sheet upload fix

scripts/export_seed_data.py

@@ -22,7 +22,7 @@ from typing import Dict, List, Any
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 
-from app.services.vector_store import _connect, _sanitize_name
+from app.services.vector_store import _connect
 from app.infrastructure.settings import DB_HOST, DB_PORT, DB_NAME
 
 logging.basicConfig(level=logging.INFO, format="%(asctime)s - %(levelname)s - %(message)s")

scripts/fast_test.py

@@ -1,7 +1,6 @@
 import sys
-import os
 sys.path.insert(0, ".")
-from app.services.rag_service import retrieve, answer_query
+from app.services.rag_service import retrieve
 from app.services.query_intent import extract_max_price, extract_brand_mention, is_count_query, detected_category
 
 print("=== Q1: How many products are there in Cadbury? ===")

scripts/make_auth_secrets.py

@@ -192,7 +192,12 @@ def main() -> None:
         metavar="NAME:ROLE",
         action="append",
         default=[],
-        help="Also mint an API_KEYS entry, e.g. --api-key partner-x:user (repeatable)",
+        help=(
+            "Also mint an API_KEYS entry, e.g. --api-key partner-x:user "
+            "(repeatable). Role is admin, user, or uploader - uploader grants "
+            "only POST /api/uploads/catalog, which is the one to issue to an "
+            "outside party sending you spreadsheets."
+        ),
     )
     parser.add_argument(
         "--fingerprint",
@@ -229,11 +234,11 @@ def main() -> None:
     user_password = args.user_password or generate_password()
 
     print("# --- Paste into backend/.env -------------------------------------")
-    print(f"AUTH_ENABLED=true")
+    print("AUTH_ENABLED=true")
     print(f"AUTH_SECRET_KEY={secrets.token_urlsafe(48)}")
-    print(f"AUTH_ADMIN_USERNAME=admin")
+    print("AUTH_ADMIN_USERNAME=admin")
     print(f"AUTH_ADMIN_PASSWORD_HASH={hash_password(admin_password)}")
-    print(f"AUTH_USER_USERNAME=user")
+    print("AUTH_USER_USERNAME=user")
     print(f"AUTH_USER_PASSWORD_HASH={hash_password(user_password)}")
 
     if args.api_key:
@@ -244,8 +249,13 @@ def main() -> None:
                 name, role = spec.split(":", 1)
             except ValueError:
                 parser.error(f"--api-key expects NAME:ROLE, got {spec!r}")
-            if role not in {"admin", "user"}:
-                parser.error(f"--api-key role must be 'admin' or 'user', got {role!r}")
+            # Must stay in step with ROLE_PERMISSIONS in
+            # app/infrastructure/security.py and the same list in
+            # settings._parse_api_keys, which rejects an unknown role at boot.
+            if role not in {"admin", "user", "uploader"}:
+                parser.error(
+                    f"--api-key role must be 'admin', 'user' or 'uploader', got {role!r}"
+                )
             key = secrets.token_urlsafe(32)
             entries.append(f"{name}:{role}:{key}")
             secrets_shown.append((name, key))

scripts/test_rag.py

@@ -1,4 +1,3 @@
-import sys
 from app.services.rag_service import retrieve, answer_query
 from app.services.query_intent import extract_max_price, extract_brand_mention, is_count_query