feat: per-user access, stored bank sync, fail-closed production

.env.example

@@ -0,0 +1,31 @@
+# Copy to .env. Everything in the first section is needed to run in production.
+# Optional features are below it, switched off until you uncomment them.
+
+# ============ REQUIRED IN PRODUCTION ============
+
+# Cloudflare Tunnel token (Zero Trust dashboard)
+TUNNEL_TOKEN=your-tunnel-token
+
+# Your site's address. The API won't start without it.
+ALLOWED_ORIGIN=https://finkit.example.com
+
+# Cloudflare Access sign-in. The API won't start without both.
+CF_ACCESS_TEAM_DOMAIN=yourteam.cloudflareaccess.com
+CF_ACCESS_AUD=audience-tag-of-the-access-application
+
+# Who may use FinKit (comma separated). The first address inherits any existing data.
+ALLOWED_USER_EMAILS=you@example.com
+
+# ============ OPTIONAL ============
+
+# --- Bank sync (Enable Banking) ---
+# Set all of these together. More detail: api/.env.example
+# BANKING_PROVIDER=enablebanking
+# BANKING_ENCRYPTION_KEY=             # openssl rand -base64 32
+# BANKING_REDIRECT_URL=https://finkit.example.com/api/banking/callback   # https, registered in your Enable Banking app
+# EB_APP_ID=
+# EB_PRIVATE_KEY_PATH=/run/secrets/enablebanking.pem                     # put the file at ./secrets/enablebanking.pem
+# BANKING_AUTO_SYNC_HOURS=12           # scheduled catch-up; minimum 6, 0 = off
+
+# --- Google Sheets export ---
+# GOOGLE_SERVICE_ACCOUNT_KEY_PATH=/run/secrets/google-sa.json            # put the file at ./secrets/google-sa.json

.github/workflows/docker-build.yml

@@ -13,11 +13,45 @@ permissions:
   packages: write
 
 jobs:
+  # ============================================
+  # Lint, types and tests: nothing is built until these pass
+  # ============================================
+  check:
+    name: Check (${{ matrix.app }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        app: [api, web]
+    defaults:
+      run:
+        working-directory: ${{ matrix.app }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          cache-dependency-path: ${{ matrix.app }}/package-lock.json
+
+      - run: npm ci
+      - name: Lint and format
+        run: npm run check
+      - name: Types (web; the API check already includes them)
+        if: matrix.app == 'web'
+        run: npx tsc --noEmit -p .
+      - name: Tests
+        run: npm test
+
   # ============================================
   # API Dependencies (cached node_modules)
   # ============================================
   api-deps:
     name: API deps (cached node_modules)
+    needs: [check]
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 20
     steps:
@@ -38,20 +72,6 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and push deps (builder)
-        uses: docker/build-push-action@v6
-        with:
-          context: ./api
-          file: ./api/Dockerfile.deps
-          target: deps-builder
-          platforms: linux/arm64
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: |
-            ghcr.io/${{ steps.owner.outputs.owner_lc }}/finkit-api-deps:builder
-            ghcr.io/${{ steps.owner.outputs.owner_lc }}/finkit-api-deps:builder-sha-${{ github.sha }}
-          cache-from: type=gha,scope=api-deps-builder
-          cache-to: type=gha,mode=max,scope=api-deps-builder
-
       - name: Build and push deps (production)
         uses: docker/build-push-action@v6
         with:
@@ -61,8 +81,8 @@ jobs:
           platforms: linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
           tags: |
-            ghcr.io/${{ steps.owner.outputs.owner_lc }}/finkit-api-deps:production
             ghcr.io/${{ steps.owner.outputs.owner_lc }}/finkit-api-deps:production-sha-${{ github.sha }}
+            ghcr.io/${{ steps.owner.outputs.owner_lc }}/finkit-api-deps:production
           cache-from: type=gha,scope=api-deps-production
           cache-to: type=gha,mode=max,scope=api-deps-production
 
@@ -72,7 +92,9 @@ jobs:
   api:
     name: API app
     runs-on: ubuntu-24.04-arm
-    needs: [api-deps]
+    needs: [check, api-deps]
+    # api-deps doesn't run on pull requests (nothing is published there); the build installs its own
+    if: ${{ !cancelled() && needs.check.result == 'success' && contains(fromJSON('["success","skipped"]'), needs.api-deps.result) }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
@@ -103,6 +125,18 @@ jobs:
             type=semver,pattern={{version}}
             type=sha,prefix=sha-,format=short
 
+      # Pull requests publish nothing, so they build their own production dependencies (api/Dockerfile).
+      - name: Dependency image
+        id: deps
+        run: |
+          {
+            echo 'args<<EOF'
+            if [ "${{ github.event_name }}" != "pull_request" ]; then
+              echo "PRODUCTION_DEPS_IMAGE=ghcr.io/${{ steps.owner.outputs.owner_lc }}/finkit-api-deps:production-sha-${{ github.sha }}"
+            fi
+            echo EOF
+          } >> "$GITHUB_OUTPUT"
+
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
@@ -112,9 +146,7 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            BUILDER_DEPS_IMAGE=ghcr.io/${{ steps.owner.outputs.owner_lc }}/finkit-api-deps:builder
-            PRODUCTION_DEPS_IMAGE=ghcr.io/${{ steps.owner.outputs.owner_lc }}/finkit-api-deps:production
+          build-args: ${{ steps.deps.outputs.args }}
           cache-from: type=gha,scope=api-app
           cache-to: type=gha,mode=max,scope=api-app
 
@@ -123,6 +155,7 @@ jobs:
   # ============================================
   web:
     name: Web app
+    needs: [check]
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:

.gitignore

@@ -56,6 +56,7 @@ temp/
 
 # Web specific
 web/.bolt/
+web/tsconfig.tsbuildinfo
 
 # Database files (SQLite)
 *.db
@@ -75,3 +76,10 @@ data/
 *.pem
 secrets/
 .finkit-secrets/
+
+# Real bank exports used to test the Enable Banking mock. Never commit.
+tilisy*.json
+**/mock-upload*.json
+
+# Playwright MCP scratch output
+.playwright-mcp/

.nvmrc

@@ -0,0 +1 @@
+26.13.0