v4.3.0 — Round 5 hardening + [#153] RVT fix

A focused 11-module deep audit + fix wave, plus an urgent fix for the production-reported TypeError: Cannot read properties of undefined (reading 'toLowerCase') that crashed the RVT upload flow on /bim. ~150 new tests across the touched modules.

Security

• carbon: 22-endpoint IDOR closure. Project gate added on every read/write site across factors, scope1/2/3, inventory, reduction-targets, offsets, reports.
• hse_advanced: MANAGER role gate on regulatory closures (RIDDOR/OSHA/ISO 45001). close_incident, close_inspection, close_audit_finding now require manager or safety_officer role and capture the closer's role in the audit trail.
• subcontractors: rating + block tampering closed. rate_subcontractor, block_subcontractor, unblock_subcontractor now require project access + procurement_manager/admin role.
• qms: IDOR closed on calibration + NCR routes (read, update, close); close-NCR also requires quality_manager role.
• rfi: IDOR on close-rfi closed. POST /rfi/{id}/close now project-gated and captures closed_by_user_id for the regulator trail.
• submittals: project-scope IDOR closed on GET /submittals/{id}, PATCH /submittals/{id}, POST /submittals/{id}/transitions.
• variations: apply-to-final-account IDOR closed. Now requires finance_manager/pm and verifies the variation belongs to the URL project.
• projects: currency-change race + slug-collision race closed. Currency change now 409s when financial transactions exist; slug-collision retry replaced with unique-index + IntegrityError catch.
• crm: GDPR Art-17 forget endpoint + role + activity-owner spoof closed. New POST /crm/leads/{id}/forget; win_lead now requires sales_manager; log_activity forces server-side owner_user_id.

Correctness

• variations: currency-aware rollup. get_project_variations_total was summing USD + EUR + GBP into one flat number. Now groups by currency_code and returns {by_currency, base_currency_total}.
• qms: NCR cost_impact_amount widened Numeric(15,2) → Numeric(18,2) (matches finance / change_orders / contracts / rfq_bidding money convention).
• submittals: unique number constraint + retry — closes a TOCTOU race producing duplicate SUB-005 rows.
• rfi: cost_impact Decimal validation — Pydantic v2 Decimal + decimal_places=2.
• service: ticket / contract / work-order number uniqueness — three unique indexes; the existing retry path now actually retries.
• eac: run-result rule_id index — closes a hot-table seq-scan on rule-cross-runs queries.

Bug fixes

• #153 — RVT upload crash: TypeError: Cannot read properties of undefined (reading 'toLowerCase'). Defensive guards at 7 sites:
• Sidebar.tsx — keydown handler
• BOQEditorPage.tsx — keydown handler
• BIMViewer.tsx — keydown handler
• InstallConverterPrompt.tsx — converterId guard
• ElementManager.ts — setDisciplineVisible + getDisciplineColor
• BIMFilterPanel.tsx — Object.keys(...).map(k => String(k).toLowerCase())

New endpoints

• POST /api/v1/crm/leads/{id}/forget — GDPR Art-17 right-to-erasure for CRM lead PII.
• POST /api/v1/submittals/{id}/attachments/upload/ — magic-byte-gated attachment upload.
• POST /api/v1/rfi/{id}/attachments/ — magic-byte-gated RFI reply attachment upload.

Migrations

v3099_eac_run_result_rule_id_index, v3099_rfi_unique_attachments, v3099_subcontractors_unique_tax_id, v3099_submittals_unique_number, v3100_schedule_advanced_user_indexes, v3101_carbon_idor_indexes, v3101_crm_lead_email_dedup_index, v3101_qms_money_numeric, v3101_service_number_uniques, v3101_variations_currency_indexes, v3102_round5_merge.

Install

pip install openconstructionerp==4.3.0
openconstructionerp

Live demo: https://openconstructionerp.com