
expect(
getScopesOfAccess({
granteeUserId: 'ffb08949-2f8a-4b6e-88fd-0f1e6b6b5f5d',
permissions: ['READ'],
scopes: []
})
).toContain(scopes.portfolioReadValues);
});
it('Derive from the permission to read restricted', () => {
expect(
getScopesOfAccess({
granteeUserId: 'ffb08949-2f8a-4b6e-88fd-0f1e6b6b5f5d',
permissions: ['READ_RESTRICTED'],
scopes: []
})
).not.toContain(scopes.portfolioReadValues);
});
it('Without permissions and scopes', () => {
expect(
getScopesOfAccess({
granteeUserId: 'ffb08949-2f8a-4b6e-88fd-0f1e6b6b5f5d'
})
).not.toContain(scopes.portfolioReadValues);
});
});
describe('Get scopes of public access', () => {
it('Allows reading the portfolio', () => {
expect(getScopesOfAccess({ permissions: ['READ_RESTRICTED'] })).toContain(
scopes.portfolioRead
);
});
it('Excludes the accounts and the watchlist', () => {
const scopesOfAccess = getScopesOfAccess({
permissions: ['READ_RESTRICTED']
});
expect(scopesOfAccess).not.toContain(scopes.accountRead);
expect(scopesOfAccess).not.toContain(scopes.watchlistRead);
});
it('Cannot be widened by the scopes', () => {
expect(
getScopesOfAccess({
scopes: [
scopes.portfolioRead,
scopes.portfolioReadValues,
scopes.watchlistRead
]
})
).toEqual([scopes.portfolioRead]);
});
it('Cannot be widened by the permission to read', () => {
expect(getScopesOfAccess({ permissions: ['READ'] })).not.toContain(
scopes.portfolioReadValues
);
});
});
describe('Get scopes of own access', () => {
// A new scope has to be added here deliberately to confirm that it is
// granted to the owner of the data
it('Covers every scope', () => {
expect(getScopesOfOwnAccess()).toEqual([
scopes.accountRead,
scopes.activityRead,
scopes.portfolioRead,
scopes.portfolioReadValues,
scopes.watchlistRead
]);
});
});
describe('Get scopes of unrestricted impersonation', () => {
// A new scope has to be added here deliberately to confirm that it is
// granted to an administrator impersonating an arbitrary user
it('Covers every scope but the monetary values', () => {
expect(getScopesOfUnrestrictedImpersonation()).toEqual([
scopes.accountRead,
scopes.activityRead,
scopes.portfolioRead,
scopes.watchlistRead
]);
});
});
describe('Has scope', () => {
it('Present scope', () => {
expect(hasScope([scopes.portfolioRead], scopes.portfolioRead)).toEqual(
true
);
});
it('Absent scope', () => {
expect(
hasScope([scopes.portfolioRead], scopes.portfolioReadValues)
).toEqual(false);
});
it('Without scopes', () => {
expect(hasScope(undefined, scopes.portfolioRead)).toEqual(false);
});
});
});

78
libs/common/src/lib/scopes.ts

@ -0,0 +1,78 @@
import { AccessPermission } from '@prisma/client';
/**
* Scopes describe what a grantee may do on behalf of the granting user. They
* are a separate axis from the permissions, which describe the capabilities of
* a role. Both are evaluated, hence a delegation can only narrow the access of
* the authenticated user and never widen it.
*/
export const scopes = {
accountRead: 'account:read',
activityRead: 'activity:read',
portfolioRead: 'portfolio:read',
portfolioReadValues: 'portfolio:read:values',
watchlistRead: 'watchlist:read'
} as const;
export type Scope = (typeof scopes)[keyof typeof scopes];
const SCOPES_OF_PUBLIC_ACCESS: Scope[] = [
scopes.activityRead,
scopes.portfolioRead
];
const SCOPES_OF_READ_ACCESS = Object.values(scopes);
const SCOPES_OF_READ_RESTRICTED_ACCESS = SCOPES_OF_READ_ACCESS.filter(
(scope) => {
return scope !== scopes.portfolioReadValues;
}
);
export function getScopesOfAccess({
granteeUserId,
permissions,
scopes: scopesOfAccess
}: {
granteeUserId?: string | null;
permissions?: AccessPermission[];
scopes?: string[];
}): string[] {
if (!scopesOfAccess?.length) {
// TODO: Remove the derivation from the permissions once they have been
// dropped from the access
scopesOfAccess = permissions?.includes('READ')
? SCOPES_OF_READ_ACCESS
: SCOPES_OF_READ_RESTRICTED_ACCESS;
}
if (granteeUserId) {
return [...scopesOfAccess];
}
// An access which has not been granted to a user is public, hence it is
// narrowed to the scopes exposed by the public endpoints
return SCOPES_OF_PUBLIC_ACCESS.filter((scope) => {
return scopesOfAccess.includes(scope);
});
}
/**
* Scopes of a user acting on their own data, which is unrestricted. The
* permissions of the role are evaluated separately.
*/
export function getScopesOfOwnAccess(): string[] {
return Object.values(scopes);
}
/**
* Scopes of an administrator impersonating an arbitrary user, which excludes
* the monetary values
*/
export function getScopesOfUnrestrictedImpersonation(): string[] {
return [...SCOPES_OF_READ_RESTRICTED_ACCESS];
}
export function hasScope(aScopes: string[] = [], aScope: Scope) {
return aScopes.includes(aScope);
}

1
libs/common/src/lib/types/impersonation-context.type.ts

@ -8,6 +8,7 @@ import { UserSettings } from '@ghostfolio/common/interfaces';
export interface ImpersonationContext { export interface ImpersonationContext {
accessId?: string; accessId?: string;
isActive: boolean; isActive: boolean;
scopes: string[];
userId: string; userId: string;
userSettings: UserSettings; userSettings: UserSettings;
} }

3
libs/common/src/lib/types/user-with-settings.type.ts

@ -1,11 +1,10 @@
import { SubscriptionType } from '@ghostfolio/common/enums'; import { SubscriptionType } from '@ghostfolio/common/enums';
import { SubscriptionOffer, UserSettings } from '@ghostfolio/common/interfaces'; import { SubscriptionOffer, UserSettings } from '@ghostfolio/common/interfaces';
import { Access, Account, Settings, User } from '@prisma/client'; import { Account, Settings, User } from '@prisma/client';
// TODO: Compare with User interface // TODO: Compare with User interface
export type UserWithSettings = User & { export type UserWithSettings = User & {
accessesGet: Access[];
accounts: Account[]; accounts: Account[];
activityCount: number; activityCount: number;
dataProviderGhostfolioDailyRequests: number; dataProviderGhostfolioDailyRequests: number;

2
prisma/migrations/20260815120000_added_symbol_profile_id_index_to_order/migration.sql

@ -0,0 +1,2 @@
-- CreateIndex
CREATE INDEX "Order_symbolProfileId_idx" ON "Order"("symbolProfileId");

24
prisma/migrations/20260815130000_added_scopes_to_access/migration.sql

@ -0,0 +1,24 @@
-- AlterTable
ALTER TABLE "Access" ADD COLUMN "scopes" TEXT[] DEFAULT ARRAY[]::TEXT[];
-- Derive the scopes from the permissions of the existing accesses
UPDATE "Access"
SET "scopes" = CASE
WHEN "granteeUserId" IS NULL THEN ARRAY[
'activity:read',
'portfolio:read'
]
WHEN 'READ' = ANY("permissions") THEN ARRAY[
'account:read',
'activity:read',
'portfolio:read',
'portfolio:read:values',
'watchlist:read'
]
ELSE ARRAY[
'account:read',
'activity:read',
'portfolio:read',
'watchlist:read'
]
END;

3
prisma/schema.prisma

@ -14,7 +14,9 @@ model Access {
granteeUser User? @relation("accessGet", fields: [granteeUserId], onDelete: Cascade, references: [id]) granteeUser User? @relation("accessGet", fields: [granteeUserId], onDelete: Cascade, references: [id])
granteeUserId String? granteeUserId String?
id String @id @default(uuid()) id String @id @default(uuid())
/// @deprecated Use the scopes instead
permissions AccessPermission[] @default([READ_RESTRICTED]) permissions AccessPermission[] @default([READ_RESTRICTED])
scopes String[] @default([])
settings Json @default("{}") settings Json @default("{}")
updatedAt DateTime @updatedAt updatedAt DateTime @updatedAt
userId String userId String
@ -195,6 +197,7 @@ model Order {
@@index([accountId]) @@index([accountId])
@@index([date]) @@index([date])
@@index([symbolProfileId])
@@index([type]) @@index([type])
@@index([userId]) @@index([userId])
} }

Loading…
Cancel
Save