TampereHacklab / mulysa

Mulysa member management for Hacklabs
GNU General Public License v3.0
6 stars 11 forks source link

OP transaction archival reference can be same between different transactions #498

Open tswfi opened 2 months ago

tswfi commented 2 months ago

If user creates a recurring payment in OP they will reuse the same archival reference for all payments done for that recurring payment. If the receiving bank is also OP they will just use the generated archival reference for the incoming transaction. This causes nordigen integration to skip all but the first transaction as the archival reference is the same.

This does not happen when receiving bank is different than OP as at least Nordea creates their own archival reference number for incoming transactions (this is also the reason this was never seen before).

This is the data that came from Nordigen api (with some data redacted)

{
    "bookingDate": "2024-07-03",
    "debtorName": "REDACTED",
    "entryReference": "00000000000000123456",
    "internalTransactionId": "5eaeXXXXX6100",
    "proprietaryBankTransactionCode": "VIITESIIRTO",
    "transactionAmount": {
        "amount": "15.00",
        "currency": "EUR"
    },
    "transactionId": "202407035936192R9019",
    "valueDate": "2024-07-03"
},
{
    "bookingDate": "2024-08-02",
    "debtorName": "REDACTED",
    "entryReference": "00000000000000123456",
    "internalTransactionId": "9c73XXXXX68e2",
    "proprietaryBankTransactionCode": "VIITESIIRTO",
    "transactionAmount": {
        "amount": "15.00",
        "currency": "EUR"
    },
    "transactionId": "202407035936192R9019",
    "valueDate": "2024-08-02"
},

internalTransactionId does differ but transactionId is the same between both transactions.

Screenshots from the users bank show the same data (also with some data redacted)

1000037529 1000037531

tswfi commented 2 months ago

Yup, OP confirms this from their support

1000037585

One way to fix this is to make the archival reference not unique and using transaction date and archival reference as the uniqueness check...