Suggestions

[pontusab]

Note

Medium Risk
Changes core matching/suggestion query paths and thresholds for inbox/transaction attachment suggestions, which can affect suggestion quality and result ordering. Low security risk, but moderate behavioral/performance risk due to altered query patterns and early-return logic.

Overview
Improves attachment suggestions/search behavior across API, DB, and dashboard UI. The search.attachments endpoint now fetches inbox suggestions first, applies a high minConfidence when suggesting by transactionId, and skips invoice searching entirely when the user isn’t actively typing a query.

Refactors matching to return ranked lists. Transaction/inbox matching utilities are generalized from single-match functions to findTopMatches / findInboxTopMatches (with wrappers preserving old findMatches / findInboxMatches behavior), and getInboxSearch/searchTransactionMatch are updated to use these shared match results instead of duplicating scoring/filtering logic.

Reduces eager querying in the attachment picker. SelectAttachment now only enables suggestion fetching after first focus (and returns fewer default suggestions), while keeping full search behavior when the user types.

^{Written by Cursor Bugbot for commit 6650a95. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is ON, but it could not run because Privacy Mode (Legacy) is turned on. To enable Bugbot Autofix, switch your privacy mode in the Cursor dashboard.}

[cursor]

includeAlreadyMatched silently ignored in suggestion path

Medium Severity

When searchTransactionMatch is called without a query (suggestion mode), it now delegates to findTopMatches, which hardcodes a notExists(transactionAttachments...) filter and always sets isAlreadyMatched: false. The includeAlreadyMatched parameter — still destructured and used in the query path — is completely ignored in the inboxId path. The UI toggle in match-transaction.tsx (defaulting to true via localStorage) becomes non-functional for suggestion results, and users lose the ability to see already-matched transactions.

Additional Locations (1)

• packages/db/src/queries/transaction-matching.ts#L676-L687

 

[cursor]

minConfidenceScore parameter accepted but silently unused

Low Severity

The minConfidenceScore field remains in SearchTransactionMatchParams and is still passed from the tRPC router, but was removed from the destructuring in searchTransactionMatch. It has no effect — findTopMatches uses its own calibrated suggestedThreshold (minimum 0.6) instead. This is dead code that misleads API consumers into thinking the parameter controls filtering behavior.