jtricerolph
bcc94024e3
- Remove dead kitchen->KDS internal API (api/internal.py, verify_internal_secret) — KDS reads kitchen_db directly (E16), nothing ever called this endpoint - Add expires_at to dispute_attachments; public attachment links now expire after 30 days instead of staying valid forever (A4) - Add services/upload_validation.py: sniff real file content via python-magic instead of trusting the client-supplied Content-Type header, plus a 20MB cap. Applied across invoices/logbook/food_flags/credit_notes/disputes upload endpoints (A5) — disputes previously had no file-type check at all - Fix nginx client_max_body_size drift (800m -> the plan's intended 20m) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
35 lines
1.2 KiB
Python
35 lines
1.2 KiB
Python
"""
|
|
Migration to add expires_at to dispute_attachments.
|
|
|
|
Public attachment links (public_hash — see add_dispute_attachment_public_hash)
|
|
were valid forever with no expiry, so a leaked/forwarded supplier link stayed
|
|
live indefinitely. See port log A4.
|
|
"""
|
|
import logging
|
|
from sqlalchemy import text
|
|
from database import engine
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
async def run_migration():
|
|
"""Add expires_at column to dispute_attachments"""
|
|
async with engine.begin() as conn:
|
|
result = await conn.execute(text("""
|
|
SELECT EXISTS (
|
|
SELECT 1 FROM information_schema.columns
|
|
WHERE table_name = 'dispute_attachments'
|
|
AND column_name = 'expires_at'
|
|
);
|
|
"""))
|
|
exists = result.scalar()
|
|
|
|
if not exists:
|
|
logger.info("Adding 'expires_at' column to dispute_attachments table")
|
|
await conn.execute(text("""
|
|
ALTER TABLE dispute_attachments
|
|
ADD COLUMN IF NOT EXISTS expires_at TIMESTAMP;
|
|
"""))
|
|
logger.info("Successfully added 'expires_at' column")
|
|
else:
|
|
logger.info("'expires_at' column already exists in dispute_attachments")
|