Carlos Escalante 82a7bfc4c5 Harden PDF uploads: size cap, magic-byte check, non-blocking parse ...

read_pdf_upload() bounds reads at 10 MB and requires the %PDF magic
before anything reaches pdftotext (SEC-06); rejections land in the
per-file errors list with the filename. Parsing now runs via
asyncio.to_thread so a slow PDF no longer blocks the event loop for up
to 30s (BE-14). Review notes: temp files were already context-managed
(BE-09 overstated) and the pension batch already commits atomically
(BE-10 overstated). 69 tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-10 15:00:49 -06:00

..

agent

Constraint and query pass: FK delete rules, grouped queries, tiebreakers

2026-06-10 14:45:46 -06:00

api

Harden PDF uploads: size cap, magic-byte check, non-blocking parse

2026-06-10 15:00:49 -06:00

models

Constraint and query pass: FK delete rules, grouped queries, tiebreakers

2026-06-10 14:45:46 -06:00

services

Constraint and query pass: FK delete rules, grouped queries, tiebreakers

2026-06-10 14:45:46 -06:00

__init__.py

Add budget module: FastAPI backend + React frontend

2026-03-21 11:33:38 -06:00

auth.py

Replace deprecated datetime.utcnow with shared naive-UTC helper

2026-06-09 19:46:54 -06:00

config.py

Add pytest harness and 55-test suite for core backend logic

2026-06-09 19:46:54 -06:00

db.py

Adopt Alembic: autogenerated baseline, stamp-or-upgrade startup

2026-06-09 20:31:55 -06:00

main.py

Adopt Alembic: autogenerated baseline, stamp-or-upgrade startup

2026-06-09 20:31:55 -06:00

seed.py

Remove MPAT and MEMP fund references from pension module

2026-04-01 10:18:36 -06:00

timeutil.py

Replace deprecated datetime.utcnow with shared naive-UTC helper

2026-06-09 19:46:54 -06:00

uploads.py

Harden PDF uploads: size cap, magic-byte check, non-blocking parse

2026-06-10 15:00:49 -06:00