From a66fe13bc65702affa16459f7d03a6deee5ff903 Mon Sep 17 00:00:00 2001
From: null <koga.industries@gmail.com>
Date: Sat, 6 Jun 2026 14:54:00 -0500
Subject: [PATCH] fix(simplefin): add 30s AbortSignal timeout to fetch calls

---
 services/simplefinService.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/services/simplefinService.js b/services/simplefinService.js
index 728ed92..5cdd564 100644
--- a/services/simplefinService.js
+++ b/services/simplefinService.js
@@ -64,7 +64,7 @@ async function claimSetupToken(setupToken) {
 
   let accessUrl;
   try {
-    const res = await fetch(claimUrl, { method: 'POST' });
+    const res = await fetch(claimUrl, { method: 'POST', signal: AbortSignal.timeout(30000) });
     if (res.status === 403) {
       throw new Error('This setup token has already been claimed or is invalid');
     }
@@ -99,6 +99,7 @@ async function fetchAccountsAndTransactions(accessUrl, sinceEpoch) {
   try {
     const res = await fetch(endpoint, {
       headers: { 'Authorization': `Basic ${basicAuth}` },
+      signal: AbortSignal.timeout(30000),
     });
     if (res.status === 403) {
       throw Object.assign(new Error('SimpleFIN access has been revoked — please reconnect'), { code: 'SIMPLEFIN_REVOKED' });