What's Changed
🎯 Account pickers, unified
Every account dropdown in MoneyMatter now looks and behaves the same, with the same layout and the same details on each account. Settings → General adds two controls over them. Pick a default account and new forms open on it instead of whatever sits first in the list. Decide whether archived accounts show up in dropdowns at all; they stay hidden unless the record you're editing already points at one.
🔒 Shared data stays inside what you shared
Sharing an account or a budget handed the other person more than the thing you shared, and a few of these needed nothing beyond any signed-in account on the instance.
- Any signed-in user could pull the day-by-day balance chart of an account that wasn't theirs. It took knowing the account's internal id, and it worked for any account on the instance. Balance history now answers only for accounts you own.
- Someone you gave "manage" rights to on a shared account or budget could widen their own access. They edited their own membership entry and raised what it allowed. A member's rights now change only when a different person with manage rights changes them.
- On a self-hosted instance, an ordinary user could claim an admin username and gain admin rights. Admin access keys off the names in
ADMIN_USERS, and nothing stopped a rename into one of those names that nobody had registered yet. Those names are reserved now. - Any signed-in user could list the accounts inside someone else's account group. Group contents now come back only for your own groups.
- Payee spending totals inside an account shared with you counted the owner's other accounts too. Open a shared account, look at a payee, and the amounts covered spending on accounts you were never given. Those figures now cover the shared account alone.
- A shared budget put both sides' full category lists in front of the other person. A shared budget now reveals only the categories its own transactions use, and the rest of your category names stay private.
- Anyone signed in could watch the progress of someone else's Monobank sync. Sync progress now answers only for your own imports.
🏠 Self-hosting and demo accounts
- A leftover address in the API returned the full list of registered users to anyone signed in, demo visitors included. It's gone. Thanks to the self-hoster who reported it in #498.
- New
SYSTEM_DEMO_DISABLEDenv var turns off demo account creation. The self-host compose stack ships with it on, since the demo exists for the hosted landing page. Demo creation also respects theSYSTEM_MAX_SIGNUPS_ALLOWEDcap now. - Demo accounts can no longer change data through a connected AI assistant, and they can no longer start AI categorization, which billed the operator's AI credits.
📝 Code Changes
- fix: Remove outdated endpoints & gate write MCP tools for demo users by @letehaha in 3815c28
- fix: Harden data access by @letehaha in #499
- feat: Improve accounts selection dialog by @letehaha in #501
Full Changelog: v0.26.3...v0.26.4