Files
actual/packages/sync-server
Copilot fc89c74445 Fix authorization bypass allowing non-owners to delete shared budgets (#6338)
* Initial plan

* Add permission checks for budget deletion

- Server-side: Check if user is file owner or admin before allowing deletion
- Client-side: Hide "Delete from all devices" button for non-owners
- Add comprehensive tests for permission checking
- Non-owners see message that only owner can delete from server

Co-authored-by: MatissJanis <886567+MatissJanis@users.noreply.github.com>

* Add release notes for PR #6338

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #6338

* Fix: Change unauthorized to forbidden in delete-user-file

Co-authored-by: matiss <matiss@mja.lv>

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #6338

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #6338

* Fix: Update error reason from 'unauthorized' to 'forbidden' in delete-user-file response

* Update VRT screenshot for date filter test case

* [autofix.ci] apply automated fixes

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: MatissJanis <886567+MatissJanis@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: matiss <matiss@mja.lv>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
2025-12-30 23:25:46 +00:00
..
2025-04-15 20:51:17 +01:00
2025-10-18 23:58:27 +01:00
2025-11-05 23:55:47 +00:00

This is the main project to run Actual, a local-first personal finance tool. It comes with the latest version of Actual, and a server to persist changes and make data available across all devices.

Getting Started

Actual is a local-first personal finance tool. It is 100% free and open-source, written in NodeJS, it has a synchronization element so that all your changes can move between devices without any heavy lifting.

If you are interested in contributing, or want to know how development works, see our contributing document we would love to have you.

Want to say thanks? Click the at the top of the page.

Using the CLI tool

Node.js v22 or higher is required for the @actual-app/sync-server npm package

Install globally with npm:

npm install --location=global @actual-app/sync-server

After installing, you can execute actual-server commands directly in your terminal.

Usage

actual-server [options]

Available options

Command Description
-h or --help Print this list and exit.
-v or --version Print this version and exit.
--config Path to the config file.
--reset-password Reset your password

Examples

Run with default configuration

actual-server

Run with custom configuration

actual-server --config ./config.json

Reset your password

actual-server --reset-password

Documentation

We have a wide range of documentation on how to use Actual. This is all available in our Community Documentation, including topics on installing, Budgeting, Account Management, Tips & Tricks and some documentation for developers.

Feature Requests

Current feature requests can be seen here. Vote for your favorite requests by reacting 👍 to the top comment of the request.

To add new feature requests, open a new Issue of the "Feature Request" type.