821caa2643 [AI] fix(enablebanking): fix HypoVereinsbank auth and data access (#8355)
* fix(enablebanking): pass PSU IP address header for HypoVereinsbank auth

HypoVereinsbank falls back to corporate auth portal when psu-ip-address
header is missing, because the first auth_method is "business". Passing
the PSU headers from the incoming request selects the personal banking
method instead.

* fix(enablebanking): remove PSU headers from data access calls

HypoVereinsbank requires Psu-Ip-Address during authorization to select
the personal auth method, but rejects it on balance/transaction API
calls with ASPSP_ERROR. Restrict PSU headers to startAuth only.

Also add balances/transactions consent scopes to the auth request
as required by the Enable Banking API.

* [AI] chore: add release notes for #8355

* [autofix.ci] apply automated fixes

* Scope PSU header removal to HypoVereinsbank only for data access calls

Instead of stripping PSU headers globally from balance/transaction fetches,
introduce `ASPSPS_WITHOUT_DATA_ACCESS_PSU_HEADERS` and `dataAccessPsuHeaders()`
so only ASPSPs known to reject these headers are affected. Other ASPSPs continue
to receive PSU headers on data access calls.

Also restore PSU headers being passed through `buildSessionResult()` at both
the auth_callback and poll-auth call sites, and propagate `aspspName` from the
client via the `/transactions` endpoint so the scoping helper has the context
it needs to decide.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* [autofix.ci] apply automated fixes

* Fix dataAccessPsuHeaders to pass through headers when aspspName is unknown

The previous condition `!aspspName || set.has(aspspName)` stripped PSU headers
whenever aspspName was undefined, breaking all ASPSPs that don't send it.
The correct default is to pass headers through for unknown ASPSPs and only
strip them when the ASPSP is explicitly listed in the exclusion set.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

---------

Co-authored-by: Carsten <[email protected]>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
2026-10-03 12:01:47 +00:00
2026-10-01 22:06:53 +00:00
2026-10-02 15:58:48 +00:00
2026-07-21 18:03:26 +00:00
2022-04-28 22:44:38 -04:00
2022-04-30 12:17:49 -04:00
2026-08-02 16:00:07 +00:00
2026-10-02 15:58:48 +00:00
2025-08-12 22:10:10 +01:00
2023-08-25 20:41:20 +01:00
2026-08-02 16:00:07 +00:00
2026-09-20 20:22:32 +00:00

Actualbudget

Getting Started

Actual is a local-first personal finance tool. It is 100% free and open-source, written in NodeJS, it has a synchronization element so that all your changes can move between devices without any heavy lifting.

If you are interested in contributing, or want to know how development works, see our contributing document we would love to have you.

Want to say thanks? Click the ⭐ at the top of the page.

Installation

There are four ways to deploy Actual:

  1. One-click deployment via PikaPods (~2.00 $/month) - recommended for non-technical users
  2. Managed hosting via Fly.io (~1.50 $/month)
  3. Self-hosted by using a Docker image
  4. Local-only apps - downloadable Windows, Mac and Linux apps you can run on your device

Learn more in the installation instructions docs.

Ready to Start Budgeting?

Read about Envelope budgeting to know more about the idea behind Actual Budget.

Are you new to budgeting or want to start fresh?

Check out the community's Starting Fresh guide so you can quickly get up and running!

Are you migrating from other budgeting apps?

Check out the community's Migration guide to start jumping on the Actual Budget train!

Documentation

We have a wide range of documentation on how to use Actual, this is all available in our Community Documentation, this includes topics on Budgeting, Account Management, Tips & Tricks and some documentation for developers.

Contributing

Actual is a community driven product. Learn more about contributing to Actual.

Code structure

The Actual app is split up into a few packages:

  • loot-core - The core application that runs on any platform
  • desktop-client - The desktop UI
  • desktop-electron - The desktop app

More information on the project structure is available in our community documentation.

Feature Requests

Current feature requests can be seen here. Vote for your favorite requests by reacting 👍 to the top comment of the request.

To add new feature requests, open a new Issue of the "Feature Request" type.

Translation

Make Actual Budget accessible to more people by helping with the Internationalization of Actual. We are using a crowd sourcing tool to manage the translations, see our Weblate Project. Weblate proudly supports open-source software projects through their Libre plan.

Translation status

Repo Activity

Alt

Sponsors

Thanks to our wonderful sponsors who make Actual Budget possible!

Deploys by Netlify Built with Depot Docker GitHub Anthropic

S
Description
A local-first personal finance app
Readme
1.3 GiB
Languages
TypeScript 94.3%
JavaScript 4.6%
CSS 0.5%
Shell 0.3%