ingestion updates

app/infrastructure/security.py

@@ -72,6 +72,22 @@ ROLE_PERMISSIONS: Dict[str, List[str]] = {
         "view_nutrition_insights",
         "optimize_profits",
     ],
+    # A third party who may drop spreadsheets into the review inbox and do
+    # NOTHING else. One permission, deliberately.
+    #
+    # This role exists because API keys carry no per-key scoping:
+    # principal_for_api_key() derives permissions entirely from the role, so
+    # "upload-only" can only be expressed as a role. Reusing `user` would have
+    # been less code and would also have handed an outside contributor
+    # add_product, upload_batch_products and upload_store_inventory - real
+    # write access to the catalog - to solve a problem that needed one verb.
+    #
+    # Nothing this role can do starts work: an uploaded file waits in the inbox
+    # until an admin selects it. So the worst an leaked uploader key costs is
+    # bounded disk (INBOX_MAX_PENDING_FILES), never CPU on a one-vCPU host.
+    "uploader": [
+        "upload_catalog",
+    ],
 }
 
 VALID_ROLES = frozenset(ROLE_PERMISSIONS)