[saesch83]

Adds Enable Banking as a second bank-sync provider next to GoCardless. Follows up on #271: GoCardless no longer takes new sign-ups, while Enable Banking's free restricted production mode lets a private person connect their own accounts at 2,500+ European banks without a business contract or AISP licence.

What it does

• Keys once per user. Each user stores their Enable Banking application ID and private key (PEM) once. They are kept as one encrypted user setting (EncryptionService), never returned by the settings API, excluded from backups/export, and kept when settings are reset.
• Connect wizard. Choose "Enable Banking", pick country and bank, confirm at the bank, return via a callback route. The callback uses Post-Redirect-Get, so the one-time code/state don't stay in the URL. Re-authorize keeps existing account mappings and revokes the old session.
• Sync. Fetches details, balances and transactions per mapped account.
  • Sync windows are per account. The first fetch reaches back 90 days; later fetches start at the last sync minus 7 days.
  • Unmapped or disabled accounts get no transaction fetch, which saves the bank's daily request quota.
  • Transactions without a bank ID (e.g. Trade Republic) get a stable hash ID with numbering, so identical rows are not dropped.
• Exact balances. On a mapping's first sync, Budget sets the opening balance so its balance equals the bank's. After that, the UI shows the difference and offers a one-click reconcile.
  • The comparison uses the date the bank reports the balance for. For example, comdirect reports the previous day's close.
  • Only providers that implement ReliableBalanceProviderInterface auto-reconcile.
• Clear errors for the cases we hit with real banks: an inactive restricted application, a consent that shared no accounts, or an authorization still in progress.

Changes to shared code

• New small interfaces: InstitutionListingProviderInterface, ReauthorizableProviderInterface, ReliableBalanceProviderInterface. BankSyncController / BankSyncService use these instead of GoCardless-specific checks.
• GoCardless: reports no balance when the bank sends none, instead of 0. Otherwise behaviour is unchanged.
• Migrations:
  • Version001000127Date20261027 adds budget_bam.balance_reconciled_at.
  • Version001000128Date20261027 adds budget_bam.last_balance_date.
• README.md: Enable Banking setup section, covering production needs an https redirect URL, linking accounts in the Enable Banking control panel first, and Trade Republic's limited data.

Privacy / security

• Outbound traffic goes to api.enablebanking.com only. Requests are signed with a short-lived RS256 JWT built with ext-openssl. There are no new dependencies.
• Keys, JWTs, session IDs, auth codes, state and amounts never reach logs or exception messages.
  • Key parameters are marked #[\SensitiveParameter], and the key value object hides itself from var_dump/print_r.
  • Transport errors are re-wrapped without the URL.
  • The callback logs nothing, because Nextcloud appends the request URL to every log entry.
• Bank logo URLs are not passed to the browser, so opening the bank list contacts no third-party host.

Testing

• Automated: 7,689 PHPUnit tests pass (1 skipped). cs:check, Psalm and npm run lint are clean, and there are 15 new vitest tests for the wizard.
• End-to-end:
  • Ran on Nextcloud 31 + MariaDB with all egress forced through a logging proxy.
  • Enable Banking sandbox: connect, callback, re-authorize and repeated sync all work without duplicates.
  • Real banks, restricted production: comdirect (two accounts) and Trade Republic. The Budget balance matched the bank balance to the cent.

Notes for review

• Version bump needed. appinfo/info.xml is still 3.2.0. Instances that already run 3.2.0 only apply migrations 127/128 after a version bump, so I left the version to you.
• Trade Republic data is limited. Over PSD2 it sends only amount, currency and booking date per transaction, with no description or counterparty. Its account label is a product code such as CHECKING_ACCOUNT (…1234). In our test it returned at most 100 transactions per request.
• Commits. The branch has 44 Conventional Commits, so it reads commit by commit. Happy to squash if you prefer.

🤖 Generated with Claude Code

[saesch83]

Hi, I saw you rejected that kind of pull request already ones. But this time it is implemented in a good shape. And the problem with GoCardless is, that it is only for business use and not for private use. While EnableBanking is allowed to use for your own bank account privately. Also I implemented the appid and private key handling savely and easily.

Regarding your plan to involve an API hoster on your own with a proper license in place. I doupt, that you will be able to do so, as this kind of service is quite expensive.

I would be very happy to have enable banking in your version. Otherwise I need to maintain it in parallel. I have also some friends who would use it then in future.

[otherworld-dev]

I've been through this and tested it on a throwaway instance with a mocked Enable Banking API - connect, callback, sync, resync and reconcile all worked, with nothing secret in the logs or the backup zip. Unit, integration, Psalm, cs and lint all pass, and it merges cleanly into dev.

A few things before I merge:

• If Enable Banking rejects the app ID or key (any 401/403 apart from the "not active" one), the user only gets "Failed to connect bank" or "Failed to fetch institutions". Can you map that to a message saying the application ID or key was rejected?
• Can you validate what comes back from the API before it's stored - currency as 3 letters, amounts as numbers, and the auth url as https? The mapping list renders currency and balance into HTML, so I'd rather not trust them.
• On every sync, unmapped accounts still get /details and /balances. With the daily access limits, could those be skipped unless it's a refresh?
• User docs live on budget.otherworld.dev, so I'll move the README setup section over there. Could you cut the README back to a one-line mention?

One bigger thing. I'm planning a hosted bank sync option later that will use the same redirect-with-state flow, and at the moment the callback route, the state lookup and the pending_auth handling are all tied to 'enablebanking'. If you're up for it, a small interface for "provider that completes auth from a callback" (your completeAuthorization already fits) plus a provider-neutral route like /bank-sync/callback would let the next provider reuse it. The route matters most, because users register it in the Enable Banking control panel and it's awkward to change after a release. If you'd rather not, no problem - I'll do that bit on dev before the release.

I'll do the .pot, the js bundle rebuild and the CHANGELOG after merging, and I'll squash it on merge.

[saesch83]

Thank you for your review and feedback. Will adjust and add that the next days.

[saesch83]

Thanks for the thorough review! All of it is in:

• Rejected keys: any 401/403 other than "application not active" now says "Enable Banking rejected the application ID or private key. Check that both belong to the same application in the Enable Banking control panel, then enter them again with Replace keys." This applies when listing banks, connecting and re-authorizing.
• Validation: I merged dev, so the Enable Banking paths use your applyProviderAccountDetails(), safeAuthorizationUrl(), noopener and handleErrorWithoutTrace() from fix(bank-sync): treat provider data as untrusted and keep secrets out of logs #474. Accounts from a completed authorization also go through cleanCurrency(). In the normalizer, a transaction without a plain decimal amount or a real Y-m-d date is dropped, and a balance without a usable amount is null.
• Daily limits: a sync no longer reads accounts that aren't imported, so it sends no /details and no /balances for them. Refresh still reads every account. With nothing mapped, a sync makes no request and doesn't mark the connection expired.
• README: the setup section is gone and the feature list keeps the mention. The callback path for your docs is now /apps/budget/bank-sync/callback.
• Provider-neutral callback: there's a new CallbackAuthorizationProviderInterface (completeAuthorization, isAuthorized, revokeReplacedAuthorization). BankSyncCallbackController serves /bank-sync/callback. The state lookup, the pending_auth handling and Re-authorize go through the interface instead of checking for 'enablebanking'. Pending credentials keep state and stateCreatedAt, as documented on the interface. A unit test runs a second "hosted" provider through the same flow.

I merged dev rather than rebasing, since you squash anyway. PHPUnit (7,795), the integration tests, Psalm, cs and lint pass. I also tested it end to end on my test instance against a real bank: connect, callback on the new URL, sync, re-authorize and a deliberately wrong key.

[otherworld-dev]

Merged. The one thing left from my review was the factory reset, it deleted the keys before the revoke ran so the Enable Banking session was never ended. I have fixed that on dev rather than hold this up any longer. It will be in the next release, and the setup docs will go up on budget.otherworld.dev with it. Thanks for sticking with this one.