Finishing touches

app/controllers/account/imports_controller.rb

@@ -4,6 +4,7 @@ class Account::ImportsController < ApplicationController
   disallow_account_scope only: %i[ new create ]
   allow_unauthorized_access only: :show
   before_action :set_import, only: %i[ show ]
+  before_action :ensure_accessed_by_owner, only: %i[ show ]
 
   def new
   end
@@ -26,6 +27,10 @@ class Account::ImportsController < ApplicationController
       @import = Current.account.imports.find(params[:id])
     end
 
+    def ensure_accessed_by_owner
+      head :forbidden unless @import.identity == Current.identity
+    end
+
     def start_import(account)
       import = nil
 

app/views/account/imports/new.html.erb

@@ -3,8 +3,6 @@
 <div class="panel panel--centered flex flex-column gap">
   <header>
     <h1 class="txt-x-large font-weight-black txt-tight-lines margin-block-end-half">Import a Fizzy account</h1>
-    <div hidden>Upload the .zip file from your Fizzy export</div>
-    <div hidden>Upload the .zip file from a Fizzy export to create a new account.</div>
     <div>Create an account using data from a Fizzy export. Upload the exported .zip file below.</div>
   </header>
 

app/views/mailers/import_mailer/failed.text.erb

@@ -1,4 +1,4 @@
-Unfortunately, we were couldn't import your Fizzy account.
+Unfortunately, we couldn't import your Fizzy account.
 
 This may be due to corrupted export data or a conflict with existing data.
 Please try again with a fresh export, or reach out for help if the problem persists.

config/brakeman.ignore

@@ -67,7 +67,7 @@
       "cwe_id": [
         295
       ],
-      "note": ""
+      "note": "Required for internal PureStorage self-signed certificates. Only used for trusted internal storage URLs."
     },
     {
       "warning_type": "Mass Assignment",

config/routes.rb

@@ -171,7 +171,6 @@ Rails.application.routes.draw do
 
   resource :landing
 
-
   namespace :my do
     resource :identity, only: :show
     resources :access_tokens