celerp 1.2.6__tar.gz → 1.2.7__tar.gz

{celerp-1.2.6 → celerp-1.2.7}/CONTRIBUTING.md

@@ -17,11 +17,10 @@ follows:
   the recommended starting point: fork one, rename it (see `legal/TRADEMARK.md`), and license your derivative
   however you wish.
 
-**How CLA acceptance works.** Contributions to official Celerp repositories require CLA acceptance before
-merge. Opening a pull request does not by itself complete the CLA. When prompted by the CLA bot on your
-pull request, post the exact acceptance phrase from your authenticated GitHub account; that one-time
-acceptance is recorded against the current `CLA.md` version. The bot blocks merge until acceptance is
-recorded.
+**How CLA acceptance works.** Contributions to official Celerp repositories require a one-time CLA
+acceptance per user. If you haven't accepted yet, you'll be linked to a page that shows the agreement and
+records your acceptance so that we know that you've read our rules and expectations. After that you can
+contribute freely.
 
 Trademarks are not licensed by any code license; see `legal/TRADEMARK.md`.
 

{celerp-1.2.6 → celerp-1.2.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: celerp
-Version: 1.2.6
+Version: 1.2.7
 Summary: Free, self-hosted ERP for small businesses
 License: Business Source License 1.1
         

{celerp-1.2.6 → celerp-1.2.7}/celerp/cli.py

@@ -206,20 +206,30 @@ def _post_migration_grants(db_url: str) -> None:
 
     Must run AFTER migrations since sequences/tables created by migrations
     won't be covered by ALTER DEFAULT PRIVILEGES set during provisioning.
+
+    Runs in-process over the existing connection rather than shelling out to
+    `sudo -u postgres psql` (which does not exist on Windows and crashed the
+    bundled launcher's migrate step). On the bundled single-user cluster the
+    connecting user is the superuser/owner, so the grants apply; best-effort so a
+    grant error never blocks startup.
     """
     parts = _parse_db_url(db_url)
     if not parts:
         return
     user = parts["user"]
-    dbname = parts["dbname"]
-    for grant_sql in [
-        f"GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO {user};",
-        f"GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO {user};",
-    ]:
-        subprocess.run(
-            ["sudo", "-u", "postgres", "psql", "-d", dbname, "-c", grant_sql],
-            capture_output=True, text=True,
-        )
+    sync_url = db_url.replace("postgresql+asyncpg://", "postgresql://")
+    try:
+        from sqlalchemy import create_engine, text
+        engine = create_engine(sync_url)
+        try:
+            with engine.begin() as conn:
+                conn.execute(text(f'GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "{user}";'))
+                conn.execute(text(f'GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO "{user}";'))
+        finally:
+            engine.dispose()
+    except Exception:
+        # Best-effort: on the bundled cluster the app user already owns its objects.
+        pass
 
 
 

{celerp-1.2.6 → celerp-1.2.7}/celerp/connectors/quickbooks.py

@@ -24,6 +24,7 @@ from typing import Any
 import httpx
 
 from celerp.connectors.http import RateLimitedClient
+from celerp.connectors.util import money
 from celerp.connectors.base import (
     ConnectorBase,
     ConnectorCategory,
@@ -37,7 +38,6 @@ import celerp.connectors.upsert as _upsert
 log = logging.getLogger(__name__)
 
 _API_BASE = "https://quickbooks.api.intuit.com/v3/company"
-_SANDBOX_BASE = "https://sandbox-quickbooks.api.intuit.com/v3/company"
 _PAGE_SIZE = 100
 
 
@@ -54,6 +54,10 @@ def _base_url(ctx: ConnectorContext) -> str:
     realm_id = ctx.store_handle or ""
     if not realm_id:
         raise ValueError("ConnectorContext.store_handle (realmId) is required for QuickBooks")
+    # realmId is an Intuit-issued numeric company id; reject anything else so it
+    # can never be used to redirect the request away from the Intuit API host.
+    if not realm_id.isdigit():
+        raise ValueError("QuickBooks realmId must be numeric")
     return f"{_API_BASE}/{realm_id}"
 
 
@@ -142,8 +146,6 @@ class QuickBooksConnector(ConnectorBase):
                 continue
 
             idempotency_key = f"quickbooks:item:{qb_item['Id']}"
-            sale_price = qb_item.get("UnitPrice")
-            cost_price = qb_item.get("PurchaseCost")
             sell_by = "service" if item_type == "Service" else "piece"
 
             try:
@@ -153,8 +155,8 @@ class QuickBooksConnector(ConnectorBase):
                     name=qb_item.get("Name") or sku,
                     description=qb_item.get("Description") or "",
                     sell_by=sell_by,
-                    sale_price=float(sale_price) if sale_price else None,
-                    cost_price=float(cost_price) if cost_price else None,
+                    sale_price=money(qb_item.get("UnitPrice")),
+                    cost_price=money(qb_item.get("PurchaseCost")),
                     idempotency_key=idempotency_key,
                 )
                 created = await _upsert.upsert_item(ctx.company_id, item)
@@ -246,8 +248,8 @@ class QuickBooksConnector(ConnectorBase):
         result = SyncResult(entity=SyncEntity.INVOICES, direction=SyncDirection.OUTBOUND)
         errors: list[str] = []
         realm_id = (ctx.extra or {}).get("realm_id") or ctx.store_handle
-        if not realm_id:
-            result.errors = ["realm_id is required for QuickBooks outbound invoice sync"]
+        if not realm_id or not str(realm_id).isdigit():
+            result.errors = ["A numeric realm_id is required for QuickBooks outbound invoice sync"]
             return result
 
         try:

{celerp-1.2.6 → celerp-1.2.7}/celerp/connectors/shopify.py

@@ -23,13 +23,13 @@ from typing import Any
 import httpx
 
 from celerp.connectors.http import RateLimitedClient
+from celerp.connectors.util import money
 from celerp.connectors.base import (
     ConnectorBase,
     ConnectorCategory,
     ConnectorContext,
     SyncDirection,
     SyncEntity,
-    SyncFrequency,
     SyncResult,
 )
 import celerp.connectors.upsert as _upsert
@@ -40,17 +40,6 @@ _API_VERSION = "2024-01"
 _PAGE_LIMIT = 250  # Shopify max per page
 
 
-def _money(v) -> float | None:
-    """Parse a Shopify money value to float. Returns None only when genuinely
-    absent (missing/null/empty) — a real price of 0 stays 0.0, not None."""
-    if v is None or v == "":
-        return None
-    try:
-        return float(v)
-    except (TypeError, ValueError):
-        return None
-
-
 def _base_url(ctx: ConnectorContext) -> str:
     if not ctx.store_handle:
         raise ValueError("ConnectorContext.store_handle is required for Shopify")
@@ -137,7 +126,7 @@ class ShopifyConnector(ConnectorBase):
                     sku=sku,
                     name=name,
                     sell_by="piece",
-                    sale_price=_money(variant.get("price")),
+                    sale_price=money(variant.get("price")),
                     quantity=float(variant.get("inventory_quantity") or 0),
                     idempotency_key=idempotency_key,
                 )
@@ -173,17 +162,18 @@ class ShopifyConnector(ConnectorBase):
 
         images: list[dict] = product.get("images", [])
 
+        import uuid as _uuid
+
         from sqlalchemy import func
 
         async with get_async_session() as session:
-            # Resolve the item by SKU with a DB-side filter (case-insensitive),
-            # returning the single match — never load the whole catalog into
-            # memory per product (that was O(products × catalog_size)).
+            # Resolve the item by SKU with a single DB-side, case-insensitive
+            # query that returns just the matching row.
             row = (await session.execute(
                 select(Projection).where(
-                    Projection.company_id == ctx.company_id,
+                    Projection.company_id == _uuid.UUID(str(ctx.company_id)),
                     Projection.entity_type == "item",
-                    func.lower(Projection.state["sku"].astext) == sku.strip().lower(),
+                    func.lower(Projection.state["sku"].as_string()) == sku.strip().lower(),
                 ).limit(1)
             )).scalar_one_or_none()
             if row is None:

{celerp-1.2.6 → celerp-1.2.7}/celerp/connectors/sync_runner.py

@@ -31,6 +31,32 @@ _SYNC_METHODS = {
 _OUTBOUND_ENTITIES = {"products_out", "invoices_out", "inventory_out"}
 
 
+async def _last_success_watermark(company_id: str, connector: str, entity: str):
+    """The start time of the most recent FULLY successful sync for this
+    (company, connector, entity), used as the incremental `since`. Returns None on
+    the first sync or if it can't be read, which means a full pull.
+
+    Only fully-successful runs advance the cursor: a partial run left some records
+    errored, so the next run must re-pull from the last good point to retry them
+    rather than skipping past them."""
+    import sqlalchemy as sa
+
+    from celerp.db import get_session_ctx
+
+    try:
+        async with get_session_ctx() as session:
+            return await session.scalar(
+                sa.select(sa.func.max(SyncRun.started_at)).where(
+                    SyncRun.company_id == company_id,
+                    SyncRun.connector == connector,
+                    SyncRun.entity == entity,
+                    SyncRun.status == "success",
+                )
+            )
+    except Exception:
+        return None
+
+
 async def run_sync(
     connector: ConnectorBase,
     ctx: ConnectorContext,
@@ -66,6 +92,11 @@ async def run_sync(
     if sync_method is None:
         raise ValueError(f"{connector.name} has no method {method_name}")
 
+    # Incremental by default: pull only what changed since the last successful run
+    # for this entity. Idempotency keys make any overlap dup-safe.
+    if since is None and entity not in _OUTBOUND_ENTITIES:
+        since = await _last_success_watermark(ctx.company_id, connector.name, entity)
+
     started_at = datetime.now(timezone.utc)
 
     try:

{celerp-1.2.6 → celerp-1.2.7}/celerp/connectors/upsert.py

@@ -1,6 +1,11 @@
 # Copyright (c) 2026 Noah Severs
 # SPDX-License-Identifier: BUSL-1.1
-"""Shared upsert helpers for all connectors. Single source of truth."""
+"""Shared upsert helpers for all connectors. Single source of truth.
+
+Each helper opens its own DB session (via the target service) so connectors
+never manage session lifecycle. Imports are deferred to keep connector import
+light and to respect default-module load order.
+"""
 from __future__ import annotations
 
 
@@ -10,23 +15,28 @@ async def upsert_item(company_id: str, item) -> bool:
 
 
 async def upsert_order_from_shopify(company_id: str, order: dict) -> bool:
-    from celerp.services import docs as docs_svc
+    from celerp_docs import doc_service as docs_svc
     return await docs_svc.upsert_order_from_shopify(company_id, order)
 
 
 async def upsert_invoice_from_quickbooks(company_id: str, invoice: dict) -> bool:
-    from celerp.services import docs as docs_svc
+    from celerp_docs import doc_service as docs_svc
     return await docs_svc.upsert_invoice_from_quickbooks(company_id, invoice)
 
 
 async def upsert_invoice_from_xero(company_id: str, invoice: dict) -> bool:
-    from celerp.services import docs as docs_svc
+    from celerp_docs import doc_service as docs_svc
     return await docs_svc.upsert_invoice_from_xero(company_id, invoice)
 
 
+async def upsert_order_from_woocommerce(company_id: str, order: dict) -> bool:
+    from celerp_docs import doc_service as docs_svc
+    return await docs_svc.upsert_order_from_woocommerce(company_id, order)
+
+
 async def upsert_contact_from_shopify(company_id: str, customer: dict) -> bool:
-    from celerp_sales_funnel import services as crm_svc
-    return await crm_svc.upsert_contact_from_shopify(company_id, customer)
+    from celerp_contacts import services as contacts_svc
+    return await contacts_svc.upsert_contact_from_shopify(company_id, customer)
 
 
 async def upsert_contact_from_quickbooks(company_id: str, customer: dict) -> bool:
@@ -39,6 +49,11 @@ async def upsert_contact_from_xero(company_id: str, contact: dict) -> bool:
     return await contacts_svc.upsert_contact_from_xero(company_id, contact)
 
 
+async def upsert_contact_from_woocommerce(company_id: str, customer: dict) -> bool:
+    from celerp_contacts import services as contacts_svc
+    return await contacts_svc.upsert_contact_from_woocommerce(company_id, customer)
+
+
 async def list_items_with_external_id(company_id: str, platform: str) -> list:
     from celerp_inventory import services as items_svc
     return await items_svc.list_items_with_external_id(company_id, platform=platform)
@@ -49,16 +64,6 @@ async def list_items_modified_since_last_sync(company_id: str, platform: str) ->
     return await items_svc.list_items_modified_since_last_sync(company_id, platform=platform)
 
 
-async def upsert_order_from_woocommerce(company_id: str, order: dict) -> bool:
-    from celerp.services import docs as docs_svc
-    return await docs_svc.upsert_order_from_woocommerce(company_id, order)
-
-
-async def upsert_contact_from_woocommerce(company_id: str, customer: dict) -> bool:
-    from celerp_contacts import services as contacts_svc
-    return await contacts_svc.upsert_contact_from_woocommerce(company_id, customer)
-
-
 async def list_unsynced_invoices(company_id: str, platform: str) -> list:
-    from celerp.services import docs as docs_svc
+    from celerp_docs import doc_service as docs_svc
     return await docs_svc.list_unsynced_invoices(company_id, platform=platform)

celerp-1.2.7/celerp/connectors/util.py

@@ -0,0 +1,19 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+"""Shared helpers for platform connectors."""
+from __future__ import annotations
+
+
+def money(v) -> float | None:
+    """Parse a platform money value to float.
+
+    Returns None only when the value is genuinely absent (missing/null/empty) or
+    unparseable. A real price of 0 stays 0.0 - never collapsed to None (a free or
+    zero-priced item is a valid price, not a missing one).
+    """
+    if v is None or v == "":
+        return None
+    try:
+        return float(v)
+    except (TypeError, ValueError):
+        return None

{celerp-1.2.6 → celerp-1.2.7}/celerp/connectors/webhooks.py

@@ -74,3 +74,49 @@ async def handle_webhook(
     # Pass since=None so the sync methods use the last SyncRun timestamp.
     await run_sync(connector, ctx, entity, direction=direction)
     log.info("webhook: processed %s/%s for %s", event.platform, event.topic, ctx.company_id)
+
+
+async def dispatch_woocommerce_webhook(raw_body: bytes, signature: str, topic: str) -> bool:
+    """Verify and process a WooCommerce webhook the relay forwarded to this instance.
+
+    WooCommerce signs the raw body with the per-config secret (base64 HMAC-SHA256,
+    sent as X-WC-Webhook-Signature). We try each configured WooCommerce company's
+    secret; the first that verifies owns the event. Returns True if handled, False
+    if no configured secret validated the signature (a forged delivery is ignored).
+    """
+    import json
+
+    import sqlalchemy as sa
+
+    from celerp.connectors.relay_token import fetch_context
+    from celerp.db import get_session_ctx
+    from celerp.models.connector_config import ConnectorConfig
+
+    if not signature:
+        return False
+
+    connector = connector_registry.get("woocommerce")
+
+    async with get_session_ctx() as session:
+        rows = await session.execute(
+            sa.select(
+                ConnectorConfig.company_id, ConnectorConfig.direction, ConnectorConfig.webhook_secret
+            ).where(ConnectorConfig.connector == "woocommerce")
+        )
+        configs = rows.all()
+
+    for company_id, direction, secret in configs:
+        if not secret or not connector.validate_webhook(raw_body, signature, secret):
+            continue
+        ctx = await fetch_context(company_id, "woocommerce")
+        if ctx is None:
+            continue
+        try:
+            data = json.loads(raw_body or b"{}")
+        except (ValueError, TypeError):
+            data = {}
+        event = WebhookEvent(platform="woocommerce", topic=topic, payload=data)
+        await handle_webhook(event, ctx, direction=SyncDirection(direction))
+        return True
+
+    return False

{celerp-1.2.6 → celerp-1.2.7}/celerp/connectors/woocommerce.py

@@ -20,13 +20,13 @@ import httpx
 import json
 
 from celerp.connectors.http import RateLimitedClient
+from celerp.connectors.util import money
 from celerp.connectors.base import (
     ConnectorBase,
     ConnectorCategory,
     ConnectorContext,
     SyncDirection,
     SyncEntity,
-    SyncFrequency,
     SyncResult,
 )
 import celerp.connectors.upsert as _upsert
@@ -61,6 +61,7 @@ class WooCommerceConnector(ConnectorBase):
         "products": "external_wins",
         "orders": "external_wins",
         "contacts": "external_wins",
+        "inventory": "internal_wins",   # stock is pushed out; CelERP is the source
     }
 
     # -- Internal helpers ------------------------------------------------------
@@ -88,8 +89,15 @@ class WooCommerceConnector(ConnectorBase):
                 resp.raise_for_status()
                 data = resp.json()
                 results.extend(data)
-                total_pages = int(resp.headers.get("X-WP-TotalPages", 1))
-                if page >= total_pages:
+                if not data:
+                    break
+                total_pages_hdr = resp.headers.get("X-WP-TotalPages")
+                if total_pages_hdr is not None:
+                    if page >= int(total_pages_hdr):
+                        break
+                elif len(data) < _PER_PAGE:
+                    # No total-pages header (proxy stripped it / error envelope):
+                    # keep paging until a short page rather than truncating at 1.
                     break
                 page += 1
 
@@ -127,11 +135,11 @@ class WooCommerceConnector(ConnectorBase):
             pid = product.get("id")
             sku = (product.get("sku") or "").strip() or f"WC-{pid}"
             name = product.get("name") or sku
-            sell_price_raw = product.get("regular_price") or product.get("price") or "0"
-            try:
-                sell_price = float(sell_price_raw) or None
-            except (ValueError, TypeError):
-                sell_price = None
+            # regular_price is the base price; fall back to the active price only
+            # when regular_price is genuinely absent. A real 0 (free item) is kept.
+            sell_price = money(product.get("regular_price"))
+            if sell_price is None:
+                sell_price = money(product.get("price"))
 
             idempotency_key = f"woocommerce:{pid}"
 
@@ -167,22 +175,25 @@ class WooCommerceConnector(ConnectorBase):
 
     async def _pull_product_files(self, ctx: ConnectorContext, product: dict[str, Any], sku: str) -> None:
         """Pull images and cert metafields from a WC product and store as item files."""
+        import uuid as _uuid
         from celerp.db import get_session_ctx as get_async_session
         from celerp.models.projections import Projection
         from celerp.connectors.images import download_and_emit_file, _CERT_TAGS
-        from sqlalchemy import select
+        from sqlalchemy import func, select
 
         images: list[dict] = product.get("images", [])
         meta_data: list[dict] = product.get("meta_data", [])
 
         async with get_async_session() as session:
-            rows = (await session.execute(
+            # Resolve the item by SKU with a single DB-side, case-insensitive
+            # query, limited to the one matching row.
+            row = (await session.execute(
                 select(Projection).where(
-                    Projection.company_id == ctx.company_id,
+                    Projection.company_id == _uuid.UUID(str(ctx.company_id)),
                     Projection.entity_type == "item",
-                )
-            )).scalars().all()
-            row = next((r for r in rows if str(r.state.get("sku", "")).strip().lower() == sku.strip().lower()), None)
+                    func.lower(Projection.state["sku"].as_string()) == sku.strip().lower(),
+                ).limit(1)
+            )).scalar_one_or_none()
             if row is None:
                 return
 
@@ -399,28 +410,32 @@ class WooCommerceConnector(ConnectorBase):
             return []
         return self._INBOUND_TOPICS
 
-    async def register_webhooks(self, ctx: ConnectorContext, webhook_url: str) -> list[str]:
-        """Register WooCommerce webhooks via REST API."""
+    async def register_webhooks(
+        self, ctx: ConnectorContext, webhook_url: str, secret: str | None = None
+    ) -> list[str]:
+        """Register WooCommerce webhooks via REST API.
+
+        When `secret` is supplied it is set on every webhook so deliveries are
+        signed with a value we already hold (X-WC-Webhook-Signature = base64
+        HMAC-SHA256 of the body), letting the receiver verify them. Returns the
+        created webhook ids."""
         base_url = _base_url(ctx)
         auth = _auth(ctx)
         ids: list[str] = []
         topics = self.webhook_topics_for_direction(self.direction)
         async with RateLimitedClient() as client:
             for topic in topics:
-                resp = await client.post(
-                    f"{base_url}/webhooks",
-                    auth=auth,
-                    json={
-                        "name": f"CelERP {topic}",
-                        "topic": topic,
-                        "delivery_url": webhook_url,
-                        "status": "active",
-                    },
-                )
+                body = {
+                    "name": f"CelERP {topic}",
+                    "topic": topic,
+                    "delivery_url": webhook_url,
+                    "status": "active",
+                }
+                if secret:
+                    body["secret"] = secret
+                resp = await client.post(f"{base_url}/webhooks", auth=auth, json=body)
                 if resp.status_code in (200, 201):
-                    wh = resp.json()
-                    ids.append(str(wh.get("id", "")))
-                    # WC generates its own secret, stored in the response
+                    ids.append(str(resp.json().get("id", "")))
                 else:
                     log.warning("woocommerce.register_webhook topic=%s status=%d", topic, resp.status_code)
         return ids

{celerp-1.2.6 → celerp-1.2.7}/celerp/connectors/xero.py

@@ -23,6 +23,7 @@ from typing import Any
 import httpx
 
 from celerp.connectors.http import RateLimitedClient
+from celerp.connectors.util import money
 from celerp.connectors.base import (
     ConnectorBase,
     ConnectorCategory,
@@ -64,8 +65,17 @@ class XeroConnector(ConnectorBase):
 
     # -- Internal helpers ------------------------------------------------------
 
-    async def _paginate(self, ctx: ConnectorContext, path: str, key: str, since: datetime | None = None) -> list[dict[str, Any]]:
-        """Fetch all pages for a resource using Xero's page-based pagination."""
+    async def _paginate(
+        self,
+        ctx: ConnectorContext,
+        path: str,
+        key: str,
+        since: datetime | None = None,
+        paginated: bool = True,
+    ) -> list[dict[str, Any]]:
+        """Fetch a resource. Paginating endpoints (Invoices, Contacts) use Xero's
+        page-based paging; endpoints that return the full set in one response
+        (Items) pass paginated=False and are fetched in a single request."""
         results: list[dict[str, Any]] = []
         page = 1
         headers = _headers(ctx)
@@ -73,16 +83,13 @@ class XeroConnector(ConnectorBase):
             headers["If-Modified-Since"] = since.strftime("%a, %d %b %Y %H:%M:%S GMT")
         async with RateLimitedClient() as client:
             while True:
-                resp = await client.get(
-                    f"{_API_BASE}{path}",
-                    headers=headers,
-                    params={"page": page, "pageSize": _PAGE_SIZE},
-                )
+                params = {"page": page, "pageSize": _PAGE_SIZE} if paginated else None
+                resp = await client.get(f"{_API_BASE}{path}", headers=headers, params=params)
                 resp.raise_for_status()
                 data = resp.json()
                 items = data.get(key, [])
                 results.extend(items)
-                if len(items) < _PAGE_SIZE:
+                if not paginated or len(items) < _PAGE_SIZE:
                     break
                 page += 1
         return results
@@ -105,7 +112,7 @@ class XeroConnector(ConnectorBase):
         errors: list[str] = []
 
         try:
-            items = await self._paginate(ctx, "/Items", "Items", since=since)
+            items = await self._paginate(ctx, "/Items", "Items", since=since, paginated=False)
         except httpx.HTTPStatusError as exc:
             result.errors = [f"Xero API error: {exc}"]
             return result
@@ -117,8 +124,6 @@ class XeroConnector(ConnectorBase):
                 continue
 
             idempotency_key = f"xero:item:{xero_item['ItemID']}"
-            sale_price = (xero_item.get("SalesDetails") or {}).get("UnitPrice")
-            cost_price = (xero_item.get("PurchaseDetails") or {}).get("UnitPrice")
 
             try:
                 from celerp_inventory.routes import ItemCreate
@@ -127,8 +132,8 @@ class XeroConnector(ConnectorBase):
                     name=xero_item.get("Name") or sku,
                     description=xero_item.get("Description") or "",
                     sell_by="piece",
-                    sale_price=float(sale_price) if sale_price else None,
-                    cost_price=float(cost_price) if cost_price else None,
+                    sale_price=money((xero_item.get("SalesDetails") or {}).get("UnitPrice")),
+                    cost_price=money((xero_item.get("PurchaseDetails") or {}).get("UnitPrice")),
                     idempotency_key=idempotency_key,
                 )
                 created = await _upsert.upsert_item(ctx.company_id, item)

{celerp-1.2.6 → celerp-1.2.7}/celerp/gateway/client.py

@@ -243,6 +243,9 @@ class GatewayClient:
         elif msg_type == "shopify.webhook":
             asyncio.create_task(self._handle_shopify_webhook(payload))
 
+        elif msg_type == "woocommerce.webhook":
+            asyncio.create_task(self._handle_woocommerce_webhook(payload))
+
         else:
             log.debug("Unhandled gateway message type: %s", msg_type)
 
@@ -302,6 +305,22 @@ class GatewayClient:
         except Exception as exc:
             log.warning("shopify webhook handling failed (topic=%s): %s", topic, exc)
 
+    async def _handle_woocommerce_webhook(self, payload: dict) -> None:
+        """A WooCommerce webhook the relay forwarded. The per-install signing
+        secret lives here, so the signature is verified locally before a targeted
+        sync runs (a forged delivery verifies against no secret and is ignored)."""
+        topic = payload.get("topic", "")
+        try:
+            import base64
+
+            from celerp.connectors.webhooks import dispatch_woocommerce_webhook
+
+            raw = base64.b64decode(payload.get("body_b64") or "")
+            signature = payload.get("signature", "")
+            await dispatch_woocommerce_webhook(raw, signature, topic)
+        except Exception as exc:
+            log.warning("woocommerce webhook handling failed (topic=%s): %s", topic, exc)
+
     async def _handle_proxy_request(self, payload: dict) -> None:
         """Handle a proxied HTTP request from the relay.