* feat(entitlements): partition the self-host bypass so connector capabilities fall through to grants; capability_grants.source accepts 'connector' Sovereign plan WS3 PR3: ships dark, nothing changes for hosted. - lib/entitlements/keys.ts: CONNECTOR_CAPABILITIES = bank_sync, skatteverket, org_lookup, migration (services Accounted operates that a self-hosted instance cannot provide itself) + isConnectorCapability(). Separate from PAID_CAPABILITIES and outside the trial-seed trigger on purpose: a hosted company can never hold a connector grant. - lib/entitlements/has-capability.ts: isPaywallBypassed() -> isBypassedFor(key). Hosted: byte-identical (dev / DISABLE_PAYWALL bypass, FORCE_PAYWALL wins, else the grant lookup). Self-host: local capabilities always on (FORCE_PAYWALL included, as the existing test demands); connector capabilities behave like hosted, i.e. dev bypass, FORCE_PAYWALL, else the grant lookup where the connector sync will write source='connector' rows. getCompanyEntitlements on a self-host: local paid keys + active connector keys, state 'paid' with an active connector grant else 'none' (never the hosted trial copy). - Migration 20260820122000: capability_grants.source CHECK gains 'connector', found through pg_constraint (the CHECK was declared inline and auto-named; Postgres stores IN as = ANY, matched accordingly). pg-real test: connector accepted, unknown source rejected, upsert on the (scope, key, source) identity, trial seed writes no connector rows. - Tests: self-hosted connector matrix (local all-on without DB, connector gated by grant/expiry, dev bypass all-on, FORCE_PAYWALL gates connector keys only, bulk resolution, entitlements shape); two pre-existing tests that asserted the old "self-host holds connector keys" contract updated to the new one. Verified: full unit suite green, pg-real suite for lib/entitlements green against a local supabase/postgres with every migration applied, lint ratchet, guards. Deferred to the instance-wiring PR: adding the connector extensions to the self-host Docker preset (dead-end upsells until a key can be issued). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(entitlements): fold the self-host branch into the existing grants query One .or(scopeFilter), not two: the duplicated helper pushed the no-phantom-columns unresolvable-expression count to 380/379. Behaviour is unchanged; the self-host matrix tests still pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(connect): hosted connector-key registry + validate RPC + entitlements endpoint; instance sync writes connector grants hourly Sovereign plan WS3 PR4 ("key infra enabling manual sales"), stacked on the entitlement partition (#1747). Nothing is purchasable yet; this is the plumbing both ends need before the first manually issued key. Hosted side: - Migration 20260820123000: connector_keys (SHA-256 key_hash, prefix, org_number, pinned instance_url, scopes, status, Stripe ids, current_period_end, per-minute rate limit, active_company_count, last_seen/synced) and connector_usage_events (per-request metering, separate from metered_events whose company_id references hosted companies). RLS on, NO policies: service role only. RPC validate_and_increment_connector_key copies the api_keys pattern (FOR UPDATE, minute window, suspended reported not counted, revoked = no row) and is REVOKEd from PUBLIC/anon/authenticated, GRANTed to service_role. pg-real test covers validate/count, unknown+revoked, suspended, rate limit, execute privileges per role, RLS invisibility, usage cascade. - lib/connect/contract.ts (shared wire types), lib/connect/hosted/keys.ts (generate/hash/validate -> 401/403/429 mapping), with-connector-auth.ts (Bearer or X-Connector-Key, one usage row per request, 500 envelope on handler throw), /api/connect/entitlements GET + POST (records active_company_count, pins instance_url on first report, never moves a pinned one), scripts/issue-connector-key.ts (dry run unless --confirm, prints the key once + the .env lines). Instance side: - lib/connect/instance/config.ts (GNUBOK_CONNECTOR_KEY, GNUBOK_CONNECT_URL default https://app.gnubok.se), sync.ts: reports the active company count and writes source='connector' grants for every company x covered scope, expires_at = min(now+72h, period_end+3d); 401/403 or a non-active status deletes them (freeze-and-retain); network/5xx/429 leave them alone. /api/connector/sync/cron (hourly) runs it; not_configured without a key. - Crontab generator gains EXTRA_JOBS (variant-only jobs not in vercel.json, with reasons) + drift tests; docker/crontab.self-hosted regenerated with the hourly sync. Docs (SELF-HOSTING connector section, env templates), DECISIONS. Tests: 52 new unit tests (keys, auth wrapper, route, config, sync outcomes and grant arithmetic, cron route, crontab EXTRA_JOBS) + 7 pg-real tests run locally against supabase/postgres with every migration applied. no-phantom-columns ceiling +1 with a reason (the bulk grant upsert). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(connect): Enable Banking proxy for self-hosted instances, with a secret-free ownership ledger and a global rate budget Sovereign plan WS3 PR5a, stacked on the connector-key infra (#1748). A self-hosted instance with a `bank_sync`-scoped connector key can now connect a bank through Arcim's PSD2 credentials; the bank session id and all transaction data stay in the instance's own database (founder decision: tokens on the instance, proxy stateless). - Migration 20260820124000: `connector_connections` (secret-free ledger: sha256 of the EB session id + account uids, service-role only), `connector_upstream_counters` + RPC `connector_reserve_upstream` (global budget under EB Annex 1 §5's 300/min, shared with hosted), and `connector_keys.limits` jsonb; validate RPC v2 returns limits. All RPCs REVOKEd from PUBLIC/anon/authenticated, GRANTed service_role. pg-real covers all of it. - EB JWT minting moved to lib/connect/upstreams/enable-banking-jwt.ts (core must not import @/extensions/); the extension re-exports it, tests unchanged. - lib/connect/hosted/{state,ledger,upstream-budget}.ts: HMAC-signed connector state (15-min TTL) so the consent redirect can use OUR registered EB callback and bounce back to the instance, no per-instance redirect URI at EB; the callback route gains that connector branch. - app/api/connect/bank/[...path]: path allowlist (aspsps, auth, sessions, accounts/{uid}/{balances,transactions}), never open passthrough. POST /auth enforces the per-company connection quota + rewrites redirect/state; reads/deletes verify ledger ownership; every upstream call takes the global budget (429 + Retry-After when exhausted). - issue-connector-key.ts: scopes default bank_sync,skatteverket (TIC out of v1), --bank/skv-connections-per-company + --sync-min-interval. - Docs (SELF-HOSTING: bank connector live), DECISIONS. Verified: 52 connect unit tests + 13 pg-real (run locally against supabase/postgres with all migrations) + EB extension suite (225, jwt relocation intact); full unit suite 15 979 green; tsc, guards, lint clean. Not in this PR: SKV broker (PR5b) and instance wiring (PR6). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(connect): Skatteverket broker + data proxy for self-hosted instances (tokens stay on the instance) Sovereign plan WS3 PR5b, stacked on the bank proxy (#1751). A self-hosted instance with a `skatteverket`-scoped connector key can now run the BankID consent, file VAT/AGI and sync skattekonto through Arcim's registered Skatteverket client; the SKV tokens are returned to the instance and stored (encrypted) there. - lib/connect/upstreams/skatteverket-oauth.ts: core-side SKV OAuth + data helpers (authorize URL, code/refresh exchange with Arcim's client secret, the four backing-API base URLs, the API-gateway Client_Id/Client_Secret headers). Core can't import @/extensions/, so this duplicates the extension's endpoints/scope set (one integrator = Arcim), mirroring the EB JWT relocation. - app/api/connect/skv/oauth/authorize-url: builds the authorize URL against OUR registered redirect_uri + a signed connector state, per-company SKV connection quota, pending ledger row. - app/api/connect/skv/oauth/token: exchanges/refreshes and RETURNS the tokens to the instance; the ledger keeps only sha256(access_token) + sha256(refresh_token). - app/api/connect/skv/api/[...path]: allowlist over moms / skattekonto / agd-inlamning / agd-period. The instance sends the user's SKV Bearer (as X-Connector-Upstream-Authorization) + X-Connector-Key; the proxy checks the token hash against the ledger, adds Arcim's gateway credentials (never exposed to the instance), forwards. Same per-key + global budget as bank. - The Skatteverket extension /callback gains the connector branch (isConnectorState -> 302 back to the instance; code never exchanged there). - Docs (SELF-HOSTING: SKV connector live) + DECISIONS. Tests: SKV oauth lib, authorize-url, token, data proxy, callback connector branch (all green; 74 connect + 425 connect/SKV). tsc, guards, lint clean; no-phantom-columns held at 380 (literal update branches). Not in this PR: instance-side wiring (PR6). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(connect): self-host connector enablement: EB/SKV in the preset, connector-mode seam, status endpoint Sovereign plan WS3 PR6 (enablement layer), stacked on the SKV broker (#1757). - docker/extensions.self-hosted.json += enable-banking, skatteverket: a connector-key self-host now ships the bank + Skatteverket extensions; a key with the matching scope makes them work, without one they show the existing capability_blocked upsell (unconfigured extensions no-op). - lib/connect/instance/upstreams.ts: the connector-mode seam. An upstream is in connector mode only when GNUBOK_CONNECTOR_KEY is set AND the instance has no own credentials for it (hasOwnEnableBankingCredentials / hasOwnSkatteverketCredentials). Hosted always has own credentials, so hosted is provably never in connector mode: the guard is what keeps hosted byte-identical. Base URLs GNUBOK_CONNECT_URL/api/connect/{bank,skv}, headers X-Connector-Company / X-Connector-Upstream-Authorization. - GET /api/connector/status: the operator's wiring view (self_hosted, per upstream own_credentials|connector|unconfigured, key prefix never the key, granted connector capabilities). Hosted returns self_hosted:false. - Docs (SELF-HOSTING: status endpoint + extensions ship in the image), DECISIONS. Tests: connector-mode detection matrix (off without a key, off with own creds incl. the _PRODUCTION EB variants, on via the proxy, CONNECT_URL override) + status route (self-host vs hosted, unconfigured, per-upstream mode, prefix-not-key). 83 connect/connector tests green; tsc, guards, lint. DEFERRED to PR6b (needs a live connector key + a real bank/SKV to verify end to end, touches the live consent path): wiring the EB api-client / consent callback and the SKV oauth / api-client to call the proxy in connector mode, and the "Synka nu" settings row (UI, needs visual sign-off). The seam + preset + status route make PR6b a contained follow-up. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(connect): upstreams seam reuses lib/entitlements/own-credentials Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb * test(connector): status route tests pass the Next params argument (post-merge withRouteContext signature) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb * docs(self-host): collapse the re-duplicated connector section; correct the crontab generator's preset comment Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb * fix(self-host): UpgradeNote and SKV tooltip name the connector key, never the hosted subscription; SOVEREIGN.md updated to merged reality Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb * fix(self-host): BankSyncNowButton gate copy branches like UpgradeNote (connector key, not hosted billing) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Emil <emilmattsson14@gmail.com>
332 lines
12 KiB
TypeScript
332 lines
12 KiB
TypeScript
'use client'
|
|
|
|
import { useEffect, useSyncExternalStore } from 'react'
|
|
import { useRouter } from 'next/navigation'
|
|
import { useTranslations } from 'next-intl'
|
|
import { Loader2, RefreshCw } from 'lucide-react'
|
|
import { Button } from '@/components/ui/button'
|
|
import { useToast } from '@/components/ui/use-toast'
|
|
import { ToastAction } from '@/components/ui/toast'
|
|
import {
|
|
DropdownMenu,
|
|
DropdownMenuContent,
|
|
DropdownMenuItem,
|
|
DropdownMenuTrigger,
|
|
} from '@/components/ui/dropdown-menu'
|
|
import { createClient } from '@/lib/supabase/client'
|
|
import { notifyBankSyncUpdated } from '@/lib/transactions/bank-sync-signal'
|
|
import { invalidateReferenceData } from '@/lib/reference-data/invalidate'
|
|
import {
|
|
claimConnectionsLoad,
|
|
clearBusyConnection,
|
|
getBankSyncSnapshot,
|
|
markConnectionStatus,
|
|
publishConnections,
|
|
releaseConnectionsLoad,
|
|
setBusyConnection,
|
|
setSyncingAll,
|
|
subscribeBankSync,
|
|
type BankConn,
|
|
} from '@/lib/transactions/bank-sync-store'
|
|
import { useCompany, useCapability } from '@/contexts/CompanyContext'
|
|
import { CAPABILITY } from '@/lib/entitlements/keys'
|
|
import { isSelfHosted } from '@/lib/env/public-flags'
|
|
import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'
|
|
|
|
export type { BankConn }
|
|
|
|
/**
|
|
* Shared on-demand bank sync state + actions. Powers the footer "Synka nu"
|
|
* button below and the "Synka bank nu" row in the Importera split-button menu
|
|
* (TransactionStatusBar). Reuses the per-connection sync endpoint that
|
|
* BankingSettingsPanel already calls.
|
|
*
|
|
* Also handles dead PSD2 sessions: a connection whose consent has closed or
|
|
* expired re-authorizes in place via `reconnect` (no disconnect needed), and a
|
|
* sync that fails with a session expiry surfaces the same reconnect action
|
|
* right in the error toast.
|
|
*/
|
|
export function useBankSync() {
|
|
const t = useTranslations('transactions')
|
|
const { toast } = useToast()
|
|
const router = useRouter()
|
|
const { company } = useCompany()
|
|
const hasBankSync = useCapability(CAPABILITY.bank_sync)
|
|
// Busy state and the connection list live in a module-level store so every
|
|
// useBankSync() instance (header split button, footer button) sees the same
|
|
// sync in flight and cannot start a concurrent one (#1162).
|
|
const store = useSyncExternalStore(subscribeBankSync, getBankSyncSnapshot, getBankSyncSnapshot)
|
|
// Never present another company's cached list while a switch is loading.
|
|
const connections = store.companyId === company?.id ? store.connections : null
|
|
|
|
useEffect(() => {
|
|
if (!company?.id) return
|
|
// First instance to mount claims the fetch; the rest read the store. The
|
|
// store outlives components, so the result publishes even if this
|
|
// instance unmounts mid-flight.
|
|
if (!claimConnectionsLoad(company.id)) return
|
|
const companyId = company.id
|
|
const supabase = createClient()
|
|
supabase
|
|
.from('bank_connections')
|
|
.select('id, bank_name, status, provider, last_synced_at')
|
|
// Include expired/error so the reconnect entry point survives a reload:
|
|
// not just active connections that can sync.
|
|
.in('status', ['active', 'expired', 'error'])
|
|
.eq('company_id', companyId)
|
|
.then(({ data, error }) => {
|
|
if (error) {
|
|
releaseConnectionsLoad(companyId)
|
|
return
|
|
}
|
|
publishConnections(companyId, (data as BankConn[]) ?? [])
|
|
})
|
|
}, [company?.id])
|
|
|
|
// Re-authorize an existing connection in place: posts the connection_id so
|
|
// the server reuses the same row, then hands off to the bank's consent screen.
|
|
async function reconnect(conn: BankConn) {
|
|
setBusyConnection(conn.id)
|
|
try {
|
|
const country = conn.provider?.split('-').pop()?.toUpperCase() || 'SE'
|
|
const res = await fetch('/api/extensions/ext/enable-banking/connect', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({
|
|
connection_id: conn.id,
|
|
aspsp_name: conn.bank_name,
|
|
aspsp_country: country,
|
|
}),
|
|
})
|
|
const data = await res.json()
|
|
if (!res.ok) throw new Error(data.error || 'Reconnect failed')
|
|
window.location.href = data.authorization_url
|
|
} catch (error) {
|
|
toast({
|
|
title: t('bank_reconnect'),
|
|
description: error instanceof Error ? getUserErrorMessage(error) : 'Reconnect failed',
|
|
variant: 'destructive',
|
|
})
|
|
setBusyConnection(null)
|
|
}
|
|
}
|
|
|
|
async function syncConnection(conn: BankConn) {
|
|
setBusyConnection(conn.id)
|
|
try {
|
|
const res = await fetch('/api/extensions/ext/enable-banking/sync', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ connection_id: conn.id }),
|
|
})
|
|
const data = await res.json()
|
|
if (!res.ok) {
|
|
// A dead PSD2 session can't be fixed by retrying: surface a one-click
|
|
// reconnect in the toast instead of a dead-end error.
|
|
if (data?.reauth_required) {
|
|
toast({
|
|
title: t('bank_sync_session_expired'),
|
|
description: t('bank_sync_session_expired_desc'),
|
|
variant: 'destructive',
|
|
action: (
|
|
<ToastAction altText={t('bank_reconnect')} onClick={() => reconnect(conn)}>
|
|
{t('bank_reconnect')}
|
|
</ToastAction>
|
|
),
|
|
})
|
|
// Reflect the now-expired status so the button flips to reconnect
|
|
// on every surface at once.
|
|
markConnectionStatus(conn.id, 'expired')
|
|
return
|
|
}
|
|
throw new Error(data.error || 'Sync failed')
|
|
}
|
|
toast({
|
|
title: t('bank_sync_button_now'),
|
|
// Surface skipped duplicates too: a renewal that dedupes correctly
|
|
// imports 0 rows, which without this line reads as a broken sync.
|
|
// Joined with '. ' so the two sentences do not run together (the
|
|
// imported-count strings are shared with the BankSyncSinceLastVisit
|
|
// chip and deliberately carry no trailing period).
|
|
description: [
|
|
data.imported === 1
|
|
? t('bank_sync_new_since_last_visit_one')
|
|
: t('bank_sync_new_since_last_visit_many', { count: data.imported ?? 0 }),
|
|
typeof data.duplicates === 'number' && data.duplicates > 0
|
|
? data.duplicates === 1
|
|
? t('bank_sync_duplicates_skipped_one')
|
|
: t('bank_sync_duplicates_skipped_many', { count: data.duplicates })
|
|
: null,
|
|
]
|
|
.filter(Boolean)
|
|
.join('. '),
|
|
})
|
|
// Tell the neighbouring status chip to refetch so it doesn't keep showing
|
|
// the pre-sync "synced Nd ago" until a hard reload.
|
|
notifyBankSyncUpdated()
|
|
// The account chooser reads cash accounts from the session cache
|
|
// (lib/reference-data); a sync can change balances, so refetch them.
|
|
void invalidateReferenceData('ref:cash-accounts')
|
|
router.refresh()
|
|
} catch (error) {
|
|
toast({
|
|
title: t('bank_sync_button_now'),
|
|
description: error instanceof Error ? getUserErrorMessage(error) : 'Sync failed',
|
|
variant: 'destructive',
|
|
})
|
|
} finally {
|
|
clearBusyConnection(conn.id)
|
|
}
|
|
}
|
|
|
|
// Active connections sync; expired/error connections reconnect. Reads the
|
|
// live snapshot, not the render closure, so a click racing a sync started
|
|
// from the other surface is a no-op instead of a concurrent PSD2 call.
|
|
function runFor(conn: BankConn) {
|
|
const { busyId, syncingAll } = getBankSyncSnapshot()
|
|
if (busyId !== null || syncingAll) return
|
|
if (conn.status === 'active') return syncConnection(conn)
|
|
return reconnect(conn)
|
|
}
|
|
|
|
// One-shot "sync everything" for the split-button menu row: syncs every
|
|
// active connection in turn; with only dead connections it jumps straight
|
|
// to re-authorizing the first one (a retry can't revive a closed session).
|
|
async function syncAll() {
|
|
const { busyId, syncingAll } = getBankSyncSnapshot()
|
|
if (busyId !== null || syncingAll) return
|
|
setSyncingAll(true)
|
|
try {
|
|
const conns = connections ?? []
|
|
const active = conns.filter((c) => c.status === 'active')
|
|
if (active.length === 0) {
|
|
if (conns[0]) await reconnect(conns[0])
|
|
return
|
|
}
|
|
for (const conn of active) {
|
|
await syncConnection(conn)
|
|
}
|
|
} finally {
|
|
setSyncingAll(false)
|
|
}
|
|
}
|
|
|
|
const lastSyncedAt =
|
|
(connections ?? [])
|
|
.map((c) => c.last_synced_at)
|
|
.filter((s): s is string => Boolean(s))
|
|
.sort()
|
|
.pop() ?? null
|
|
|
|
return {
|
|
connections,
|
|
busyId: store.busyId,
|
|
isBusy: store.busyId !== null || store.syncingAll,
|
|
hasBankSync,
|
|
reconnect,
|
|
syncConnection,
|
|
runFor,
|
|
syncAll,
|
|
lastSyncedAt,
|
|
}
|
|
}
|
|
|
|
/**
|
|
* On-demand "Sync now" button beside BankSyncStatusChip. If the user has
|
|
* multiple connections, a dropdown lets them pick which one to sync/reconnect.
|
|
*/
|
|
export default function BankSyncNowButton() {
|
|
const t = useTranslations('transactions')
|
|
const { connections, isBusy, hasBankSync, runFor } = useBankSync()
|
|
|
|
if (!connections || connections.length === 0) return null
|
|
|
|
const syncLabel = isBusy ? t('bank_sync_button_syncing') : t('bank_sync_button_now')
|
|
|
|
// Bank sync (and reconnect) is a paid external PSD2 call. Without the
|
|
// capability we keep the button VISIBLE as the conversion surface but inert,
|
|
// and surface an Uppgradera link. CSV/SIE import stays free (separate UI).
|
|
// Self-host: the remedy is a connector key (or own EB credentials), never
|
|
// the hosted Stripe billing page; same branch as UpgradeNote.
|
|
const selfHosted = isSelfHosted()
|
|
const gateTitle = !hasBankSync
|
|
? selfHosted
|
|
? 'Bankkoppling kräver en connector-nyckel eller egna Enable Banking-uppgifter'
|
|
: 'Bankkoppling kräver ett abonnemang'
|
|
: undefined
|
|
const upsellNote = !hasBankSync ? (
|
|
selfHosted ? (
|
|
<span className="text-xs text-muted-foreground">Kräver connector-nyckel (GNUBOK_CONNECTOR_KEY).</span>
|
|
) : (
|
|
<span className="text-xs text-muted-foreground">
|
|
Kräver abonnemang.{' '}
|
|
<a href="/settings/billing" className="underline underline-offset-2">
|
|
Uppgradera
|
|
</a>
|
|
</span>
|
|
)
|
|
) : null
|
|
|
|
if (connections.length === 1) {
|
|
const conn = connections[0]
|
|
const needsReconnect = conn.status !== 'active'
|
|
return (
|
|
<div className="flex items-center gap-2">
|
|
<Button
|
|
variant="outline"
|
|
size="sm"
|
|
className="h-7 gap-1.5 px-2.5 text-xs"
|
|
disabled={isBusy || !hasBankSync}
|
|
title={gateTitle}
|
|
onClick={() => runFor(conn)}
|
|
>
|
|
{isBusy ? (
|
|
<Loader2 className="h-3.5 w-3.5 animate-spin" />
|
|
) : (
|
|
<RefreshCw className="h-3.5 w-3.5" />
|
|
)}
|
|
<span>{needsReconnect ? t('bank_reconnect') : syncLabel}</span>
|
|
</Button>
|
|
{upsellNote}
|
|
</div>
|
|
)
|
|
}
|
|
|
|
return (
|
|
<div className="flex items-center gap-2">
|
|
<DropdownMenu>
|
|
<DropdownMenuTrigger asChild>
|
|
<Button
|
|
variant="outline"
|
|
size="sm"
|
|
className="h-7 gap-1.5 px-2.5 text-xs"
|
|
disabled={isBusy || !hasBankSync}
|
|
title={gateTitle}
|
|
>
|
|
{isBusy ? (
|
|
<Loader2 className="h-3.5 w-3.5 animate-spin" />
|
|
) : (
|
|
<RefreshCw className="h-3.5 w-3.5" />
|
|
)}
|
|
<span>{syncLabel}</span>
|
|
</Button>
|
|
</DropdownMenuTrigger>
|
|
<DropdownMenuContent align="start">
|
|
{connections.map((conn) => (
|
|
<DropdownMenuItem
|
|
key={conn.id}
|
|
disabled={isBusy}
|
|
onSelect={() => runFor(conn)}
|
|
>
|
|
{conn.status === 'active'
|
|
? conn.bank_name
|
|
: `${conn.bank_name} · ${t('bank_reconnect')}`}
|
|
</DropdownMenuItem>
|
|
))}
|
|
</DropdownMenuContent>
|
|
</DropdownMenu>
|
|
{upsellNote}
|
|
</div>
|
|
)
|
|
}
|