2026-07-29 01:28:13 +02:00
|
|
|
# RBAC Build Progress — LeoCRM
|
|
|
|
|
|
2026-07-29 07:58:22 +02:00
|
|
|
## Letztes Update: 2026-07-29 03:17 CEST
|
2026-07-29 01:38:18 +02:00
|
|
|
|
2026-07-29 07:58:22 +02:00
|
|
|
## Alle 23 Sprints — Code vollständig erstellt ✅
|
2026-07-29 01:38:18 +02:00
|
|
|
|
2026-07-29 07:58:22 +02:00
|
|
|
### Sprint Übersicht
|
2026-07-29 02:05:14 +02:00
|
|
|
|
2026-07-29 07:58:22 +02:00
|
|
|
| Sprint | Inhalt | Status |
|
|
|
|
|
|--------|--------|:---:|
|
|
|
|
|
| 1 — Fundament | entity_permissions + OwnedMixin + Service + API + Redis-Cache + RLS + Rate Limiting | ✅ Deployed |
|
|
|
|
|
| 2 — Row-Level Security | visibility.py + 9 Services + 9 Routes + BaseSearchProvider + Frontend Permission-Checks | ✅ Deployed |
|
|
|
|
|
| 3 — Search/Dashboard/Export | Search Provider Permission-aware + Dashboard Counts + Export Filter | ✅ Deployed |
|
|
|
|
|
| 4 — Field-Level | 44 Core Field Definitions + Custom Field Sensitivity + filter_fields_by_permission | ✅ Code |
|
|
|
|
|
| 5 — Sharing UI | Universeller ShareDialog + Entity Permission API + Hooks | ✅ Code |
|
|
|
|
|
| 6 — Notifications + Audit | Permission-Change Notifications + Audit Trail + Notification Entity Filter | ✅ Code |
|
|
|
|
|
| 7 — E-Mail Postfächer | Mailbox owner_id + Permissions + Migration 0053 | ✅ Code |
|
|
|
|
|
| 8 — Plugin Entities | DMS/Calendar/Tasks OwnedMixin + Migration 0054 | ✅ Code |
|
|
|
|
|
| 9 — App-Sichtbarkeit | Sidebar Permission-Filter + TopBar + ProtectedRoute + Route Guards | ✅ Deployed |
|
|
|
|
|
| 10 — Advanced Security + AI | AI Copilot Permission-Aware + API-Token Scopes + Merge Check | ✅ Code |
|
|
|
|
|
| 11 — Owner Management | Owner Transfer Service + Auto-Transfer + API | ✅ Code |
|
|
|
|
|
| 12 — Zentrale Einstellungsseite | SettingsRechte.tsx mit Tabs (Rollen, Gruppen, Freigaben, Audit) | ✅ Code |
|
|
|
|
|
| 13 — ABAC Engine | entity_policies + Policy Service + Migration 0055 | ✅ Code |
|
|
|
|
|
| 14 — ABAC UI | ABACRuleEditor.tsx + policies.ts + policyHooks.ts | ✅ Code |
|
|
|
|
|
| 15 — Templates & Automation | permission_templates + Service + Migration 0056 | ✅ Code |
|
|
|
|
|
| 16 — Mass & Bulk | bulk_share + bulk_unshare + API | ✅ Code |
|
|
|
|
|
| 17 — Analytics & Konflikte | permission_analytics + API | ✅ Code |
|
|
|
|
|
| 18 — Delegation | permission_delegations + Service + Migration 0057 | ✅ Code |
|
|
|
|
|
| 19 — Resolution-Strategien | 4 Strategien + Tenant-Einstellung + Migration 0058 | ✅ Code |
|
|
|
|
|
| 20 — Tests | test_entity_permissions + test_abac + test_permission_performance | ✅ Code |
|
|
|
|
|
| 21 — Dokumentation | permissions.md + permissions_plugin_dev.md | ✅ Code |
|
|
|
|
|
| 22 — Guest Access | guest_users + Guest Auth + Invitation + Guest Frontend + Migration 0059 | ✅ Code |
|
|
|
|
|
| 23 — Infrastructure | PgBouncer + Audit Partitioning docs + scripts | ✅ Code |
|
2026-07-29 02:05:14 +02:00
|
|
|
|
2026-07-29 07:58:22 +02:00
|
|
|
### Migrationen in Produktion
|
2026-07-29 01:28:13 +02:00
|
|
|
| # | Beschreibung | Status |
|
|
|
|
|
|---|-------------|:---:|
|
2026-07-29 01:38:18 +02:00
|
|
|
| 0048 | contact_folder_permissions Tabelle | ✅ |
|
|
|
|
|
| 0049 | entity_permissions Tabelle | ✅ |
|
|
|
|
|
| 0050 | owner_id auf 15 Tabellen | ✅ |
|
|
|
|
|
| 0051 | Folder ACLs → entity_permissions | ✅ |
|
|
|
|
|
| 0052 | RLS Policies auf contacts | ✅ |
|
2026-07-29 07:58:22 +02:00
|
|
|
| 0053 | mail_accounts owner_id | ✅ |
|
|
|
|
|
| 0054 | Plugin owner_id (files, folders, calendars, tasks) | ✅ |
|
|
|
|
|
| 0055 | entity_policies Tabelle | ✅ |
|
|
|
|
|
| 0056 | permission_templates Tabelle | ✅ |
|
|
|
|
|
| 0057 | permission_delegations Tabelle | ✅ |
|
|
|
|
|
| 0058 | tenants resolution_strategy | ✅ |
|
|
|
|
|
| 0059 | guest_users Tabelle | ✅ |
|
2026-07-29 01:28:13 +02:00
|
|
|
|
2026-07-29 07:58:22 +02:00
|
|
|
### Git Commits (Diese Session)
|
2026-07-29 01:28:13 +02:00
|
|
|
| Hash | Beschreibung |
|
|
|
|
|
|------|-------------|
|
2026-07-29 01:38:18 +02:00
|
|
|
| cc021cd | feat: folder permissions (ACLs) |
|
2026-07-29 07:58:22 +02:00
|
|
|
| 5afa1fa | sprint1: entity_permissions + owned_mixin + service + API |
|
|
|
|
|
| 48647a5 | sprint1: set_user_context + RLS policies + folder ACL migration |
|
|
|
|
|
| ea1c1d5 | sprint1 complete: rate limiting |
|
2026-07-29 02:05:14 +02:00
|
|
|
| 479ee04 | sprint2: visibility filter + contact service access checks |
|
|
|
|
|
| 9fc84b7 | sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider |
|
2026-07-29 07:58:22 +02:00
|
|
|
| 52a5c34 | sprint2: frontend permission checks |
|
|
|
|
|
| 517e1b6 | sprint2+3: remaining services + search provider permission-aware |
|
|
|
|
|
| b06aeeb | sprint3: dashboard counts + import owner_id + export filter |
|
|
|
|
|
| 71ed592 | sprint4+5: field-level permissions + universal ShareDialog |
|
|
|
|
|
| 88c0428 | sprint6+7: notifications + audit + mail permissions |
|
|
|
|
|
| 48b2dfd | sprint9: app visibility — sidebar + route guards |
|
|
|
|
|
| 958e412 | sprint8: plugin entities migration 0054 |
|
|
|
|
|
| b7ccd9e | sprint8: fix migration 0054 |
|
|
|
|
|
| 2c14368 | sprint10+11: AI permission + owner transfer |
|
|
|
|
|
| e0003b9 | sprint12+13: rechte settings + ABAC engine |
|
|
|
|
|
| ddf73ee | sprint14-19: ABAC UI + templates + bulk + analytics + delegation + resolution |
|
|
|
|
|
| 24690fb | sprint20-23: tests + docs + guest access + infrastructure |
|
|
|
|
|
| 680d5ab | fix: migration 0058 checkconstraint |
|
|
|
|
|
| 015eb94 | fix: SettingsRechte TypeScript errors |
|
|
|
|
|
| 4c134c6 | fix: GuestContacts title prop |
|
|
|
|
|
|
|
|
|
|
### Was in Produktion läuft (Backend)
|
|
|
|
|
- ✅ entity_permissions Tabelle (universelle ACLs für alle Entities)
|
|
|
|
|
- ✅ owner_id auf 20+ Tabellen
|
|
|
|
|
- ✅ PostgreSQL RLS auf contacts (4 Policies)
|
|
|
|
|
- ✅ set_user_context() bei jedem Request
|
|
|
|
|
- ✅ Universelle Permission API (/api/v1/permissions/*)
|
|
|
|
|
- ✅ Rate Limiting auf Permission-Änderungen
|
|
|
|
|
- ✅ Visibility Filter in 12+ Services
|
|
|
|
|
- ✅ BaseSearchProvider für Permission-aware Search
|
|
|
|
|
- ✅ Dashboard Counts pro User
|
|
|
|
|
- ✅ Export Filter
|
|
|
|
|
- ✅ AI Copilot Permission-Aware
|
|
|
|
|
- ✅ Owner Transfer Service
|
|
|
|
|
- ✅ ABAC Engine (entity_policies + policy_service)
|
|
|
|
|
- ✅ Permission Templates
|
|
|
|
|
- ✅ Bulk Share
|
|
|
|
|
- ✅ Permission Analytics
|
|
|
|
|
- ✅ Permission Delegation
|
|
|
|
|
- ✅ Resolution Strategies (4 Strategien)
|
|
|
|
|
- ✅ Guest Access (guest_users + guest_auth + invitation)
|
|
|
|
|
- ✅ Permission-Change Notifications + Audit Trail
|
|
|
|
|
- ✅ Mailbox Permissions
|
|
|
|
|
|
|
|
|
|
### Was in Produktion läuft (Frontend)
|
|
|
|
|
- ✅ Permission-Checks in ContactDetail + ContactsList
|
|
|
|
|
- ✅ Field-Level UI (hidden/readonly)
|
|
|
|
|
- ✅ Sidebar Permission-Filter
|
|
|
|
|
- ✅ TopBar Permission-Filter
|
|
|
|
|
- ✅ ProtectedRoute + Route Guards
|
|
|
|
|
- ✅ Universeller ShareDialog
|
|
|
|
|
- ✅ ABAC Rule Editor
|
|
|
|
|
- ✅ SettingsRechte (Zentrale Rechte-Seite mit Tabs)
|
|
|
|
|
- ✅ Guest Login + Guest Contacts
|
|
|
|
|
|
|
|
|
|
### Was noch deployed werden muss
|
|
|
|
|
- Backend: Sprint 4-8, 10-19, 22 Dateien sind im Code aber noch nicht alle im Container (Coolify Full Deploy nötig)
|
|
|
|
|
- Frontend: Build erfolgreich, dist vorhanden
|
