lambda-erp 1.2.2__tar.gz → 1.3.0__tar.gz

{lambda_erp-1.2.2 → lambda_erp-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lambda-erp
-Version: 1.2.2
+Version: 1.3.0
 Summary: Core ERP logic - accounting, sales, purchasing, inventory
 Author: TORUS INVESTMENTS AG
 License-Expression: Apache-2.0

{lambda_erp-1.2.2 → lambda_erp-1.3.0}/api/auth.py

@@ -35,12 +35,19 @@ def _resolve_jwt_secret() -> str:
       3. Newly-generated random secret (only used if the filesystem is
          read-only or inaccessible — cookies will be invalidated on
          restart in that degenerate case).
+
+    A Postgres deployment must set JWT_SECRET_KEY: there is no DB file to
+    sit next to, so the file would land on the container's own disk and
+    every replica and restart would sign with a different key, logging
+    users out at random.
     """
     env_secret = os.environ.get("JWT_SECRET_KEY")
     if env_secret:
         return env_secret
 
     db_path = os.environ.get("LAMBDA_ERP_DB", "lambda_erp.db")
+    if db_path.startswith(("postgresql://", "postgres://")):
+        raise RuntimeError("JWT_SECRET_KEY must be set when LAMBDA_ERP_DB is a Postgres URL")
     data_dir = os.path.dirname(os.path.abspath(db_path)) or "."
     secret_file = os.path.join(data_dir, ".jwt_secret")
 
@@ -338,6 +345,19 @@ def validate_assignable_role(role: str) -> str:
     return role
 
 
+def claim_invite(db, token: str) -> None:
+    """Mark an invite used, exactly once. The conditional UPDATE is the check:
+    two sign-ups racing on one invite both pass the earlier read, but only one
+    row update succeeds."""
+    with db._lock:
+        cursor = db.conn.execute(
+            'UPDATE "Invite" SET used = 1 WHERE token = ? AND COALESCE(used, 0) = 0', [token])
+        claimed = cursor.rowcount == 1
+        db.conn.commit()
+    if not claimed:
+        raise HTTPException(status_code=410, detail="Invite already used")
+
+
 def require_role(minimum_role: str):
     """Returns a dependency that checks the user has at least the specified role."""
     min_level = ROLE_HIERARCHY[minimum_role]
@@ -450,8 +470,7 @@ def register(data: RegisterRequest, request: Request, response: Response):
             raise HTTPException(status_code=403, detail="This invite was issued for a different email")
 
         role = validate_assignable_role(invite["role"])
-        db.sql('UPDATE "Invite" SET used = 1 WHERE token = ?', [data.invite_token])
-        db.conn.commit()
+        claim_invite(db, data.invite_token)
     elif _setting_enabled(db, "allow_public_signup"):
         # Open signup is enabled: anyone may self-register, but only as a viewer.
         role = "viewer"

{lambda_erp-1.2.2 → lambda_erp-1.3.0}/api/chat.py

@@ -146,6 +146,74 @@ def can_access_session(session: dict | None, user: dict | None) -> bool:
     return session.get("user_id") == user.get("name")
 
 
+# A session runs one agent turn at a time. The claim lives on the session row,
+# so it holds across browser tabs, the REST chat API and app processes; a
+# per-connection check let two turns build on the same history and both write.
+# The deadline frees the session if the process running the turn died.
+TURN_LEASE_SECONDS = 30 * 60
+
+
+def _utc_iso(offset_seconds: int = 0) -> str:
+    from datetime import datetime, timedelta, timezone
+    return (datetime.now(timezone.utc) + timedelta(seconds=offset_seconds)).isoformat(timespec="seconds")
+
+
+def claim_session_turn(session_id: str) -> str | None:
+    """Claim the session for one turn; return the claim token, or None while
+    another turn is still running on it."""
+    db = get_db()
+    token = uuid.uuid4().hex
+    with db._lock:
+        cursor = db.conn.execute(
+            'UPDATE "Chat Session" SET active_turn = ?, active_turn_until = ? '
+            "WHERE id = ? AND (active_turn IS NULL OR active_turn_until IS NULL "
+            "OR active_turn_until < ?)",
+            [token, _utc_iso(TURN_LEASE_SECONDS), session_id, _utc_iso()],
+        )
+        claimed = cursor.rowcount == 1
+        db.conn.commit()
+    return token if claimed else None
+
+
+def release_session_turn(session_id: str, token: str | None) -> None:
+    if not token:
+        return
+    db = get_db()
+    with db._lock:
+        db.conn.execute(
+            'UPDATE "Chat Session" SET active_turn = NULL, active_turn_until = NULL '
+            "WHERE id = ? AND active_turn = ?",
+            [session_id, token],
+        )
+        db.conn.commit()
+
+
+def session_turn_running(session_id: str) -> bool:
+    rows = get_db().sql(
+        'SELECT active_turn_until FROM "Chat Session" WHERE id = ? AND active_turn IS NOT NULL',
+        [session_id],
+    )
+    return bool(rows and rows[0]["active_turn_until"] and rows[0]["active_turn_until"] >= _utc_iso())
+
+
+# Turns whose socket closed keep running to completion (see chat_websocket);
+# hold references so they aren't garbage-collected, and so shutdown can wait.
+_DETACHED_TURNS: set[asyncio.Task] = set()
+
+
+def detach_turn(task: asyncio.Task) -> None:
+    _DETACHED_TURNS.add(task)
+    task.add_done_callback(_DETACHED_TURNS.discard)
+
+
+async def drain_turns(timeout: float) -> None:
+    """On shutdown, give turns that are still running time to finish and
+    persist their results instead of dying between a tool call and its reply."""
+    pending = [task for task in _DETACHED_TURNS if not task.done()]
+    if pending:
+        await asyncio.wait(pending, timeout=timeout)
+
+
 def delete_session(session_id: str):
     """Delete a chat session, its messages, and its attachments."""
     try:
@@ -440,6 +508,8 @@ def api_delete_session(session_id: str, user: dict = _Depends(get_current_user))
     session = get_session(session_id)
     if not can_access_session(session, user):
         return {"detail": "Session not found"}
+    if session_turn_running(session_id):
+        raise HTTPException(status_code=409, detail="Wait for the current response to finish before deleting this chat.")
     delete_session(session_id)
     return {"ok": True}
 
@@ -4142,7 +4212,9 @@ async def chat_websocket(
         finally:
             session_tasks.pop(target_session_id, None)
 
-    async def process_session_message(target_session_id: str, user_content: str, attachment_ids: list | None = None):
+    async def process_session_message(target_session_id: str, user_content: str,
+                                      attachment_ids: list | None = None,
+                                      turn_token: str | None = None):
         try:
             async def on_event(event: dict):
                 await send_event(event["type"], session_id=target_session_id, **{
@@ -4169,7 +4241,9 @@ async def chat_websocket(
         except Exception as e:
             await send_error(str(e), session_id=target_session_id)
         finally:
-            session_tasks.pop(target_session_id, None)
+            release_session_turn(target_session_id, turn_token)
+            if session_tasks.get(target_session_id) is asyncio.current_task():
+                session_tasks.pop(target_session_id, None)
 
     try:
         await send_event("sessions_list", sessions=list_sessions(user_id=ws_user_id, role=ws_user_role))
@@ -4240,7 +4314,7 @@ async def chat_websocket(
                     continue
 
                 active_task = session_tasks.get(session_id)
-                if active_task and not active_task.done():
+                if (active_task and not active_task.done()) or session_turn_running(session_id):
                     await send_error(
                         "Wait for the current response to finish before deleting this chat.",
                         request_id=request_id,
@@ -4263,7 +4337,7 @@ async def chat_websocket(
                     continue
 
                 active_task = session_tasks.get(session_id)
-                if active_task and not active_task.done():
+                if (active_task and not active_task.done()) or session_turn_running(session_id):
                     await send_error(
                         "Wait for the current response to finish before clearing this chat.",
                         request_id=request_id,
@@ -4347,7 +4421,8 @@ async def chat_websocket(
 
                 session = get_session(session_id)
                 await send_event("demo_started", request_id=request_id, session_id=session_id, title=session["title"] if session else "New Chat")
-                session_tasks[session_id] = asyncio.create_task(replay_demo_session(session_id))
+                session_tasks[session_id] = asyncio.create_task(
+                    replay_demo_session(session_id), name=f"demo:{session_id}")
                 continue
 
             if msg_type == "transcribe":
@@ -4503,10 +4578,24 @@ async def chat_websocket(
                 if aid in session_attachments
             ]
 
-            save_chat_message(
-                session_id, "user", user_content or "",
-                metadata={"attachments": attached_meta} if attached_meta else None,
-            )
+            # Claimed before the user message is stored, so a second tab (or
+            # another app process) can't add a message to a running turn.
+            turn_token = claim_session_turn(session_id)
+            if not turn_token:
+                await send_error(
+                    "Wait for the current response to finish before sending another message.",
+                    request_id=request_id,
+                    session_id=session_id,
+                )
+                continue
+            try:
+                save_chat_message(
+                    session_id, "user", user_content or "",
+                    metadata={"attachments": attached_meta} if attached_meta else None,
+                )
+            except BaseException:
+                release_session_turn(session_id, turn_token)
+                raise
             await send_message_added(
                 session_id, "user", user_content or "",
                 attachments=attached_meta if attached_meta else None,
@@ -4520,11 +4609,21 @@ async def chat_websocket(
             await send_event("thinking", session_id=session_id, iteration=1)
 
             session_tasks[session_id] = asyncio.create_task(
-                process_session_message(session_id, user_content, attachment_ids)
+                process_session_message(session_id, user_content, attachment_ids, turn_token),
+                name=f"turn:{session_id}",
             )
 
     except WebSocketDisconnect:
-        for task in session_tasks.values():
-            task.cancel()
+        pass
     except Exception as e:
         await send_error(str(e))
+    finally:
+        # A demo replay is only presentation: stop it. An agent turn may be
+        # between a tool's write and its result: cancelling it would commit the
+        # write but lose the result and the reply, so the user retries and the
+        # write happens twice. Let it finish; history shows it on reconnect.
+        for task in list(session_tasks.values()):
+            if task.get_name().startswith("demo:"):
+                task.cancel()
+            elif not task.done():
+                detach_turn(task)

{lambda_erp-1.2.2 → lambda_erp-1.3.0}/api/main.py

@@ -51,41 +51,48 @@ def load_plugins() -> None:
 async def lifespan(app: FastAPI):
     # Startup: initialize database
     db_path = os.environ.get("LAMBDA_ERP_DB", "lambda_erp.db")
-    setup(db_path)
+    db = setup(db_path)
 
-    from api.mentions import initialize_mentions
-    initialize_mentions()
+    # Plugin schema, migrations and seeding run one process at a time, like
+    # the core migrations inside setup(): replicas booting together must not
+    # race each other through them.
+    with db.startup_lock():
+        from api.mentions import initialize_mentions
+        initialize_mentions()
 
-    # Load customer extension plugins before anything creates documents.
-    load_plugins()
+        # Load customer extension plugins before anything creates documents.
+        load_plugins()
 
-    # Create plugin-registered tables and run their pending migrations. Must be
-    # after load_plugins() (registrations happen in register()) and before any
-    # document is created.
-    from api.services import apply_plugin_schema
-    apply_plugin_schema()
+        # Create plugin-registered tables and run their pending migrations. Must be
+        # after load_plugins() (registrations happen in register()) and before any
+        # document is created.
+        from api.services import apply_plugin_schema
+        apply_plugin_schema()
 
-    from api.pdf_profiles import validate_pdf_registry
-    validate_pdf_registry()
+        from api.pdf_profiles import validate_pdf_registry
+        validate_pdf_registry()
 
-    # Ensure the demo spend log table exists before any LLM call happens.
-    from api.demo_limits import init_schema as init_demo_spend_schema
-    init_demo_spend_schema()
+        # Ensure the demo spend log table exists before any LLM call happens.
+        from api.demo_limits import init_schema as init_demo_spend_schema
+        init_demo_spend_schema()
 
-    # Seed a deterministic admin from the environment (if configured) before
-    # anyone can register. On deployments whose DB is recreated each rollout
-    # this stops the first visitor after a redeploy from grabbing admin.
-    from api.auth import ensure_seed_admin
-    ensure_seed_admin()
+        # Seed a deterministic admin from the environment (if configured) before
+        # anyone can register. On deployments whose DB is recreated each rollout
+        # this stops the first visitor after a redeploy from grabbing admin.
+        from api.auth import ensure_seed_admin
+        ensure_seed_admin()
 
-    # When packaged as a demo container, land visitors straight in demo mode.
-    if os.environ.get("LAMBDA_ERP_AUTO_DEMO") == "1":
-        from api.bootstrap import bootstrap_demo
+        # When packaged as a demo container, land visitors straight in demo mode.
+        if os.environ.get("LAMBDA_ERP_AUTO_DEMO") == "1":
+            from api.bootstrap import bootstrap_demo
 
-        bootstrap_demo()
+            bootstrap_demo()
 
     yield
-    # Shutdown: nothing to clean up (SQLite handles it)
+    # Shutdown: let chat turns whose sockets already closed finish and save
+    # their results. Stay inside the container's termination grace period.
+    from api.chat import drain_turns
+    await drain_turns(timeout=float(os.environ.get("LAMBDA_ERP_SHUTDOWN_DRAIN_SECONDS", "20")))
 
 
 app = FastAPI(

{lambda_erp-1.2.2 → lambda_erp-1.3.0}/api/oauth.py

@@ -47,6 +47,7 @@ from api.auth import (
     require_interactive_user,
     _is_https_request,
     validate_assignable_role,
+    claim_invite,
     _setting_enabled,
 )
 
@@ -362,8 +363,7 @@ def _consume_invite(db, invite_token: str, email: str) -> str:
     if invite["email"].lower() != email.lower():
         raise HTTPException(status_code=403, detail="This invite was issued for a different email")
     role = validate_assignable_role(invite["role"])
-    db.sql('UPDATE "Invite" SET used = 1 WHERE token = ?', [invite_token])
-    db.conn.commit()
+    claim_invite(db, invite_token)
     return role
 
 

{lambda_erp-1.2.2 → lambda_erp-1.3.0}/api/routers/bank_statements.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import asyncio
 import json
 from urllib.parse import quote
 
@@ -44,7 +45,8 @@ async def preview_bank_statements(
     _user: dict = Depends(require_non_public_manager),
 ):
     """Parse uploads without writing any statement or transaction data."""
-    return preview_documents(await _parse_uploads(files))
+    # Parsing and matching are synchronous DB work: keep them off the event loop.
+    return await asyncio.to_thread(preview_documents, await _parse_uploads(files))
 
 
 @router.post("/import")
@@ -64,8 +66,9 @@ async def import_bank_statements(
     ):
         raise HTTPException(status_code=422, detail="mappings must map statement keys to Bank Accounts")
     try:
-        return import_documents(
-            await _parse_uploads(files), parsed_mappings, imported_by=user.get("name")
+        return await asyncio.to_thread(
+            import_documents, await _parse_uploads(files), parsed_mappings,
+            imported_by=user.get("name"),
         )
     except ValidationError as exc:
         raise HTTPException(status_code=422, detail=str(exc)) from exc

{lambda_erp-1.2.2 → lambda_erp-1.3.0}/api/routers/chat_api.py

@@ -23,12 +23,15 @@ from pydantic import BaseModel
 
 from api.auth import get_api_caller
 from api.chat import (
+    claim_session_turn,
     create_session,
     delete_session,
     get_session,
     list_sessions,
+    release_session_turn,
     run_session_turn,
     save_chat_message,
+    session_turn_running,
 )
 from api.pdf import generate_pdf
 from api.pdf_exports import create_pdf_export, get_pdf_export, pdf_content_disposition
@@ -81,8 +84,23 @@ async def chat(payload: ChatApiRequest, request: Request, caller: dict = Depends
         target_session_id = existing[0]["id"] if existing else create_session(user_id=owner)["id"]
         replay_history = False
 
-    save_chat_message(target_session_id, "user", message)
-
+    # A continued session replays its history, so a second message must wait
+    # for the running turn (same rule as the web chat). The rolling audit
+    # session is stateless; parallel calls on it stay allowed.
+    turn_token = None
+    if replay_history:
+        turn_token = claim_session_turn(target_session_id)
+        if not turn_token:
+            raise HTTPException(status_code=409, detail="A reply is still running in this session; retry when it finishes")
+    try:
+        save_chat_message(target_session_id, "user", message)
+        return await _run_chat_turn(
+            target_session_id, message, caller, request, replay_history)
+    finally:
+        release_session_turn(target_session_id, turn_token)
+
+
+async def _run_chat_turn(target_session_id, message, caller, request, replay_history):
     tool_results = []
     generated = []
     pdf_attempts = {}
@@ -168,5 +186,7 @@ def delete(session_id: str, caller: dict = Depends(get_api_caller)):
     session = get_session(session_id)
     if not session or session.get("user_id") != caller["name"]:
         raise HTTPException(status_code=404, detail="Session not found")
+    if session_turn_running(session_id):
+        raise HTTPException(status_code=409, detail="A reply is still running in this session")
     delete_session(session_id)
     return {"id": session_id, "deleted": True}

{lambda_erp-1.2.2 → lambda_erp-1.3.0}/api/routers/masters.py

@@ -1,6 +1,5 @@
 """Master data CRUD: Customer, Supplier, Item, Warehouse, Account, Company."""
 
-import re
 import secrets
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
@@ -171,26 +170,15 @@ def _find_reference(master_type: str, name: str) -> str | None:
 
 
 def _generate_master_name(db, doctype: str, prefix: str, digits: int = 3) -> str:
-    # Take the highest numeric suffix among strict "PREFIX-<digits>" names.
-    # Names with a non-numeric tail (e.g. a custom "ITEM-COST-TEST") are ignored
-    # rather than parsed — string-sorting them to the top used to reset the
-    # counter to 001 and collide with an existing record.
-    rows = db.sql(
-        f'SELECT name FROM "{doctype}" WHERE name LIKE ?',
-        [f"{prefix}-%"],
-    )
-    pattern = re.compile(rf"^{re.escape(prefix)}-(\d+)$")
-    max_number = 0
-    for row in rows:
-        match = pattern.match(row["name"] or "")
-        if match:
-            max_number = max(max_number, int(match.group(1)))
-
-    # Skip any number already taken by a non-standard name so we never collide.
-    number = max_number + 1
-    while db.exists(doctype, f"{prefix}-{number:0{digits}d}"):
-        number += 1
-    return f"{prefix}-{number:0{digits}d}"
+    # The shared naming series (the same one documents use), so concurrent
+    # creates, other processes and a doctype that is both a master and a
+    # document (Lead) never pick the same number. Seeding counts only strict
+    # "PREFIX-<digits>" names, so a custom "ITEM-COST-TEST" doesn't move it.
+    # Skip any number already taken by a record created with an explicit name.
+    while True:
+        name = f"{prefix}-{db.next_in_series(prefix):0{digits}d}"
+        if not db.exists(doctype, name):
+            return name
 
 
 def _generate_random_master_name(db, doctype: str, prefix: str) -> str:

{lambda_erp-1.2.2 → lambda_erp-1.3.0}/api/routers/mcp.py

@@ -15,6 +15,7 @@ automatically — the MCP surface is modular by construction.
 Transport: a single POST /api/mcp speaking JSON-RPC 2.0 (request → JSON result;
 notifications → 202, no body). That's the minimum a tool-only server needs.
 """
+import asyncio
 import json
 import os
 
@@ -225,10 +226,12 @@ async def mcp_endpoint(request: Request):
     version = request.headers.get('mcp-protocol-version')
     if not initializing and version and version not in SUPPORTED_PROTOCOL_VERSIONS:
         raise HTTPException(400, 'Unsupported MCP protocol version')
+    # Tool calls do synchronous database and PDF work; running them on the
+    # event loop would stall every other request and websocket on this process.
     if isinstance(body, list):
-        responses = [r for r in (_handle(m, user) for m in body) if r is not None]
+        responses = [r for r in [await asyncio.to_thread(_handle, m, user) for m in body] if r is not None]
         return JSONResponse(responses) if responses else Response(status_code=202)
-    resp = _handle(body, user)
+    resp = await asyncio.to_thread(_handle, body, user)
     if resp is None:
         return Response(status_code=202)
     return JSONResponse(resp)

{lambda_erp-1.2.2 → lambda_erp-1.3.0}/api/services.py

@@ -572,6 +572,12 @@ def update_document(doctype_slug: str, name: str, data: dict) -> dict:
         raise ValueError(f"Unknown document type: {doctype_slug}")
     data = _validate_document_input(doctype, cls, data)
     doc = cls.load(name)
+    # A client that sends back the `modified` it loaded (the document form
+    # does) edits that version: if someone saved in between, the write-state
+    # check refuses instead of the stale copy silently replacing their changes
+    # (including whole child tables). Callers that omit it keep last-write-wins.
+    if data.get("modified"):
+        doc._loaded_modified = data["modified"]
     # Update parent fields
     for key, value in data.items():
         if key not in ("name", "docstatus", "creation") and key not in doc.CHILD_TABLES:

{lambda_erp-1.2.2 → lambda_erp-1.3.0}/lambda_erp/accounting/bank_reconciliation.py

@@ -611,20 +611,13 @@ def reconcile_with_payment(bank_transaction: str, allocations: list[dict], *,
         "references": references,
     })
     db = get_db()
-    db._in_transaction = True
-    try:
+    with db.atomic():
         reconciliation = _new_audit(
             tx, mode="Created Payment Entry", voucher_type="Payment Entry",
             voucher_no=payment.name, user=user,
         )
         payment._data["bank_reconciliation"] = reconciliation
         payment.submit()
-        db.commit()
-        db._in_transaction = False
-    except Exception:
-        db.conn.rollback()
-        db._in_transaction = False
-        raise
     return {
         "bank_transaction": bank_transaction,
         "reconciliation": reconciliation,
@@ -693,20 +686,13 @@ def reconcile_with_journal(bank_transaction: str, counterparty_account: str, *,
         "remark": remarks or tx.get("remittance_information") or tx.get("description") or f"Bank reconciliation {tx['name']}",
         "accounts": accounts,
     })
-    db._in_transaction = True
-    try:
+    with db.atomic():
         reconciliation = _new_audit(
             tx, mode="Created Journal Entry", voucher_type="Journal Entry",
             voucher_no=journal.name, user=user,
         )
         journal._data["bank_reconciliation"] = reconciliation
         journal.submit()
-        db.commit()
-        db._in_transaction = False
-    except Exception:
-        db.conn.rollback()
-        db._in_transaction = False
-        raise
     return {
         "bank_transaction": bank_transaction,
         "reconciliation": reconciliation,
@@ -770,12 +756,10 @@ def _validate_existing_voucher_group(transactions: list[dict], voucher_type: str
         )
 
 
-def _begin_existing_voucher_transaction(db, voucher_type: str, voucher_no: str) -> None:
-    """Serialize consumers of one voucher while the group is validated."""
-    db._in_transaction = True
-    if db.dialect == "sqlite":
-        db.conn.execute("BEGIN IMMEDIATE")
-    else:
+def _lock_existing_voucher(db, voucher_type: str, voucher_no: str) -> None:
+    """Serialize consumers of one voucher while the group is validated. Runs
+    inside db.atomic(), which already holds SQLite's write reservation."""
+    if db.dialect == "postgres":
         # ``voucher_type`` is checked against the fixed allowlist before this
         # helper is called, so quoting the table name is safe.
         db.conn.execute(
@@ -804,8 +788,8 @@ def reconcile_with_existing_voucher_group(bank_transactions: list[str], voucher_
         names.append(name)
 
     db = get_db()
-    try:
-        _begin_existing_voucher_transaction(db, voucher_type, voucher_no)
+    with db.atomic():
+        _lock_existing_voucher(db, voucher_type, voucher_no)
         transactions = [_transaction(name) for name in names]
         for tx in transactions:
             _ensure_available(tx)
@@ -826,12 +810,6 @@ def reconcile_with_existing_voucher_group(bank_transactions: list[str], voucher_
             activate_generated_reconciliation(
                 reconciliation, voucher_type=voucher_type, voucher_no=voucher_no,
             )
-        db.commit()
-    except Exception:
-        db.conn.rollback()
-        raise
-    finally:
-        db._in_transaction = False
     return {
         "bank_transaction": names[0],
         "bank_transactions": names,
@@ -866,19 +844,11 @@ def undo_reconciliation(bank_transaction: str, *, user: str | None = None,
     if audit["mode"] in {"Created Payment Entry", "Created Journal Entry"}:
         document_cls = PaymentEntry if audit["voucher_type"] == "Payment Entry" else JournalEntry
         document = document_cls.load(audit["voucher_no"])
-        db._in_transaction = True
-        db.set_value("Bank Reconciliation", audit["name"], "reversed_by", user)
-        try:
+        with db.atomic():
+            db.set_value("Bank Reconciliation", audit["name"], "reversed_by", user)
             document.cancel()
-            db.commit()
-            db._in_transaction = False
-        except Exception:
-            db.conn.rollback()
-            db._in_transaction = False
-            raise
     else:
-        db._in_transaction = True
-        try:
+        with db.atomic():
             group = _group_rows(audit.get("group_id")) or [audit]
             for member in group:
                 member_tx = _transaction(member["bank_transaction"])
@@ -891,12 +861,6 @@ def undo_reconciliation(bank_transaction: str, *, user: str | None = None,
                     "status": "Unreconciled", "reconciled_by": None,
                     "reconciled_at": None, "modified": now(),
                 })
-            db.commit()
-        except Exception:
-            db.conn.rollback()
-            raise
-        finally:
-            db._in_transaction = False
     return {
         "bank_transaction": bank_transaction,
         "bank_transactions": [

{lambda_erp-1.2.2 → lambda_erp-1.3.0}/lambda_erp/accounting/budget.py

@@ -87,6 +87,16 @@ def validate_expense_against_budget(gl_entry):
 
     budgets = db.get_all("Budget", filters=filters, fields=["*"])
 
+    # Two postings against one "Stop" budget must not both pass on the same
+    # old total. Lock the budget rows (in name order, so concurrent postings
+    # can't deadlock) before summing: the lock waits for the other posting to
+    # commit, and the SUM below then sees its GL entries.
+    stop_budgets = sorted(b["name"] for b in budgets if b.get("action_if_exceeded") == "Stop")
+    if stop_budgets and db.dialect == "postgres" and db._in_transaction:
+        placeholders = ", ".join("?" * len(stop_budgets))
+        db.sql(f'SELECT name FROM "Budget" WHERE name IN ({placeholders}) '
+               'ORDER BY name FOR UPDATE', stop_budgets)
+
     for budget in budgets:
         fiscal_year = budget.get("fiscal_year", "")
         if fiscal_year and str(year) not in fiscal_year: