Account Authorization and Permissions#

Accounts in Sure can be shared between family members at different access levels. The permission system has two layers: database-level scopes on the Account model that filter which accounts a user can see, and controller-level enforcement through the AccountAuthorizable concern that gates write operations on specific permission levels.

Permission Levels#

There are four effective permission levels, resolved by Account#permission_for(user):

The method returns :owner for the account owner, or the AccountShare#permission value (as a symbol) for shared users 1. Ownership is non-transferable during normal use; it is only reassigned automatically when a user is purged from the family 2.

Data Model#

AccountShare (app/models/account_share.rb) is the join table between accounts and non-owner users:

• permission — one of full_control, read_write, read_only 3
• include_in_finances — boolean controlling whether the shared account factors into the user's financial calculations 4
• Unique constraint on (account_id, user_id); cannot share with the account's owner; user must be in the same family 5

Account convenience helpers 6:

• share_with!(user, permission:, include_in_finances:) — create a share
• unshare_with!(user) — remove all shares for a user
• auto_share_with_family! — bulk-share with all other family members at read_write permission; called on account creation when Family#share_all_by_default? is true

Database-Level Scopes#

Three scopes on Account filter rows at the query level 7:

• accessible_by(user) — owned accounts + any account with a share record 8. Used everywhere for read access.
• writable_by(user) — owned + shares with full_control only 9.
• included_in_finances_for(user) — owned + shares with include_in_finances = true 10.

Current.accessible_accounts and Current.finance_accounts surface these through the request cycle 11, delegating to User#accessible_accounts and User#finance_accounts.

Controller-Level Enforcement#

AccountAuthorizable concern#

app/controllers/concerns/account_authorizable.rb is included in ApplicationController and exposes a single private method:

require_account_permission!(account, level = :write, redirect_path: nil)

It resolves the current user's permission on the account and compares against three levels 12:

On failure it redirects (HTML), renders a Turbo Stream redirect, or returns a 403 JSON response, and returns false so callers can return unless require_account_permission!(...) 13.

Usage patterns#

AccountsController uses a before_action :set_manageable_account for destructive actions (toggle_active, toggle_exclude_from_reports, destroy, unlink, etc.) — it finds the account via accessible_accounts then inline-checks for :owner or :full_control 14 15. Read actions like show use set_account, which only calls accessible_accounts.find(params[:id]) with no permission check 16.

TransactionsController calls require_account_permission! inline per action 17:

• create — :write (default)
• update_tags — :annotate, with a custom redirect path
• merge_duplicate, unlock, mark_as_recurring, etc. — :write

Family-Level Sharing Defaults#

Family#default_account_sharing is either "shared" or "private" 18. When "shared", every new account is auto-shared at read_write with all other family members at creation time 19. Existing families were backfilled to "shared" mode when the feature shipped.