The PO upload route (and the delivery-notes and xlsx import
paths) writes the uploaded file into the DATA_IMPORT_BATCHES.
original_file field. That field was bootstrapped with a CSV/Excel
allowlist only:
text/csv, text/plain, application/vnd.ms-excel, application/csv
When the upload route was rewritten on 2026-08-19 (commit f0f7c82)
to write directly to PB instead of forwarding the file to n8n, every
PDF and image upload started failing PB field validation with
validation_invalid_mime_type, surfacing in the API as a 500 with
error='batch_create_failed' and the real cause buried in
pb_data.original_file. The 2026-08-24 migration that should have
added xlsx was also never applied to prod (verified in PB:
xlsx missing too).
Migration: scripts/migrations/2026-08-31-data-import-batches-allow-pdf-images.py
- Strictly additive: unions the new mimeTypes onto the existing
allowlist, exits no-op if already applied (verified idempotent).
- Adds application/pdf, image/jpeg, image/png, image/webp (PDF /
image support for the PO and delivery-note flows) and
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
(xlsx, completing the missed 2026-08-24 migration).
- No code change in the upload routes required - they were already
validating against ALLOWED_MIME in purchase-order-schema.ts and
expecting PB to accept the same set.
Verification on https://pb.mega.infra.apphub.co.za:
Before: POST /api/purchase-orders/upload (PDF) -> HTTP 500,
pb_data.original_file.code = 'validation_invalid_mime_type'.
After: same POST -> HTTP 202 with batch_id, PB row created
(batch_type=purchase_orders, status=pending, file_hash
populated, original_file stored).
658d83dcff