lambda-erp 1.2.3__tar.gz → 1.3.1__tar.gz

{lambda_erp-1.2.3 → lambda_erp-1.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lambda-erp
-Version: 1.2.3
+Version: 1.3.1
 Summary: Core ERP logic - accounting, sales, purchasing, inventory
 Author: TORUS INVESTMENTS AG
 License-Expression: Apache-2.0

{lambda_erp-1.2.3 → lambda_erp-1.3.1}/api/auth.py

@@ -35,12 +35,19 @@ def _resolve_jwt_secret() -> str:
       3. Newly-generated random secret (only used if the filesystem is
          read-only or inaccessible — cookies will be invalidated on
          restart in that degenerate case).
+
+    A Postgres deployment must set JWT_SECRET_KEY: there is no DB file to
+    sit next to, so the file would land on the container's own disk and
+    every replica and restart would sign with a different key, logging
+    users out at random.
     """
     env_secret = os.environ.get("JWT_SECRET_KEY")
     if env_secret:
         return env_secret
 
     db_path = os.environ.get("LAMBDA_ERP_DB", "lambda_erp.db")
+    if db_path.startswith(("postgresql://", "postgres://")):
+        raise RuntimeError("JWT_SECRET_KEY must be set when LAMBDA_ERP_DB is a Postgres URL")
     data_dir = os.path.dirname(os.path.abspath(db_path)) or "."
     secret_file = os.path.join(data_dir, ".jwt_secret")
 
@@ -338,6 +345,19 @@ def validate_assignable_role(role: str) -> str:
     return role
 
 
+def claim_invite(db, token: str) -> None:
+    """Mark an invite used, exactly once. The conditional UPDATE is the check:
+    two sign-ups racing on one invite both pass the earlier read, but only one
+    row update succeeds."""
+    with db._lock:
+        cursor = db.conn.execute(
+            'UPDATE "Invite" SET used = 1 WHERE token = ? AND COALESCE(used, 0) = 0', [token])
+        claimed = cursor.rowcount == 1
+        db.conn.commit()
+    if not claimed:
+        raise HTTPException(status_code=410, detail="Invite already used")
+
+
 def require_role(minimum_role: str):
     """Returns a dependency that checks the user has at least the specified role."""
     min_level = ROLE_HIERARCHY[minimum_role]
@@ -450,8 +470,7 @@ def register(data: RegisterRequest, request: Request, response: Response):
             raise HTTPException(status_code=403, detail="This invite was issued for a different email")
 
         role = validate_assignable_role(invite["role"])
-        db.sql('UPDATE "Invite" SET used = 1 WHERE token = ?', [data.invite_token])
-        db.conn.commit()
+        claim_invite(db, data.invite_token)
     elif _setting_enabled(db, "allow_public_signup"):
         # Open signup is enabled: anyone may self-register, but only as a viewer.
         role = "viewer"

{lambda_erp-1.2.3 → lambda_erp-1.3.1}/api/chat.py

@@ -146,6 +146,74 @@ def can_access_session(session: dict | None, user: dict | None) -> bool:
     return session.get("user_id") == user.get("name")
 
 
+# A session runs one agent turn at a time. The claim lives on the session row,
+# so it holds across browser tabs, the REST chat API and app processes; a
+# per-connection check let two turns build on the same history and both write.
+# The deadline frees the session if the process running the turn died.
+TURN_LEASE_SECONDS = 30 * 60
+
+
+def _utc_iso(offset_seconds: int = 0) -> str:
+    from datetime import datetime, timedelta, timezone
+    return (datetime.now(timezone.utc) + timedelta(seconds=offset_seconds)).isoformat(timespec="seconds")
+
+
+def claim_session_turn(session_id: str) -> str | None:
+    """Claim the session for one turn; return the claim token, or None while
+    another turn is still running on it."""
+    db = get_db()
+    token = uuid.uuid4().hex
+    with db._lock:
+        cursor = db.conn.execute(
+            'UPDATE "Chat Session" SET active_turn = ?, active_turn_until = ? '
+            "WHERE id = ? AND (active_turn IS NULL OR active_turn_until IS NULL "
+            "OR active_turn_until < ?)",
+            [token, _utc_iso(TURN_LEASE_SECONDS), session_id, _utc_iso()],
+        )
+        claimed = cursor.rowcount == 1
+        db.conn.commit()
+    return token if claimed else None
+
+
+def release_session_turn(session_id: str, token: str | None) -> None:
+    if not token:
+        return
+    db = get_db()
+    with db._lock:
+        db.conn.execute(
+            'UPDATE "Chat Session" SET active_turn = NULL, active_turn_until = NULL '
+            "WHERE id = ? AND active_turn = ?",
+            [session_id, token],
+        )
+        db.conn.commit()
+
+
+def session_turn_running(session_id: str) -> bool:
+    rows = get_db().sql(
+        'SELECT active_turn_until FROM "Chat Session" WHERE id = ? AND active_turn IS NOT NULL',
+        [session_id],
+    )
+    return bool(rows and rows[0]["active_turn_until"] and rows[0]["active_turn_until"] >= _utc_iso())
+
+
+# Turns whose socket closed keep running to completion (see chat_websocket);
+# hold references so they aren't garbage-collected, and so shutdown can wait.
+_DETACHED_TURNS: set[asyncio.Task] = set()
+
+
+def detach_turn(task: asyncio.Task) -> None:
+    _DETACHED_TURNS.add(task)
+    task.add_done_callback(_DETACHED_TURNS.discard)
+
+
+async def drain_turns(timeout: float) -> None:
+    """On shutdown, give turns that are still running time to finish and
+    persist their results instead of dying between a tool call and its reply."""
+    pending = [task for task in _DETACHED_TURNS if not task.done()]
+    if pending:
+        await asyncio.wait(pending, timeout=timeout)
+
+
 def delete_session(session_id: str):
     """Delete a chat session, its messages, and its attachments."""
     try:
@@ -440,6 +508,8 @@ def api_delete_session(session_id: str, user: dict = _Depends(get_current_user))
     session = get_session(session_id)
     if not can_access_session(session, user):
         return {"detail": "Session not found"}
+    if session_turn_running(session_id):
+        raise HTTPException(status_code=409, detail="Wait for the current response to finish before deleting this chat.")
     delete_session(session_id)
     return {"ok": True}
 
@@ -2650,6 +2720,9 @@ The `remarks` (Notes / Terms) field on quotations, sales orders, and invoices re
 - Separate blocks with a blank line; a single newline is just a line break.
 Plain text (no special characters) still renders fine, so only reach for the markup when it improves a customer-facing note.
 
+### Internal notes (never printed)
+`remarks` is PRINTED and goes to the customer or supplier. Internal team remarks ("customer disputes line 2", "@Anna please check the price") belong in an internal note on the record instead: `add_record_note` (doctype = the record type slug, e.g. `sales-invoice` or `customer`; record_id = its name), read with `list_record_notes`, change with `update_record_note` / `delete_record_note`. Every document and master type supports them; they appear in the record's "Internal notes" card and never change the record. To notify a colleague, first `search_mention_users` and put their exact `mention_text` in the body. Never put internal remarks into `remarks`, and never copy internal notes into customer-facing text.
+
 ### Purchase Cycle
 Purchase Order → Purchase Receipt (receiving) / Purchase Invoice (billing) → Payment Entry
 
@@ -4142,7 +4215,9 @@ async def chat_websocket(
         finally:
             session_tasks.pop(target_session_id, None)
 
-    async def process_session_message(target_session_id: str, user_content: str, attachment_ids: list | None = None):
+    async def process_session_message(target_session_id: str, user_content: str,
+                                      attachment_ids: list | None = None,
+                                      turn_token: str | None = None):
         try:
             async def on_event(event: dict):
                 await send_event(event["type"], session_id=target_session_id, **{
@@ -4169,7 +4244,9 @@ async def chat_websocket(
         except Exception as e:
             await send_error(str(e), session_id=target_session_id)
         finally:
-            session_tasks.pop(target_session_id, None)
+            release_session_turn(target_session_id, turn_token)
+            if session_tasks.get(target_session_id) is asyncio.current_task():
+                session_tasks.pop(target_session_id, None)
 
     try:
         await send_event("sessions_list", sessions=list_sessions(user_id=ws_user_id, role=ws_user_role))
@@ -4240,7 +4317,7 @@ async def chat_websocket(
                     continue
 
                 active_task = session_tasks.get(session_id)
-                if active_task and not active_task.done():
+                if (active_task and not active_task.done()) or session_turn_running(session_id):
                     await send_error(
                         "Wait for the current response to finish before deleting this chat.",
                         request_id=request_id,
@@ -4263,7 +4340,7 @@ async def chat_websocket(
                     continue
 
                 active_task = session_tasks.get(session_id)
-                if active_task and not active_task.done():
+                if (active_task and not active_task.done()) or session_turn_running(session_id):
                     await send_error(
                         "Wait for the current response to finish before clearing this chat.",
                         request_id=request_id,
@@ -4347,7 +4424,8 @@ async def chat_websocket(
 
                 session = get_session(session_id)
                 await send_event("demo_started", request_id=request_id, session_id=session_id, title=session["title"] if session else "New Chat")
-                session_tasks[session_id] = asyncio.create_task(replay_demo_session(session_id))
+                session_tasks[session_id] = asyncio.create_task(
+                    replay_demo_session(session_id), name=f"demo:{session_id}")
                 continue
 
             if msg_type == "transcribe":
@@ -4503,10 +4581,24 @@ async def chat_websocket(
                 if aid in session_attachments
             ]
 
-            save_chat_message(
-                session_id, "user", user_content or "",
-                metadata={"attachments": attached_meta} if attached_meta else None,
-            )
+            # Claimed before the user message is stored, so a second tab (or
+            # another app process) can't add a message to a running turn.
+            turn_token = claim_session_turn(session_id)
+            if not turn_token:
+                await send_error(
+                    "Wait for the current response to finish before sending another message.",
+                    request_id=request_id,
+                    session_id=session_id,
+                )
+                continue
+            try:
+                save_chat_message(
+                    session_id, "user", user_content or "",
+                    metadata={"attachments": attached_meta} if attached_meta else None,
+                )
+            except BaseException:
+                release_session_turn(session_id, turn_token)
+                raise
             await send_message_added(
                 session_id, "user", user_content or "",
                 attachments=attached_meta if attached_meta else None,
@@ -4520,11 +4612,21 @@ async def chat_websocket(
             await send_event("thinking", session_id=session_id, iteration=1)
 
             session_tasks[session_id] = asyncio.create_task(
-                process_session_message(session_id, user_content, attachment_ids)
+                process_session_message(session_id, user_content, attachment_ids, turn_token),
+                name=f"turn:{session_id}",
             )
 
     except WebSocketDisconnect:
-        for task in session_tasks.values():
-            task.cancel()
+        pass
     except Exception as e:
         await send_error(str(e))
+    finally:
+        # A demo replay is only presentation: stop it. An agent turn may be
+        # between a tool's write and its result: cancelling it would commit the
+        # write but lose the result and the reply, so the user retries and the
+        # write happens twice. Let it finish; history shows it on reconnect.
+        for task in list(session_tasks.values()):
+            if task.get_name().startswith("demo:"):
+                task.cancel()
+            elif not task.done():
+                detach_turn(task)

{lambda_erp-1.2.3 → lambda_erp-1.3.1}/api/erp_context.py

@@ -24,6 +24,11 @@ draft creation does not imply submission, stock movement or ledger posting. Chec
 status and warnings. Correct validation errors using the field metadata and user information.
 Use list/search filters and pagination; an empty or partial search is not proof of zero
 stock. Use query_dataset/get_report for totals and stock, with the requested scope and dates.
+Text for the customer or supplier goes in a document's printed `remarks` (Notes / Terms)
+field. Internal team remarks ("customer disputes line 2", "@Anna please check") go in an
+internal note instead (add_record_note / list_record_notes): never printed, visible to
+signed-in colleagues only, and @mentions there notify colleagues. Never put internal
+remarks into `remarks`, and never copy internal notes into a document the customer sees.
 Generate a fresh PDF after edits. Only a successful artifact descriptor proves generation;
 download that artifact, check its SHA-256 and deliver it through the calling application's
 attachment mechanism. Do not invent download URLs or reuse a stale document attachment.

{lambda_erp-1.2.3 → lambda_erp-1.3.1}/api/main.py

@@ -51,41 +51,50 @@ def load_plugins() -> None:
 async def lifespan(app: FastAPI):
     # Startup: initialize database
     db_path = os.environ.get("LAMBDA_ERP_DB", "lambda_erp.db")
-    setup(db_path)
+    db = setup(db_path)
 
-    from api.mentions import initialize_mentions
-    initialize_mentions()
+    # Plugin schema, migrations and seeding run one process at a time, like
+    # the core migrations inside setup(): replicas booting together must not
+    # race each other through them.
+    with db.startup_lock():
+        from api.mentions import initialize_mentions
+        initialize_mentions()
+        from api.record_notes import initialize_record_notes
+        initialize_record_notes()
 
-    # Load customer extension plugins before anything creates documents.
-    load_plugins()
+        # Load customer extension plugins before anything creates documents.
+        load_plugins()
 
-    # Create plugin-registered tables and run their pending migrations. Must be
-    # after load_plugins() (registrations happen in register()) and before any
-    # document is created.
-    from api.services import apply_plugin_schema
-    apply_plugin_schema()
+        # Create plugin-registered tables and run their pending migrations. Must be
+        # after load_plugins() (registrations happen in register()) and before any
+        # document is created.
+        from api.services import apply_plugin_schema
+        apply_plugin_schema()
 
-    from api.pdf_profiles import validate_pdf_registry
-    validate_pdf_registry()
+        from api.pdf_profiles import validate_pdf_registry
+        validate_pdf_registry()
 
-    # Ensure the demo spend log table exists before any LLM call happens.
-    from api.demo_limits import init_schema as init_demo_spend_schema
-    init_demo_spend_schema()
+        # Ensure the demo spend log table exists before any LLM call happens.
+        from api.demo_limits import init_schema as init_demo_spend_schema
+        init_demo_spend_schema()
 
-    # Seed a deterministic admin from the environment (if configured) before
-    # anyone can register. On deployments whose DB is recreated each rollout
-    # this stops the first visitor after a redeploy from grabbing admin.
-    from api.auth import ensure_seed_admin
-    ensure_seed_admin()
+        # Seed a deterministic admin from the environment (if configured) before
+        # anyone can register. On deployments whose DB is recreated each rollout
+        # this stops the first visitor after a redeploy from grabbing admin.
+        from api.auth import ensure_seed_admin
+        ensure_seed_admin()
 
-    # When packaged as a demo container, land visitors straight in demo mode.
-    if os.environ.get("LAMBDA_ERP_AUTO_DEMO") == "1":
-        from api.bootstrap import bootstrap_demo
+        # When packaged as a demo container, land visitors straight in demo mode.
+        if os.environ.get("LAMBDA_ERP_AUTO_DEMO") == "1":
+            from api.bootstrap import bootstrap_demo
 
-        bootstrap_demo()
+            bootstrap_demo()
 
     yield
-    # Shutdown: nothing to clean up (SQLite handles it)
+    # Shutdown: let chat turns whose sockets already closed finish and save
+    # their results. Stay inside the container's termination grace period.
+    from api.chat import drain_turns
+    await drain_turns(timeout=float(os.environ.get("LAMBDA_ERP_SHUTDOWN_DRAIN_SECONDS", "20")))
 
 
 app = FastAPI(

{lambda_erp-1.2.3 → lambda_erp-1.3.1}/api/mentions.py

@@ -18,6 +18,7 @@ from lambda_erp.database import get_db
 from lambda_erp.utils import now
 
 SOURCES = {}
+_FALLBACKS = []  # (resolve(doctype) -> source | None, list_types() -> [doctype]) for unregistered types
 REAL_ROLES = {"viewer", "manager", "admin"}
 _WRITING_MENTION_NOTE = ContextVar("writing_mention_note", default=False)
 _MENTION_START = re.compile(r"(?<![\w@./+\-])@(?=\S)")
@@ -79,6 +80,31 @@ def register_mention_source(doctype, *, label, can_access, create_note, resolve_
                            create_note=create_note, resolve_note=resolve_note, resolve_notes=resolve_notes)
 
 
+def register_mention_source_fallback(resolve, list_types):
+    """Resolve sources for record types without an explicit registration
+    (api.record_notes uses this for every document and master type)."""
+    if all(entry[0] is not resolve for entry in _FALLBACKS):
+        _FALLBACKS.append((resolve, list_types))
+
+
+def find_source(doctype):
+    source = SOURCES.get(doctype)
+    for resolve, _ in _FALLBACKS:
+        if source:
+            break
+        source = resolve(doctype)
+    return source
+
+
+def supported_sources():
+    sources = {key: value["label"] for key, value in SOURCES.items()}
+    for resolve, list_types in _FALLBACKS:
+        for doctype in list_types():
+            if doctype not in sources and (source := resolve(doctype)):
+                sources[doctype] = source["label"]
+    return [{"doctype": key, "label": label} for key, label in sources.items()]
+
+
 class Input(BaseModel):
     model_config = ConfigDict(extra="forbid", strict=True)
 
@@ -121,7 +147,7 @@ def _identity(actor):
 
 
 def _source(doctype):
-    source = SOURCES.get(doctype)
+    source = find_source(doctype)
     if not source:
         raise ValueError("This record type does not support mention notes.")
     return source
@@ -141,7 +167,7 @@ def search_mention_users(args, user):
         token = full_name if full_name and len(aliases.get(full_name.lower(), {})) == 1 else row["email"]
         row["mention_text"] = "@" + token
     return {"users": rows, "acting_user": _identity(actor),
-            "sources": [{"doctype": key, "label": value["label"]} for key, value in SOURCES.items()]}
+            "sources": supported_sources()}
 
 
 def add_record_note(args, user):
@@ -221,7 +247,7 @@ def sync_note_mentions(doctype, record_id, note_id, body, user):
 
 
 def _visible(row, actor, notes=None, authors=None):
-    source = SOURCES.get(row["doctype"])
+    source = find_source(row["doctype"])
     note = (notes.get((row["doctype"], row["note_id"])) if notes is not None else
             source["resolve_note"](row["note_id"], actor) if source else None)
     if not note:
@@ -242,7 +268,7 @@ def list_my_mentions(args, user):
     # source and author lookups so polling a populated inbox avoids N+1 queries.
     notes, authors = {}, {}
     for doctype in {row["doctype"] for row in rows}:
-        source = SOURCES.get(doctype)
+        source = find_source(doctype)
         if not source:
             continue
         ids = list({row["note_id"] for row in rows if row["doctype"] == doctype})
@@ -301,7 +327,7 @@ def initialize_mentions():
         ("search_mention_users", search_mention_users, Search, "viewer",
          "Find enabled ERP colleagues for visible @mentions by name/email. Returns mention_text: insert that exact text in the note body to tag the person. Also returns canonical user IDs, acting_user and supported record types. Do not guess a person when ambiguous."),
         ("add_record_note", add_record_note, Note, "manager",
-         "Save an internal note and notify people visibly @mentioned in its body, including yourself. First use search_mention_users, then include each recipient's exact mention_text in body, e.g. 'salü vom johnny @Jon Torus'. Recipients are determined only from body; there is no recipient-ID argument. Unknown @handles and ordinary emails remain text. Ambiguous names require @email. Generic CRM note writes use the same mention processing. Use a new request_id (UUID) per intended note; reuse it unchanged on retries. No email is sent. Authorship is the authenticated ERP account."),
+         "Save an internal team note on a record and notify people visibly @mentioned in its body, including yourself. doctype is the record type slug: any document or master type (e.g. sales-invoice, purchase-order, customer, supplier, item) or a plugin type listed in search_mention_users sources; record_id is the record's name. Internal notes are never printed and do not change the record; customer-facing text belongs in the document's printed `remarks` (Notes / Terms) field instead. A note needs no mention. To tag someone, first use search_mention_users, then include each recipient's exact mention_text in body, e.g. 'salü vom johnny @Jon Torus'. Recipients are determined only from body; there is no recipient-ID argument. Unknown @handles and ordinary emails remain text. Ambiguous names require @email. CRM lead notes written through the generic document tools use the same mention processing. Use a new request_id (UUID) per intended note; reuse it unchanged on retries. No email is sent. Authorship is the authenticated ERP account."),
         ("list_my_mentions", list_my_mentions, Inbox, "viewer",
          "List the authenticated ERP user's mentions, with record/note links. open means not done; unread is separate. Use this for 'my mentions', never guess or pass another user. Returns acting_user, unread_count and pagination."),
         ("set_mention_state", set_mention_state, State, "viewer",

{lambda_erp-1.2.3 → lambda_erp-1.3.1}/api/oauth.py

@@ -47,6 +47,7 @@ from api.auth import (
     require_interactive_user,
     _is_https_request,
     validate_assignable_role,
+    claim_invite,
     _setting_enabled,
 )
 
@@ -362,8 +363,7 @@ def _consume_invite(db, invite_token: str, email: str) -> str:
     if invite["email"].lower() != email.lower():
         raise HTTPException(status_code=403, detail="This invite was issued for a different email")
     role = validate_assignable_role(invite["role"])
-    db.sql('UPDATE "Invite" SET used = 1 WHERE token = ?', [invite_token])
-    db.conn.commit()
+    claim_invite(db, invite_token)
     return role