Merge pull request #11725 from firefly-iii/release-1771152972

🤖 Automatically merge the PR into the develop branch.

app/Console/Commands/Tools/VerifiesDatabaseConnection.php

@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * VerifiesDatabaseConnection.php
+ * Copyright (c) 2026 james@firefly-iii.org
+ *
+ * This file is part of Firefly III (https://github.com/firefly-iii).
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+namespace FireflyIII\Console\Commands\Tools;
+
+use FireflyIII\Console\Commands\ShowsFriendlyMessages;
+use Illuminate\Console\Command;
+use Illuminate\Database\QueryException;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Exception;
+
+class VerifiesDatabaseConnection extends Command
+{
+    use ShowsFriendlyMessages;
+
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature   = 'firefly-iii:verify-database-connection';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This command tries to connect to the database.';
+
+    /**
+     * Execute the console command.
+     */
+    public function handle(): int
+    {
+        $loops     = 30;
+        $loop      = 0;
+        $queries   = ['pgsql'  => 'SELECT * FROM pg_catalog.pg_tables;', 'sqlite' => 'SELECT name FROM sqlite_schema;', 'mysql'  => 'SHOW TABLES;'];
+        $default   = config('database.default');
+        if (!array_key_exists($default, $queries)) {
+            $this->friendlyWarning(sprintf('Cannot validate database connection for "%s"', $default));
+
+            return Command::SUCCESS;
+        }
+        $query     = $queries[$default];
+        $connected = false;
+        Log::debug(sprintf('Connecting to database "%s"...', config('database.default')));
+        while (!$connected && $loop < $loops) {
+            try {
+                DB::select($query);
+                $connected = true;
+            } catch (QueryException $e) {
+                Log::error(sprintf('Loop #%d: connection failed: %s', $loop, $e->getMessage()));
+                $this->friendlyWarning(sprintf('Database connection attempt #%d failed. Sleep for 10 seconds...', $loop + 1));
+                sleep(10);
+            } catch (Exception $e) {
+                Log::error(sprintf('Loop #%d: not connected yet because of a %s: %s', $loop, get_class($e), $e->getMessage()));
+                $this->friendlyWarning(sprintf('Database connection attempt #%d failed. Sleep for 10 seconds...', $loop + 1));
+                sleep(10);
+            }
+            ++$loop;
+        }
+        if ($connected) {
+            Log::debug(sprintf('Connected to database after %d attempt(s).', $loop));
+            $this->friendlyPositive('Connected to the database.');
+
+            return Command::SUCCESS;
+        }
+        Log::error('Failed to connect to database.');
+        $this->friendlyError('Failed to connect to the database. Is it up?');
+
+        return Command::FAILURE;
+    }
+}

app/Console/Commands/Upgrade/UpgradesDatabase.php

@@ -94,6 +94,7 @@ class UpgradesDatabase extends Command
 
     private function callInitialCommands(): void
     {
+        $this->call('firefly-iii:verify-database-connection');
         $this->call('migrate', ['--seed'           => true, '--force'          => true, '--no-interaction' => true]);
         $this->call('upgrade:600-pgsql-sequences');
         $this->call('upgrade:480-decrypt-all');

app/Console/Kernel.php

@@ -1,69 +0,0 @@
-<?php
-
-/**
- * Kernel.php
- * Copyright (c) 2020 james@firefly-iii.org
- *
- * This file is part of Firefly III (https://github.com/firefly-iii).
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-declare(strict_types=1);
-
-namespace FireflyIII\Console;
-
-use Illuminate\Console\Scheduling\Schedule;
-use Illuminate\Foundation\Console\Kernel as ConsoleKernel;
-use Illuminate\Support\Facades\Log;
-use Override;
-
-/**
- * File to make sure commands work.
- */
-class Kernel extends ConsoleKernel
-{
-    /**
-     * Register the commands for the application.
-     */
-    #[Override]
-    protected function commands(): void
-    {
-        $this->load(__DIR__.'/Commands');
-
-        require base_path('routes/console.php');
-    }
-
-    /**
-     * Define the application's command schedule.
-     */
-    #[Override]
-    protected function schedule(Schedule $schedule): void
-    {
-        $schedule->call(static function (): void {
-            Log::error('Firefly III no longer users the Laravel scheduler to do cron jobs! Please read the instructions at https://docs.firefly-iii.org/');
-            echo "\n";
-            echo '------------';
-            echo "\n";
-            echo wordwrap('Firefly III no longer users the Laravel scheduler to do cron jobs! Please read the instructions here:');
-            echo "\n";
-            echo 'https://docs.firefly-iii.org/';
-            echo "\n\n";
-            echo 'Disable this cron job!';
-            echo "\n";
-            echo '------------';
-            echo "\n";
-        })->daily();
-    }
-}

app/Http/Controllers/Auth/LoginController.php

@@ -190,6 +190,14 @@ class LoginController extends Controller
      */
     public function showLoginForm(Request $request): Factory|Redirector|RedirectResponse|View
     {
+        if ('remote_user_guard' === config('auth.defaults.guard')) {
+            $message = sprintf(
+                'Firefly III is configured to use the "remote user guard", but was unable to link you to a user. Are you sure the "%s" header is in place?',
+                config('auth.guard_header')
+            );
+
+            return view('errors.error', ['message' => $message]);
+        }
         Log::channel('audit')->info('Show login form (1.1).');
 
         $count             = DB::table('users')->count();

app/Http/Kernel.php

@@ -1,65 +0,0 @@
-<?php
-
-/**
- * Kernel.php
- * Copyright (c) 2019 james@firefly-iii.org
- *
- * This file is part of Firefly III (https://github.com/firefly-iii).
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-declare(strict_types=1);
-
-namespace FireflyIII\Http;
-
-use FireflyIII\Http\Middleware\Authenticate;
-use FireflyIII\Http\Middleware\Binder;
-use FireflyIII\Http\Middleware\InstallationId;
-use FireflyIII\Http\Middleware\RedirectIfAuthenticated;
-use FireflyIII\Http\Middleware\StartFireflySession;
-use FireflyIII\Http\Middleware\TrimStrings;
-use FireflyIII\Http\Middleware\TrustProxies;
-use Illuminate\Auth\Middleware\AuthenticateWithBasicAuth;
-use Illuminate\Auth\Middleware\Authorize;
-use Illuminate\Foundation\Http\Kernel as HttpKernel;
-use Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode;
-use Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull;
-use Illuminate\Foundation\Http\Middleware\ValidatePostSize;
-use Illuminate\Routing\Middleware\ThrottleRequests;
-use Illuminate\View\Middleware\ShareErrorsFromSession;
-
-/**
- * Class Kernel
- */
-class Kernel extends HttpKernel
-{
-    protected $middleware         = [
-        // SecureHeaders::class,
-        CheckForMaintenanceMode::class,
-        ValidatePostSize::class,
-        TrimStrings::class,
-        ConvertEmptyStringsToNull::class,
-        TrustProxies::class,
-        InstallationId::class,
-    ];
-    protected $middlewareAliases  = [
-        'auth'       => Authenticate::class,
-        'auth.basic' => AuthenticateWithBasicAuth::class,
-        'bindings'   => Binder::class,
-        'can'        => Authorize::class,
-        'guest'      => RedirectIfAuthenticated::class,
-        'throttle'   => ThrottleRequests::class,
-    ];
-    protected $middlewarePriority = [StartFireflySession::class, ShareErrorsFromSession::class, Authenticate::class, Binder::class, Authorize::class];
-}

app/Http/Middleware/Authenticate.php

@@ -82,22 +82,25 @@ class Authenticate
     protected function authenticate($request, array $guards)
     {
         if (0 === count($guards)) {
-            // go for default guard:
-            // @noinspection PhpUndefinedMethodInspection
-            if ($this->auth->check()) {
-                // do an extra check on user object.
-                /** @noinspection PhpUndefinedMethodInspection */
-
-                /** @var User $user */
-                $user = $this->auth->authenticate();
+            Log::debug('in Authenticate::authenticate() with zero guards.');
+            // There are no guards defined, go for the default guard:
+            if (auth()->check()) {
+                Log::debug('User is authenticated.');
+                $user = auth()->user();
                 $this->validateBlockedUser($user, $guards);
-            }
 
+                return;
+            }
             // @noinspection PhpUndefinedMethodInspection
-            return $this->auth->authenticate();
+            $this->auth->authenticate();
+            if (!$this->auth->check()) {
+                throw new AuthenticationException('The user is not logged in but must be.', $guards);
+            }
         }
 
+        exit('five');
         foreach ($guards as $guard) {
+            exit('six');
             if ('api' !== $guard) {
                 $this->auth->guard($guard)->authenticate();
             }
@@ -111,6 +114,7 @@ class Authenticate
             }
         }
 
+        exit('seven');
         // this is a massive hack, but if the handler has the oauth exception
         // at this point we can report its error instead of a generic one.
         $message = 'Unauthenticated.';
@@ -143,5 +147,6 @@ class Authenticate
             // @phpstan-ignore-line (thinks function is undefined)
             throw new AuthenticationException('Blocked account.', $guards);
         }
+        Log::debug(sprintf('User #%d is not blocked.', $user->id));
     }
 }

app/Http/Middleware/StartFireflyIIISession.php

@@ -32,7 +32,7 @@ use Override;
 /**
  * Class StartFireflySession.
  */
-class StartFireflySession extends StartSession
+class StartFireflyIIISession extends StartSession
 {
     /**
      * Store the current URL for the request if necessary.

app/Providers/AuthServiceProvider.php

@@ -34,10 +34,6 @@ use Laravel\Passport\Passport;
  */
 class AuthServiceProvider extends ServiceProvider
 {
-    protected $policies = [
-        // 'FireflyIII\Model' => 'FireflyIII\Policies\ModelPolicy',
-    ];
-
     /**
      * Register any authentication / authorization services.
      *

app/Providers/FireflySessionProvider.php

@@ -23,7 +23,7 @@ declare(strict_types=1);
 
 namespace FireflyIII\Providers;
 
-use FireflyIII\Http\Middleware\StartFireflySession;
+use FireflyIII\Http\Middleware\StartFireflyIIISession;
 use Illuminate\Session\SessionManager;
 use Illuminate\Support\ServiceProvider;
 use Override;
@@ -43,7 +43,7 @@ class FireflySessionProvider extends ServiceProvider
 
         $this->registerSessionDriver();
 
-        $this->app->singleton(StartFireflySession::class);
+        $this->app->singleton(StartFireflyIIISession::class);
     }
 
     /**

app/Providers/RouteServiceProvider.php

@@ -42,20 +42,18 @@ class RouteServiceProvider extends ServiceProvider
     #[Override]
     public function boot(): void
     {
-        $this->routes(function (): void {
-            Route::prefix('api')
-                ->middleware('api')
-                ->namespace($this->namespace)
-                ->group(base_path('routes/api.php'))
-            ;
-
-            Route::prefix('api/v1/cron')
-                ->middleware('api_basic')
-                ->namespace($this->namespace)
-                ->group(base_path('routes/api-noauth.php'))
-            ;
-
-            Route::middleware('web')->namespace($this->namespace)->group(base_path('routes/web.php'));
-        });
+        //        $this->routes(function (): void {
+        //            Route::prefix('api')
+        //                ->middleware('api')
+        //                ->namespace($this->namespace)
+        //                ->group(base_path('routes/api.php'))
+        //            ;
+        //            Route::prefix('api/v1/cron')
+        //                ->middleware('api_basic')
+        //                ->namespace($this->namespace)
+        //                ->group(base_path('routes/api-noauth.php'))
+        //            ;
+        //            Route::middleware('web')->namespace($this->namespace)->group(base_path('routes/web.php'));
+        //        });
     }
 }

app/Providers/SessionServiceProvider.php

@@ -23,7 +23,7 @@ declare(strict_types=1);
 
 namespace FireflyIII\Providers;
 
-use FireflyIII\Http\Middleware\StartFireflySession;
+use FireflyIII\Http\Middleware\StartFireflyIIISession;
 use Illuminate\Session\SessionServiceProvider as BaseSessionServiceProvider;
 use Override;
 
@@ -42,6 +42,6 @@ class SessionServiceProvider extends BaseSessionServiceProvider
 
         $this->registerSessionDriver();
 
-        $this->app->singleton(StartFireflySession::class);
+        $this->app->singleton(StartFireflyIIISession::class);
     }
 }

app/Support/Authentication/RemoteUserGuard.php

@@ -84,7 +84,8 @@ class RemoteUserGuard implements Guard
         if (null === $userID || '' === $userID) {
             Log::error(sprintf('No user in header "%s".', $header));
 
-            throw new FireflyException('The guard header was unexpectedly empty. See the logs.');
+            // throw new FireflyException('The guard header was unexpectedly empty. See the logs.');
+            return;
         }
 
         Log::debug(sprintf('User ID found in header is "%s"', $userID));

app/Support/Export/ExportDataGenerator.php

@@ -132,6 +132,14 @@ class ExportDataGenerator
 
     // @phpstan-ignore-line
 
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
     public function __construct()
     {
         $this->accounts = new Collection();

app/Support/JsonApi/Enrichments/AvailableBudgetEnrichment.php

@@ -62,6 +62,10 @@ class AvailableBudgetEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private readonly bool $convertToPrimary; // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
@@ -84,6 +88,10 @@ class AvailableBudgetEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private array $currencies            = [];
     private array $currencyIds           = [];
     private array $ids                   = [];

app/Support/JsonApi/Enrichments/BudgetLimitEnrichment.php

@@ -62,6 +62,10 @@ class BudgetLimitEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private array $currencies  = [];
     private array $currencyIds = [];
     private Carbon $end;

app/Support/JsonApi/Enrichments/PiggyBankEnrichment.php

@@ -64,6 +64,10 @@ class PiggyBankEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private array $accounts      = []; // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
@@ -86,6 +90,10 @@ class PiggyBankEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private array $amounts       = [];
     private Collection $collection;
     private array $currencies    = [];

app/Support/JsonApi/Enrichments/PiggyBankEventEnrichment.php

@@ -59,6 +59,10 @@ class PiggyBankEventEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private array $accountIds        = []; // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
@@ -81,6 +85,10 @@ class PiggyBankEventEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private Collection $collection;
     private array $currencies        = [];
     private array $groupIds          = [];

app/Support/JsonApi/Enrichments/SubscriptionEnrichment.php

@@ -68,6 +68,10 @@ class SubscriptionEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private readonly bool $convertToPrimary;
     private ?Carbon $end             = null;
     private array   $mappedObjects   = [];

app/Support/JsonApi/Enrichments/TransactionGroupEnrichment.php

@@ -97,6 +97,14 @@ class TransactionGroupEnrichment implements EnrichmentInterface
 
     // @phpstan-ignore-line
 
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
     public function __construct()
     {
         $this->dateFields      = ['interest_date', 'book_date', 'process_date', 'due_date', 'payment_date', 'invoice_date'];

app/Support/JsonApi/Enrichments/WebhookEnrichment.php

@@ -64,6 +64,10 @@ class WebhookEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private array $ids               = []; // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
@@ -86,6 +90,10 @@ class WebhookEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private array $responses         = [];
     private array $triggers          = [];
     private array $webhookDeliveries = [];

bootstrap/app.php

@@ -32,11 +32,9 @@ use FireflyIII\Http\Middleware\IsAdmin;
 use FireflyIII\Http\Middleware\Range;
 use FireflyIII\Http\Middleware\RedirectIfAuthenticated;
 use FireflyIII\Http\Middleware\SecureHeaders;
-use FireflyIII\Http\Middleware\StartFireflySession;
-use FireflyIII\Http\Middleware\TrustProxies;
+use FireflyIII\Http\Middleware\StartFireflyIIISession;
 use FireflyIII\Http\Middleware\VerifyCsrfToken;
 use Illuminate\Contracts\Debug\ExceptionHandler;
-use Illuminate\Contracts\Http\Kernel;
 use Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse;
 use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Configuration\Exceptions;
@@ -47,7 +45,6 @@ use Illuminate\Foundation\Http\Middleware\PreventRequestsDuringMaintenance;
 use Illuminate\Foundation\Http\Middleware\TrimStrings;
 use Illuminate\Http\Middleware\HandleCors;
 use Illuminate\Http\Middleware\ValidatePostSize;
-use Illuminate\Routing\Middleware\SubstituteBindings;
 use Illuminate\View\Middleware\ShareErrorsFromSession;
 use Laravel\Passport\Http\Middleware\CreateFreshApiToken;
 use Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful;
@@ -92,115 +89,98 @@ if (!function_exists('stringIsEqual')) {
 $app = Application::configure(basePath: dirname(__DIR__))
                   ->withRouting(
                       web     : __DIR__ . '/../routes/web.php',
+                      api     : __DIR__ . '/../routes/api.php',
                       commands: __DIR__ . '/../routes/console.php',
                       health  : '/up',
                   )
                   ->withMiddleware(function (Middleware $middleware): void {
+
                       // overrule the standard middleware
                       $middleware->use(
                           [
                               InvokeDeferredCallbacks::class,
+                              \Illuminate\Http\Middleware\TrustProxies::class, // use the DEFAULT middleware for this.
                               HandleCors::class,
                               PreventRequestsDuringMaintenance::class,
                               ValidatePostSize::class,
                               TrimStrings::class,
                               ConvertEmptyStringsToNull::class,
-                              SecureHeaders::class,
-                              TrustProxies::class,
+                              SecureHeaders::class, // is a Firefly III specific middleware class.
                           ]
                       );
 
-                      // overrule the web group
+                      // append and extend the default "web" middleware
+                      // to include our own custom "StartFireflyIIISession" class.
+                      // this class in turns contains a better "previous URL" feature.
+                      // See https://laravel.com/docs/12.x/middleware for the default list.
                       $middleware->group('web',
                                          [
                                              EncryptCookies::class,
                                              AddQueuedCookiesToResponse::class,
-                                             StartFireflySession::class,
+                                             StartFireflyIIISession::class, // this is different.
                                              ShareErrorsFromSession::class,
                                              VerifyCsrfToken::class,
-                                             SubstituteBindings::class,
+                                             Binder::class, // this is also different.
                                              CreateFreshApiToken::class,
                                          ]
                       );
-                      // new group?
-                      $middleware->appendToGroup('binders-only',
-                                                 [
-                                                     Installer::class,
-                                                     EncryptCookies::class,
-                                                     AddQueuedCookiesToResponse::class,
-                                                     Binder::class,
-                                                 ]);
 
-                      //
-                      $middleware->appendToGroup('user-not-logged-in', [
-                          Installer::class,
-                          EncryptCookies::class,
-                          AddQueuedCookiesToResponse::class,
-                          StartFireflySession::class,
-                          ShareErrorsFromSession::class,
-                          VerifyCsrfToken::class,
-                          Binder::class,
-                          RedirectIfAuthenticated::class,
-                      ]);
+                      // the default API group only contains "substitute bindings" middleware
+                      // so here we replace the entire API group and add more sensible stuff.
+                      $middleware->group('api',
+                                         [
+                                             AcceptHeaders::class,
+                                             EnsureFrontendRequestsAreStateful::class,
+                                             'auth:api',
+                          ]
+                      );
+                      $middleware->appendToGroup('api_basic', [AcceptHeaders::class, Binder::class]);
 
-                      // more
-                      $middleware->appendToGroup('user-logged-in-no-2fa', [
-                          Installer::class,
-                          EncryptCookies::class,
-                          AddQueuedCookiesToResponse::class,
-                          StartFireflySession::class,
-                          ShareErrorsFromSession::class,
-                          VerifyCsrfToken::class,
-                          Binder::class,
-                          Authenticate::class,
-                      ]);
 
-                      // simple auth
+                      // "simple auth" means the user must be logged in and present,
+                      // but does not have to be 2FA authenticated. This is so all users
+                      // can always log out, for example.
                       $middleware->appendToGroup('user-simple-auth', [
-                          EncryptCookies::class,
-                          AddQueuedCookiesToResponse::class,
-                          StartFireflySession::class,
-                          ShareErrorsFromSession::class,
-                          VerifyCsrfToken::class,
-                          Binder::class,
                           Authenticate::class,
                       ]);
 
-                      // user full auth
+                      // This middleware is added for all routes where the user MUST have full authentication.
+                      // this includes 2FA etc.
+                      // incidentally, this group also includes the range middleware and the message thing.
                       $middleware->appendToGroup('user-full-auth', [
-                          EncryptCookies::class,
-                          AddQueuedCookiesToResponse::class,
-                          StartFireflySession::class,
-                          ShareErrorsFromSession::class,
-                          VerifyCsrfToken::class,
                           Authenticate::class,
                           MFAMiddleware::class,
                           Range::class,
-                          Binder::class,
                           InterestingMessage::class,
-                          CreateFreshApiToken::class,
                       ]);
-
-                      // admin
+                      // This middleware is added to ensure that the user is not only logged in and
+                      // authenticated (with MFA and everything), but also admin.
                       $middleware->appendToGroup('admin', [
-                          EncryptCookies::class,
-                          AddQueuedCookiesToResponse::class,
-                          StartFireflySession::class,
-                          ShareErrorsFromSession::class,
-                          VerifyCsrfToken::class,
                           Authenticate::class,
-                          // AuthenticateTwoFactor::class,
+                          MFAMiddleware::class,
                           IsAdmin::class,
                           Range::class,
-                          Binder::class,
-                          CreateFreshApiToken::class,
+                          InterestingMessage::class,
                       ]);
 
-                      // api
-                      $middleware->appendToGroup('api', [AcceptHeaders::class, EnsureFrontendRequestsAreStateful::class, 'auth:api,sanctum', Binder::class]);
-                      // api basic,
-                      $middleware->appendToGroup('api_basic', [AcceptHeaders::class, Binder::class]);
+                      // if the user is not logged in, this group applies.
+                      // on top of everything else of course.
+                      $middleware->appendToGroup('user-not-logged-in', [
+                          Installer::class,
+                          RedirectIfAuthenticated::class,
+                      ]);
 
+                      // the "binders only" group does not need or ask for authentication
+                      // it just makes sure strings from routes are bound to objects if possible.
+                      $middleware->group('binders-only',
+                                         [
+                                             Installer::class,
+                                             EncryptCookies::class,
+                                             AddQueuedCookiesToResponse::class,
+                                             Binder::class,
+                                         ]);
+
+                      // $middleware->priority([StartFireflyIIISession::class, ShareErrorsFromSession::class, Authenticate::class, Binder::class, Authorize::class]);
                   })
                   ->withEvents(discover: [
                                              __DIR__ . '/../app/Listeners',
@@ -225,16 +205,6 @@ $app = Application::configure(basePath: dirname(__DIR__))
 |
 */
 
-$app->singleton(
-    Kernel::class,
-    FireflyIII\Http\Kernel::class
-);
-
-$app->singleton(
-    Illuminate\Contracts\Console\Kernel::class,
-    FireflyIII\Console\Kernel::class
-);
-
 $app->singleton(
     ExceptionHandler::class,
     Handler::class

bootstrap/providers.php

@@ -0,0 +1,71 @@
+<?php
+/*
+ * providers.php
+ * Copyright (c) 2026 james@firefly-iii.org
+ *
+ * This file is part of Firefly III (https://github.com/firefly-iii).
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+use FireflyIII\Providers\AccountServiceProvider;
+use FireflyIII\Providers\AdminServiceProvider;
+use FireflyIII\Providers\AppServiceProvider;
+use FireflyIII\Providers\AttachmentServiceProvider;
+use FireflyIII\Providers\BillServiceProvider;
+use FireflyIII\Providers\BudgetServiceProvider;
+use FireflyIII\Providers\CategoryServiceProvider;
+use FireflyIII\Providers\CurrencyServiceProvider;
+use FireflyIII\Providers\FireflyServiceProvider;
+use FireflyIII\Providers\JournalServiceProvider;
+use FireflyIII\Providers\PiggyBankServiceProvider;
+use FireflyIII\Providers\RecurringServiceProvider;
+use FireflyIII\Providers\RouteServiceProvider;
+use FireflyIII\Providers\RuleGroupServiceProvider;
+use FireflyIII\Providers\RuleServiceProvider;
+use FireflyIII\Providers\SearchServiceProvider;
+use FireflyIII\Providers\TagServiceProvider;
+use TwigBridge\ServiceProvider;
+
+return [
+    // Package Service Providers...
+
+    // Application Service Providers...
+    AppServiceProvider::class,
+    FireflyIII\Providers\AuthServiceProvider::class,
+    // FireflyIII\Providers\BroadcastServiceProvider::class,
+    // EventServiceProvider::class,
+    RouteServiceProvider::class,
+
+    // own stuff:
+    PragmaRX\Google2FALaravel\ServiceProvider::class,
+    ServiceProvider::class,
+
+    // More service providers.
+    AccountServiceProvider::class,
+    AttachmentServiceProvider::class,
+    BillServiceProvider::class,
+    BudgetServiceProvider::class,
+    CategoryServiceProvider::class,
+    CurrencyServiceProvider::class,
+    FireflyServiceProvider::class,
+    JournalServiceProvider::class,
+    PiggyBankServiceProvider::class,
+    RuleServiceProvider::class,
+    RuleGroupServiceProvider::class,
+    SearchServiceProvider::class,
+    TagServiceProvider::class,
+    AdminServiceProvider::class,
+    RecurringServiceProvider::class,
+];

config/app.php

@@ -22,59 +22,18 @@
 
 declare(strict_types=1);
 
-use FireflyIII\Providers\AccountServiceProvider;
-use FireflyIII\Providers\AdminServiceProvider;
-use FireflyIII\Providers\AppServiceProvider;
-use FireflyIII\Providers\AttachmentServiceProvider;
-use FireflyIII\Providers\BillServiceProvider;
-use FireflyIII\Providers\BudgetServiceProvider;
-use FireflyIII\Providers\CategoryServiceProvider;
-use FireflyIII\Providers\CurrencyServiceProvider;
-use FireflyIII\Providers\EventServiceProvider;
-use FireflyIII\Providers\FireflyServiceProvider;
-use FireflyIII\Providers\JournalServiceProvider;
-use FireflyIII\Providers\PiggyBankServiceProvider;
-use FireflyIII\Providers\RecurringServiceProvider;
-use FireflyIII\Providers\RouteServiceProvider;
-use FireflyIII\Providers\RuleGroupServiceProvider;
-use FireflyIII\Providers\RuleServiceProvider;
-use FireflyIII\Providers\SearchServiceProvider;
-use FireflyIII\Providers\SessionServiceProvider;
-use FireflyIII\Providers\TagServiceProvider;
 use FireflyIII\Support\Facades\AccountForm;
 use FireflyIII\Support\Facades\CurrencyForm;
 use FireflyIII\Support\Facades\ExpandedForm;
 use FireflyIII\Support\Facades\PiggyBankForm;
 use FireflyIII\Support\Facades\RuleForm;
-use Illuminate\Auth\AuthServiceProvider;
-use Illuminate\Auth\Passwords\PasswordResetServiceProvider;
-use Illuminate\Broadcasting\BroadcastServiceProvider;
-use Illuminate\Bus\BusServiceProvider;
-use Illuminate\Cache\CacheServiceProvider;
-use Illuminate\Cookie\CookieServiceProvider;
-use Illuminate\Database\DatabaseServiceProvider;
-use Illuminate\Encryption\EncryptionServiceProvider;
-use Illuminate\Filesystem\FilesystemServiceProvider;
-use Illuminate\Foundation\Providers\ConsoleSupportServiceProvider;
-use Illuminate\Foundation\Providers\FoundationServiceProvider;
-use Illuminate\Hashing\HashServiceProvider;
-use Illuminate\Mail\MailServiceProvider;
-use Illuminate\Notifications\NotificationServiceProvider;
-use Illuminate\Pagination\PaginationServiceProvider;
-use Illuminate\Pipeline\PipelineServiceProvider;
-use Illuminate\Queue\QueueServiceProvider;
-use Illuminate\Redis\RedisServiceProvider;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Config;
 use Illuminate\Support\Facades\Lang;
 use Illuminate\Support\Facades\Route;
 use Illuminate\Support\Facades\Session;
 use Illuminate\Support\Facades\URL;
-use Illuminate\Translation\TranslationServiceProvider;
-use Illuminate\Validation\ValidationServiceProvider;
-use Illuminate\View\ViewServiceProvider;
 use Spatie\Html\Facades\Html;
-use TwigBridge\ServiceProvider;
 
 return [
     'name'            => envNonEmpty('APP_NAME', 'Firefly III'),
@@ -86,61 +45,6 @@ return [
     'fallback_locale' => 'en_US',
     'key'             => env('APP_KEY'),
     'cipher'          => 'AES-256-CBC',
-    'providers'       => [
-        // Laravel Framework Service Providers...
-        AuthServiceProvider::class,
-        BroadcastServiceProvider::class,
-        BusServiceProvider::class,
-        CacheServiceProvider::class,
-        ConsoleSupportServiceProvider::class,
-        CookieServiceProvider::class,
-        DatabaseServiceProvider::class,
-        EncryptionServiceProvider::class,
-        FilesystemServiceProvider::class,
-        FoundationServiceProvider::class,
-        HashServiceProvider::class,
-        MailServiceProvider::class,
-        NotificationServiceProvider::class,
-        PaginationServiceProvider::class,
-        PipelineServiceProvider::class,
-        QueueServiceProvider::class,
-        RedisServiceProvider::class,
-        PasswordResetServiceProvider::class,
-        SessionServiceProvider::class,
-        TranslationServiceProvider::class,
-        ValidationServiceProvider::class,
-        ViewServiceProvider::class,
-
-        // Package Service Providers...
-
-        // Application Service Providers...
-        AppServiceProvider::class,
-        FireflyIII\Providers\AuthServiceProvider::class,
-        // FireflyIII\Providers\BroadcastServiceProvider::class,
-        // EventServiceProvider::class,
-        RouteServiceProvider::class,
-
-        // own stuff:
-        PragmaRX\Google2FALaravel\ServiceProvider::class,
-        ServiceProvider::class,
-
-        // More service providers.
-        AccountServiceProvider::class,
-        AttachmentServiceProvider::class,
-        BillServiceProvider::class,
-        BudgetServiceProvider::class,
-        CategoryServiceProvider::class,
-        CurrencyServiceProvider::class,
-        FireflyServiceProvider::class,
-        JournalServiceProvider::class,
-        PiggyBankServiceProvider::class,
-        RuleServiceProvider::class,
-        RuleGroupServiceProvider::class,
-        SearchServiceProvider::class,
-        TagServiceProvider::class,
-        AdminServiceProvider::class,
-        RecurringServiceProvider::class,
-    ],
     'aliases'         => [
         'Auth'          => Auth::class,
         'Route'         => Route::class,

config/firefly.php

@@ -78,8 +78,8 @@ return [
         'running_balance_column' => (bool)envNonEmpty('USE_RUNNING_BALANCE', true), // this is only the default value, is not used.
         // see cer.php for exchange rates feature flag.
     ],
-    'version'                              => 'develop/2026-02-14',
-    'build_time'                           => 1771097509,
+    'version'                              => 'develop/2026-02-15',
+    'build_time'                           => 1771152837,
     'api_version'                          => '2.1.0', // field is no longer used.
     'db_version'                           => 28, // field is no longer used.
 

package-lock.json

@@ -4240,6 +4240,22 @@
             "dev": true,
             "license": "MIT"
         },
+        "node_modules/body-parser/node_modules/qs": {
+            "version": "6.14.2",
+            "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
+            "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==",
+            "dev": true,
+            "license": "BSD-3-Clause",
+            "dependencies": {
+                "side-channel": "^1.1.0"
+            },
+            "engines": {
+                "node": ">=0.6"
+            },
+            "funding": {
+                "url": "https://github.com/sponsors/ljharb"
+            }
+        },
         "node_modules/bonjour-service": {
             "version": "1.3.0",
             "resolved": "https://registry.npmjs.org/bonjour-service/-/bonjour-service-1.3.0.tgz",
@@ -4578,9 +4594,9 @@
             }
         },
         "node_modules/caniuse-lite": {
-            "version": "1.0.30001769",
-            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001769.tgz",
-            "integrity": "sha512-BCfFL1sHijQlBGWBMuJyhZUhzo7wer5sVj9hqekB/7xn0Ypy+pER/edCYQm4exbXj4WiySGp40P8UuTh6w1srg==",
+            "version": "1.0.30001770",
+            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001770.tgz",
+            "integrity": "sha512-x/2CLQ1jHENRbHg5PSId2sXq1CIO1CISvwWAj027ltMVG2UNgW+w9oH2+HzgEIRFembL8bUlXtfbBHR1fCg2xw==",
             "dev": true,
             "funding": [
                 {
@@ -6191,6 +6207,22 @@
             "dev": true,
             "license": "MIT"
         },
+        "node_modules/express/node_modules/qs": {
+            "version": "6.14.2",
+            "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
+            "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==",
+            "dev": true,
+            "license": "BSD-3-Clause",
+            "dependencies": {
+                "side-channel": "^1.1.0"
+            },
+            "engines": {
+                "node": ">=0.6"
+            },
+            "funding": {
+                "url": "https://github.com/sponsors/ljharb"
+            }
+        },
         "node_modules/fast-deep-equal": {
             "version": "3.1.3",
             "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -9717,9 +9749,9 @@
             "license": "MIT"
         },
         "node_modules/qs": {
-            "version": "6.14.2",
-            "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
-            "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==",
+            "version": "6.15.0",
+            "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.0.tgz",
+            "integrity": "sha512-mAZTtNCeetKMH+pSjrb76NAM8V9a05I9aBZOHztWy/UqcJdQYNsf59vrRKWnojAT9Y+GbIvoTBC++CPHqpDBhQ==",
             "dev": true,
             "license": "BSD-3-Clause",
             "dependencies": {

routes/api-noauth.php

@@ -1,39 +0,0 @@
-<?php
-
-/*
- * api-noauth.php
- * Copyright (c) 2021 james@firefly-iii.org
- *
- * This file is part of Firefly III (https://github.com/firefly-iii).
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-declare(strict_types=1);
-
-use Illuminate\Support\Facades\Route;
-// Cron job API routes:
-use FireflyIII\Http\Middleware\AcceptHeaders;
-
-Route::group(
-    [
-        'namespace'  => 'FireflyIII\Api\V1\Controllers\System',
-        'prefix'     => '',
-        'as'         => 'api.v1.cron.',
-        'middleware' => [AcceptHeaders::class],
-    ],
-    static function (): void {
-        Route::get('{cliToken}', ['uses' => 'CronController@cron', 'as' => 'index']);
-    }
-);

routes/api.php

@@ -21,6 +21,9 @@
  */
 
 declare(strict_types=1);
+
+use FireflyIII\Http\Middleware\AcceptHeaders;
+use FireflyIII\Http\Middleware\Binder;
 use Illuminate\Support\Facades\Route;
 
 use function Safe\define;
@@ -38,6 +41,19 @@ if (!defined('DATEFORMAT')) {
     define('DATEFORMAT', '(19|20)[0-9]{2}-?[0-9]{2}-?[0-9]{2}');
 }
 
+// API route for cron
+Route::group(
+    [
+        'namespace'  => 'FireflyIII\Api\V1\Controllers\System',
+        'prefix'     => 'v1',
+        'as'         => 'api.v1.cron.',
+        'middleware' => [Binder::class, AcceptHeaders::class],
+    ],
+    static function (): void {
+        Route::get('cron/{cliToken}', ['uses' => 'CronController@cron', 'as' => 'index'])->withoutMiddleware(['api']);
+    }
+);
+
 // Autocomplete controllers
 Route::group(
     [

routes/web.php

@@ -73,24 +73,24 @@ Route::group(
     }
 );
 
-Route::group(
-    ['middleware' => 'binders-only', 'namespace' => 'FireflyIII\Http\Controllers\System', 'as' => 'cron.', 'prefix' => 'cron'],
-    static function (): void {
-        Route::get('run/{cliToken}', ['uses' => 'CronController@cron', 'as' => 'cron']);
-    }
-);
+// Route::group(
+//    ['middleware' => 'binders-only', 'namespace' => 'FireflyIII\Http\Controllers\System', 'as' => 'cron.', 'prefix' => 'cron'],
+//    static function (): void {
+//        Route::get('run/{cliToken}', ['uses' => 'CronController@cron', 'as' => 'cron']);
+//    }
+// );
 
 Route::group(
-    ['middleware' => 'binders-only', 'namespace' => 'FireflyIII\Http\Controllers\System'],
+    ['middleware' => ['binders-only'], 'namespace' => 'FireflyIII\Http\Controllers\System'],
     static function (): void {
         // Route::get('offline', static fn () => view('errors.offline'));
-        Route::get('health', ['uses' => 'HealthcheckController@check', 'as' => 'healthcheck']);
+        Route::get('health', ['uses' => 'HealthcheckController@check', 'as' => 'healthcheck'])->withoutMiddleware(['web']);
     }
 );
 
 // These routes only work when the user is NOT logged in.
 Route::group(
-    ['middleware' => 'user-not-logged-in', 'namespace' => 'FireflyIII\Http\Controllers'],
+    ['middleware' => ['user-not-logged-in'], 'namespace' => 'FireflyIII\Http\Controllers'],
     static function (): void {
         // Authentication Routes...
         Route::get('login', ['uses' => 'Auth\LoginController@showLoginForm', 'as' => 'login']);
@@ -128,7 +128,7 @@ Route::group(
 
 // For the two factor routes, the user must be logged in, but NOT 2FA. Account confirmation does not matter here.
 Route::group(
-    ['middleware' => 'user-logged-in-no-2fa', 'prefix' => 'two-factor', 'as' => 'two-factor.', 'namespace' => 'FireflyIII\Http\Controllers\Auth'],
+    ['middleware' => 'user-simple-auth', 'prefix' => 'two-factor', 'as' => 'two-factor.', 'namespace' => 'FireflyIII\Http\Controllers\Auth'],
     static function (): void {
         Route::post('submit', ['uses' => 'TwoFactorController@submitMFA', 'as' => 'submit']);
         Route::get('lost', ['uses' => 'TwoFactorController@lostTwoFactor', 'as' => 'lost']); // can be removed when v2 is live.