lambda-erp 1.3.0__tar.gz → 1.3.1__tar.gz

{lambda_erp-1.3.0 → lambda_erp-1.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lambda-erp
-Version: 1.3.0
+Version: 1.3.1
 Summary: Core ERP logic - accounting, sales, purchasing, inventory
 Author: TORUS INVESTMENTS AG
 License-Expression: Apache-2.0

{lambda_erp-1.3.0 → lambda_erp-1.3.1}/api/chat.py

@@ -2720,6 +2720,9 @@ The `remarks` (Notes / Terms) field on quotations, sales orders, and invoices re
 - Separate blocks with a blank line; a single newline is just a line break.
 Plain text (no special characters) still renders fine, so only reach for the markup when it improves a customer-facing note.
 
+### Internal notes (never printed)
+`remarks` is PRINTED and goes to the customer or supplier. Internal team remarks ("customer disputes line 2", "@Anna please check the price") belong in an internal note on the record instead: `add_record_note` (doctype = the record type slug, e.g. `sales-invoice` or `customer`; record_id = its name), read with `list_record_notes`, change with `update_record_note` / `delete_record_note`. Every document and master type supports them; they appear in the record's "Internal notes" card and never change the record. To notify a colleague, first `search_mention_users` and put their exact `mention_text` in the body. Never put internal remarks into `remarks`, and never copy internal notes into customer-facing text.
+
 ### Purchase Cycle
 Purchase Order → Purchase Receipt (receiving) / Purchase Invoice (billing) → Payment Entry
 

{lambda_erp-1.3.0 → lambda_erp-1.3.1}/api/erp_context.py

@@ -24,6 +24,11 @@ draft creation does not imply submission, stock movement or ledger posting. Chec
 status and warnings. Correct validation errors using the field metadata and user information.
 Use list/search filters and pagination; an empty or partial search is not proof of zero
 stock. Use query_dataset/get_report for totals and stock, with the requested scope and dates.
+Text for the customer or supplier goes in a document's printed `remarks` (Notes / Terms)
+field. Internal team remarks ("customer disputes line 2", "@Anna please check") go in an
+internal note instead (add_record_note / list_record_notes): never printed, visible to
+signed-in colleagues only, and @mentions there notify colleagues. Never put internal
+remarks into `remarks`, and never copy internal notes into a document the customer sees.
 Generate a fresh PDF after edits. Only a successful artifact descriptor proves generation;
 download that artifact, check its SHA-256 and deliver it through the calling application's
 attachment mechanism. Do not invent download URLs or reuse a stale document attachment.

{lambda_erp-1.3.0 → lambda_erp-1.3.1}/api/main.py

@@ -59,6 +59,8 @@ async def lifespan(app: FastAPI):
     with db.startup_lock():
         from api.mentions import initialize_mentions
         initialize_mentions()
+        from api.record_notes import initialize_record_notes
+        initialize_record_notes()
 
         # Load customer extension plugins before anything creates documents.
         load_plugins()

{lambda_erp-1.3.0 → lambda_erp-1.3.1}/api/mentions.py

@@ -18,6 +18,7 @@ from lambda_erp.database import get_db
 from lambda_erp.utils import now
 
 SOURCES = {}
+_FALLBACKS = []  # (resolve(doctype) -> source | None, list_types() -> [doctype]) for unregistered types
 REAL_ROLES = {"viewer", "manager", "admin"}
 _WRITING_MENTION_NOTE = ContextVar("writing_mention_note", default=False)
 _MENTION_START = re.compile(r"(?<![\w@./+\-])@(?=\S)")
@@ -79,6 +80,31 @@ def register_mention_source(doctype, *, label, can_access, create_note, resolve_
                            create_note=create_note, resolve_note=resolve_note, resolve_notes=resolve_notes)
 
 
+def register_mention_source_fallback(resolve, list_types):
+    """Resolve sources for record types without an explicit registration
+    (api.record_notes uses this for every document and master type)."""
+    if all(entry[0] is not resolve for entry in _FALLBACKS):
+        _FALLBACKS.append((resolve, list_types))
+
+
+def find_source(doctype):
+    source = SOURCES.get(doctype)
+    for resolve, _ in _FALLBACKS:
+        if source:
+            break
+        source = resolve(doctype)
+    return source
+
+
+def supported_sources():
+    sources = {key: value["label"] for key, value in SOURCES.items()}
+    for resolve, list_types in _FALLBACKS:
+        for doctype in list_types():
+            if doctype not in sources and (source := resolve(doctype)):
+                sources[doctype] = source["label"]
+    return [{"doctype": key, "label": label} for key, label in sources.items()]
+
+
 class Input(BaseModel):
     model_config = ConfigDict(extra="forbid", strict=True)
 
@@ -121,7 +147,7 @@ def _identity(actor):
 
 
 def _source(doctype):
-    source = SOURCES.get(doctype)
+    source = find_source(doctype)
     if not source:
         raise ValueError("This record type does not support mention notes.")
     return source
@@ -141,7 +167,7 @@ def search_mention_users(args, user):
         token = full_name if full_name and len(aliases.get(full_name.lower(), {})) == 1 else row["email"]
         row["mention_text"] = "@" + token
     return {"users": rows, "acting_user": _identity(actor),
-            "sources": [{"doctype": key, "label": value["label"]} for key, value in SOURCES.items()]}
+            "sources": supported_sources()}
 
 
 def add_record_note(args, user):
@@ -221,7 +247,7 @@ def sync_note_mentions(doctype, record_id, note_id, body, user):
 
 
 def _visible(row, actor, notes=None, authors=None):
-    source = SOURCES.get(row["doctype"])
+    source = find_source(row["doctype"])
     note = (notes.get((row["doctype"], row["note_id"])) if notes is not None else
             source["resolve_note"](row["note_id"], actor) if source else None)
     if not note:
@@ -242,7 +268,7 @@ def list_my_mentions(args, user):
     # source and author lookups so polling a populated inbox avoids N+1 queries.
     notes, authors = {}, {}
     for doctype in {row["doctype"] for row in rows}:
-        source = SOURCES.get(doctype)
+        source = find_source(doctype)
         if not source:
             continue
         ids = list({row["note_id"] for row in rows if row["doctype"] == doctype})
@@ -301,7 +327,7 @@ def initialize_mentions():
         ("search_mention_users", search_mention_users, Search, "viewer",
          "Find enabled ERP colleagues for visible @mentions by name/email. Returns mention_text: insert that exact text in the note body to tag the person. Also returns canonical user IDs, acting_user and supported record types. Do not guess a person when ambiguous."),
         ("add_record_note", add_record_note, Note, "manager",
-         "Save an internal note and notify people visibly @mentioned in its body, including yourself. First use search_mention_users, then include each recipient's exact mention_text in body, e.g. 'salü vom johnny @Jon Torus'. Recipients are determined only from body; there is no recipient-ID argument. Unknown @handles and ordinary emails remain text. Ambiguous names require @email. Generic CRM note writes use the same mention processing. Use a new request_id (UUID) per intended note; reuse it unchanged on retries. No email is sent. Authorship is the authenticated ERP account."),
+         "Save an internal team note on a record and notify people visibly @mentioned in its body, including yourself. doctype is the record type slug: any document or master type (e.g. sales-invoice, purchase-order, customer, supplier, item) or a plugin type listed in search_mention_users sources; record_id is the record's name. Internal notes are never printed and do not change the record; customer-facing text belongs in the document's printed `remarks` (Notes / Terms) field instead. A note needs no mention. To tag someone, first use search_mention_users, then include each recipient's exact mention_text in body, e.g. 'salü vom johnny @Jon Torus'. Recipients are determined only from body; there is no recipient-ID argument. Unknown @handles and ordinary emails remain text. Ambiguous names require @email. CRM lead notes written through the generic document tools use the same mention processing. Use a new request_id (UUID) per intended note; reuse it unchanged on retries. No email is sent. Authorship is the authenticated ERP account."),
         ("list_my_mentions", list_my_mentions, Inbox, "viewer",
          "List the authenticated ERP user's mentions, with record/note links. open means not done; unread is separate. Use this for 'my mentions', never guess or pass another user. Returns acting_user, unread_count and pagination."),
         ("set_mention_state", set_mention_state, State, "viewer",

lambda_erp-1.3.1/api/record_notes.py

@@ -0,0 +1,233 @@
+"""Internal notes on any ERP document or master record.
+
+Notes are private to the team: they never print and never change the record
+itself (no `modified` bump, so open forms are not marked stale). They plug into
+the personal mention inbox as a fallback source, so every document and master
+type supports @mentions without registering anything. Record types with their
+own notes (a plugin's explicit mention source, e.g. CRM leads) keep theirs.
+"""
+import uuid
+from urllib.parse import quote
+
+from fastapi import HTTPException
+from pydantic import Field
+
+from api import mentions, services
+from lambda_erp.database import get_db
+from lambda_erp.utils import now
+
+TABLE = "Record Note"
+_DISABLED: set[str] = set()
+
+
+def disable_record_notes(record_type):
+    """Opt a record type out, e.g. one whose rows are themselves notes."""
+    _DISABLED.add(record_type)
+
+
+def _target(record_type):
+    """(table, kind) for a record type that takes generic notes, else None."""
+    if record_type in _DISABLED or record_type in mentions.SOURCES:
+        return None
+    doctype = services.SLUG_TO_DOCTYPE.get(record_type)
+    if doctype:
+        return doctype, "document"
+    master = services.MASTER_TABLES.get(record_type)
+    if master:
+        return master[0], "master"
+    return None
+
+
+def record_types():
+    return sorted({*services.SLUG_TO_DOCTYPE, *services.MASTER_TABLES} - _DISABLED - mentions.SOURCES.keys())
+
+
+def _reader(user):
+    return (user or {}).get("role") in mentions.REAL_ROLES
+
+
+def _existing(table, ids):
+    db, found = get_db(), {}
+    ids = list(ids)
+    for start in range(0, len(ids), 250):
+        chunk = ids[start:start + 250]
+        found.update({row["name"]: row for row in db.sql(
+            f'SELECT * FROM "{table}" WHERE name IN (' + ','.join('?' for _ in chunk) + ')', chunk)})
+    return found
+
+
+def _title(record_type, record):
+    table, kind = _target(record_type)
+    if kind == "master":
+        label = record.get(services.MASTER_TABLES[record_type][1])
+        return f"{table} {record['name']}" + (f" · {label}" if label and label != record["name"] else "")
+    party = record.get("customer_name") or record.get("supplier_name") or record.get("party_name")
+    return f"{table} {record['name']}" + (f" · {party}" if party else "")
+
+
+def view_url(record_type, record_id, note_id=None):
+    _, kind = _target(record_type)
+    base = "/app" if kind == "document" else "/masters"
+    url = f"{base}/{record_type}/{quote(record_id, safe='')}"
+    return url + (f"#note-{note_id}" if note_id else "")
+
+
+def _can_access(record_type, record_id, user):
+    target = _target(record_type)
+    return bool(target and _reader(user) and get_db().exists(target[0], record_id))
+
+
+def _create(record_type, record_id, body, user):
+    note_id, stamp = uuid.uuid4().hex, now()
+    get_db().insert(TABLE, {
+        "name": note_id, "record_type": record_type, "record_id": record_id, "body": body,
+        "author_id": user.get("user_id") or user["name"], "created_at": stamp, "updated_at": stamp,
+    })
+    return note_id
+
+
+def _resolve(record_type, note_ids, user):
+    target = _target(record_type)
+    if not note_ids or not target or not _reader(user):
+        return {}
+    rows = get_db().sql(f'SELECT name, record_id, body FROM "{TABLE}" WHERE record_type = ? AND name IN ('
+                        + ','.join('?' for _ in note_ids) + ')', [record_type, *note_ids])
+    records = _existing(target[0], {row["record_id"] for row in rows})
+    return {row["name"]: {
+        "record_id": row["record_id"], "title": _title(record_type, records[row["record_id"]]),
+        "body": row["body"], "view_url": view_url(record_type, row["record_id"], row["name"]),
+    } for row in rows if row["record_id"] in records}
+
+
+def _source(record_type):
+    target = _target(record_type)
+    if not target:
+        return None
+    return dict(
+        label=target[0],
+        can_access=lambda record_id, user: _can_access(record_type, record_id, user),
+        create_note=lambda record_id, body, user: _create(record_type, record_id, body, user),
+        resolve_note=lambda note_id, user: _resolve(record_type, [note_id], user).get(note_id),
+        resolve_notes=lambda note_ids, user: _resolve(record_type, note_ids, user),
+    )
+
+
+class ListNotes(mentions.Input):
+    record_type: str = Field(min_length=1, max_length=100)
+    record_id: str = Field(min_length=1, max_length=200)
+    limit: int = Field(default=50, ge=1, le=200)
+    offset: int = Field(default=0, ge=0)
+
+
+class EditNote(mentions.Input):
+    note_id: str = Field(min_length=1, max_length=100)
+    body: str = Field(min_length=1, max_length=8000)
+
+
+class DeleteNote(mentions.Input):
+    note_id: str = Field(min_length=1, max_length=100)
+
+
+def _require_record(record_type, record_id, user):
+    if not _target(record_type):
+        raise ValueError(f"{record_type!r} does not take internal notes. "
+                         f"Supported record types: {', '.join(record_types())}.")
+    if not _can_access(record_type, record_id, user):
+        raise HTTPException(404, "Record is unavailable")
+
+
+def list_record_notes(args, user):
+    data = ListNotes.model_validate(args)
+    if not _reader(user):
+        raise PermissionError("Sign in with an ERP account to read internal notes.")
+    _require_record(data.record_type, data.record_id, user)
+    db, me = get_db(), user.get("user_id") or user.get("name")
+    where = [data.record_type, data.record_id]
+    total = db.sql(f'SELECT COUNT(*) AS n FROM "{TABLE}" WHERE record_type = ? AND record_id = ?', where)[0]["n"]
+    rows = db.sql(f'SELECT * FROM "{TABLE}" WHERE record_type = ? AND record_id = ? '
+                  'ORDER BY created_at DESC, name DESC LIMIT ? OFFSET ?', [*where, data.limit, data.offset])
+    authors = _existing("User", {row["author_id"] for row in rows})
+    notes = [{
+        "id": row["name"], "body": row["body"], "author_id": row["author_id"],
+        "author_name": (authors.get(row["author_id"]) or {}).get("full_name")
+        or (authors.get(row["author_id"]) or {}).get("email") or row["author_id"],
+        "created_at": row["created_at"], "updated_at": row["updated_at"],
+        "edited": row["updated_at"] != row["created_at"],
+        "can_edit": row["author_id"] == me,
+        "can_delete": row["author_id"] == me or user.get("role") == "admin",
+        "view_url": view_url(data.record_type, data.record_id, row["name"]),
+    } for row in rows]
+    return {"record_type": data.record_type, "record_id": data.record_id, "notes": notes,
+            "total": total, "has_more": data.offset + len(notes) < total}
+
+
+def _load_note(note_id):
+    rows = get_db().sql(f'SELECT * FROM "{TABLE}" WHERE name = ?', [note_id])
+    if not rows:
+        raise HTTPException(404, "Note not found")
+    return rows[0]
+
+
+def update_record_note(args, user):
+    data, actor = EditNote.model_validate(args), mentions._actor(user)
+    body = data.body.strip()
+    if not body:
+        raise ValueError("Note body must not be blank.")
+    db = get_db()
+    with db.atomic():
+        note = _load_note(data.note_id)
+        _require_record(note["record_type"], note["record_id"], actor)
+        if note["author_id"] != actor["user_id"]:
+            raise PermissionError("Only the author can edit a note.")
+        db.sql(f'UPDATE "{TABLE}" SET body = ?, updated_at = ? WHERE name = ?', [body, now(), note["name"]])
+        notified = mentions.sync_note_mentions(note["record_type"], note["record_id"], note["name"], body, actor)
+    return {"note_id": note["name"], "notified_count": notified,
+            "view_url": view_url(note["record_type"], note["record_id"], note["name"])}
+
+
+def delete_record_note(args, user):
+    data, actor = DeleteNote.model_validate(args), mentions._actor(user)
+    db = get_db()
+    with db.atomic():
+        note = _load_note(data.note_id)
+        _require_record(note["record_type"], note["record_id"], actor)
+        if note["author_id"] != actor["user_id"] and actor["role"] != "admin":
+            raise PermissionError("Only the author or an admin can delete a note.")
+        db.sql('DELETE FROM "Mention Notification" WHERE doctype = ? AND note_id = ?',
+               [note["record_type"], note["name"]])
+        db.sql(f'DELETE FROM "{TABLE}" WHERE name = ?', [note["name"]])
+    return {"success": True, "note_id": note["name"]}
+
+
+def delete_record_notes_for(record_type, record_id):
+    """Drop a hard-deleted record's notes and their inbox entries."""
+    db = get_db()
+    ids = [row["name"] for row in db.sql(
+        f'SELECT name FROM "{TABLE}" WHERE record_type = ? AND record_id = ?', [record_type, record_id])]
+    for start in range(0, len(ids), 250):
+        chunk = ids[start:start + 250]
+        db.sql('DELETE FROM "Mention Notification" WHERE doctype = ? AND note_id IN ('
+               + ','.join('?' for _ in chunk) + ')', [record_type, *chunk])
+    db.sql(f'DELETE FROM "{TABLE}" WHERE record_type = ? AND record_id = ?', [record_type, record_id])
+
+
+_NOT_PRINTED = ("Internal notes are visible to signed-in colleagues only; they are never printed and "
+                "never change the record. Not the printed `remarks` (Notes / Terms) field.")
+
+
+def initialize_record_notes():
+    mentions.register_mention_source_fallback(_source, record_types)
+    for name, handler, schema, role, description in (
+        ("list_record_notes", list_record_notes, ListNotes, "viewer",
+         "List the internal team notes on one document or master record, newest first. record_type is the "
+         "document or master type slug (e.g. sales-invoice, customer) and record_id its name. "
+         + _NOT_PRINTED),
+        ("update_record_note", update_record_note, EditNote, "manager",
+         "Replace the text of an internal note you wrote (note_id from list_record_notes). @mentions are "
+         "re-read from the new text: added colleagues are notified, removed ones lose the notification."),
+        ("delete_record_note", delete_record_note, DeleteNote, "manager",
+         "Delete an internal note. Authors can delete their own notes; admins can delete any. Also removes "
+         "its mention notifications."),
+    ):
+        services.register_action(name, handler, description=description,
+                                 parameters=schema.model_json_schema(), minimum_role=role, pass_user=True)

{lambda_erp-1.3.0 → lambda_erp-1.3.1}/api/routers/masters.py

@@ -748,7 +748,10 @@ def delete_master_record(master_type: str, name: str) -> dict:
             return {"ok": True, "status": "disabled", "reason": f"Referenced by {reference}"}
         raise HTTPException(status_code=409, detail=f"Cannot delete {doctype} {name}: referenced by {reference}")
 
-    db.delete(doctype, name=name)
+    from api.record_notes import delete_record_notes_for
+    with db.atomic():
+        delete_record_notes_for(master_type, name)
+        db.delete(doctype, name=name)
     return {"ok": True, "status": "deleted"}
 
 

{lambda_erp-1.3.0 → lambda_erp-1.3.1}/api/routers/mcp.py

@@ -50,7 +50,7 @@ _EXCLUDE = {
 }
 
 _READ_ONLY = {
-    'search_mention_users', 'list_my_mentions',
+    'search_mention_users', 'list_my_mentions', 'list_record_notes',
     'get_erp_context',
     'list_documents', 'get_document_fields', 'get_document', 'get_master_fields',
     'search_masters', 'get_report', 'get_current_time', 'query_dataset',

{lambda_erp-1.3.0 → lambda_erp-1.3.1}/lambda_erp/database.py

@@ -3063,6 +3063,25 @@ def _m041_chat_turn_lease(db: "Database") -> None:
     db.ensure_column("Chat Session", "active_turn_until", "TEXT")
 
 
+def _m042_record_notes(db: "Database") -> None:
+    """Internal team notes on any document or master (see api.record_notes)."""
+    db.conn.execute(
+        """CREATE TABLE IF NOT EXISTS "Record Note" (
+            name TEXT PRIMARY KEY,
+            record_type TEXT NOT NULL,
+            record_id TEXT NOT NULL,
+            body TEXT NOT NULL,
+            author_id TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL
+        )"""
+    )
+    db.conn.execute(
+        'CREATE INDEX IF NOT EXISTS record_note_record ON "Record Note" (record_type, record_id, created_at)'
+    )
+    db.conn.commit()
+
+
 Database.MIGRATIONS = [
     (1, "chat_message_session_id", _m001_chat_message_session_id),
     (2, "chat_session_user_id", _m002_chat_session_user_id),
@@ -3105,6 +3124,7 @@ Database.MIGRATIONS = [
     (39, "connection_app_type", _m039_connection_app_type),
     (40, "naming_series", _m040_naming_series),
     (41, "chat_turn_lease", _m041_chat_turn_lease),
+    (42, "record_notes", _m042_record_notes),
 ]
 
 

{lambda_erp-1.3.0 → lambda_erp-1.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lambda-erp"
-version = "1.3.0"
+version = "1.3.1"
 description = "Core ERP logic - accounting, sales, purchasing, inventory"
 readme = "README.md"
 license = "Apache-2.0"