celerp 1.2.4__tar.gz → 1.2.6__tar.gz

{celerp-1.2.4 → celerp-1.2.6}/CONTRIBUTING.md

@@ -39,8 +39,9 @@ Trademarks are not licensed by any code license; see `legal/TRADEMARK.md`.
 ## CLI commands (pip install)
 
 ```bash
-celerp init       # first-time setup (connects DB, runs migrations, writes config)
-celerp start      # launches API + UI
+celerp init             # first-time setup: DB + migrations + config, then launches the servers
+celerp init --no-start  # same setup, but exit WITHOUT launching (service-managed/headless)
+celerp start            # launch API + UI (e.g. from systemd, after `init --no-start`)
 celerp migrate    # apply pending migrations after an upgrade
 celerp status     # show config, DB connection, migration state
 celerp demo       # seed demo data
@@ -56,9 +57,43 @@ celerp upgrade    # pip install --upgrade celerp + migrate
 | `--ui-port` | `8080` | UI server port |
 | `--cloud-token` | _(empty)_ | Celerp Cloud token (optional) |
 | `--force` | off | Overwrite existing config |
+| `--yes` / `-y` | off | Skip the `--force` wipe confirmation (non-interactive) |
+| `--no-start` | off | Set up, then exit WITHOUT launching servers (service-managed/headless) |
 
 To change ports after init, edit `~/.config/celerp/config.toml` directly.
 
+### Run as a service (systemd)
+
+`celerp init` launches the servers and blocks (good for the one-command desktop
+flow). For a headless box where a process manager owns the lifecycle, set up with
+`--no-start` and let systemd run `celerp start`:
+
+```bash
+# First boot: provision DB + migrations + config, then exit (do not block).
+sudo celerp init --no-start \
+  --db-url "postgresql+asyncpg://celerp:<password>@localhost:5432/celerp" \
+  --api-port 8000 --ui-port 8080
+```
+
+```ini
+# /etc/systemd/system/celerp.service
+[Unit]
+Description=Celerp
+After=network.target postgresql.service
+
+[Service]
+ExecStart=/usr/local/bin/celerp start
+Restart=on-failure
+User=celerp
+
+[Install]
+WantedBy=multi-user.target
+```
+
+```bash
+sudo systemctl enable --now celerp
+```
+
 ## Troubleshooting
 
 | Error | Fix |

{celerp-1.2.4 → celerp-1.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: celerp
-Version: 1.2.4
+Version: 1.2.6
 Summary: Free, self-hosted ERP for small businesses
 License: Business Source License 1.1
         
@@ -214,13 +214,16 @@ Or install via pip:
 
 ```bash
 pip install celerp
-celerp init
-celerp start
+celerp init        # sets up the database and launches Celerp
 ```
 
 Open **http://localhost:8080**. Done.
 Your office can securely access the system at your IP address :8080.
 
+Running headless or under a process manager? Use `celerp init --no-start` to set up
+without launching, then have your service run `celerp start` — see
+[Run as a service (systemd)](CONTRIBUTING.md#run-as-a-service-systemd).
+
 ---
 
 ## What's inside

{celerp-1.2.4 → celerp-1.2.6}/README.md

@@ -43,13 +43,16 @@ Or install via pip:
 
 ```bash
 pip install celerp
-celerp init
-celerp start
+celerp init        # sets up the database and launches Celerp
 ```
 
 Open **http://localhost:8080**. Done.
 Your office can securely access the system at your IP address :8080.
 
+Running headless or under a process manager? Use `celerp init --no-start` to set up
+without launching, then have your service run `celerp start` — see
+[Run as a service (systemd)](CONTRIBUTING.md#run-as-a-service-systemd).
+
 ---
 
 ## What's inside

celerp-1.2.6/celerp/__main__.py

@@ -0,0 +1,14 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+"""Module entrypoint so `python -m celerp <command>` runs the CLI.
+
+The packaged Electron launcher invokes the bundled Python by module
+(`python -m celerp migrate`) rather than via the `celerp` console script,
+which is not on PATH inside the app bundle. This mirrors `python -m alembic`.
+"""
+from __future__ import annotations
+
+from celerp.cli import main
+
+if __name__ == "__main__":
+    main()

{celerp-1.2.4 → celerp-1.2.6}/celerp/ai/conversations.py

@@ -82,7 +82,7 @@ async def list_conversations(
             AIConversation.company_id == company_id,
             AIConversation.user_id == user_id,
         )
-        .order_by(AIConversation.updated_at.desc())
+        .order_by(AIConversation.updated_at.desc(), AIConversation.id.desc())  # id tiebreaker → stable pagination
         .limit(limit)
         .offset(offset)
     )

{celerp-1.2.4 → celerp-1.2.6}/celerp/cli.py

@@ -418,6 +418,42 @@ def _run_migrations(db_url: str) -> None:
         sys.exit(1)
 
 
+def _reconcile_after_migrate(db_url: str) -> None:
+    """Replay data-backfill migrations the auto-stamp walker skips on a develop
+    (create_all) database, so a develop→release in-place upgrade preserves data.
+
+    Gated by an instance_meta marker so it runs once per version; the backfills
+    are idempotent, so a redundant run would be a no-op anyway. The projection
+    rebuild (the other half of the version-change reconcile) runs in the API
+    lifespan, where module projection handlers are loaded.
+    """
+    import sqlalchemy as _sa
+
+    from celerp import __version__
+    from celerp.migrations._data_reconcile import (
+        BACKFILL_VERSION_KEY,
+        get_meta,
+        replay_data_backfills,
+        set_meta,
+    )
+
+    sync_url = (
+        db_url.replace("postgresql+asyncpg://", "postgresql://")
+        .replace("postgresql+psycopg2://", "postgresql://")
+    )
+    engine = _sa.create_engine(sync_url, pool_pre_ping=True)
+    try:
+        with engine.begin() as conn:
+            if get_meta(conn, BACKFILL_VERSION_KEY) == __version__:
+                return  # already reconciled for this version
+            replayed = replay_data_backfills(conn)
+            set_meta(conn, BACKFILL_VERSION_KEY, __version__)
+        if replayed:
+            click.echo(f"  · Reconciled {len(replayed)} data-backfill migration(s) for {__version__}")
+    finally:
+        engine.dispose()
+
+
 # ── Commands ──────────────────────────────────────────────────────────────────
 
 @click.group()
@@ -430,8 +466,15 @@ def main() -> None:
 @click.option("--api-port", default=None, type=int, help="API server port (default 8000).")
 @click.option("--ui-port", default=None, type=int, help="UI server port (default 8080).")
 @click.option("--cloud-token", default=None, help="Celerp Cloud token (optional).")
-@click.option("--force", is_flag=True, help="Overwrite existing config.")
-def init(db_url, api_port, ui_port, cloud_token, force):
+@click.option("--force", is_flag=True, help="Reconfigure: WIPES the database and all attached files.")
+@click.option("--yes", "-y", "assume_yes", is_flag=True, help="Skip the --force wipe confirmation (non-interactive use).")
+@click.option(
+    "--no-start", "no_start", is_flag=True,
+    help="Provision the database, run migrations, and write config, then exit "
+         "WITHOUT launching the servers. For service-managed/headless installs "
+         "where a process manager (e.g. systemd) runs `celerp start`.",
+)
+def init(db_url, api_port, ui_port, cloud_token, force, assume_yes, no_start):
     """Initialize Celerp: write config and run database migrations."""
     config_path = _config_path()
 
@@ -441,6 +484,21 @@ def init(db_url, api_port, ui_port, cloud_token, force):
         return
 
     if force:
+        # --force is destructive: it drops the database AND removes attached files.
+        # init can run under sudo, so warn (with full paths) and confirm before wiping.
+        from celerp.config import settings
+        _purge_dirs = [
+            settings.data_dir / "static" / "attachments",
+            settings.data_dir / "ai_uploads",
+        ]
+        click.echo("⚠  `init --force` permanently WIPES this instance:")
+        click.echo(f"     - database: {db_url or _DEFAULT_DB_URL}")
+        for _d in _purge_dirs:
+            click.echo(f"     - files:    {_d.resolve()}")
+        click.echo("   Make sure you have a backup.")
+        if not assume_yes and not click.confirm("Continue?", default=False):
+            click.echo("Aborted.")
+            return
         _stop_servers()
 
     enabled_modules: list[str] = []
@@ -469,6 +527,13 @@ def init(db_url, api_port, ui_port, cloud_token, force):
             )
             sys.exit(1)
         click.echo("  ✓ Database ready (fresh)")
+        # Wipe attached files too, so a forced re-init is a truly fresh instance and no
+        # orphaned files remain. Recreated automatically on next boot.
+        import shutil
+        for _d in _purge_dirs:
+            if _d.exists():
+                shutil.rmtree(_d, ignore_errors=True)
+                click.echo(f"  ✓ Removed {_d.resolve()}")
     else:
         # Test DB connection — auto-provision if running as root
         click.echo("Connecting to database...")
@@ -549,10 +614,13 @@ def init(db_url, api_port, ui_port, cloud_token, force):
     from celerp.gateway.state import build_handoff_url as _handoff
     if _settings.star_cta_enabled:
         click.echo(
-            "New and independent - founding supporters are how other teams find us.\n"
+            "New and independent - early stargazers are how other teams find us.\n"
             f"  Back us early: {_handoff('/github', medium='cli')}\n"
         )
 
+    if no_start:
+        click.echo("Setup complete. Start the servers with: celerp start")
+        return
     _start(cfg)
 
 
@@ -674,15 +742,20 @@ def start():
 
 
 @main.command()
-def migrate():
-    """Apply pending database migrations."""
-    cfg = _read_config()
-    if not cfg:
-        click.echo("Not initialized. Run `celerp init` first.", err=True)
-        sys.exit(1)
+@click.option("--db-url", default=None, help="Database URL (overrides config; used by the packaged launcher).")
+def migrate(db_url):
+    """Apply pending database migrations, then the develop→release reconcile."""
+    url = db_url
+    if url is None:
+        cfg = _read_config()
+        if not cfg:
+            click.echo("Not initialized. Run `celerp init` first.", err=True)
+            sys.exit(1)
+        url = cfg["database"]["url"]
     click.echo("Running migrations...")
-    _run_migrations(cfg["database"]["url"])
-    _post_migration_grants(cfg["database"]["url"])
+    _run_migrations(url)
+    _post_migration_grants(url)
+    _reconcile_after_migrate(url)
     click.echo("  ✓ Done")
 
 

{celerp-1.2.4 → celerp-1.2.6}/celerp/config.py

@@ -20,6 +20,9 @@ class Settings(BaseSettings):
     jwt_algorithm: str = "HS256"
     access_token_expire_minutes: int = 15
     refresh_token_expire_days: int = 30
+    # Log the UI out after this many minutes of no user interaction (client-side idle timer).
+    # Uniform across direct and relay access; set to 0 to disable.
+    idle_logout_minutes: int = 15
     # Set to "true" to allow the default JWT secret (CI only).
     allow_insecure_jwt: str = "false"
     # Logging level for both API and UI processes. Override with LOG_LEVEL env var.
@@ -31,7 +34,8 @@ class Settings(BaseSettings):
     celerp_public_url: str = ""
     # Cloud Relay (opt-in - leave blank to disable entirely).
     # Set GATEWAY_TOKEN to activate the persistent WS connection to relay.celerp.com.
-    # No value = no connection, no telemetry, no cloud dependency.
+    # No `[gateway_token]` means no gateway connection, no product telemetry, and
+    # no cloud dependency, except a startup subscription check.
     gateway_token: str = ""
     gateway_url: str = "wss://relay.celerp.com/ws/connect"
     # Unique instance identifier sent to gateway (auto-generated if blank).

{celerp-1.2.4 → celerp-1.2.6}/celerp/connectors/daily_scheduler.py

@@ -46,10 +46,13 @@ async def check_and_run_daily_syncs(
     synced: list[str] = []
 
     async with get_session_ctx() as session:
+        # Reconcile EVERY enabled connector once a day — including realtime
+        # (webhook) ones — so a daily incremental pass backstops any webhooks
+        # missed while the instance/tunnel was offline (idempotency keys make
+        # webhook + reconcile converge to a single write).
         rows = await session.execute(
             sa.select(ConnectorConfig).where(
                 ConnectorConfig.company_id == company_id,
-                ConnectorConfig.sync_frequency == SyncFrequency.DAILY.value,
             )
         )
         configs = [row[0] for row in rows]
@@ -118,3 +121,24 @@ async def scheduler_loop(company_id: str, token_fetcher: TokenFetcher | None = N
         except Exception as exc:
             log.error("daily_scheduler: error: %s", exc)
         await asyncio.sleep(_CHECK_INTERVAL_SECONDS)
+
+
+async def _distinct_company_ids() -> list[str]:
+    from celerp.db import get_session_ctx
+    async with get_session_ctx() as session:
+        rows = await session.execute(sa.select(ConnectorConfig.company_id).distinct())
+        return [r[0] for r in rows]
+
+
+async def scheduler_loop_all(token_fetcher: TokenFetcher | None = None) -> None:
+    """Reconciliation backstop: hourly, run any due daily syncs for every company
+    that has a connector configured. Started from the API lifespan."""
+    while True:
+        try:
+            for company_id in await _distinct_company_ids():
+                synced = await check_and_run_daily_syncs(company_id, token_fetcher=token_fetcher)
+                if synced:
+                    log.info("daily_scheduler: synced %s for %s", ", ".join(synced), company_id)
+        except Exception as exc:
+            log.error("daily_scheduler: loop error: %s", exc)
+        await asyncio.sleep(_CHECK_INTERVAL_SECONDS)

celerp-1.2.6/celerp/connectors/relay_token.py

@@ -0,0 +1,50 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+"""Fetch a short-lived connector access token from the relay.
+
+Autonomous syncs (the reconciliation scheduler and webhook-triggered syncs) run
+inside the core process, so unlike the manual sync route — where the UI passes
+the token in the request body — they must fetch the token themselves. The relay
+holds the encrypted token and returns a short-lived copy to the authenticated
+instance. Returns None when there is no relay session (e.g. a self-hosted
+instance not connected to Celerp Cloud), in which case the caller skips.
+"""
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING
+
+log = logging.getLogger(__name__)
+
+if TYPE_CHECKING:
+    from celerp.connectors.base import ConnectorContext
+
+
+async def fetch_context(company_id: str, connector_name: str) -> "ConnectorContext | None":
+    import httpx
+
+    from celerp.connectors.base import ConnectorContext
+    from celerp.gateway.state import get_session_token, relay_http_url, relay_session_headers
+
+    if not get_session_token():
+        return None  # no cloud session → no relay token available
+    try:
+        async with httpx.AsyncClient(timeout=15.0) as c:
+            r = await c.get(
+                f"{relay_http_url()}/tokens/{connector_name}/access-token",
+                headers=relay_session_headers(),
+            )
+        if r.status_code != 200:
+            log.debug("relay token fetch for %s returned %d", connector_name, r.status_code)
+            return None
+        data = r.json()
+    except Exception as exc:
+        log.warning("relay token fetch for %s failed: %s", connector_name, exc)
+        return None
+
+    return ConnectorContext(
+        company_id=company_id,
+        access_token=data["access_token"],
+        store_handle=data.get("store_handle"),
+        extra=data.get("extra"),
+    )

{celerp-1.2.4 → celerp-1.2.6}/celerp/connectors/shopify.py

@@ -40,6 +40,17 @@ _API_VERSION = "2024-01"
 _PAGE_LIMIT = 250  # Shopify max per page
 
 
+def _money(v) -> float | None:
+    """Parse a Shopify money value to float. Returns None only when genuinely
+    absent (missing/null/empty) — a real price of 0 stays 0.0, not None."""
+    if v is None or v == "":
+        return None
+    try:
+        return float(v)
+    except (TypeError, ValueError):
+        return None
+
+
 def _base_url(ctx: ConnectorContext) -> str:
     if not ctx.store_handle:
         raise ValueError("ConnectorContext.store_handle is required for Shopify")
@@ -126,7 +137,7 @@ class ShopifyConnector(ConnectorBase):
                     sku=sku,
                     name=name,
                     sell_by="piece",
-                    sale_price=float(variant.get("price") or 0) or None,
+                    sale_price=_money(variant.get("price")),
                     quantity=float(variant.get("inventory_quantity") or 0),
                     idempotency_key=idempotency_key,
                 )
@@ -162,14 +173,19 @@ class ShopifyConnector(ConnectorBase):
 
         images: list[dict] = product.get("images", [])
 
+        from sqlalchemy import func
+
         async with get_async_session() as session:
-            rows = (await session.execute(
+            # Resolve the item by SKU with a DB-side filter (case-insensitive),
+            # returning the single match — never load the whole catalog into
+            # memory per product (that was O(products × catalog_size)).
+            row = (await session.execute(
                 select(Projection).where(
                     Projection.company_id == ctx.company_id,
                     Projection.entity_type == "item",
-                )
-            )).scalars().all()
-            row = next((r for r in rows if str(r.state.get("sku", "")).strip().lower() == sku.strip().lower()), None)
+                    func.lower(Projection.state["sku"].astext) == sku.strip().lower(),
+                ).limit(1)
+            )).scalar_one_or_none()
             if row is None:
                 return
 

{celerp-1.2.4 → celerp-1.2.6}/celerp/events/engine.py

@@ -49,6 +49,12 @@ async def _check_period_lock(session, company_id, data: dict) -> None:
 
 
 async def emit_event(session, **kwargs) -> LedgerEntry:
+    # A backup represents a clean point in time: while one is building, pause writes
+    # (reads, which never emit, are unaffected) so nothing changes mid-backup.
+    from celerp.services.backup_state import is_active as _backup_active
+    if _backup_active():
+        raise HTTPException(status_code=503, detail="Backup in progress, try again shortly.")
+
     schema = EVENT_SCHEMA_MAP.get(kwargs["event_type"])
     if schema is None:
         raise ValueError(f"Unknown event_type: {kwargs['event_type']}")

{celerp-1.2.4 → celerp-1.2.6}/celerp/gateway/client.py

@@ -240,6 +240,9 @@ class GatewayClient:
         elif msg_type == "http.request":
             asyncio.create_task(self._handle_proxy_request(payload))
 
+        elif msg_type == "shopify.webhook":
+            asyncio.create_task(self._handle_shopify_webhook(payload))
+
         else:
             log.debug("Unhandled gateway message type: %s", msg_type)
 
@@ -267,6 +270,38 @@ class GatewayClient:
         except Exception as exc:
             log.warning("Gateway: failed to persist feature_flags: %s", exc)
 
+    async def _handle_shopify_webhook(self, payload: dict) -> None:
+        """A Shopify webhook the relay forwarded. Trigger a targeted incremental
+        sync for the affected entity on each company with Shopify configured
+        (idempotency keys dedupe against the reconciliation pass)."""
+        topic = payload.get("topic", "")
+        data = payload.get("data") or {}
+        try:
+            import sqlalchemy as sa
+
+            from celerp.connectors.base import SyncDirection
+            from celerp.connectors.relay_token import fetch_context
+            from celerp.connectors.webhooks import WebhookEvent, handle_webhook
+            from celerp.db import get_session_ctx
+            from celerp.models.connector_config import ConnectorConfig
+
+            async with get_session_ctx() as session:
+                rows = await session.execute(
+                    sa.select(ConnectorConfig.company_id, ConnectorConfig.direction).where(
+                        ConnectorConfig.connector == "shopify"
+                    )
+                )
+                configs = rows.all()
+
+            event = WebhookEvent(platform="shopify", topic=topic, payload=data)
+            for company_id, direction in configs:
+                ctx = await fetch_context(company_id, "shopify")
+                if ctx is None:
+                    continue
+                await handle_webhook(event, ctx, direction=SyncDirection(direction))
+        except Exception as exc:
+            log.warning("shopify webhook handling failed (topic=%s): %s", topic, exc)
+
     async def _handle_proxy_request(self, payload: dict) -> None:
         """Handle a proxied HTTP request from the relay.
 
@@ -298,7 +333,7 @@ class GatewayClient:
                 "payload": {
                     "id": request_id,
                     "status": 200,
-                    "headers": {"content-type": "text/event-stream", "cache-control": "no-cache"},
+                    "headers": [["content-type", "text/event-stream"], ["cache-control", "no-cache"]],
                     "body_b64": base64.b64encode(b"data: {}\n\n").decode(),
                 },
             })
@@ -326,12 +361,16 @@ class GatewayClient:
                     content=body,
                 )
             resp_body_b64 = base64.b64encode(resp.content).decode() if resp.content else ""
-            # Filter hop-by-hop headers from response
-            _skip = {"transfer-encoding", "connection", "keep-alive"}
-            resp_headers = {
-                k: v for k, v in resp.headers.items()
+            # Serialize as an ORDERED LIST of pairs (not a dict): a response can carry several
+            # Set-Cookie headers (login/refresh emit access_token + refresh_token), and a dict would
+            # collapse them into one comma-joined value the browser can't parse — so the refresh
+            # cookie never reaches the browser and the session dies at the access token's hard cap.
+            # multi_items() keeps each header separate. Drop content-length; the relay recomputes it.
+            _skip = {"transfer-encoding", "connection", "keep-alive", "content-length"}
+            resp_headers = [
+                [k, v] for k, v in resp.headers.multi_items()
                 if k.lower() not in _skip
-            }
+            ]
             await self._send(self._ws, {
                 "type": "http.response",
                 "payload": {
@@ -348,7 +387,7 @@ class GatewayClient:
                 "payload": {
                     "id": request_id,
                     "status": 502,
-                    "headers": {"content-type": "text/plain"},
+                    "headers": [["content-type", "text/plain"]],
                     "body_b64": base64.b64encode(
                         f"Local app error: {type(exc).__name__}: {exc}".encode()
                     ).decode(),

{celerp-1.2.4 → celerp-1.2.6}/celerp/main.py

@@ -89,8 +89,9 @@ async def _try_auto_activate() -> None:
         _prev_level = _httpx_log.level
         _httpx_log.setLevel(logging.WARNING)
         try:
+            from celerp import __version__ as _ver
             async with httpx.AsyncClient(timeout=10.0) as c:
-                r = await c.post(f"{relay_base}/auth/activate", json={"instance_id": iid})
+                r = await c.post(f"{relay_base}/auth/activate", json={"instance_id": iid, "version": _ver})
         finally:
             _httpx_log.setLevel(_prev_level)
         if r.status_code != 200:
@@ -199,6 +200,22 @@ async def lifespan(_app: FastAPI):
         "_module": "_kernel",
     })
 
+    # Develop→release guard: on a version change, rebuild projections with the
+    # release's handlers (now that all handlers are registered). Gated by a
+    # marker so it runs once per version. Non-fatal: a failure must not block
+    # boot — the marker stays unset and a later boot retries.
+    try:
+        from celerp.db import SessionLocal as _GuardSession
+        from celerp.services.dev_release_guard import run_upgrade_guard
+        async with _GuardSession() as _guard_sess:
+            await run_upgrade_guard(_guard_sess)
+            await _guard_sess.commit()
+    except Exception:
+        logging.getLogger(__name__).exception(
+            "Develop→release upgrade guard failed (non-fatal); projections may be "
+            "stale until rebuilt via doctor or /ledger/rebuild"
+        )
+
     # Start gateway client if configured (opt-in, no-op if GATEWAY_TOKEN is blank)
     gateway_task = None
     if settings.gateway_token:
@@ -230,6 +247,13 @@ async def lifespan(_app: FastAPI):
     from celerp.services.session_tracker import run_jti_cleanup_loop
     jti_cleanup_task = asyncio.create_task(run_jti_cleanup_loop())
 
+    # Connector reconciliation scheduler: a daily incremental sync per connector,
+    # backstopping any realtime webhooks missed while offline. No-op without a
+    # relay session (self-hosted instances skip token fetch).
+    from celerp.connectors.daily_scheduler import scheduler_loop_all
+    from celerp.connectors.relay_token import fetch_context as _connector_token_fetcher
+    connector_sched_task = asyncio.create_task(scheduler_loop_all(token_fetcher=_connector_token_fetcher))
+
     yield
 
     # Terminate all active SSE connections so Uvicorn doesn't hang on shutdown
@@ -239,6 +263,7 @@ async def lifespan(_app: FastAPI):
     # Stop background tasks
     cleanup_task.cancel()
     jti_cleanup_task.cancel()
+    connector_sched_task.cancel()
     try:
         await cleanup_task
     except asyncio.CancelledError:

{celerp-1.2.4 → celerp-1.2.6}/celerp/middleware.py

@@ -73,10 +73,13 @@ class MaxBodySizeMiddleware:
             await self.app(scope, receive, send)
             return
 
-        # Bulk file/cert import legitimately uploads a large ZIP (many small files);
-        # exempt it from the body cap. It's bounded instead by the WS tunnel frame
-        # size and the per-file 50 MB limit in store_upload().
-        if scope.get("path", "").endswith(("/items/files/bulk", "/items/attachments/bulk")):
+        # Bulk file/cert import and backup restore legitimately upload large archives;
+        # exempt them from the body cap. Bulk imports are bounded by the WS tunnel frame
+        # size and the per-file 50 MB limit in store_upload(); a .celerp-backup restore is
+        # a trusted whole-instance archive (DB + files) that is inherently large.
+        if scope.get("path", "").endswith(
+            ("/items/files/bulk", "/items/attachments/bulk", "/backup/import", "/backup/import-bootstrap")
+        ):
             await self.app(scope, receive, send)
             return