OpenConstructionERP Files

Round 3 wave: security hardening, observability foundation, and a sizeable frontend bundle slimdown.

Security

• POST /api/v1/jobs/{job_id}/cancel now requires authentication (closes unauthenticated mutation surface).
• Path-traversal hardening in CAD/BOQ smart-import: 3 sites that built Path(tmpdir) / file.filename now normalise via Path(filename).name and 400 on empty / . / ...
• AI photo / file estimate uses require_signature(...) magic-byte validation — bytes whose declared Content-Type mismatches the file's magic prefix return HTTP 415.
• StampTemplateEditor XSS closed. The shared-template preview no longer renders raw SVG via dangerouslySetInnerHTML; it mounts inside a sandboxed iframe (empty sandbox="" attribute, content via srcDoc) — no scripts, no same-origin, no forms.

Observability foundation

• RequestIDMiddleware generates uuid4().hex[:16] (or honours a client-supplied X-Request-ID), stores it in a ContextVar, echoes it on every response. Every log line in the process now carries [%(request_id)s].
• Slow-query SQLA event listeners log statements over OE_SLOW_QUERY_MS (default 500 ms) at WARNING with structured extra={elapsed_ms, statement[:200], executemany}.
• /api/health deepened with alembic_head_matches + frontend_dist_present; either being false flips top-level status to "degraded" (still HTTP 200).
• New oe_client_errors module — frontend errorLogger.ts now POSTs anonymised payloads to POST /api/v1/client-errors/ (30/min per IP, message capped at 2048 chars, stack capped at 64 lines).
• docs/RUNBOOK.md (156 lines) extracted from internal memory for on-call ops.

DB integrity

• alembic v3096_round3_fk_indexes adds 6 missing foreign-key indexes: oe_contracts_progress_claim_line.contract_line_id, oe_clash_issue.{first_seen,last_seen,resolved}_run_id, oe_crm_opportunity.lost_reason_code, oe_equipment_work_order.schedule_id. Inspector-guarded so re-running is safe.

API hygiene

• 3 silent-fail 200 + {error} responses converted to proper status codes: fieldreports/weather 200 to 503, costs/vector/index 200 to 503 (× 4 branches), costs rate-import "no rate_code column" 200 to 422.
• Broken collection in test_tendering_leveling.py repaired (module-level skip with reactivation conditions); pytest now collects all 5,922 tests cleanly.

Frontend performance

• index-*.js bundle: 1.76 MB to 1.27 MB (gzip 311 KB).
• 11 packages removed: leaflet, react-leaflet, @types/leaflet, jszip, i18next-http-backend, i18next-browser-languagedetector plus transitives.
• 7 admin pages converted from eager to React.lazy(...) (Settings, Modules, ModuleDeveloperGuide, Assemblies + 3 siblings, ImportDatabase, OnboardingWizard, LoginPageNext, QuickEstimate). About 530 KB raw split off the main chunk.
• BOQGrid column stability: previous useMemo dep on t from useTranslation() (a fresh function each render) rebuilt column defs on every render. Now keyed on i18n.language with a tRef for the latest t.
• MoneyDisplay / QuantityDisplay use Zustand field selectors instead of full-store subscription — the BOQ grid no longer re-renders every money/quantity cell on unrelated preference changes.
• 4 orphan describe.skip blocks annotated with reactivation conditions.

Notes

109 modules load on boot (was 108: oe_client_errors added). No new Python deps. Alembic chain stays single-head at v3096_round3_fk_indexes.