From 1b80090ad256874c5e25495ceb1bd4cf26c81c71 Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Sun, 13 Sep 2026 02:35:52 +0200 Subject: [PATCH] fix(plugins): forgejo_error_reporter permissions korrekt auf Manifest-Ebene MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Der vorherige Patch hatte permissions=["system:read"] versehentlich in die PluginRouteDef-kwargs gesetzt statt auf Manifest-Ebene — der Key blieb dadurch unregistriert (live bewiesen: nur 11/12 Keys im Produktionskatalog sichtbar). Korrigiert; Test f9 prueft jetzt die ECHTEN Manifeste statt manueller Registrierung, so haette der Fehler ab sofort gefangen werden muessen. Verifikation: tests/test_audit_architecture_fixes.py 17/17, manifest.permissions=['system:read'], is_core=False, routes=1. --- .../builtins/forgejo_error_reporter/plugin.py | 10 ++++++---- tests/test_audit_architecture_fixes.py | 19 +++++++++++++++++-- 2 files changed, 23 insertions(+), 6 deletions(-) diff --git a/app/plugins/builtins/forgejo_error_reporter/plugin.py b/app/plugins/builtins/forgejo_error_reporter/plugin.py index 2dd9e33..a823404 100644 --- a/app/plugins/builtins/forgejo_error_reporter/plugin.py +++ b/app/plugins/builtins/forgejo_error_reporter/plugin.py @@ -29,19 +29,21 @@ class ForgejoErrorReporterPlugin(BasePlugin): dependencies=[], events=[], migrations=[], - permissions=[], + # Audit P1 (permission catalog): /status route requires system:read — + # the key must be grantable via the manifest. + permissions=["system:read"], routes=[ PluginRouteDef( path="/api/v1/forgejo-error-reporter", module="app.plugins.builtins.forgejo_error_reporter.routes", router_attr="router", - permissions=["system:read"], - ), + ), ], author="LeoCRM Team", min_app_version="1.0.0", - contract_version="1.0.0") + contract_version="1.0.0", + ) def __init__(self) -> None: super().__init__() diff --git a/tests/test_audit_architecture_fixes.py b/tests/test_audit_architecture_fixes.py index 8af3172..c8677f6 100644 --- a/tests/test_audit_architecture_fixes.py +++ b/tests/test_audit_architecture_fixes.py @@ -344,11 +344,26 @@ def test_f9_all_audit_permission_keys_registered(): ) init_permission_registry(set()) + # Register from the REAL manifests (not hand-picked lists) — this catches + # kwargs-level corruption like the bug where permissions=[...] had landed + # inside PluginRouteDef kwargs instead of the manifest level. + from app.plugins.builtins.forgejo_error_reporter.plugin import ( + ForgejoErrorReporterPlugin, + ) + from app.plugins.builtins.permissions.plugin import PermissionsPlugin + + assert PermissionsPlugin().manifest.permissions == [ + "permissions:read", "permissions:admin", + ] + assert ForgejoErrorReporterPlugin().manifest.permissions == ["system:read"], ( + "system:read must be declared at MANIFEST level (not PluginRouteDef kwargs)" + ) + get_permission_registry().register_plugin_permissions( - "permissions", ["permissions:read", "permissions:admin"] + "permissions", PermissionsPlugin().manifest.permissions ) get_permission_registry().register_plugin_permissions( - "forgejo_error_reporter", ["system:read"] + "forgejo_error_reporter", ForgejoErrorReporterPlugin().manifest.permissions ) known = get_permission_registry().get_all()