[SamsonNegedu]

Summary

request
  AccessGuard            prod: Cloudflare token required, else the server won't start
    CsrfGuard            X-FinKit + exact Origin (ALLOWED_ORIGIN, required in prod)
      every query filtered by user_id

bank-connections/
├── config/         env, tokens
├── connections/    connect flow, callback, connection store
├── sync/           manual sync, scheduled catch-up (1 min after start, then every 30 min check)
├── transactions/   stored per user, one encrypted value per row
├── providers/      Enable Banking, test bank
└── admin/          back office

 sync (manual)
   fetch from bank
+    PSU headers (person's IP + browser) when the bank requires exactly those
+    first fetch: strategy=longest, fallback to the normal window
-  return to browser
+  store (encrypted, deduped by keyed fingerprint)
+  return to browser
+ scheduled catch-up (twice a day, no PSU headers; more than 500 pages fails instead of truncating)

Also: Sheets input validation (tab names, column letters), generic export errors, /terms and /privacy routes, privacy and terms pages and docs/privacy-facts.md updated, .env.example rewritten (required first), ./secrets mounted read-only for key files, CI check job gates the image builds.

Evidence

• Before: production without Cloudflare Access settings or ALLOWED_ORIGIN booted in shared dev@localhost mode with open CORS; a missing Origin passed CSRF; export errors leaked Google messages; stored transactions did not exist.
  After: API 106 tests, web 35 tests, lint, format and types pass locally.

make({ NODE_ENV: 'production' })                       -> rejects /CF_ACCESS/
make({ NODE_ENV: 'production', CF_*, no origin })      -> rejects /ALLOWED_ORIGIN/
POST /api/learn/mapping, ALLOWED_ORIGIN set, no Origin -> 403
user B GET/DELETE /api/banking/transactions            -> sees/deletes none of user A's
SELECT * FROM bank_transactions                        -> only ids, ext_key (HMAC), payload (v1. ciphertext)

Merge Danger

Door: one-way

The database upgrades itself on start: rows from before accounts existed are given to the first address in ALLOWED_USER_EMAILS, and the earlier bank_transactions layout is rewritten into the encrypted one. Take a backup first.

Blast Radius: Deployment

• Existing deployments will not start until ALLOWED_ORIGIN, CF_ACCESS_TEAM_DOMAIN and CF_ACCESS_AUD are set. The tunnel variable is TUNNEL_TOKEN (the old example said CLOUDFLARE_TUNNEL_TOKEN).
• BANKING_ENCRYPTION_KEY now protects all stored transactions; losing it loses them. Back it up apart from the database.
• Deploy no longer logs in to ghcr.io: the two image packages must be public.
• Real Enable Banking sync is still untested against the live API (fake-server tests only).
• Privacy and terms pages need a qualified review before being relied on.

🤖 Generated with Claude Code