Carlos Escalante 82a7bfc4c5 Harden PDF uploads: size cap, magic-byte check, non-blocking parse ...

read_pdf_upload() bounds reads at 10 MB and requires the %PDF magic
before anything reaches pdftotext (SEC-06); rejections land in the
per-file errors list with the filename. Parsing now runs via
asyncio.to_thread so a slow PDF no longer blocks the event loop for up
to 30s (BE-14). Review notes: temp files were already context-managed
(BE-09 overstated) and the pension batch already commits atomically
(BE-10 overstated). 69 tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-10 15:00:49 -06:00

..

__init__.py

Add budget module: FastAPI backend + React frontend

2026-03-21 11:33:38 -06:00

accounts.py

Replace deprecated datetime.utcnow with shared naive-UTC helper

2026-06-09 19:46:54 -06:00

analytics.py

Convert all currencies to CRC and poll rates every 6h

2026-04-15 17:16:20 -06:00

auth.py

Rate-limit logins, constant-time creds, pin CORS, secure cookie

2026-06-09 19:13:19 -06:00

budget.py

Replace deprecated datetime.utcnow with shared naive-UTC helper

2026-06-09 19:46:54 -06:00

categories.py

Add budget module: FastAPI backend + React frontend

2026-03-21 11:33:38 -06:00

exchange_rate.py

Add accounts expansion, analytics, exchange rates, API tokens, PWA support, and UI overhaul

2026-03-21 18:23:47 -06:00

import_transactions.py

Cap paste-import payload at 1 MB (ARCH-05)

2026-06-09 19:13:32 -06:00

municipal_receipts.py

Harden PDF uploads: size cap, magic-byte check, non-blocking parse

2026-06-10 15:00:49 -06:00

notifications.py

Add budget module and push notifications for transactions

2026-03-26 22:28:14 -06:00

pensions.py

Harden PDF uploads: size cap, magic-byte check, non-blocking parse

2026-06-10 15:00:49 -06:00

salarios.py

Constraint and query pass: FK delete rules, grouped queries, tiebreakers

2026-06-10 14:45:46 -06:00

savings_accrual.py

Replace deprecated datetime.utcnow with shared naive-UTC helper

2026-06-09 19:46:54 -06:00

settings.py

Replace deprecated datetime.utcnow with shared naive-UTC helper

2026-06-09 19:46:54 -06:00

tokens.py

Replace deprecated datetime.utcnow with shared naive-UTC helper

2026-06-09 19:46:54 -06:00

transactions.py

Constraint and query pass: FK delete rules, grouped queries, tiebreakers

2026-06-10 14:45:46 -06:00