financial page with bank data

tools/bunq-callback.sh

@@ -185,8 +185,51 @@ for item in d.get("Response",[]):
         aid=acc.get("id"); st=acc.get("status",""); desc=acc.get("description","")
         print(f"  id={aid:<10} {st:<8} {kind:<22} {desc}  {iban}  balance {bal}")'
     echo
-    echo "current MUTATION filters:"
-    api GET "/v1/user/$USER_ID/notification-filter-url" "" "$SESSION" | python3 -m json.tool
+    # Filters registered PER ACCOUNT do not appear in the user-level list, so
+    # showing only that one reads as "nothing is registered" when in fact
+    # everything is. Both are printed, per account, or this command lies.
+    echo "MUTATION filters, per account:"
+    api GET "/v1/user/$USER_ID/monetary-account?count=50" "" "$SESSION" | python3 -c 'import json,sys
+d=json.load(sys.stdin)
+ids=[]
+for item in d.get("Response",[]):
+    for acc in item.values():
+        if isinstance(acc,dict) and "id" in acc: ids.append(str(acc["id"]))
+print(" ".join(ids))' > /tmp/.cc-accts.$$
+for _a in $(cat /tmp/.cc-accts.$$); do
+    _f=$(api GET "/v1/user/$USER_ID/monetary-account/$_a/notification-filter-url" "" "$SESSION" \
+        | python3 -c 'import json,sys
+d=json.load(sys.stdin)
+out=[]
+for item in d.get("Response",[]):
+    f=item.get("NotificationFilterUrl") or {}
+    if not f: continue
+    t=f.get("notification_target") or ""
+    # never print the callback secret: the last path segment is masked
+    parts=t.rsplit("/",1)
+    masked=parts[0]+"/"+(parts[1][:4]+"…" if len(parts)>1 and parts[1] else "")
+    out.append(f.get("category","?")+" -> "+masked)
+print("; ".join(out) if out else "(none)")')
+    printf '    account %-10s %s\n' "$_a" "$_f"
+done
+rm -f /tmp/.cc-accts.$$
+echo
+echo "user-level filters (apply to ALL accounts):"
+api GET "/v1/user/$USER_ID/notification-filter-url" "" "$SESSION" | python3 -c 'import json,sys
+d=json.load(sys.stdin)
+r=d.get("Response") or []
+if not r:
+    print("    (none)"); raise SystemExit
+for item in r:
+    f=item.get("NotificationFilterUrl") or {}
+    t=f.get("notification_target") or ""
+    # The callback URL ENDS IN A SHARED SECRET. Never print it whole: this
+    # output gets pasted into issues and terminals that keep scrollback.
+    parts=t.rsplit("/",1)
+    masked=parts[0]+"/"+(parts[1][:4]+"…" if len(parts)>1 and parts[1] else "")
+    accts=f.get("all_monetary_account_id") or []
+    cat=f.get("category","?")
+    print(f"    {cat} -> {masked}  accounts={sorted(set(accts))}")'
     ;;
 set)
     ACCOUNT="${2:?usage: tools/bunq-callback.sh set <account-id> <callback-url>}"
@@ -207,6 +250,21 @@ set)
         echo "      (A wrong secret answers 404 by design — check the secret too.)" >&2
         exit 1
     fi
+    # "all" registers at USER level, covering every account including ones
+    # created later. Prefer it: bunq treats even per-account registrations as
+    # user-scoped entries anyway, and repeated per-account POSTs accumulate
+    # duplicate account ids rather than replacing cleanly. A user-level POST
+    # replaces the ENTIRE set, which is also how you clear stale URLs.
+    if [ "$ACCOUNT" = all ]; then
+        echo "bunq: installing the MUTATION filter for ALL accounts"
+        _resp=$(api POST "/v1/user/$USER_ID/notification-filter-url" \
+            "$(python3 -c 'import json,sys
+print(json.dumps({"notification_filters":[
+    {"category":"MUTATION","notification_target":sys.argv[1]}]}))' "$URL")" "$SESSION")
+        die_on_error "$_resp"
+        echo "  done (previous filters replaced)"
+        exit 0
+    fi
     echo "bunq: installing the MUTATION filter on account $ACCOUNT"
     # POST REPLACES the whole filter set for this account, so this is also how
     # you change or clear one.
@@ -220,8 +278,165 @@ print(json.dumps({"notification_filters":[
     echo "bunq: done. Send yourself €0.01 and watch:"
     echo "      ssh hetzner journalctl -u catcrafts-server -f"
     ;;
+payments)
+    # What a real mutation actually looks like, WITHOUT printing what a real
+    # mutation actually says. This exists to answer "which field tells me a
+    # payment came from bunq.me?" empirically rather than from memory — so it
+    # prints the SHAPE (key names, and the values of fields that classify
+    # rather than identify) and masks everything that names a human.
+    ACCOUNT="${2:?usage: tools/bunq-callback.sh payments <account-id> [count]}"
+    api GET "/v1/user/$USER_ID/monetary-account/$ACCOUNT/payment?count=${3:-25}" \
+        "" "$SESSION" | python3 -c 'import json,sys
+SAFE={"id","created","type","sub_type","amount","payment_auto_allocate_instance",
+      "bunqme_fundraiser_result","request_reference_split_the_bill",
+      "payment_arrival_expected","merchant_reference","batch_id","scheduled_id"}
+d=json.load(sys.stdin)
+rows=[item["Payment"] for item in d.get("Response",[]) if "Payment" in item]
+if not rows:
+    print("  (no payments on this account)"); raise SystemExit
+allkeys=set()
+for p in rows: allkeys.update(p.keys())
+print(f"  {len(rows)} payment(s). Union of keys present:")
+for k in sorted(allkeys):
+    mark="  <- SAFE to classify on" if k in SAFE else ""
+    print(f"    {k}{mark}")
+print()
+print("  per payment (identifying fields masked):")
+for p in rows:
+    amt=(p.get("amount") or {})
+    val=amt.get("value","?"); cur=amt.get("currency","?")
+    bm=p.get("bunqme_fundraiser_result")
+    bmk="yes" if bm else "no"
+    extra=""
+    if isinstance(bm,dict):
+        extra=" bunqme_keys=" + ",".join(sorted(bm.keys()))
+    pid=p.get("id"); ptype=p.get("type"); psub=p.get("sub_type")
+    print(f"    id={pid} type={ptype} sub_type={psub} "
+          f"amount={val} {cur} bunqme_fundraiser_result={bmk}{extra}")'
+    ;;
+backfill)
+    # The categorisation worklist for a date window. READ ONLY — it publishes
+    # nothing and writes nothing to the server. Incoming and outgoing are
+    # separated because they ask different questions ("is this a donation?" vs
+    # "which expense category?"), and outgoing is grouped by counterparty
+    # because that is the unit a rule matches on.
+    SINCE="${2:?usage: tools/bunq-callback.sh backfill <YYYY-MM-DD> [YYYY-MM-DD]}"
+    UNTIL="${3:-9999-12-31}"
+    _tmp=$(mktemp -d)
+    api GET "/v1/user/$USER_ID/monetary-account?count=50" "" "$SESSION" | python3 -c 'import json,sys
+d=json.load(sys.stdin)
+for item in d.get("Response",[]):
+    for acc in item.values():
+        if isinstance(acc,dict) and "id" in acc:
+            print(acc["id"], (acc.get("description") or "?").replace(" ","_"))' > "$_tmp/accts"
+    while read -r _id _nm; do
+        api GET "/v1/user/$USER_ID/monetary-account/$_id/payment?count=200" "" "$SESSION" \
+            > "$_tmp/pay-$_id-$_nm.json"
+    done < "$_tmp/accts"
+    python3 - "$SINCE" "$UNTIL" "$_tmp" <<'PY'
+import glob, json, os, sys
+since, until, tmp = sys.argv[1], sys.argv[2], sys.argv[3]
+rows=[]
+for path in sorted(glob.glob(os.path.join(tmp,"pay-*.json"))):
+    label=os.path.basename(path)[4:-5]
+    try: d=json.load(open(path))
+    except Exception: continue
+    for item in d.get("Response",[]):
+        p=item.get("Payment")
+        if not isinstance(p,dict): continue
+        created=(p.get("created") or "")[:10]
+        if not (since <= created <= until): continue
+        amt=(p.get("amount") or {})
+        if amt.get("currency")!="EUR": continue
+        try: cents=int(round(float(amt.get("value","0"))*100))
+        except Exception: continue
+        cp=(p.get("counterparty_alias") or {})
+        rows.append({"acct":label,"date":created,"cents":cents,
+                     "type":p.get("type"),"sub":p.get("sub_type"),
+                     "name":cp.get("display_name") or "?",
+                     "iban":cp.get("iban") or "",
+                     "desc":(p.get("description") or "").strip()[:44]})
+if not rows:
+    print("  no EUR payments in", since, "..", until); raise SystemExit
+print(f"  window {since} .. {until}   {len(rows)} payment(s)\n")
+ins=[r for r in rows if r["cents"]>0]
+outs=[r for r in rows if r["cents"]<0]
+
+print(f"  INCOMING ({len(ins)}) — decide donation / sale payout / other:")
+for r in sorted(ins,key=lambda r:r["date"]):
+    eur=r["cents"]/100
+    print(f"    {r['date']}  {eur:>9.2f}  {r['type']:<11}{r['sub']:<9} {r['name'][:22]:<22} {r['desc']}")
+print(f"    ---- incoming total: {sum(r['cents'] for r in ins)/100:.2f}\n")
+
+print(f"  OUTGOING ({len(outs)}) — grouped by counterparty; each group is one rule:")
+groups={}
+for r in outs:
+    key=(r["name"],r["iban"])
+    g=groups.setdefault(key,{"cents":0,"n":0,"descs":set()})
+    g["cents"]+=r["cents"]; g["n"]+=1
+    if r["desc"]: g["descs"].add(r["desc"])
+for (name,iban),g in sorted(groups.items(),key=lambda kv:kv[1]["cents"]):
+    eur=-g["cents"]/100
+    sample=sorted(g["descs"])[0] if g["descs"] else ""
+    print(f"    {eur:>10.2f}  x{g['n']:<3} {name[:26]:<26} {iban:<20} {sample[:30]}")
+print(f"    ---- outgoing total: {-sum(r['cents'] for r in outs)/100:.2f}")
+PY
+    rm -rf "$_tmp"
+    ;;
+payment)
+    # One payment by id, classification fields only. Used to answer "what does
+    # a payment that AROSE FROM a bunq.me tab actually look like on the wire?"
+    ACCOUNT="${2:?usage: tools/bunq-callback.sh payment <account-id> <payment-id>...}"
+    shift 2
+    for pid in "$@"; do
+        api GET "/v1/user/$USER_ID/monetary-account/$ACCOUNT/payment/$pid" "" "$SESSION" \
+        | python3 -c 'import json,sys
+d=json.load(sys.stdin)
+rows=[i["Payment"] for i in d.get("Response",[]) if "Payment" in i]
+for p in rows:
+    amt=(p.get("amount") or {})
+    val=amt.get("value","?")
+    pid=p.get("id"); ptype=p.get("type"); psub=p.get("sub_type")
+    has_bm="bunqme_fundraiser_result" in p
+    print(f"  id={pid} type={ptype} sub_type={psub} amount={val} "
+          f"has_bunqme_field={has_bm}")'
+    done
+    ;;
+bunqme)
+    # The bunq.me side. A tab records which payments fulfilled it, so this is
+    # the only authoritative "did this money come from a bunq.me link?" join —
+    # and note it takes an API CALL WITH THE KEY, which is exactly what the
+    # server does not have. Prints payment ids so they can be matched against
+    # `payments` output; no payer names or links are shown in full.
+    ACCOUNT="${2:?usage: tools/bunq-callback.sh bunqme <account-id> [count]}"
+    api GET "/v1/user/$USER_ID/monetary-account/$ACCOUNT/bunqme-tab?count=${3:-25}" \
+        "" "$SESSION" | python3 -c 'import json,sys
+d=json.load(sys.stdin)
+tabs=[i["BunqMeTab"] for i in d.get("Response",[]) if "BunqMeTab" in i]
+if not tabs:
+    print("  (no bunq.me tabs on this account)"); raise SystemExit
+for t in tabs:
+    url=t.get("bunqme_tab_share_url") or ""
+    slug=url.rsplit("/",1)[-1]
+    masked=slug[:3]+"…" if slug else "(none)"
+    entry=t.get("bunqme_tab_entry") or {}
+    inq=t.get("result_inquiries") or []
+    pids=[]
+    for r in inq:
+        node=r.get("BunqMeTabResultInquiry") or r
+        pay=(node.get("payment") or {})
+        pay=pay.get("Payment") or pay
+        if isinstance(pay,dict) and pay.get("id") is not None:
+            pids.append(str(pay["id"]))
+    tid=t.get("id"); st=t.get("status")
+    amt=(entry.get("amount_inquired") or {}).get("value","open")
+    joined=",".join(pids)
+    print(f"  tab={tid} status={st} link=bunq.me/{masked} asked={amt} "
+          f"fulfilled_by_payment_ids=[{joined}]")'
+    ;;
 *)
-    echo "usage: tools/bunq-callback.sh [list | set <account-id> <callback-url>]" >&2
+    echo "usage: tools/bunq-callback.sh [list | set <account-id> <callback-url> |" >&2
+    echo "                               payments <account-id> [count] | bunqme <account-id> [count]]" >&2
     exit 2
     ;;
 esac