Centralize account-name validation into a shared module; apply to all creation paths #51
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Found in the high-effort code review of PR #46.
Two related altitude issues with the new
_validate_account_name/_is_valid_account_component(views_api.py):1. Only the admin endpoint validates. The sibling super-user path
POST /api/v1/accounts(api_create_account,views_api.py:291→crud.create_account) insertsnameinto libra's DB with no Beancount-grammar check. A malformed name can enter the DB there and later diverge from / break Fava during account-sync or an Open write. Validation belongs in a shared module (next toaccount_utils) that every creation path calls — not bolted onto the one endpoint the UI happens to use.2. The five-type rule and the grammar rule are split.
views_api.py:3725doesstartswith(_VALID_ACCOUNT_PREFIXES)(the real five-root gate) and:3734calls_validate_account_name, which accepts any uppercase-initial root. They run back-to-back with divergent 400 messages (e.g.name="Income"→ "must start with Income:" instead of "needs a sub-account"). Fold the root-allowlist into the validator so there's one source of truth and one message.Suggested fix
Add
account_utils.validate_account_name(name)(grammar + five-root check, mirroringbeancount.core.account— already cross-checked to matchis_valid()across 20 cases) and call it from both creation endpoints. Collapses #1 and #2.