celerp 2.5.4__tar.gz → 2.5.6__tar.gz

{celerp-2.5.4 → celerp-2.5.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: celerp
-Version: 2.5.4
+Version: 2.5.6
 Summary: Free, self-hosted ERP for small businesses
 License: Business Source License 1.1
         
@@ -134,7 +134,7 @@ Requires-Dist: annotated-doc==0.0.5
 Requires-Dist: annotated-types==0.8.0
 Requires-Dist: anyio==4.15.1
 Requires-Dist: async-timeout==5.0.1; python_full_version < "3.11"
-Requires-Dist: asyncpg==0.31.0
+Requires-Dist: asyncpg==0.32.0
 Requires-Dist: bcrypt==5.0.0
 Requires-Dist: beautifulsoup4==4.15.0
 Requires-Dist: celerp-postgres==17.10.0; (platform_machine == "aarch64" and sys_platform == "linux") or (platform_machine == "x86_64" and sys_platform == "linux") or (platform_machine == "AMD64" and sys_platform == "win32")
@@ -150,13 +150,13 @@ Requires-Dist: deprecated==3.0.0; python_full_version >= "3.12"
 Requires-Dist: ecdsa==0.19.2
 Requires-Dist: et-xmlfile==2.0.0
 Requires-Dist: exceptiongroup==1.3.1; python_full_version < "3.11"
-Requires-Dist: fastapi==0.142.2
+Requires-Dist: fastapi==0.143.0
 Requires-Dist: fastcore==2.2.33
 Requires-Dist: greenlet==3.5.6
 Requires-Dist: h11==0.16.0
 Requires-Dist: httpcore==1.0.9
 Requires-Dist: httpcore2==2.13.1; sys_platform != "emscripten"
-Requires-Dist: httptools==0.8.0
+Requires-Dist: httptools==0.9.0
 Requires-Dist: httpx==0.28.1
 Requires-Dist: httpx2==2.13.1
 Requires-Dist: httpx2-jsfetch==1.0; python_full_version >= "3.12" and sys_platform == "emscripten"
@@ -167,21 +167,21 @@ Requires-Dist: mako==1.4.3
 Requires-Dist: markupsafe==3.0.4
 Requires-Dist: numpy==2.2.6; python_full_version < "3.11"
 Requires-Dist: numpy==2.4.6; python_full_version == "3.11.*"
-Requires-Dist: numpy==2.5.3; python_full_version >= "3.12"
+Requires-Dist: numpy==2.5.4; python_full_version >= "3.12"
 Requires-Dist: oauthlib==4.0.0
 Requires-Dist: openpyxl==3.1.5
-Requires-Dist: opentelemetry-api==1.45.0
+Requires-Dist: opentelemetry-api==1.45.1
 Requires-Dist: packaging==26.3
 Requires-Dist: passlib==1.7.4
 Requires-Dist: pillow==12.3.0
 Requires-Dist: psutil==7.2.2
 Requires-Dist: psycopg2-binary==2.9.13
 Requires-Dist: pyasn1==0.6.4
-Requires-Dist: pycparser==3.0; implementation_name != "PyPy" and platform_python_implementation != "PyPy"
-Requires-Dist: pydantic==2.13.5
-Requires-Dist: pydantic-core==2.46.5
+Requires-Dist: pycparser==3.11; implementation_name != "PyPy" and platform_python_implementation != "PyPy"
+Requires-Dist: pydantic==2.14.1
+Requires-Dist: pydantic-core==2.50.1
 Requires-Dist: pydantic-settings==2.15.0
-Requires-Dist: pypdf==6.19.0
+Requires-Dist: pypdf==6.20.0
 Requires-Dist: python-barcode==0.16.1
 Requires-Dist: python-dateutil==2.9.0.post0
 Requires-Dist: python-dotenv==1.2.4
@@ -194,11 +194,12 @@ Requires-Dist: reportlab==5.0.1
 Requires-Dist: rsa==4.9.1
 Requires-Dist: six==1.17.0
 Requires-Dist: slowapi==0.1.10
-Requires-Dist: soupsieve==2.10
+Requires-Dist: soupsieve==2.10; python_full_version < "3.11.5"
+Requires-Dist: soupsieve==3.0.2; python_full_version >= "3.11.5"
 Requires-Dist: sqlalchemy==2.0.54; python_full_version < "3.11"
-Requires-Dist: sqlalchemy==2.1.3; python_full_version >= "3.11"
+Requires-Dist: sqlalchemy==2.1.4; python_full_version >= "3.11"
 Requires-Dist: starlette==1.7.0
-Requires-Dist: tomli==2.4.1; python_full_version < "3.11"
+Requires-Dist: tomli==2.5.0; python_full_version < "3.11"
 Requires-Dist: truststore==0.10.4; sys_platform != "emscripten"
 Requires-Dist: typing-extensions==4.16.0
 Requires-Dist: typing-inspection==0.4.4
@@ -300,7 +301,7 @@ card in the notifications panel.
 - Connect Shopify, WooCommerce, QuickBooks, Xero
 - Manufacturing - BOMs, production orders, merge/split/transform
 - CRM - contacts, pipeline, memos, activity feed
-- Recurring subscriptions with automatic invoicing
+- Recurring subscriptions: generate each invoice or purchase order when it is due
 - CSV import/export everything - idempotent, audited, column-mapped
 - Multi-company from one install
 - Role-based permissions - five access levels (viewer, operator, manager, admin, owner) for controlled employee access
@@ -329,7 +330,7 @@ Every business domain is a self-contained module. The full set ships with the do
 | `celerp-docs` | Invoices, POs, quotations, credit notes, receipts |
 | `celerp-accounting` | Chart of accounts, journal entries, P&L, balance sheet |
 | `celerp-reports` | AR/AP aging, sales, purchases, inventory valuation |
-| `celerp-subscriptions` | Recurring billing, auto-invoice generation |
+| `celerp-subscriptions` | Recurring billing templates; generate each document when it is due |
 | `celerp-manufacturing` | BOMs, production orders, merge/split/transform |
 | `celerp-labels` | Label printing, barcode generation |
 | `celerp-verticals` | Industry presets - configure for your business type on first run |

{celerp-2.5.4 → celerp-2.5.6}/README.md

@@ -73,7 +73,7 @@ card in the notifications panel.
 - Connect Shopify, WooCommerce, QuickBooks, Xero
 - Manufacturing - BOMs, production orders, merge/split/transform
 - CRM - contacts, pipeline, memos, activity feed
-- Recurring subscriptions with automatic invoicing
+- Recurring subscriptions: generate each invoice or purchase order when it is due
 - CSV import/export everything - idempotent, audited, column-mapped
 - Multi-company from one install
 - Role-based permissions - five access levels (viewer, operator, manager, admin, owner) for controlled employee access
@@ -102,7 +102,7 @@ Every business domain is a self-contained module. The full set ships with the do
 | `celerp-docs` | Invoices, POs, quotations, credit notes, receipts |
 | `celerp-accounting` | Chart of accounts, journal entries, P&L, balance sheet |
 | `celerp-reports` | AR/AP aging, sales, purchases, inventory valuation |
-| `celerp-subscriptions` | Recurring billing, auto-invoice generation |
+| `celerp-subscriptions` | Recurring billing templates; generate each document when it is due |
 | `celerp-manufacturing` | BOMs, production orders, merge/split/transform |
 | `celerp-labels` | Label printing, barcode generation |
 | `celerp-verticals` | Industry presets - configure for your business type on first run |

{celerp-2.5.4 → celerp-2.5.6}/celerp/accounting_roles.py

@@ -58,8 +58,11 @@ INVENTORY_ORIGIN_SCHEMA = 1
 # stock (celerp.services.lot_origin.in_stock). Only the system writes it.
 ON_BOOKS_FIELD = "inventory_on_books"
 
+# Settings > Accounting, which only those who manage accounting can use: a notice
+# linking into it is listed with no link to anyone else (notifications.service.link_for).
+ACCOUNTING_SETTINGS_PATH = "/settings/accounting"
 # Where a user fixes a missing or invalid role.
-POSTING_ACCOUNTS_PATH = "/settings/accounting?tab=posting-accounts"
+POSTING_ACCOUNTS_PATH = f"{ACCOUNTING_SETTINGS_PATH}?tab=posting-accounts"
 
 
 class AccountRole(StrEnum):

{celerp-2.5.4 → celerp-2.5.6}/celerp/config.py

@@ -125,8 +125,6 @@ class Settings(BaseSettings):
 
     # Cookie security — set True in prod (HTTPS); False allows HTTP in dev/CI
     cookie_secure: bool = False
-    # Redis URL for distributed rate limiting; empty = per-process only
-    redis_url: str = ""  # e.g. redis://localhost:6379/0
     # Email: SMTP fallback for self-hosted installs.
     # If GATEWAY_TOKEN is set, email routes through the cloud relay instead.
     # If neither is configured, email notifications are silently skipped.
@@ -137,13 +135,6 @@ class Settings(BaseSettings):
     smtp_from: str = ""
     smtp_from_name: str = "Celerp"  # Display name shown to recipients, e.g. "Acme ERP"
     smtp_tls: bool = True
-    # Worker counts for multi-worker server deploys.
-    # api_workers: number of Uvicorn workers for the API process.
-    # gui_workers: number of Uvicorn workers for the GUI process.
-    # Electron builds always use 1/1 regardless of this setting.
-    api_workers: int = 2
-    gui_workers: int = 1
-
     # GitHub-star CTA. The relay (celerp.com) is the single source of the count,
     # tier ladder, and copy; the install only renders the relay's resolved CTA and
     # falls back to a static neutral link when the relay is unreachable.

{celerp-2.5.4 → celerp-2.5.6}/celerp/events/engine.py

@@ -338,8 +338,10 @@ async def _record_lot_account(session, kwargs: dict, previous_state: dict | None
     inventory account when it is booked as opening stock (lot_origin.draft_boundary,
     lot_origin.recognize_opening_lots). Stock a migration brings in keeps the account its
     source books held it in. Nothing else is guessed: a snapshot of another system's item
-    records none until its stock is placed. No later event may change it: the lot's value
-    stays on that account for as long as the lot holds stock."""
+    records none until its stock is placed, which the writer bringing it in does at once
+    (lot_origin.place_company_stock). Only a move changes it (lot_origin.
+    move_lot_accounts), and only from the account the mover read, so a move made on a stale
+    read is refused rather than applied over a later one; its entry moves the value with it."""
     from celerp.accounting_roles import LOT_ACCOUNT_FIELD, refusal
     from celerp.services.account_roles import source_lot_account
 
@@ -360,6 +362,12 @@ async def _record_lot_account(session, kwargs: dict, previous_state: dict | None
                 "inventory.account_already_recorded",
                 "This stock already records its inventory account."))
         return
+    if kwargs["event_type"] == "item.inventory_account.moved":
+        if not current or current != data.get("from_account"):
+            raise HTTPException(status_code=409, detail=refusal(
+                "inventory.account_moved_since",
+                "This stock has moved to another inventory account since it was read. Reload and try again."))
+        return
     changed = data.get("fields_changed")
     if LOT_ACCOUNT_FIELD in data:
         written = data[LOT_ACCOUNT_FIELD]
@@ -550,7 +558,8 @@ async def emit_event(
     if kwargs["event_type"] == "acc.journal_entry.created":
         from celerp.services.journal_accounts import prepare_journal_entry
 
-        await prepare_journal_entry(session, kwargs.get("company_id"), kwargs["data"])
+        await prepare_journal_entry(session, kwargs.get("company_id"), kwargs["data"],
+                                    restored=bool((kwargs.get("metadata_") or {}).get("restores")))
 
     # Enforce the line rules on every document and List write. Extract the post-change
     # line set by DATA SHAPE so every writer (create, patch, shared_import, update,

{celerp-2.5.4 → celerp-2.5.6}/celerp/events/schemas.py

@@ -235,6 +235,7 @@ class ItemWrittenOff(BaseModel):
     cost_total: float
     reason: str | None = None
     source_list_id: str | None = None
+    doc_number: str | None = None
 
 
 class ItemReturnedToSupplier(BaseModel):
@@ -246,6 +247,13 @@ class ItemReturnedToSupplier(BaseModel):
     consignment_flag: str | None = None
 
 
+class ItemSupplierReturnUndone(BaseModel):
+    # The supplier credit note a return raised was voided: the goods that went back are in
+    # stock again, in the status they had before the return.
+    source_doc_id: str
+    restored_status: str
+
+
 class ItemSplit(BaseModel):
     # Aggregate marker on the MOTHER. The projection consumes child_ids/child_skus;
     # children_detail drives the per-child history rows (one row per child).
@@ -351,8 +359,15 @@ class ItemCostAdjusted(BaseModel):
 
 class ItemInventoryAccountRecorded(BaseModel):
     # A lot from before lots recorded their inventory account: the account the upgrade
-    # placed it on, or the one the user picked for it. Only a lot with no account can take one.
+    # placed it on. Only a lot with no account can take one.
+    inventory_account_code: str
+
+
+class ItemInventoryAccountMoved(BaseModel):
+    # Older stock placed automatically, moved to another inventory account (or back, when
+    # the move is undone). Applied only while the lot is still on ``from_account``.
     inventory_account_code: str
+    from_account: str
 
 
 class ItemConsignorPayableRecorded(BaseModel):
@@ -908,6 +923,15 @@ class DocReturnReceived(BaseModel):
     notes: str | None = None
 
 
+class DocSupplierReturnUndone(BaseModel):
+    """A return to the supplier undone by voiding the supplier credit note it raised: the
+    document holds the goods again and owes what the return took off it."""
+    return_key: str
+    supplier_credit_doc_id: str
+    payable_credit: float = 0.0
+    supplier_credit: float = 0.0
+
+
 class DocReturnUndone(BaseModel):
     undone_by: str
     undone_at: str = ""
@@ -1204,6 +1228,39 @@ class SysMigrationApplied(BaseModel):
     revision: str
 
 
+class SysOlderStockPlaced(BaseModel):
+    # One placement of older stock (lot_origin._place): the account its lots were placed
+    # on, what each inventory account held beyond its stock before (rooms), the value
+    # moved onto the account, recognized as opening stock or left unresolved, the cost
+    # invoices recognized on the lots before with no entry naming its account
+    # (provisional), and the journal entries that booked it.
+    placement: str
+    day: str
+    count: int
+    value: float
+    account: str
+    rooms: dict[str, float]
+    transferred: float
+    recognized: float
+    unresolved: float
+    provisional: float
+    classification: str
+    journal: list[str]
+
+
+class SysOlderStockCorrected(BaseModel):
+    # A correction of how a placement treated its difference (lot_origin.correct_placements):
+    # ``amount`` booked onto the books (off them when negative), and what the placement
+    # has recognized and left unresolved after it.
+    placement: str
+    kind: str
+    day: str
+    amount: float
+    recognized: float
+    unresolved: float
+    journal: str
+
+
 # Subscription schemas - open/permissive since subscription data is user-defined
 class SubCreated(BaseModel):
     model_config = {"extra": "allow"}
@@ -1348,6 +1405,7 @@ EVENT_SCHEMA_MAP: dict[str, type[BaseModel]] = {
     "item.expired": ItemExpired,
     "item.written_off": ItemWrittenOff,
     "item.returned_to_supplier": ItemReturnedToSupplier,
+    "item.supplier_return_undone": ItemSupplierReturnUndone,
     "item.split": ItemSplit,
     "item.split_from": ItemSplitFrom,
     "item.transform": ItemTransform,
@@ -1361,6 +1419,7 @@ EVENT_SCHEMA_MAP: dict[str, type[BaseModel]] = {
     "item.produced": ItemProduced,
     "item.cost_adjusted": ItemCostAdjusted,
     "item.inventory_account.recorded": ItemInventoryAccountRecorded,
+    "item.inventory_account.moved": ItemInventoryAccountMoved,
     "item.consignor_payable.recorded": ItemConsignorPayableRecorded,
     "item.consignment.bought": ItemConsignmentBought,
     "item.inventory_on_books.recorded": ItemInventoryOnBooksRecorded,
@@ -1447,6 +1506,7 @@ EVENT_SCHEMA_MAP: dict[str, type[BaseModel]] = {
     "doc.items_returned": DocItemsReturned,
     "doc.return_received": DocReturnReceived,
     "doc.return_undone": DocReturnUndone,
+    "doc.supplier_return_undone": DocSupplierReturnUndone,
     "doc.receive_undone": DocReceiveUndone,
     "doc.fulfillment_reversed": DocFulfillmentReversed,
 
@@ -1489,6 +1549,8 @@ EVENT_SCHEMA_MAP: dict[str, type[BaseModel]] = {
     "sys.api_key.revoked": SysApiKeyRevoked,
     "sys.backup.created": SysBackupCreated,
     "sys.migration.applied": SysMigrationApplied,
+    "sys.older_stock.placed": SysOlderStockPlaced,
+    "sys.older_stock.corrected": SysOlderStockCorrected,
 
     # Lists
     "list.created": ListCreated,

{celerp-2.5.4 → celerp-2.5.6}/celerp/events/types.py

@@ -17,6 +17,7 @@ class EventType(StrEnum):
     ITEM_EXPIRED = "item.expired"
     ITEM_WRITTEN_OFF = "item.written_off"
     ITEM_RETURNED_TO_SUPPLIER = "item.returned_to_supplier"
+    ITEM_SUPPLIER_RETURN_UNDONE = "item.supplier_return_undone"
     ITEM_SPLIT = "item.split"
     ITEM_SPLIT_FROM = "item.split_from"
     ITEM_TRANSFORM = "item.transform"
@@ -26,6 +27,7 @@ class EventType(StrEnum):
     ITEM_PRODUCED = "item.produced"
     ITEM_COST_ADJUSTED = "item.cost_adjusted"
     ITEM_INVENTORY_ACCOUNT_RECORDED = "item.inventory_account.recorded"
+    ITEM_INVENTORY_ACCOUNT_MOVED = "item.inventory_account.moved"
     ITEM_CONSIGNOR_PAYABLE_RECORDED = "item.consignor_payable.recorded"
     ITEM_CONSIGNMENT_BOUGHT = "item.consignment.bought"
     ITEM_INVENTORY_ON_BOOKS_RECORDED = "item.inventory_on_books.recorded"
@@ -80,6 +82,7 @@ class EventType(StrEnum):
     DOC_CONVERTED = "doc.converted"
     DOC_RECEIVED = "doc.received"
     DOC_ITEMS_RETURNED = "doc.items_returned"
+    DOC_SUPPLIER_RETURN_UNDONE = "doc.supplier_return_undone"
     DOC_FILE_ATTACHED = "doc.file_attached"
     DOC_FILE_TAGGED = "doc.file_tagged"
     DOC_FILE_DELETED = "doc.file_deleted"
@@ -137,3 +140,5 @@ class EventType(StrEnum):
     SYS_API_KEY_REVOKED = "sys.api_key.revoked"
     SYS_BACKUP_CREATED = "sys.backup.created"
     SYS_MIGRATION_APPLIED = "sys.migration.applied"
+    SYS_OLDER_STOCK_PLACED = "sys.older_stock.placed"
+    SYS_OLDER_STOCK_CORRECTED = "sys.older_stock.corrected"

{celerp-2.5.4 → celerp-2.5.6}/celerp/gateway/client.py

@@ -48,6 +48,9 @@ _REAP_GRACE = 5 * 60       # seconds
 # socket is wedged (a stalled or backpressured peer). Bound every send so it surfaces as an
 # error instead of pinning the proxy task holding a relay slot forever.
 _SEND_DEADLINE = 30        # seconds
+# Anonymous API-app pages a visitor opens from a link: shared documents and pay links.
+# Matched on a segment boundary, so /payments or /shared-thing stay on the UI server.
+_PUBLIC_API_PREFIXES = ("/share", "/pay")
 
 
 class _SharedProxyTransport(httpx.AsyncHTTPTransport):
@@ -172,11 +175,11 @@ class GatewayClient:
         /api/, which are UI-server endpoints (HTMX fragments, image/barcode
         previews, item & bulk actions), NOT the internal data API. The API
         server is an internal backend the UI calls server-side via api_client.
-        The one exception: public share links (/share/<token>[/bundle]) are
-        anonymous API-app routes, so they must go to the API port — routed to
-        the UI server they 404 and every shared link is dead.
+        The exceptions are the anonymous API-app pages a visitor opens from a link
+        (_PUBLIC_API_PREFIXES): routed to the UI server they 404, so every shared
+        document and every pay link would be dead.
         """
-        if path == "/share" or path.startswith("/share/"):
+        if any(path == p or path.startswith(p + "/") for p in _PUBLIC_API_PREFIXES):
             return self._api_port
         return self._ui_port
 
@@ -963,6 +966,15 @@ class GatewayClient:
         # the same local app), but the original path is forwarded verbatim so the
         # local server performs its own decoding.
         port = self._local_port_for(policy_path)
+        # The local server takes a forwarding address from this machine as the visitor's,
+        # but the one the relay copies names an edge server or whatever the visitor typed.
+        # Without it every proxied visitor arrives from loopback, which names no one.
+        # The caller header is likewise trusted from loopback as the visitor the UI
+        # server names, so a visitor who sets it would choose whose sign-ins they spend.
+        from celerp.services.auth import CALLER_HEADER
+
+        dropped = {"x-forwarded-for", CALLER_HEADER.lower()}
+        headers = {k: v for k, v in headers.items() if k.lower() not in dropped}
 
         url = f"http://127.0.0.1:{port}{raw_path}"
         if query:

{celerp-2.5.4 → celerp-2.5.6}/celerp/main.py

@@ -13,15 +13,14 @@ from fastapi import FastAPI, Request
 from fastapi.encoders import jsonable_encoder
 from fastapi.exceptions import RequestValidationError
 from fastapi.responses import JSONResponse
-from slowapi import Limiter, _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
-from slowapi.util import get_remote_address
 
 from celerp import __version__, runtime as _runtime
 _runtime.watch_supervisor_pipe()
 from celerp.db import create_tables, engine, lifecycle_engine, mask_db_credentials
 from celerp.inventory_codes import CodeConflictError
 from celerp.projections.engine import UnhandledEventsError
+from celerp.services.account_roles import PostingRoleError
 from celerp.services.auto_je import UnbalancedJournalEntry
 from celerp.config import settings, assert_secure_jwt, ensure_instance_id, load_cloud_config, load_backup_config
 load_cloud_config()
@@ -43,7 +42,7 @@ from celerp.held_back import (
     module_start_step,
     unowned_error,
 )
-from celerp.middleware import DrainMiddleware, MaxBodySizeMiddleware, ModuleStartupMiddleware, RecoveryMaintenanceMiddleware, SecurityHeadersMiddleware, SlidingTokenRefreshMiddleware, log_unhandled_exception
+from celerp.middleware import DrainMiddleware, MaxBodySizeMiddleware, ModuleStartupMiddleware, OlderStockMiddleware, RecoveryMaintenanceMiddleware, SecurityHeadersMiddleware, SlidingTokenRefreshMiddleware, log_unhandled_exception, notify_refused
 from ui.i18n import I18nMiddleware, t
 
 from celerp.routers import auth, companies, company_backup, ledger, migrations
@@ -641,9 +640,6 @@ async def _serve(_app: FastAPI, held):
 logging.basicConfig(level=settings.log_level.upper())
 log = logging.getLogger(__name__)
 
-_storage_uri = settings.redis_url or "memory://"
-limiter = Limiter(key_func=get_remote_address, default_limits=["60/minute"], storage_uri=_storage_uri)
-
 _OPENAPI_TAGS = [
     {"name": "auth", "description": "Authenticate users and manage sessions and access tokens."},
     {"name": "companies", "description": "Manage companies, members, and roles."},
@@ -656,7 +652,7 @@ _OPENAPI_TAGS = [
     {"name": "manufacturing", "description": "Manage bills of materials and production orders."},
     {"name": "labels", "description": "Manage label templates, barcodes, and printing."},
     {"name": "crm", "description": "Manage contacts, pipeline, and activity."},
-    {"name": "subscriptions", "description": "Manage recurring billing and automatic invoicing."},
+    {"name": "subscriptions", "description": "Manage recurring billing templates and generate each document when it is due."},
     {"name": "connectors", "description": "Configure and operate external integrations."},
     {"name": "payments", "description": "Manage payment collection."},
     {"name": "backup", "description": "Export and import Celerp data."},
@@ -703,8 +699,8 @@ def _openapi_settings() -> dict:
 
 
 app = FastAPI(title="Celerp REST API", docs_url=None, redoc_url=None, lifespan=lifespan, **_openapi_settings())
-app.state.limiter = limiter
-app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
+# Innermost, so a request it runs again passes every check below once more.
+app.add_middleware(OlderStockMiddleware)
 app.add_middleware(DrainMiddleware)
 app.add_middleware(RecoveryMaintenanceMiddleware)
 app.add_middleware(ModuleStartupMiddleware)
@@ -771,6 +767,19 @@ async def unhandled_events_handler(_request: Request, exc: UnhandledEventsError)
     return JSONResponse(status_code=409, content={"detail": str(exc)})
 
 
+@app.exception_handler(PostingRoleError)
+async def posting_refused_handler(request: Request, exc: PostingRoleError):
+    # Those who manage accounting are notified of the roles refused (notify_refused);
+    # the refusal is returned whether or not that succeeds.
+    company_id = getattr(request.state, "company_id", None)
+    if company_id is not None:
+        try:
+            await notify_refused(company_id, [p["params"]["role"] for p in exc.detail["params"]["problems"]])
+        except Exception:
+            logging.getLogger(__name__).exception("Could not notify a refused posting")
+    return JSONResponse(status_code=exc.status_code, content={"detail": exc.detail}, headers=exc.headers)
+
+
 @app.exception_handler(UnbalancedJournalEntry)
 async def unbalanced_je_handler(_request: Request, exc: UnbalancedJournalEntry):
     # An automatic journal entry that would not balance is refused, and the write that

{celerp-2.5.4 → celerp-2.5.6}/celerp/middleware.py

@@ -6,8 +6,13 @@ from __future__ import annotations
 import json
 import logging
 import time
+from contextvars import ContextVar
+from dataclasses import dataclass, field
 from typing import Callable
 
+from sqlalchemy import event
+from sqlalchemy.engine import Engine
+
 from starlette.requests import Request
 from starlette.responses import JSONResponse, Response
 from starlette.types import ASGIApp, Receive, Scope, Send
@@ -321,6 +326,156 @@ class DrainMiddleware:
         await self.app(scope, receive, send)
 
 
+class OlderStockMiddleware:
+    """Run a write request once more after placing older stock it was refused for.
+
+    A request refused only because a lot it needs records no inventory account yet
+    (lot_origin.PLACEABLE_REFUSALS) has ended, rolled back, holding nothing. Its
+    company's stock is then placed the one way (lot_origin.place_unplaced_stock) in a
+    transaction of its own, and once none waits the request runs again, once, and its
+    answer is the one returned. Placing that cannot happen (a posting account or a
+    period lock holds it back, each with its own notice) returns the refusal as it was.
+    Only a writer marked lot_origin.rerun_after_placing runs again, as nothing it does
+    before such a refusal reaches outside the database; and not when it committed any
+    write before it was refused (_WRITES), so nothing it wrote is written twice. Any
+    other has its stock placed and its refusal returned. The company is the one the
+    request was authorised for (auth.get_auth_context)."""
+
+    _REFUSED = (409, 422)
+
+    def __init__(self, app: ASGIApp) -> None:
+        self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http" or scope.get("method", "") not in _WRITE_METHODS:
+            await self.app(scope, receive, send)
+            return
+        body, more = [], True
+        while more:
+            message = await receive()
+            if message["type"] != "http.request":
+                return  # the client went away before sending the request
+            body.append(message.get("body", b""))
+            more = message.get("more_body", False)
+        body = b"".join(body)
+        token = _WRITES.set(writes := _Writes())
+        try:
+            held = await self._run(scope, body, receive, send)
+        finally:
+            _WRITES.reset(token)
+        if held is None:
+            return
+        company_id = (scope.get("state") or {}).get("company_id")
+        if (company_id is not None and _placeable(held) and await _placed(company_id) and not writes.committed
+                and _reruns(scope)):
+            await self._run(scope, body, receive, send, hold=False)
+            return
+        for message in held:
+            await send(message)
+
+    async def _run(self, scope: Scope, body: bytes, receive: Receive, send: Send, *,
+                   hold: bool = True) -> list[dict] | None:
+        """Run the request on ``body``. A refusal is kept and returned instead of sent
+        when ``hold``; anything else is sent as it comes and None returned."""
+        sent = False
+        held: list[dict] = []
+
+        async def replay() -> dict:
+            nonlocal sent
+            if sent:
+                return await receive()
+            sent = True
+            return {"type": "http.request", "body": body, "more_body": False}
+
+        async def keep(message: dict) -> None:
+            if held or (hold and message["type"] == "http.response.start" and message["status"] in self._REFUSED):
+                held.append(message)
+            else:
+                await send(message)
+
+        await self.app(scope, replay, keep)
+        return held or None
+
+
+@dataclass
+class _Writes:
+    """What a request run by OlderStockMiddleware wrote: the connections holding a write
+    not committed yet (by id), and whether any write was committed."""
+    pending: set[int] = field(default_factory=set)
+    committed: bool = False
+
+
+# Set while OlderStockMiddleware runs a request the first time. A statement other than
+# a read marks its connection, and that connection's commit marks the request as having
+# kept a write, whether through a session's objects, a text or Core statement, or a
+# connection of its own. A released savepoint is not a commit; a write inside one
+# rolled back still counts, which only ever keeps a request from running again. Only
+# the connection's identity is read, so a connection being invalidated is never touched.
+_WRITES: ContextVar[_Writes | None] = ContextVar("older_stock_writes", default=None)
+_READS = frozenset({"SELECT", "SHOW", "SAVEPOINT", "RELEASE", "ROLLBACK", "BEGIN", "COMMIT", "SET"})
+
+
+@event.listens_for(Engine, "begin")
+@event.listens_for(Engine, "rollback")
+def _discarded(conn) -> None:
+    if (writes := _WRITES.get()) is not None:
+        writes.pending.discard(id(conn))
+
+
+@event.listens_for(Engine, "after_cursor_execute")
+def _executed(conn, _cursor, statement: str, _parameters, _context, _executemany) -> None:
+    writes = _WRITES.get()
+    if writes is not None and (statement.split(None, 1) or ["SELECT"])[0].upper() not in _READS:
+        writes.pending.add(id(conn))
+
+
+@event.listens_for(Engine, "commit")
+def _committed(conn) -> None:
+    if (writes := _WRITES.get()) is not None and id(conn) in writes.pending:
+        writes.pending.discard(id(conn))
+        writes.committed = True
+
+
+def _reruns(scope: Scope) -> bool:
+    """Whether the request's writer may run again (lot_origin.rerun_after_placing)."""
+    from celerp.services.lot_origin import RERUN_AFTER_PLACING
+
+    return getattr(scope.get("endpoint"), RERUN_AFTER_PLACING, False)
+
+
+def _placeable(held: list[dict]) -> bool:
+    """Whether a held refusal is one placing older stock can lift."""
+    from celerp.services.lot_origin import PLACEABLE_REFUSALS
+
+    try:
+        detail = json.loads(b"".join(m.get("body", b"") for m in held[1:])).get("detail")
+    except (ValueError, AttributeError):
+        return False
+    return isinstance(detail, dict) and detail.get("message_key") in PLACEABLE_REFUSALS
+
+
+async def _placed(company_id) -> bool:
+    from celerp.services.lot_origin import place_unplaced_stock
+
+    async with get_session_ctx() as session:
+        await session.rollback()  # nothing of the refused request is kept
+        placed = await place_unplaced_stock(session, company_id)
+        await session.commit()
+    return placed
+
+
+async def notify_refused(company_id, roles: list[str]) -> None:
+    """A posting was refused because ``roles`` have no account that can take it. The
+    refused request has rolled back, so those who manage accounting are notified in a
+    transaction of its own (posting_readiness.notify_unmapped)."""
+    from celerp.services.posting_readiness import notify_unmapped
+
+    async with get_session_ctx() as session:
+        await session.rollback()
+        await notify_unmapped(session, company_id, roles)
+        await session.commit()
+
+
 # The anonymous liveness probes, matched exactly: the only routes an unfinished
 # System Recovery still serves. Readiness is refused until the recovery converges,
 # so nothing routes traffic to an installation that answers only 503s. Never a