celerp 2.3.2__tar.gz → 2.3.3__tar.gz

{celerp-2.3.2 → celerp-2.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: celerp
-Version: 2.3.2
+Version: 2.3.3
 Summary: Free, self-hosted ERP for small businesses
 License: Business Source License 1.1
         

celerp-2.3.3/celerp/db.py

@@ -0,0 +1,136 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+
+import os
+import re
+from contextlib import asynccontextmanager
+
+from sqlalchemy import text as _sql_text
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from celerp.config import settings
+
+# Shared advisory-lock key that serialises schema migrations across every process
+# that might run them (the CLI upgrade command and the API startup phase). One
+# key, one source of truth, so two boots can never migrate the same database at
+# once.
+_MIGRATION_LOCK_KEY = 4207320001
+
+# Redacts the password in any Postgres URL: "://user:secret@host" -> "://user:***@host".
+# One authoritative masker for logs and surfaced errors so a connection string
+# never leaks a password.
+_DB_CREDENTIALS_RE = re.compile(r"(://[^:]+:)[^@]+(@)")
+
+
+def mask_db_credentials(text: str) -> str:
+    """Return text with any database URL password replaced by ``***``."""
+    return _DB_CREDENTIALS_RE.sub(r"\1***\2", text)
+
+# Request-connection timeouts (ms). One source of truth: the engine sets them in
+# server_settings, and lifecycle_timeouts_disabled restores exactly these values
+# after clearing them for startup work.
+_REQUEST_LOCK_TIMEOUT_MS = "3000"
+_REQUEST_STATEMENT_TIMEOUT_MS = "30000"
+
+# Pool budget: total_possible = (api_workers * (pool_size + max_overflow))
+#                              + (gui_workers * (gui_pool_size + gui_max_overflow))
+# Default workers 2 API + 1 GUI → 2*(10+5) + 1*(5+5) = 40 connections max.
+# Postgres default max_connections=100 leaves 60 for migrations, admin tools, etc.
+# If you increase worker counts, recalculate this budget before deploying.
+if os.environ.get("CELERP_TEST_NULLPOOL"):
+    # Test mode: a fresh connection per use that closes on return, so a failed
+    # test can't leave a poisoned/locked connection lingering in a pooled
+    # connection and block the next test's TRUNCATE. Only ever set by the test
+    # harness; no effect in production.
+    engine = create_async_engine(settings.database_url, future=True, poolclass=NullPool)
+else:
+    engine = create_async_engine(
+        settings.database_url,
+        future=True,
+        pool_pre_ping=True,
+        pool_size=10,
+        max_overflow=5,
+        # Bound how long any query may wait on a lock or run, so a stuck query is
+        # cancelled instead of pinning one of the few pooled connections for the
+        # full request lifetime (lock_timeout 3s, statement_timeout 30s, in ms).
+        # This is a per-connection default, so it applies to every request AND
+        # every pooled background job (connector syncs, the gateway, the daily
+        # scheduler) - all of which must stay bounded. Startup reconciliation and
+        # the projection rebuild are the only work that legitimately runs longer;
+        # they use lifecycle_engine below instead of this pool, and the migration
+        # advisory-lock wait self-exempts via lifecycle_timeouts_disabled.
+        connect_args={
+            "server_settings": {
+                "lock_timeout": _REQUEST_LOCK_TIMEOUT_MS,
+                "statement_timeout": _REQUEST_STATEMENT_TIMEOUT_MS,
+            }
+        },
+    )
+SessionLocal = async_sessionmaker(engine, class_=AsyncSession, expire_on_commit=False)
+
+# Lifecycle/maintenance engine: a separate NullPool engine carrying NO statement
+# or lock timeout. Startup reconciliation (create_all, module on_modules_ready
+# seed hooks, the develop->release projection rebuild, the one-time status-doc and
+# COGS backfills) and the on-demand projection rebuild routes run whole-table
+# DELETEs and full-ledger replays that can legitimately exceed the request
+# statement_timeout on a mature database. Running them on the bounded request pool
+# would cancel them at 30s - permanently blocking boot's upgrade guard and the
+# /ledger/rebuild recovery route. They run on this engine instead. NullPool: these
+# operations are rare and brief, so no pooled slot is reserved and the request pool
+# budget above is unaffected (at most one transient connection per concurrent
+# lifecycle op).
+lifecycle_engine = create_async_engine(settings.database_url, future=True, poolclass=NullPool)
+LifecycleSessionLocal = async_sessionmaker(
+    lifecycle_engine, class_=AsyncSession, expire_on_commit=False
+)
+
+
+@asynccontextmanager
+async def lifecycle_timeouts_disabled(conn):
+    """Clear the request statement/lock timeouts on the migration lock connection.
+
+    The migration advisory-lock wait runs on a connection drawn from the bounded
+    request engine (so a single engine serialises boots), but a second worker's
+    wait can legitimately exceed the 30s statement_timeout while the first worker
+    migrates, and a cancelled wait aborts the boot. This sets both timeouts to 0
+    (unbounded) for the block and restores the request defaults on exit, so the
+    connection returned to the pool still carries them. Other long-running startup
+    work uses lifecycle_engine (no timeout) rather than this in-place exemption.
+    Postgres only; a no-op on other dialects, which have no such settings.
+    """
+    if conn.dialect.name != "postgresql":
+        yield
+        return
+    await conn.execute(_sql_text("SET statement_timeout = 0"))
+    await conn.execute(_sql_text("SET lock_timeout = 0"))
+    try:
+        yield
+    finally:
+        await conn.execute(_sql_text(f"SET statement_timeout = {_REQUEST_STATEMENT_TIMEOUT_MS}"))
+        await conn.execute(_sql_text(f"SET lock_timeout = {_REQUEST_LOCK_TIMEOUT_MS}"))
+
+
+async def get_session() -> AsyncSession:
+    async with SessionLocal() as session:
+        yield session
+
+
+@asynccontextmanager
+async def get_session_ctx():
+    """Standalone async context manager for use outside FastAPI request handlers."""
+    async with SessionLocal() as session:
+        yield session
+
+
+@asynccontextmanager
+async def get_lifecycle_session_ctx():
+    """Session on the unbounded lifecycle_engine, for known long-running work.
+
+    Use for the projection rebuild and startup backfills: a full rebuild's
+    whole-table DELETE and full-ledger replay can exceed the request
+    statement_timeout on a mature database, and must not be cancelled. Ordinary
+    request and background work uses get_session/get_session_ctx (bounded).
+    """
+    async with LifecycleSessionLocal() as session:
+        yield session

{celerp-2.3.2 → celerp-2.3.3}/celerp/events/schemas.py

@@ -546,6 +546,15 @@ class DocUnvoided(BaseModel):
     restored_status: str
 
 
+class DocClosed(BaseModel):
+    reason: str | None = None
+    pre_close_status: str | None = None
+
+
+class DocReopened(BaseModel):
+    restored_status: str
+
+
 class DocSent(BaseModel):
     sent_via: str | None = None
     sent_to: str | None = None
@@ -1162,6 +1171,8 @@ EVENT_SCHEMA_MAP: dict[str, type[BaseModel]] = {
     "doc.voided": DocVoided,
     "doc.reverted_to_draft": DocRevertedToDraft,
     "doc.unvoided": DocUnvoided,
+    "doc.closed": DocClosed,
+    "doc.reopened": DocReopened,
     "doc.converted_to_bill": DocConvertedToBill,
     "doc.sent": DocSent,
     "doc.payment.received": DocPaymentReceived,

{celerp-2.3.2 → celerp-2.3.3}/celerp/main.py

@@ -12,7 +12,7 @@ from slowapi import Limiter, _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
 from slowapi.util import get_remote_address
 
-from celerp.db import engine, mask_db_credentials
+from celerp.db import engine, lifecycle_engine, mask_db_credentials
 from celerp.inventory_codes import BarcodeConflictError
 from celerp.config import settings, assert_secure_jwt, ensure_instance_id, load_cloud_config, load_backup_config
 load_cloud_config()
@@ -164,7 +164,7 @@ async def _try_auto_activate() -> None:
 async def lifespan(_app: FastAPI):
     (settings.data_dir / "static" / "attachments").mkdir(parents=True, exist_ok=True)
     try:
-        async with engine.begin() as conn:
+        async with lifecycle_engine.begin() as conn:
             await conn.run_sync(Base.metadata.create_all)
     except Exception as exc:
         masked_url = mask_db_credentials(settings.database_url)
@@ -205,19 +205,20 @@ async def lifespan(_app: FastAPI):
             register_api_routes(_app, _loaded_modules)
             # Module models register on Base.metadata at import time.
             # Run create_all again so module tables are created (idempotent).
-            async with engine.begin() as conn:
+            async with lifecycle_engine.begin() as conn:
                 await conn.run_sync(Base.metadata.create_all)
             # Allow modules to backfill data for existing companies (e.g. seed
             # chart of accounts when accounting module is first enabled on an
             # instance that already has companies).
             from celerp.modules.slots import fire_lifecycle as _fire
-            from celerp.db import SessionLocal as _SessionLocal
+            from celerp.db import LifecycleSessionLocal as _LifecycleSession
             # Best-effort, like the two sibling blocks below: a hook that fails
             # during flush poisons the shared session, so the commit raises.
             # Roll back and log at ERROR rather than let that crash boot - the
             # manufacturing seed hook, for one, must never be able to take the
-            # app down.
-            async with _SessionLocal() as _sess:
+            # app down. Seed hooks can replay large ledgers, so they run on the
+            # unbounded lifecycle engine, not the timeout-bounded request pool.
+            async with _LifecycleSession() as _sess:
                 try:
                     await _fire("on_modules_ready", session=_sess)
                     await _sess.commit()
@@ -236,7 +237,7 @@ async def lifespan(_app: FastAPI):
                 _demoted = demoted_first_party(_enabled)
                 if _demoted:
                     from celerp.modules.demotion import notify_demoted_modules
-                    async with _SessionLocal() as _dsess:
+                    async with _LifecycleSession() as _dsess:
                         await notify_demoted_modules(_dsess, _demoted)
                         await _dsess.commit()
             except Exception:
@@ -256,7 +257,7 @@ async def lifespan(_app: FastAPI):
     # marker so it runs once per version. Non-fatal: a failure must not block
     # boot — the marker stays unset and a later boot retries.
     try:
-        from celerp.db import SessionLocal as _GuardSession
+        from celerp.db import LifecycleSessionLocal as _GuardSession
         from celerp.services.dev_release_guard import run_upgrade_guard
         async with _GuardSession() as _guard_sess:
             await run_upgrade_guard(_guard_sess)
@@ -271,7 +272,7 @@ async def lifespan(_app: FastAPI):
     # or consigned in before that field shipped, so their inventory status links
     # to its document. Marker-gated (runs once); non-fatal like the guard above.
     try:
-        from celerp.db import SessionLocal as _BackfillSession
+        from celerp.db import LifecycleSessionLocal as _BackfillSession
         from celerp.services.status_doc_backfill import run_status_doc_backfill
         async with _BackfillSession() as _bf_sess:
             await run_status_doc_backfill(_bf_sess)
@@ -287,7 +288,7 @@ async def lifespan(_app: FastAPI):
     # (runs once; retries stragglers while any doc is locked or errored);
     # non-fatal like the backfill above.
     try:
-        from celerp.db import SessionLocal as _CogsSession
+        from celerp.db import LifecycleSessionLocal as _CogsSession
         from celerp.services.cogs_backfill import run_cogs_backfill
         async with _CogsSession() as _cogs_sess:
             await run_cogs_backfill(_cogs_sess)

celerp-2.3.3/celerp/migrations/versions/c9d8e7f6a5b4_seed_shrinkage_writeoff_account.py

@@ -0,0 +1,65 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+
+"""seed the inventory shrinkage/write-off account 6970 for existing companies
+
+Revision ID: c9d8e7f6a5b4
+Revises: bc0d1e2f3a4b
+Create Date: 2026-08-31
+
+Inventory write-offs and audit shrinkage post to 6970. New companies get the
+account from THAI_CHART_OF_ACCOUNTS on creation; this backfills existing ones,
+which would otherwise be refused at posting time.
+"""
+
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = "c9d8e7f6a5b4"
+down_revision = "bc0d1e2f3a4b"
+branch_labels = None
+depends_on = None
+
+_CODE = "6970"
+_NAME = "Inventory Shrinkage & Write-offs"
+_TYPE = "expense"
+_PARENT = "6000"
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+    # to_regclass resolves against the connection's search_path rather than
+    # assuming public, so the guard is correct for any schema the migration is
+    # actually run in.
+    table_exists = conn.execute(sa.text("SELECT to_regclass('accounts')")).scalar()
+    if not table_exists:
+        return  # Nothing to backfill on fresh install
+
+    companies = conn.execute(
+        sa.text("SELECT DISTINCT company_id FROM accounts WHERE code = :parent"),
+        {"parent": _PARENT},
+    ).fetchall()
+
+    for (company_id,) in companies:
+        exists = conn.execute(
+            sa.text("SELECT 1 FROM accounts WHERE company_id = :cid AND code = :code"),
+            {"cid": company_id, "code": _CODE},
+        ).fetchone()
+        if not exists:
+            conn.execute(
+                sa.text(
+                    "INSERT INTO accounts (id, company_id, code, name, account_type, parent_code, is_active, created_at) "
+                    "VALUES (gen_random_uuid(), :cid, :code, :name, :acc_type, :parent, TRUE, NOW())"
+                ),
+                {"cid": company_id, "code": _CODE, "name": _NAME,
+                 "acc_type": _TYPE, "parent": _PARENT},
+            )
+
+
+def downgrade() -> None:
+    # The upgrade only inserts 6970 when absent, so a seeded row is indistinguishable from a
+    # company's own pre-existing 6970. Deleting on downgrade would destroy user data and orphan any
+    # ledger row referencing it, so the reversal intentionally leaves the account in place.
+    pass

{celerp-2.3.2 → celerp-2.3.3}/celerp/modules/migrations_runner.py

@@ -29,7 +29,7 @@ import sqlalchemy as sa
 from alembic.operations import Operations
 from alembic.runtime.migration import MigrationContext
 
-from celerp.db import _MIGRATION_LOCK_KEY, mask_db_credentials
+from celerp.db import _MIGRATION_LOCK_KEY, lifecycle_timeouts_disabled, mask_db_credentials
 from celerp.modules import loader
 
 # A prefix is well-formed when it is a non-empty string of at least this length
@@ -197,36 +197,40 @@ async def run_migration_phase(engine, enabled):
     lock_conn = await engine.connect()
     lock_conn = await lock_conn.execution_options(isolation_level="AUTOCOMMIT")
     try:
-        await lock_conn.execute(
-            sa.text("SELECT pg_advisory_lock(:key)"), {"key": _MIGRATION_LOCK_KEY}
-        )
-        try:
-            for name in sorted(enabled):
-                module_path = loader.resolve_module_path(name)
-                if module_path is None:
-                    continue
-                manifest = loader.read_manifest(module_path)
-                migrations_pkg = manifest.get("migrations")
-                if not migrations_pkg:
-                    continue
-                table_prefix = manifest.get("table_prefix") or ""
-                try:
-                    async with engine.begin() as conn:
-                        await conn.run_sync(
-                            run_module_migrations, name, module_path,
-                            migrations_pkg, table_prefix,
-                        )
-                except Exception as exc:
-                    if loader.is_first_party(module_path):
-                        raise
-                    held_errors[name] = mask_db_credentials(
-                        f"Migration failed: {type(exc).__name__}: {exc}"
-                    )
-                    surviving.discard(name)
-        finally:
+        # The advisory-lock wait blocks until any other worker's phase finishes;
+        # the request statement_timeout would cancel that wait and abort the boot,
+        # so clear it on this connection for the whole locked section.
+        async with lifecycle_timeouts_disabled(lock_conn):
             await lock_conn.execute(
-                sa.text("SELECT pg_advisory_unlock(:key)"), {"key": _MIGRATION_LOCK_KEY}
+                sa.text("SELECT pg_advisory_lock(:key)"), {"key": _MIGRATION_LOCK_KEY}
             )
+            try:
+                for name in sorted(enabled):
+                    module_path = loader.resolve_module_path(name)
+                    if module_path is None:
+                        continue
+                    manifest = loader.read_manifest(module_path)
+                    migrations_pkg = manifest.get("migrations")
+                    if not migrations_pkg:
+                        continue
+                    table_prefix = manifest.get("table_prefix") or ""
+                    try:
+                        async with engine.begin() as conn:
+                            await conn.run_sync(
+                                run_module_migrations, name, module_path,
+                                migrations_pkg, table_prefix,
+                            )
+                    except Exception as exc:
+                        if loader.is_first_party(module_path):
+                            raise
+                        held_errors[name] = mask_db_credentials(
+                            f"Migration failed: {type(exc).__name__}: {exc}"
+                        )
+                        surviving.discard(name)
+            finally:
+                await lock_conn.execute(
+                    sa.text("SELECT pg_advisory_unlock(:key)"), {"key": _MIGRATION_LOCK_KEY}
+                )
     finally:
         await lock_conn.close()
     return surviving, held_errors

{celerp-2.3.2 → celerp-2.3.3}/celerp/routers/doctor.py

@@ -29,7 +29,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy import func, select, text
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from celerp.db import get_session
+from celerp.db import get_lifecycle_session_ctx, get_session
 from celerp.events.engine import emit_event
 from celerp.models.ledger import LedgerEntry
 from celerp.models.projections import Projection
@@ -848,8 +848,13 @@ async def run_doctor(
         await session.commit()
 
     if rebuild and fix:
-        await ProjectionEngine.rebuild(session, company_id=company_id)
-        await session.commit()
+        # The fixes above are already committed, so a fresh lifecycle session
+        # sees them. Run the rebuild there: replaying the whole ledger can
+        # exceed the request statement_timeout on a mature database, and a
+        # cancelled rebuild would leave projections half-built.
+        async with get_lifecycle_session_ctx() as _rebuild_sess:
+            await ProjectionEngine.rebuild(_rebuild_sess, company_id=company_id)
+            await _rebuild_sess.commit()
 
     total_found = sum(r["found"] for r in results)
     total_fixed = sum(r["fixed"] for r in results)

{celerp-2.3.2 → celerp-2.3.3}/celerp/routers/ledger.py

@@ -7,12 +7,12 @@ from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from celerp.db import get_session
+from celerp.db import get_lifecycle_session_ctx, get_session
 from celerp.models.ledger import LedgerEntry
 from celerp.projections.engine import ProjectionEngine
 from celerp.services.activity_redaction import redact_entries_for_role, redact_event_costs
 from celerp.services.auth import get_current_company_id, get_current_role, get_current_user
-from celerp.services.permissions import get_current_company_settings
+from celerp.services.permissions import get_current_company_settings, require_permission
 
 router = APIRouter(dependencies=[Depends(get_current_user)])
 
@@ -105,7 +105,17 @@ async def get_entry(entry_id: int, company_id: str = Depends(get_current_company
 
 
 @router.post("/rebuild")
-async def rebuild(company_id: str = Depends(get_current_company_id), session: AsyncSession = Depends(get_session)) -> dict:
-    await ProjectionEngine.rebuild(session, company_id=company_id)
-    await session.commit()
+async def rebuild(
+    company_id: str = Depends(get_current_company_id),
+    _: None = require_permission("manage_company_lifecycle"),
+) -> dict:
+    # A full rebuild deletes every projection for the company and replays the
+    # whole ledger, which can exceed the request statement_timeout on a mature
+    # database. Run it on the unbounded lifecycle session so recovery is never
+    # cancelled mid-replay, leaving projections half-rebuilt. That unbounded work
+    # is gated on the owner-only company-lifecycle permission so an ordinary
+    # subuser cannot open concurrent full replays outside the request pool budget.
+    async with get_lifecycle_session_ctx() as session:
+        await ProjectionEngine.rebuild(session, company_id=company_id)
+        await session.commit()
     return {"ok": True}

{celerp-2.3.2 → celerp-2.3.3}/celerp/services/auto_je.py

@@ -1127,9 +1127,9 @@ async def create_for_mfg_completed(session, *, company_id, user_id, order_id: st
 
 
 # Inventory-audit stock adjustment accounts:
-#   shrinkage (count < system): Dr 5100 Cost of Goods Sold / Cr 1130-P Inventory
+#   shrinkage (count < system): Dr 6970 Inventory Shrinkage & Write-offs / Cr 1130-P Inventory
 #   overage   (count > system): Dr 1130-P Inventory          / Cr 4300 Other Income
-_AUDIT_SHRINKAGE_ACCT = "5100"
+_AUDIT_SHRINKAGE_ACCT = "6970"
 _AUDIT_OVERAGE_ACCT = "4300"
 _AUDIT_INVENTORY_ACCT = _INVENTORY_ACCT
 

{celerp-2.3.2 → celerp-2.3.3}/celerp/services/cost_visibility.py

@@ -15,11 +15,17 @@ from celerp.services.auth import ROLE_LEVELS
 
 # Item-dict keys stripped when the caller lacks view_inventory_costs.
 COST_ITEM_KEYS: frozenset[str] = frozenset({"cost_price", "cost_total"})
+# Read-side cost companions: derived cost data that a cost-hidden caller must not see
+# either, or the goods cost leaks through a value computed off it. Kept separate from
+# COST_ITEM_KEYS because that set also drives write-path price classification; these are
+# stripped only, never written or validated against.
+COST_DERIVED_ITEM_KEYS: frozenset[str] = frozenset({"cost_base", "cost_landed", "landed_contributions"})
 
 
 def apply_field_visibility(
     items: list[dict], role: str, field_schema: list[dict], can_see_costs: bool,
     can_author_drafts: bool = False,
+    derived_field_deps: dict[str, tuple[str, ...]] | None = None,
 ) -> list[dict]:
     """Strip fields from item dicts that the caller is not allowed to see.
 
@@ -36,6 +42,12 @@ def apply_field_visibility(
     available, not at creation. When ``can_author_drafts`` (the caller holds
     edit_inventory), a DRAFT item keeps its cost keys so its creator can finish
     authoring it; every non-draft item is stripped as before.
+
+    Derived fields: ``derived_field_deps`` maps a computed key to the source keys
+    it is derived from (e.g. qty_each from quantity and pieces). A derived key is
+    stripped whenever ANY of its sources is stripped, so a caller cannot recover a
+    hidden source from a value computed off it. The rule is stated once by the
+    caller; this service stays generic and holds no field names of its own.
     """
     caller_level = ROLE_LEVELS.get(role, 0)
     restricted = {
@@ -55,6 +67,10 @@ def apply_field_visibility(
         if cost_hidden and not (
             can_author_drafts and str(item.get("status") or "").lower() == "draft"
         ):
-            drop |= COST_ITEM_KEYS
+            drop |= COST_ITEM_KEYS | COST_DERIVED_ITEM_KEYS
+        if derived_field_deps:
+            for derived, sources in derived_field_deps.items():
+                if any(s in drop for s in sources):
+                    drop.add(derived)
         out.append({k: v for k, v in item.items() if k not in drop} if drop else item)
     return out

{celerp-2.3.2 → celerp-2.3.3}/celerp/services/field_schema.py

@@ -166,6 +166,18 @@ def cost_columns(price_lists: list[dict]) -> list[dict]:
     return [f for f in _inject_price_columns([], price_lists) if f.get("key") in COST_SCHEMA_KEYS]
 
 
+# The schema field types whose stored values are numeric, so a field of one of these
+# types is range/exact scope-searchable and classified numeric on merge. Single source
+# for that classification, consumed by the inventory search and merge paths.
+NUMERIC_SCHEMA_TYPES: frozenset[str] = frozenset({"number", "money", "rate", "weight"})
+
+# Field keys a company can never hide through a visible_to_roles override. status drives
+# lifecycle membership filtering (sold/archived/draft) that runs BEFORE field visibility
+# in list_items, so a role-restricted status would be a membership oracle: probing
+# ?status=sold against the default view discloses the hidden value. Forcing an empty
+# visible_to_roles keeps that pre-visibility filter safe.
+NON_HIDEABLE_FIELD_KEYS: frozenset[str] = frozenset({"status"})
+
 # Backward-compatible constant: base fields + default price columns
 DEFAULT_ITEM_SCHEMA: list[dict] = _inject_price_columns(_BASE_FIELDS, _DEFAULT_PRICE_LISTS)
 
@@ -222,5 +234,12 @@ async def get_effective_field_schema(
             keys_in_cat = {f["key"] for f in cat_fields}
             merged = [f for f in base_schema if f["key"] not in keys_in_cat]
             merged.extend(cat_fields)
-            return _rehydrate_builtin_metadata(merged)
+            base_schema = merged
+
+    # Non-hideable fields carry an empty visible_to_roles no matter what a stored base or
+    # category override set. Applied at the single exit so both paths are covered.
+    base_schema = [
+        {**f, "visible_to_roles": []} if f["key"] in NON_HIDEABLE_FIELD_KEYS else f
+        for f in base_schema
+    ]
     return _rehydrate_builtin_metadata(base_schema)

{celerp-2.3.2 → celerp-2.3.3}/celerp/services/system_health.py

@@ -25,14 +25,23 @@ _MESSAGES = {
         " unresponsive. Upgrade your RAM or close other applications."
     ),
     "cpu_warning": "Your computer's processor is under heavy load. Response times may be slow.",
-    "disk_warning": "Your disk is getting full. Free up space to keep Celerp running smoothly.",
-    "disk_critical": (
-        "Your disk is almost full. Celerp may stop working if disk space runs out."
-        " Free up space immediately."
-    ),
 }
 
 
+def _disk_message(suffix: str, used_percent: float, free_gb: float, total_gb: float) -> str:
+    """A disk warning that names the numbers the user needs to act: how much is free
+    now, the total, and how much to free to clear the warning. The clear target is the
+    warning threshold (used <= _DISK_WARN), so the same actionable figure is shown for
+    both warning and critical - it is what makes the message disappear."""
+    to_free = round(max(0.0, (used_percent - _DISK_WARN) / 100.0 * total_gb), 1)
+    where = f"{free_gb:.1f} GB free of {total_gb:.1f} GB"
+    if suffix == "critical":
+        return (f"Your disk is almost full: {where}. Free up about {to_free:.1f} GB to"
+                " clear this warning, or Celerp may stop working if space runs out.")
+    return (f"Your disk is getting full: {where}. Free up about {to_free:.1f} GB more"
+            " to clear this warning.")
+
+
 def _threshold(value: float, warn: float, crit: float | None) -> tuple[str, str | None]:
     """Return (status, message_key_suffix | None) for a metric."""
     if crit is not None and value > crit:
@@ -54,6 +63,8 @@ def get_system_health() -> dict:
     ram_status, ram_suffix = _threshold(mem.percent, _RAM_WARN, _RAM_CRIT)
     cpu_status, cpu_suffix = _threshold(cpu_pct, _CPU_WARN, None)
     disk_status, disk_suffix = _threshold(disk.percent, _DISK_WARN, _DISK_CRIT)
+    disk_free_gb = round(disk.free / _GB, 2)
+    disk_total_gb = round(disk.total / _GB, 2)
 
     return {
         "ram": {
@@ -70,10 +81,10 @@ def get_system_health() -> dict:
         },
         "disk": {
             "used_percent": disk.percent,
-            "free_gb": round(disk.free / _GB, 2),
-            "total_gb": round(disk.total / _GB, 2),
+            "free_gb": disk_free_gb,
+            "total_gb": disk_total_gb,
             "status": disk_status,
-            "message": _MESSAGES.get(f"disk_{disk_suffix}") if disk_suffix else None,
+            "message": _disk_message(disk_suffix, disk.percent, disk_free_gb, disk_total_gb) if disk_suffix else None,
         },
         "overall": _worst(ram_status, cpu_status, disk_status),
     }

{celerp-2.3.2 → celerp-2.3.3}/celerp.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: celerp
-Version: 2.3.2
+Version: 2.3.3
 Summary: Free, self-hosted ERP for small businesses
 License: Business Source License 1.1
         

{celerp-2.3.2 → celerp-2.3.3}/celerp.egg-info/SOURCES.txt

@@ -90,6 +90,7 @@ celerp/migrations/versions/bc0d1e2f3a4b_barcode_unique_index.py
 celerp/migrations/versions/c1d2e3f4a5b6_add_marketplace.py
 celerp/migrations/versions/c2d3e4f5a6b7_add_is_sync_to_shopify.py
 celerp/migrations/versions/c4d5e6f7a8b9_account_cash_flow_category.py
+celerp/migrations/versions/c9d8e7f6a5b4_seed_shrinkage_writeoff_account.py
 celerp/migrations/versions/d0e1f2a3b4c5_add_share_token_expiry.py
 celerp/migrations/versions/d2e3f4a5b6c7_add_password_reset_token.py
 celerp/migrations/versions/d5e6f7a8b9c0_rename_fx_rounding_to_fx_difference.py
@@ -324,7 +325,9 @@ default_modules/celerp-docs/celerp_docs/taxes.py
 default_modules/celerp-docs/celerp_docs/ui_routes.py
 default_modules/celerp-docs/tests/conftest.py
 default_modules/celerp-docs/tests/test_audits.py
+default_modules/celerp-docs/tests/test_bulk_payment_alloc_lock.py
 default_modules/celerp-docs/tests/test_consolidate_lots.py
+default_modules/celerp-docs/tests/test_cross_lot_settlement.py
 default_modules/celerp-docs/tests/test_freight_je.py
 default_modules/celerp-docs/tests/test_freight_lines.py
 default_modules/celerp-docs/tests/test_fulfill_no_split.py
@@ -336,10 +339,17 @@ default_modules/celerp-docs/tests/test_line_delete_persist.py
 default_modules/celerp-docs/tests/test_line_identifier.py
 default_modules/celerp-docs/tests/test_list_concurrency.py
 default_modules/celerp-docs/tests/test_list_outcome_concurrency.py
+default_modules/celerp-docs/tests/test_memo_close.py
+default_modules/celerp-docs/tests/test_memo_close_projection.py
+default_modules/celerp-docs/tests/test_memo_close_review_fixes.py
+default_modules/celerp-docs/tests/test_memo_lifecycle_concurrency.py
+default_modules/celerp-docs/tests/test_memo_line_labels.py
+default_modules/celerp-docs/tests/test_memo_unfulfilled_filter.py
 default_modules/celerp-docs/tests/test_payment_void_activity.py
 default_modules/celerp-docs/tests/test_receive_sku_batch.py
 default_modules/celerp-docs/tests/test_send_visibility.py
 default_modules/celerp-docs/tests/test_service_lines.py
+default_modules/celerp-docs/tests/test_sold_label_ordering.py
 default_modules/celerp-docs/tests/test_void_guards.py
 default_modules/celerp-docs/tests/test_writeoffs.py
 default_modules/celerp-inventory/LICENSE