celerp 2.3.1__tar.gz → 2.3.3__tar.gz

{celerp-2.3.1 → celerp-2.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: celerp
-Version: 2.3.1
+Version: 2.3.3
 Summary: Free, self-hosted ERP for small businesses
 License: Business Source License 1.1
         

celerp-2.3.3/celerp/db.py

@@ -0,0 +1,136 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+
+import os
+import re
+from contextlib import asynccontextmanager
+
+from sqlalchemy import text as _sql_text
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from celerp.config import settings
+
+# Shared advisory-lock key that serialises schema migrations across every process
+# that might run them (the CLI upgrade command and the API startup phase). One
+# key, one source of truth, so two boots can never migrate the same database at
+# once.
+_MIGRATION_LOCK_KEY = 4207320001
+
+# Redacts the password in any Postgres URL: "://user:secret@host" -> "://user:***@host".
+# One authoritative masker for logs and surfaced errors so a connection string
+# never leaks a password.
+_DB_CREDENTIALS_RE = re.compile(r"(://[^:]+:)[^@]+(@)")
+
+
+def mask_db_credentials(text: str) -> str:
+    """Return text with any database URL password replaced by ``***``."""
+    return _DB_CREDENTIALS_RE.sub(r"\1***\2", text)
+
+# Request-connection timeouts (ms). One source of truth: the engine sets them in
+# server_settings, and lifecycle_timeouts_disabled restores exactly these values
+# after clearing them for startup work.
+_REQUEST_LOCK_TIMEOUT_MS = "3000"
+_REQUEST_STATEMENT_TIMEOUT_MS = "30000"
+
+# Pool budget: total_possible = (api_workers * (pool_size + max_overflow))
+#                              + (gui_workers * (gui_pool_size + gui_max_overflow))
+# Default workers 2 API + 1 GUI → 2*(10+5) + 1*(5+5) = 40 connections max.
+# Postgres default max_connections=100 leaves 60 for migrations, admin tools, etc.
+# If you increase worker counts, recalculate this budget before deploying.
+if os.environ.get("CELERP_TEST_NULLPOOL"):
+    # Test mode: a fresh connection per use that closes on return, so a failed
+    # test can't leave a poisoned/locked connection lingering in a pooled
+    # connection and block the next test's TRUNCATE. Only ever set by the test
+    # harness; no effect in production.
+    engine = create_async_engine(settings.database_url, future=True, poolclass=NullPool)
+else:
+    engine = create_async_engine(
+        settings.database_url,
+        future=True,
+        pool_pre_ping=True,
+        pool_size=10,
+        max_overflow=5,
+        # Bound how long any query may wait on a lock or run, so a stuck query is
+        # cancelled instead of pinning one of the few pooled connections for the
+        # full request lifetime (lock_timeout 3s, statement_timeout 30s, in ms).
+        # This is a per-connection default, so it applies to every request AND
+        # every pooled background job (connector syncs, the gateway, the daily
+        # scheduler) - all of which must stay bounded. Startup reconciliation and
+        # the projection rebuild are the only work that legitimately runs longer;
+        # they use lifecycle_engine below instead of this pool, and the migration
+        # advisory-lock wait self-exempts via lifecycle_timeouts_disabled.
+        connect_args={
+            "server_settings": {
+                "lock_timeout": _REQUEST_LOCK_TIMEOUT_MS,
+                "statement_timeout": _REQUEST_STATEMENT_TIMEOUT_MS,
+            }
+        },
+    )
+SessionLocal = async_sessionmaker(engine, class_=AsyncSession, expire_on_commit=False)
+
+# Lifecycle/maintenance engine: a separate NullPool engine carrying NO statement
+# or lock timeout. Startup reconciliation (create_all, module on_modules_ready
+# seed hooks, the develop->release projection rebuild, the one-time status-doc and
+# COGS backfills) and the on-demand projection rebuild routes run whole-table
+# DELETEs and full-ledger replays that can legitimately exceed the request
+# statement_timeout on a mature database. Running them on the bounded request pool
+# would cancel them at 30s - permanently blocking boot's upgrade guard and the
+# /ledger/rebuild recovery route. They run on this engine instead. NullPool: these
+# operations are rare and brief, so no pooled slot is reserved and the request pool
+# budget above is unaffected (at most one transient connection per concurrent
+# lifecycle op).
+lifecycle_engine = create_async_engine(settings.database_url, future=True, poolclass=NullPool)
+LifecycleSessionLocal = async_sessionmaker(
+    lifecycle_engine, class_=AsyncSession, expire_on_commit=False
+)
+
+
+@asynccontextmanager
+async def lifecycle_timeouts_disabled(conn):
+    """Clear the request statement/lock timeouts on the migration lock connection.
+
+    The migration advisory-lock wait runs on a connection drawn from the bounded
+    request engine (so a single engine serialises boots), but a second worker's
+    wait can legitimately exceed the 30s statement_timeout while the first worker
+    migrates, and a cancelled wait aborts the boot. This sets both timeouts to 0
+    (unbounded) for the block and restores the request defaults on exit, so the
+    connection returned to the pool still carries them. Other long-running startup
+    work uses lifecycle_engine (no timeout) rather than this in-place exemption.
+    Postgres only; a no-op on other dialects, which have no such settings.
+    """
+    if conn.dialect.name != "postgresql":
+        yield
+        return
+    await conn.execute(_sql_text("SET statement_timeout = 0"))
+    await conn.execute(_sql_text("SET lock_timeout = 0"))
+    try:
+        yield
+    finally:
+        await conn.execute(_sql_text(f"SET statement_timeout = {_REQUEST_STATEMENT_TIMEOUT_MS}"))
+        await conn.execute(_sql_text(f"SET lock_timeout = {_REQUEST_LOCK_TIMEOUT_MS}"))
+
+
+async def get_session() -> AsyncSession:
+    async with SessionLocal() as session:
+        yield session
+
+
+@asynccontextmanager
+async def get_session_ctx():
+    """Standalone async context manager for use outside FastAPI request handlers."""
+    async with SessionLocal() as session:
+        yield session
+
+
+@asynccontextmanager
+async def get_lifecycle_session_ctx():
+    """Session on the unbounded lifecycle_engine, for known long-running work.
+
+    Use for the projection rebuild and startup backfills: a full rebuild's
+    whole-table DELETE and full-ledger replay can exceed the request
+    statement_timeout on a mature database, and must not be cancelled. Ordinary
+    request and background work uses get_session/get_session_ctx (bounded).
+    """
+    async with LifecycleSessionLocal() as session:
+        yield session

{celerp-2.3.1 → celerp-2.3.3}/celerp/events/schemas.py

@@ -5,7 +5,18 @@ from __future__ import annotations
 
 from typing import Any
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, model_validator
+
+# The SKU/barcode write-time predicates live in celerp.inventory_codes so the event
+# boundary, the interactive routes, the allocation service, and the scanner share one
+# source of truth. reject_comma_sku/SKU_COMMA_MESSAGE are re-exported here because
+# celerp_inventory.routes imports them from this module.
+from celerp.inventory_codes import (  # noqa: F401 - re-exported for celerp_inventory
+    SKU_COMMA_MESSAGE,
+    reject_comma_sku,
+    validate_barcode,
+    validate_sku,
+)
 
 
 # -----------------
@@ -13,7 +24,27 @@ from pydantic import BaseModel, Field
 # -----------------
 
 
-class ItemCreated(BaseModel):
+class _SkuGuard(BaseModel):
+    """Mixin: enforce the SKU and barcode invariants on any item event that sets them.
+
+    SKU: no comma (Celerp's OR operator in the SKU/search syntax) and a bounded length.
+    Barcode: digits only and a bounded length. These are the canonical write-time
+    predicates; interactive routes wrap them to surface a friendly 422, every other
+    emitter hits them here at the event boundary (imports, connector upserts, document
+    receiving). Replay never runs these schemas (the reducer does), so enforcing here
+    can never brick a historical projection.
+    """
+
+    @model_validator(mode="before")
+    @classmethod
+    def _guard_item_codes(cls, data: Any) -> Any:
+        if isinstance(data, dict):
+            validate_sku(data.get("sku"))
+            validate_barcode(data.get("barcode"))
+        return data
+
+
+class ItemCreated(_SkuGuard):
     sku: str
     name: str
     quantity: float = 0
@@ -28,7 +59,7 @@ class ItemCreated(BaseModel):
     model_config = {"extra": "allow"}
 
 
-class ItemSnapshot(BaseModel):
+class ItemSnapshot(_SkuGuard):
     """Snapshot of full item state - used for imports. sku/name optional (absent in some sources)."""
 
     sku: str | None = None
@@ -53,6 +84,14 @@ class ItemSnapshot(BaseModel):
 class ItemUpdated(BaseModel):
     fields_changed: dict[str, dict[str, Any]]
 
+    @model_validator(mode="after")
+    def _guard_item_codes(self) -> "ItemUpdated":
+        if "sku" in self.fields_changed:
+            validate_sku((self.fields_changed.get("sku") or {}).get("new"))
+        if "barcode" in self.fields_changed:
+            validate_barcode((self.fields_changed.get("barcode") or {}).get("new"))
+        return self
+
 
 class ItemPricingSet(BaseModel):
     price_type: str
@@ -188,7 +227,7 @@ class ItemMerged(BaseModel):
     source_entity_ids: list[str]
 
 
-class ItemPatched(BaseModel):
+class ItemPatched(_SkuGuard):
     """CSV upsert patch: accepts any item data fields."""
     model_config = {"extra": "allow"}
 
@@ -507,6 +546,15 @@ class DocUnvoided(BaseModel):
     restored_status: str
 
 
+class DocClosed(BaseModel):
+    reason: str | None = None
+    pre_close_status: str | None = None
+
+
+class DocReopened(BaseModel):
+    restored_status: str
+
+
 class DocSent(BaseModel):
     sent_via: str | None = None
     sent_to: str | None = None
@@ -1123,6 +1171,8 @@ EVENT_SCHEMA_MAP: dict[str, type[BaseModel]] = {
     "doc.voided": DocVoided,
     "doc.reverted_to_draft": DocRevertedToDraft,
     "doc.unvoided": DocUnvoided,
+    "doc.closed": DocClosed,
+    "doc.reopened": DocReopened,
     "doc.converted_to_bill": DocConvertedToBill,
     "doc.sent": DocSent,
     "doc.payment.received": DocPaymentReceived,

celerp-2.3.3/celerp/inventory_codes.py

@@ -0,0 +1,87 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+
+"""Canonical inventory code limits and validation - one source of truth.
+
+The SKU/barcode invariants live here so the event boundary (celerp.events.schemas),
+the interactive inventory routes, the allocation service, and the scanner all share
+the exact same rules. A comma is Celerp's OR operator in the SKU/search syntax, so a
+SKU may never contain one (it would split into separate codes wherever SKUs are
+matched). A barcode is a numeric physical-lot identifier and must be unique per
+company - enforced at the event boundary (format) and by a partial unique index on
+the projections table (uniqueness).
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+MAX_BARCODE_LEN = 64
+MAX_SKU_LEN = 255
+MAX_SCAN_CODE_LEN = max(MAX_BARCODE_LEN, MAX_SKU_LEN)
+
+# Partial unique index enforcing at-most-one item per (company, barcode). Declared on
+# the Projection model so create_all builds it for the test schema, and created on
+# existing databases by the barcode-uniqueness migration. Named here so the applier
+# can tell a barcode violation apart from the (company_id, entity_id) primary-key race.
+BARCODE_UNIQUE_INDEX = "uq_projection_company_item_barcode"
+
+SKU_COMMA_MESSAGE = "SKU cannot contain a comma"
+SKU_TOO_LONG_MESSAGE = f"SKU cannot exceed {MAX_SKU_LEN} characters"
+BARCODE_NOT_DIGITS_MESSAGE = "Barcode must contain only digits"
+BARCODE_TOO_LONG_MESSAGE = f"Barcode cannot exceed {MAX_BARCODE_LEN} characters"
+BARCODE_CONFLICT_MESSAGE = "Barcode '{barcode}' already exists"
+
+
+def reject_comma_sku(sku: Any) -> Any:
+    """Reject a comma-bearing SKU. Returns the sku for chaining."""
+    if sku is not None and "," in str(sku):
+        raise ValueError(SKU_COMMA_MESSAGE)
+    return sku
+
+
+def validate_sku(sku: Any) -> Any:
+    """Reject a comma-bearing or over-long SKU. Returns the sku for chaining."""
+    reject_comma_sku(sku)
+    if sku is not None and len(str(sku)) > MAX_SKU_LEN:
+        raise ValueError(SKU_TOO_LONG_MESSAGE)
+    return sku
+
+
+def validate_barcode(barcode: Any) -> Any:
+    """Reject a non-digit or over-long barcode. An absent/empty barcode is allowed."""
+    if barcode is None:
+        return barcode
+    s = str(barcode)
+    if s == "":
+        return barcode
+    if not s.isdigit():
+        raise ValueError(BARCODE_NOT_DIGITS_MESSAGE)
+    if len(s) > MAX_BARCODE_LEN:
+        raise ValueError(BARCODE_TOO_LONG_MESSAGE)
+    return barcode
+
+
+class BarcodeConflictError(Exception):
+    """A write violated the (company, item, barcode) uniqueness invariant.
+
+    Raised by the projection applier when the DB unique index rejects an insert - the
+    final defense for any writer that bypasses the application lock (imports,
+    connectors, a future writer). The API layer maps it to 409.
+    """
+
+    def __init__(self, barcode: str | None = None):
+        self.barcode = barcode
+        super().__init__(
+            BARCODE_CONFLICT_MESSAGE.format(barcode=barcode) if barcode else "Barcode already exists"
+        )
+
+
+def is_barcode_unique_violation(exc: Exception) -> bool:
+    """True when an IntegrityError is the barcode unique-index violation (not the PK race)."""
+    orig = getattr(exc, "orig", None)
+    if getattr(orig, "constraint_name", None) == BARCODE_UNIQUE_INDEX:
+        return True
+    # Expression-index violations do not always populate constraint_name across drivers;
+    # the index name still appears in the server message.
+    return BARCODE_UNIQUE_INDEX in str(exc)

{celerp-2.3.1 → celerp-2.3.3}/celerp/main.py

@@ -12,7 +12,8 @@ from slowapi import Limiter, _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
 from slowapi.util import get_remote_address
 
-from celerp.db import engine, mask_db_credentials
+from celerp.db import engine, lifecycle_engine, mask_db_credentials
+from celerp.inventory_codes import BarcodeConflictError
 from celerp.config import settings, assert_secure_jwt, ensure_instance_id, load_cloud_config, load_backup_config
 load_cloud_config()
 load_backup_config()
@@ -163,7 +164,7 @@ async def _try_auto_activate() -> None:
 async def lifespan(_app: FastAPI):
     (settings.data_dir / "static" / "attachments").mkdir(parents=True, exist_ok=True)
     try:
-        async with engine.begin() as conn:
+        async with lifecycle_engine.begin() as conn:
             await conn.run_sync(Base.metadata.create_all)
     except Exception as exc:
         masked_url = mask_db_credentials(settings.database_url)
@@ -204,19 +205,20 @@ async def lifespan(_app: FastAPI):
             register_api_routes(_app, _loaded_modules)
             # Module models register on Base.metadata at import time.
             # Run create_all again so module tables are created (idempotent).
-            async with engine.begin() as conn:
+            async with lifecycle_engine.begin() as conn:
                 await conn.run_sync(Base.metadata.create_all)
             # Allow modules to backfill data for existing companies (e.g. seed
             # chart of accounts when accounting module is first enabled on an
             # instance that already has companies).
             from celerp.modules.slots import fire_lifecycle as _fire
-            from celerp.db import SessionLocal as _SessionLocal
+            from celerp.db import LifecycleSessionLocal as _LifecycleSession
             # Best-effort, like the two sibling blocks below: a hook that fails
             # during flush poisons the shared session, so the commit raises.
             # Roll back and log at ERROR rather than let that crash boot - the
             # manufacturing seed hook, for one, must never be able to take the
-            # app down.
-            async with _SessionLocal() as _sess:
+            # app down. Seed hooks can replay large ledgers, so they run on the
+            # unbounded lifecycle engine, not the timeout-bounded request pool.
+            async with _LifecycleSession() as _sess:
                 try:
                     await _fire("on_modules_ready", session=_sess)
                     await _sess.commit()
@@ -235,7 +237,7 @@ async def lifespan(_app: FastAPI):
                 _demoted = demoted_first_party(_enabled)
                 if _demoted:
                     from celerp.modules.demotion import notify_demoted_modules
-                    async with _SessionLocal() as _dsess:
+                    async with _LifecycleSession() as _dsess:
                         await notify_demoted_modules(_dsess, _demoted)
                         await _dsess.commit()
             except Exception:
@@ -255,7 +257,7 @@ async def lifespan(_app: FastAPI):
     # marker so it runs once per version. Non-fatal: a failure must not block
     # boot — the marker stays unset and a later boot retries.
     try:
-        from celerp.db import SessionLocal as _GuardSession
+        from celerp.db import LifecycleSessionLocal as _GuardSession
         from celerp.services.dev_release_guard import run_upgrade_guard
         async with _GuardSession() as _guard_sess:
             await run_upgrade_guard(_guard_sess)
@@ -270,7 +272,7 @@ async def lifespan(_app: FastAPI):
     # or consigned in before that field shipped, so their inventory status links
     # to its document. Marker-gated (runs once); non-fatal like the guard above.
     try:
-        from celerp.db import SessionLocal as _BackfillSession
+        from celerp.db import LifecycleSessionLocal as _BackfillSession
         from celerp.services.status_doc_backfill import run_status_doc_backfill
         async with _BackfillSession() as _bf_sess:
             await run_status_doc_backfill(_bf_sess)
@@ -286,7 +288,7 @@ async def lifespan(_app: FastAPI):
     # (runs once; retries stragglers while any doc is locked or errored);
     # non-fatal like the backfill above.
     try:
-        from celerp.db import SessionLocal as _CogsSession
+        from celerp.db import LifecycleSessionLocal as _CogsSession
         from celerp.services.cogs_backfill import run_cogs_backfill
         async with _CogsSession() as _cogs_sess:
             await run_cogs_backfill(_cogs_sess)
@@ -447,6 +449,14 @@ async def rate_limit_handler(_request: Request, _exc: RateLimitExceeded):
     return JSONResponse(status_code=429, content={"detail": "Rate limit exceeded"})
 
 
+@app.exception_handler(BarcodeConflictError)
+async def barcode_conflict_handler(_request: Request, exc: BarcodeConflictError):
+    # The projection applier raises this when the barcode unique index rejects a write
+    # that bypassed the allocation lock (imports, connectors). A more specific handler
+    # than the Exception catch-all, so it maps to 409 instead of a masked 500.
+    return JSONResponse(status_code=409, content={"detail": str(exc)})
+
+
 # Kernel routes — always present regardless of module configuration
 app.include_router(health.router, tags=["system"])
 app.include_router(auth.router, prefix="/auth", tags=["auth"])

celerp-2.3.3/celerp/migrations/versions/bc0d1e2f3a4b_barcode_unique_index.py

@@ -0,0 +1,119 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+
+"""Enforce at-most-one item per (company, barcode) with a partial unique index.
+
+Revision ID: bc0d1e2f3a4b
+Revises: b3c4d5e6f7a8
+Create Date: 2026-08-25
+
+Context
+-------
+A barcode identifies at most one physical-lot item per company. Until now that was
+only enforced by an application check under a lock; any writer bypassing the lock
+(imports, connectors, a future writer) could create duplicates, and legacy databases
+may already hold some.
+
+This migration is the final defense: a PostgreSQL partial expression unique index on
+``(company_id, state ->> 'barcode')`` for item projections with a non-empty barcode.
+
+It refuses to create the index while incompatible data exists rather than silently
+renaming or clearing anything. A preflight scans for duplicate non-empty barcodes,
+barcodes over the length limit, SKUs over the length limit, and comma-bearing SKUs,
+and stops with an actionable report (company, value, affected entity ids) so an
+operator can remediate and re-run.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+from celerp.inventory_codes import BARCODE_UNIQUE_INDEX, MAX_BARCODE_LEN, MAX_SKU_LEN
+
+revision = "bc0d1e2f3a4b"
+down_revision = "b3c4d5e6f7a8"
+branch_labels = None
+depends_on = None
+
+
+def _preflight(conn) -> list[str]:
+    """Return a list of human-readable remediation problems; empty means clean."""
+    problems: list[str] = []
+
+    dups = conn.execute(
+        sa.text(
+            "SELECT company_id, state ->> 'barcode' AS barcode, "
+            "       array_agg(entity_id ORDER BY entity_id) AS entities "
+            "FROM projections "
+            "WHERE entity_type = 'item' AND NULLIF(state ->> 'barcode', '') IS NOT NULL "
+            "GROUP BY company_id, state ->> 'barcode' "
+            "HAVING count(*) > 1"
+        )
+    ).fetchall()
+    for row in dups:
+        problems.append(
+            f"duplicate barcode {row.barcode!r} in company {row.company_id}: entities {list(row.entities)}"
+        )
+
+    long_barcodes = conn.execute(
+        sa.text(
+            "SELECT company_id, entity_id, state ->> 'barcode' AS barcode "
+            "FROM projections "
+            "WHERE entity_type = 'item' AND length(state ->> 'barcode') > :n"
+        ),
+        {"n": MAX_BARCODE_LEN},
+    ).fetchall()
+    for row in long_barcodes:
+        problems.append(
+            f"barcode {row.barcode!r} over {MAX_BARCODE_LEN} chars in company {row.company_id} entity {row.entity_id}"
+        )
+
+    long_skus = conn.execute(
+        sa.text(
+            "SELECT company_id, entity_id "
+            "FROM projections "
+            "WHERE entity_type = 'item' AND length(state ->> 'sku') > :n"
+        ),
+        {"n": MAX_SKU_LEN},
+    ).fetchall()
+    for row in long_skus:
+        problems.append(
+            f"SKU over {MAX_SKU_LEN} chars in company {row.company_id} entity {row.entity_id}"
+        )
+
+    comma_skus = conn.execute(
+        sa.text(
+            "SELECT company_id, entity_id, state ->> 'sku' AS sku "
+            "FROM projections "
+            "WHERE entity_type = 'item' AND position(',' in state ->> 'sku') > 0"
+        )
+    ).fetchall()
+    for row in comma_skus:
+        problems.append(
+            f"comma-bearing SKU {row.sku!r} in company {row.company_id} entity {row.entity_id}"
+        )
+
+    return problems
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    problems = _preflight(conn)
+    if problems:
+        raise RuntimeError(
+            "Cannot create the barcode uniqueness index: incompatible item data exists. "
+            "Resolve each of the following (rename or clear the barcode/SKU on the affected "
+            "items), then re-run the migration:\n  - " + "\n  - ".join(problems)
+        )
+
+    op.execute(
+        f"CREATE UNIQUE INDEX IF NOT EXISTS {BARCODE_UNIQUE_INDEX} "
+        "ON projections (company_id, (state ->> 'barcode')) "
+        "WHERE entity_type = 'item' AND NULLIF(state ->> 'barcode', '') IS NOT NULL"
+    )
+
+
+def downgrade() -> None:
+    op.execute(f"DROP INDEX IF EXISTS {BARCODE_UNIQUE_INDEX}")

celerp-2.3.3/celerp/migrations/versions/c9d8e7f6a5b4_seed_shrinkage_writeoff_account.py

@@ -0,0 +1,65 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+
+"""seed the inventory shrinkage/write-off account 6970 for existing companies
+
+Revision ID: c9d8e7f6a5b4
+Revises: bc0d1e2f3a4b
+Create Date: 2026-08-31
+
+Inventory write-offs and audit shrinkage post to 6970. New companies get the
+account from THAI_CHART_OF_ACCOUNTS on creation; this backfills existing ones,
+which would otherwise be refused at posting time.
+"""
+
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = "c9d8e7f6a5b4"
+down_revision = "bc0d1e2f3a4b"
+branch_labels = None
+depends_on = None
+
+_CODE = "6970"
+_NAME = "Inventory Shrinkage & Write-offs"
+_TYPE = "expense"
+_PARENT = "6000"
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+    # to_regclass resolves against the connection's search_path rather than
+    # assuming public, so the guard is correct for any schema the migration is
+    # actually run in.
+    table_exists = conn.execute(sa.text("SELECT to_regclass('accounts')")).scalar()
+    if not table_exists:
+        return  # Nothing to backfill on fresh install
+
+    companies = conn.execute(
+        sa.text("SELECT DISTINCT company_id FROM accounts WHERE code = :parent"),
+        {"parent": _PARENT},
+    ).fetchall()
+
+    for (company_id,) in companies:
+        exists = conn.execute(
+            sa.text("SELECT 1 FROM accounts WHERE company_id = :cid AND code = :code"),
+            {"cid": company_id, "code": _CODE},
+        ).fetchone()
+        if not exists:
+            conn.execute(
+                sa.text(
+                    "INSERT INTO accounts (id, company_id, code, name, account_type, parent_code, is_active, created_at) "
+                    "VALUES (gen_random_uuid(), :cid, :code, :name, :acc_type, :parent, TRUE, NOW())"
+                ),
+                {"cid": company_id, "code": _CODE, "name": _NAME,
+                 "acc_type": _TYPE, "parent": _PARENT},
+            )
+
+
+def downgrade() -> None:
+    # The upgrade only inserts 6970 when absent, so a seeded row is indistinguishable from a
+    # company's own pre-existing 6970. Deleting on downgrade would destroy user data and orphan any
+    # ledger row referencing it, so the reversal intentionally leaves the account in place.
+    pass

{celerp-2.3.1 → celerp-2.3.3}/celerp/models/projections.py

@@ -9,12 +9,27 @@ import sqlalchemy as sa
 from sqlalchemy import BigInteger, Boolean, DateTime, ForeignKey, PrimaryKeyConstraint, String, Text
 from sqlalchemy.orm import Mapped, mapped_column
 
+from celerp.inventory_codes import BARCODE_UNIQUE_INDEX
 from celerp.models.base import Base
 
 
 class Projection(Base):
     __tablename__ = "projections"
-    __table_args__ = (PrimaryKeyConstraint("company_id", "entity_id"),)
+    __table_args__ = (
+        PrimaryKeyConstraint("company_id", "entity_id"),
+        # At most one item per (company, non-empty barcode). The final defense behind
+        # the application allocation lock: imports, connectors, or a future writer that
+        # bypasses the lock still cannot create a duplicate barcode. Declared here so
+        # create_all builds it for the test schema; created on existing databases by the
+        # barcode-uniqueness migration.
+        sa.Index(
+            BARCODE_UNIQUE_INDEX,
+            "company_id",
+            sa.text("(state ->> 'barcode')"),
+            unique=True,
+            postgresql_where=sa.text("entity_type = 'item' AND NULLIF(state ->> 'barcode', '') IS NOT NULL"),
+        ),
+    )
 
     entity_id: Mapped[str] = mapped_column(Text, nullable=False)
     company_id: Mapped[uuid.UUID] = mapped_column(sa.Uuid(as_uuid=True), ForeignKey("companies.id"), nullable=False)