Import dedup transparency + override; bulk transaction actions

Paste-import now returns each skipped duplicate WITH the matched
existing row (id, merchant, date, amount, source) instead of a bare
count, and accepts allow_duplicates to force-import false positives —
the practical fix for same-day identical purchases hashing together
(UX-20; supersedes the BE-08 hash change, which would have orphaned
every existing hash). POST /transactions/bulk applies
delete/set_category/set_deferred to up to 500 ids atomically. 82 tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/app/api/v1/endpoints/import_transactions.py

@@ -26,12 +26,29 @@ class PasteImportRequest(BaseModel):
     text: str = Field(max_length=1_000_000)
     bank: Bank = Bank.BAC
     source: TransactionSource = TransactionSource.CREDIT_CARD
+    # Override for false-positive dedup (legitimate same-day, same-amount
+    # repeat purchases hash identically) — review UX-20/BE-08.
+    allow_duplicates: bool = False
+
+
+class SkippedDuplicate(BaseModel):
+    line: int
+    merchant: str
+    date: str
+    amount: float
+    currency: str
+    existing_id: int
+    existing_merchant: str
+    existing_date: str
+    existing_amount: float
+    existing_source: str
 
 
 class PasteImportResult(BaseModel):
     imported: int
     duplicates: int
     errors: list[str]
+    skipped: list[SkippedDuplicate] = []
 
 
 def make_reference_hash(date: datetime, merchant: str, amount: float, currency: str) -> str:
@@ -103,6 +120,7 @@ def paste_import(
     imported = 0
     duplicates = 0
     errors: list[str] = []
+    skipped: list[SkippedDuplicate] = []
 
     lines = req.text.strip().splitlines()
 
@@ -120,13 +138,29 @@ def paste_import(
             parsed["date"], parsed["merchant"], parsed["amount"], parsed["currency"]
         )
 
-        # Check for duplicates
-        existing = session.exec(
-            select(Transaction).where(Transaction.reference == ref_hash)
-        ).first()
-        if existing:
-            duplicates += 1
-            continue
+        # Check for duplicates — and SHOW the user what matched instead of
+        # silently dropping the line (UX-20).
+        if not req.allow_duplicates:
+            existing = session.exec(
+                select(Transaction).where(Transaction.reference == ref_hash)
+            ).first()
+            if existing:
+                duplicates += 1
+                skipped.append(
+                    SkippedDuplicate(
+                        line=i,
+                        merchant=parsed["merchant"],
+                        date=parsed["date"].isoformat(),
+                        amount=parsed["amount"],
+                        currency=parsed["currency"],
+                        existing_id=existing.id or 0,
+                        existing_merchant=existing.merchant,
+                        existing_date=existing.date.isoformat(),
+                        existing_amount=float(existing.amount),
+                        existing_source=existing.source.value,
+                    )
+                )
+                continue
 
         tx = Transaction(
             amount=parsed["amount"],
@@ -147,4 +181,6 @@ def paste_import(
     if imported > 0:
         session.commit()
 
-    return PasteImportResult(imported=imported, duplicates=duplicates, errors=errors)
+    return PasteImportResult(
+        imported=imported, duplicates=duplicates, errors=errors, skipped=skipped
+    )

backend/app/api/v1/endpoints/transactions.py

@@ -99,6 +99,46 @@ def list_transactions(
     return session.exec(query).all()
 
 
+class BulkActionRequest(BaseModel):
+    ids: list[int]
+    action: str  # 'delete' | 'set_category' | 'set_deferred'
+    category_id: Optional[int] = None  # for set_category (None clears)
+    deferred: Optional[bool] = None  # for set_deferred
+
+
+@router.post("/bulk")
+def bulk_action(
+    req: BulkActionRequest,
+    session: Session = Depends(get_session),
+    _user: str = Depends(get_current_user),
+):
+    """Apply one action to many transactions atomically (review 4.4)."""
+    if not req.ids or len(req.ids) > 500:
+        raise HTTPException(status_code=400, detail="ids must contain 1-500 entries")
+    if req.action not in ("delete", "set_category", "set_deferred"):
+        raise HTTPException(status_code=400, detail=f"Unknown action: {req.action}")
+    if req.action == "set_deferred" and req.deferred is None:
+        raise HTTPException(status_code=400, detail="deferred is required for set_deferred")
+    if req.action == "set_category" and req.category_id is not None:
+        if session.get(Category, req.category_id) is None:
+            raise HTTPException(status_code=404, detail="Category not found")
+
+    txs = session.exec(
+        select(Transaction).where(col(Transaction.id).in_(req.ids))
+    ).all()
+    for tx in txs:
+        if req.action == "delete":
+            session.delete(tx)
+        elif req.action == "set_category":
+            tx.category_id = req.category_id
+            session.add(tx)
+        elif req.action == "set_deferred":
+            tx.deferred_to_next_cycle = bool(req.deferred)
+            session.add(tx)
+    session.commit()
+    return {"affected": len(txs)}
+
+
 @router.get("/export")
 def export_transactions_csv(
     source: Optional[TransactionSource] = None,