fix(api): validate transaction category, merchant and tag ownership

app/controllers/api/v1/transactions_controller.rb

@@ -96,6 +96,8 @@ def create
       return render_existing_idempotent_entry(existing_entry)
     end
 
+    return unless validate_family_associations
+
     @entry = account.entries.new(entry_params_for_create)
 
     if @entry.save
@@ -140,6 +142,8 @@ def update
       return
     end
 
+    return unless validate_family_associations
+
     Entry.transaction do
       if @entry.update(entry_params_for_update)
         # Handle tags separately - only when explicitly provided in the request
@@ -318,6 +322,40 @@ def account_id_param
       params.dig(:transaction, :account_id).presence
     end
 
+    # Category, merchant and tag references are assigned straight onto the
+    # record, so an unusable id has to be rejected here rather than reaching the
+    # database. A malformed UUID casts to NULL and the association is dropped
+    # while the request still reports success, an unknown UUID trips the foreign
+    # key and surfaces as a 500, and a UUID owned by another family is accepted
+    # outright. Returns false once a response has been rendered.
+    def validate_family_associations
+      family = current_resource_owner.family
+
+      category_id = transaction_params[:category_id]
+      if category_id.present? && !family_owns?(family.categories, category_id)
+        render_validation_error("Category not found or does not belong to your family")
+        return false
+      end
+
+      merchant_id = transaction_params[:merchant_id]
+      if merchant_id.present? && !family_owns?(family.merchants, merchant_id)
+        render_validation_error("Merchant not found or does not belong to your family")
+        return false
+      end
+
+      tag_ids = Array(transaction_params[:tag_ids]).reject(&:blank?).uniq
+      if tag_ids.any? && !tag_ids.all? { |id| family_owns?(family.tags, id) }
+        render_validation_error("One or more tags were not found or do not belong to your family")
+        return false
+      end
+
+      true
+    end
+
+    def family_owns?(scope, id)
+      valid_uuid?(id) && scope.exists?(id: id)
+    end
+
     def entry_params_for_create
       entry_params = {
         name: transaction_params[:name] || transaction_params[:description],

docs/api/openapi.yaml

@@ -7353,11 +7353,13 @@ paths:
                     category_id:
                       type: string
                       format: uuid
-                      description: Category ID
+                      description: Category ID. Must be the UUID of a category in
+                        your own family, as returned by GET /api/v1/categories
                     merchant_id:
                       type: string
                       format: uuid
-                      description: Merchant ID
+                      description: Merchant ID. Must be the UUID of a merchant in
+                        your own family, as returned by GET /api/v1/merchants
                     nature:
                       type: string
                       enum:
@@ -7379,7 +7381,8 @@ paths:
                       items:
                         type: string
                         format: uuid
-                      description: Array of tag IDs
+                      description: Array of tag IDs. Each must be the UUID of a tag
+                        in your own family
                   required:
                   - account_id
                   - date

spec/requests/api/v1/transactions_spec.rb

@@ -171,12 +171,12 @@
               description: { type: :string, description: 'Alternative to name field' },
               notes: { type: :string, description: 'Additional notes' },
               currency: { type: :string, description: 'Currency code (defaults to family currency)' },
-              category_id: { type: :string, format: :uuid, description: 'Category ID' },
-              merchant_id: { type: :string, format: :uuid, description: 'Merchant ID' },
+              category_id: { type: :string, format: :uuid, description: 'Category ID. Must be the UUID of a category in your own family, as returned by GET /api/v1/categories' },
+              merchant_id: { type: :string, format: :uuid, description: 'Merchant ID. Must be the UUID of a merchant in your own family, as returned by GET /api/v1/merchants' },
               nature: { type: :string, enum: %w[income expense inflow outflow], description: 'Transaction nature (determines sign)' },
               external_id: { type: :string, description: 'Optional external idempotency key scoped to account and source' },
               source: { type: :string, description: 'Optional source namespace for external_id. Requires external_id and defaults to api when external_id is provided' },
-              tag_ids: { type: :array, items: { type: :string, format: :uuid }, description: 'Array of tag IDs' }
+              tag_ids: { type: :array, items: { type: :string, format: :uuid }, description: 'Array of tag IDs. Each must be the UUID of a tag in your own family' }
             },
             required: %w[account_id date amount name]
           }

test/controllers/api/v1/transactions_controller_test.rb

@@ -601,6 +601,106 @@ class Api::V1::TransactionsControllerTest < ActionDispatch::IntegrationTest
     assert_response :unauthorized
   end
 
+  # Association scoping tests (issue #2781)
+  test "should create transaction with a category from the caller's family" do
+    category = categories(:food_and_drink)
+
+    post api_v1_transactions_url,
+         params: transaction_params_with(category_id: category.id),
+         headers: api_headers(@api_key)
+
+    assert_response :created
+    assert_equal category.id, JSON.parse(response.body).dig("category", "id")
+  end
+
+  test "should reject create with malformed category_id instead of silently dropping it" do
+    assert_no_difference("@account.entries.count") do
+      post api_v1_transactions_url,
+           params: transaction_params_with(category_id: "18bsy6-"),
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    assert_equal "validation_failed", JSON.parse(response.body)["error"]
+  end
+
+  test "should reject create with unknown category_id instead of raising a server error" do
+    assert_no_difference("@account.entries.count") do
+      post api_v1_transactions_url,
+           params: transaction_params_with(category_id: SecureRandom.uuid),
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    assert_equal "validation_failed", JSON.parse(response.body)["error"]
+  end
+
+  test "should reject create with a category belonging to another family" do
+    foreign_category = families(:empty).categories.create!(name: "Foreign Category")
+
+    assert_no_difference("@account.entries.count") do
+      post api_v1_transactions_url,
+           params: transaction_params_with(category_id: foreign_category.id),
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+  end
+
+  test "should reject create with a merchant belonging to another family" do
+    foreign_merchant = families(:empty).merchants.create!(name: "Foreign Merchant", type: "FamilyMerchant")
+
+    assert_no_difference("@account.entries.count") do
+      post api_v1_transactions_url,
+           params: transaction_params_with(merchant_id: foreign_merchant.id),
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+  end
+
+  test "should reject create with malformed merchant_id" do
+    assert_no_difference("@account.entries.count") do
+      post api_v1_transactions_url,
+           params: transaction_params_with(merchant_id: "not-a-uuid"),
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+  end
+
+  test "should reject create with a tag belonging to another family" do
+    foreign_tag = families(:empty).tags.create!(name: "Foreign Tag")
+
+    assert_no_difference("@account.entries.count") do
+      post api_v1_transactions_url,
+           params: transaction_params_with(tag_ids: [ foreign_tag.id ]),
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+  end
+
+  test "should reject update with malformed category_id instead of silently ignoring it" do
+    put api_v1_transaction_url(@transaction),
+        params: { transaction: { category_id: "18bsy6-" } },
+        headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    assert_equal "validation_failed", JSON.parse(response.body)["error"]
+  end
+
+  test "should reject update with a category belonging to another family" do
+    foreign_category = families(:empty).categories.create!(name: "Foreign Category")
+
+    put api_v1_transaction_url(@transaction),
+        params: { transaction: { category_id: foreign_category.id } },
+        headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    assert_not_equal foreign_category.id, @transaction.reload.category_id
+  end
+
   # UPDATE action tests
   test "should update transaction with valid parameters" do
     update_params = {
@@ -834,6 +934,19 @@ def count_db_queries(&block)
       queries
     end
 
+    def transaction_params_with(overrides)
+      {
+        transaction: {
+          account_id: @account.id,
+          name: "Association Scoping Transaction",
+          amount: 25.00,
+          date: Date.current,
+          currency: "USD",
+          nature: "expense"
+        }.merge(overrides)
+      }
+    end
+
     def create_transfer_between_accounts
       from_account = @family.accounts.create!(
         name: "Transfer From Account",