Merge pull request #12007 from firefly-iii/release-1774159543

🤖 Automatically merge the PR into the develop branch.

THANKS.md

@@ -4,6 +4,7 @@ Over time, many people have contributed to Firefly III. Their efforts are not al
 Please find below all the people who contributed to the Firefly III code. Their names are mentioned in the year of their first contribution.
 
 ## 2026
+- Joe Longendyke
 - Daniel Holøien
 - Matthew Grove
 - Cinnamon Pyro

app/Api/V1/Controllers/Models/TransactionCurrency/UpdateController.php

@@ -35,7 +35,6 @@ use FireflyIII\Support\Http\Api\TransactionFilter;
 use FireflyIII\Transformers\CurrencyTransformer;
 use FireflyIII\User;
 use Illuminate\Http\JsonResponse;
-use Illuminate\Support\Facades\Log;
 use League\Fractal\Resource\Item;
 
 /**
@@ -154,7 +153,6 @@ final class UpdateController extends Controller
     public function update(UpdateRequest $request, TransactionCurrency $currency): JsonResponse
     {
         $data        = $request->getAll();
-        Log::debug(__METHOD__, $data);
 
         /** @var User $user */
         $user        = auth()->user();

app/Api/V1/Requests/Models/TransactionCurrency/UpdateRequest.php

@@ -28,6 +28,7 @@ use FireflyIII\Models\TransactionCurrency;
 use FireflyIII\Rules\IsBoolean;
 use FireflyIII\Support\Request\ChecksLogin;
 use FireflyIII\Support\Request\ConvertsDataTypes;
+use FireflyIII\User;
 use Illuminate\Foundation\Http\FormRequest;
 
 /**
@@ -45,15 +46,23 @@ class UpdateRequest extends FormRequest
      */
     public function getAll(): array
     {
-        // return nothing that isn't explicitly in the array:
-        $fields = [
-            'name'           => ['name', 'convertString'],
-            'code'           => ['code', 'convertString'],
-            'symbol'         => ['symbol', 'convertString'],
-            'decimal_places' => ['decimal_places', 'convertInteger'],
-            'default'        => ['default', 'boolean'],
-            'enabled'        => ['enabled', 'boolean'],
+        /** @var User $user */
+        $user    = auth()->user();
+        $isAdmin = $user->hasRole('owner');
+
+        $fields  = [
+            'enabled' => ['enabled', 'boolean'],
         ];
+        if ($isAdmin) {
+            $fields = [
+                'name'           => ['name', 'convertString'],
+                'code'           => ['code', 'convertString'],
+                'symbol'         => ['symbol', 'convertString'],
+                'decimal_places' => ['decimal_places', 'convertInteger'],
+                'default'        => ['default', 'boolean'],
+                'enabled'        => ['enabled', 'boolean'],
+            ];
+        }
 
         return $this->getAllData($fields);
     }

app/Exceptions/Handler.php

@@ -251,7 +251,7 @@ class Handler extends ExceptionHandler
             'method'       => request()->method(),
             'headers'      => $headers,
             // @mago-expect lint:no-request-all
-            'post'         => 'POST' === request()->method() ? json_encode(request()->all()) : '',
+            'post'         => 'PUT' === request()->method() || 'POST' === request()->method() ? json_encode(request()->all()) : '',
         ];
 
         // create job that will mail.

app/Http/Controllers/Admin/NotificationController.php

@@ -132,7 +132,7 @@ final class NotificationController extends Controller
             return redirect(route('settings.notification.index'));
         }
 
-        $all              = $request->only(['channel']);
+        $all              = $request->only(['test_submit']);
         $channel          = $all['test_submit'] ?? '';
 
         switch ($channel) {

app/Http/Middleware/IsAdminApi.php

@@ -29,6 +29,7 @@ use FireflyIII\User;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Log;
 
 /**
  * Class IsAdmin.
@@ -41,6 +42,8 @@ class IsAdminApi
      * @param null|string $guard
      *
      * @return mixed
+     *
+     * @throws AuthorizationException
      */
     public function handle(Request $request, Closure $next, $guard = null)
     {
@@ -58,6 +61,8 @@ class IsAdminApi
         /** @var UserRepositoryInterface $repository */
         $repository = app(UserRepositoryInterface::class);
         if (!$repository->hasRole($user, 'owner')) {
+            Log::error(sprintf('Cannot access %s?%s.', $request->url(), $request->getQueryString()));
+
             throw new AuthorizationException();
         }
 

app/Services/Internal/Recalculate/PrimaryAmountRecalculationService.php

@@ -202,7 +202,7 @@ class PrimaryAmountRecalculationService
 
         /** @var Account $account */
         foreach ($set as $account) {
-            $currencyId = (int) $account->accountMeta()->where('name', 'currency_id')->first()->data;
+            $currencyId = (int) $account->accountMeta()->where('name', 'currency_id')->first()?->data;
             if ($groupCurrency->id === $currencyId) {
                 Log::debug(sprintf('Account "%s" is in group currency %s. Skip.', $account->name, $groupCurrency->code));
 

app/Support/Binder/Date.php

@@ -70,7 +70,7 @@ class Date implements BinderInterface
         try {
             $result = new Carbon($value);
         } catch (InvalidDateException|InvalidFormatException $e) {
-            $message = sprintf('Could not parse date "%s" for user #%d: %s', $value, auth()->user()->id, $e->getMessage());
+            $message = sprintf('Could not parse date "%s" for user #%d: %s', $value, (int) auth()->user()?->id, $e->getMessage());
             Log::error($message);
 
             throw new NotFoundHttpException('Could not parse value', $e);

config/firefly.php

@@ -78,8 +78,8 @@ return [
         'running_balance_column' => (bool)envDefaultWhenEmpty(env('USE_RUNNING_BALANCE'), true), // this is only the default value, is not used.
         // see cer.php for exchange rates feature flag.
     ],
-    'version'                              => 'develop/2026-03-21',
-    'build_time'                           => 1774102650,
+    'version'                              => 'develop/2026-03-22',
+    'build_time'                           => 1774159352,
     'api_version'                          => '2.1.0', // field is no longer used.
     'db_version'                           => 28, // field is no longer used.
 

package-lock.json

@@ -7143,26 +7143,26 @@
             }
         },
         "node_modules/i18next": {
-            "version": "25.10.0",
-            "resolved": "https://registry.npmjs.org/i18next/-/i18next-25.10.0.tgz",
-            "integrity": "sha512-syBEN80PJ3MOpczGXFtv6OTfKQzgi/VbvgtQQjr1z5b/0xSGa1iG8n5ESG7TVT5scGbbRr/1Du2tufHEkr5pHw==",
+            "version": "25.10.3",
+            "resolved": "https://registry.npmjs.org/i18next/-/i18next-25.10.3.tgz",
+            "integrity": "sha512-9XCjFgF7q4wNdmy7RFcDBIx1ndSXU3QwtbmqPjOdUxYxU9gbovJzZUY5Mb3ejWmDhxMl6Wmr2OenWOU3uyy6VQ==",
             "funding": [
                 {
                     "type": "individual",
-                    "url": "https://locize.com"
-                },
-                {
-                    "type": "individual",
-                    "url": "https://locize.com/i18next.html"
+                    "url": "https://www.locize.com/i18next"
                 },
                 {
                     "type": "individual",
                     "url": "https://www.i18next.com/how-to/faq#i18next-is-awesome.-how-can-i-support-the-project"
+                },
+                {
+                    "type": "individual",
+                    "url": "https://www.locize.com"
                 }
             ],
             "license": "MIT",
             "dependencies": {
-                "@babel/runtime": "^7.28.6"
+                "@babel/runtime": "^7.29.2"
             },
             "peerDependencies": {
                 "typescript": "^5"
@@ -7913,9 +7913,9 @@
             }
         },
         "node_modules/launch-editor": {
-            "version": "2.13.1",
-            "resolved": "https://registry.npmjs.org/launch-editor/-/launch-editor-2.13.1.tgz",
-            "integrity": "sha512-lPSddlAAluRKJ7/cjRFoXUFzaX7q/YKI7yPHuEvSJVqoXvFnJov1/Ud87Aa4zULIbA9Nja4mSPK8l0z/7eV2wA==",
+            "version": "2.13.2",
+            "resolved": "https://registry.npmjs.org/launch-editor/-/launch-editor-2.13.2.tgz",
+            "integrity": "sha512-4VVDnbOpLXy/s8rdRCSXb+zfMeFR0WlJWpET1iA9CQdlZDfwyLjUuGQzXU4VeOoey6AicSAluWan7Etga6Kcmg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
@@ -12373,9 +12373,9 @@
             "license": "ISC"
         },
         "node_modules/ws": {
-            "version": "8.19.0",
-            "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
-            "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
+            "version": "8.20.0",
+            "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.0.tgz",
+            "integrity": "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==",
             "dev": true,
             "license": "MIT",
             "engines": {

routes/api.php

@@ -347,7 +347,6 @@ Route::group(
         'namespace'  => 'FireflyIII\Api\V1\Controllers\Models\UserGroup',
         'prefix'     => 'v1/user-groups',
         'as'         => 'api.v1.user-groups.',
-        'middleware' => ['api-admin'],
     ],
     static function (): void {
         Route::get('', ['uses' => 'IndexController@index', 'as' => 'index']);
@@ -636,6 +635,7 @@ Route::group(
     ],
     static function (): void {
         Route::get('', ['uses' => 'ShowController@index', 'as' => 'index']);
+        Route::put('{currency_code?}', ['uses' => 'UpdateController@update', 'as' => 'update']);
         Route::get('primary', ['uses' => 'ShowController@showPrimary', 'as' => 'show.primary']);
         Route::get('default', ['uses' => 'ShowController@showPrimary', 'as' => 'show.default']);
         Route::get('{currency_code}', ['uses' => 'ShowController@show', 'as' => 'show']);
@@ -666,7 +666,6 @@ Route::group(
     static function (): void {
         Route::delete('{currency_code}', ['uses' => 'DestroyController@destroy', 'as' => 'delete']);
         Route::post('', ['uses' => 'StoreController@store', 'as' => 'store']);
-        Route::put('{currency_code?}', ['uses' => 'UpdateController@update', 'as' => 'update']);
     }
 );