Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions 5 Packages Projects Releases 1 Wiki Activity

sprint2: visibility filter + contact service access checks + contacts route integration

Browse Source
This commit is contained in:
Agent Zero
2026-07-29 01:38:18 +02:00
parent ea1c1d5113
commit 479ee04834
4 changed files with 362 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
RBAC_PROGRESS.md
+46 -57
View File
@@ -1,74 +1,63 @@
# RBAC Build Progress — LeoCRM
## Letztes Update: 2026-07-29 01:28 CEST
## Letztes Update: 2026-07-29 01:31 CEST
## Sprint 1 — Fundament (14h)
## Sprint 1 — Fundament (14h) ✅ VOLLSTÄNDIG
### Erledigt ✅
- [x] EntityPermission Model erstellt (`app/models/entity_permission.py`)
- Generische Tabelle für alle Entities
- principal_type: user | group | role | guest
- permission_level: none | read | write | admin | delete
- expires_at für zeitlich begrenzte Freigaben
- created_by für Audit-Trail
- Indexes auf entity, principal, tenant, expires_at
### Alle Items erledigt:
- [x] EntityPermission Model (`app/models/entity_permission.py`)
- [x] OwnedMixin (`app/models/owned_mixin.py`)
- [x] Migration 0049: entity_permissions Tabelle — ✅ Produktion
- [x] Migration 0050: owner_id auf 15 Tabellen — ✅ Produktion
- [x] Migration 0051: Folder ACLs → entity_permissions — ✅ Produktion
- [x] Migration 0052: RLS Policies auf contacts — ✅ Produktion
- [x] OwnedMixin auf 13 Models angewendet
- [x] Universeller Permission Service (648 Zeilen)
- [x] Universelle Permission API (6 Endpoints + Rate Limiting)
- [x] set_user_context() für RLS in db/__init__.py
- [x] deps.py: set_user_context() wird bei jedem Request aufgerufen
- [x] Rate Limiting auf Permission-Änderungen (50/min/User)
- [x] Container neu gestartet, alles deployed
- [x] Git committed und gepusht (ea1c1d5)
- [x] OwnedMixin erstellt (`app/models/owned_mixin.py`)
- owner_id Feld (nullable, FK → users.id, ON DELETE SET NULL)
- Index auf owner_id
- Kann auf jedes Model angewendet werden
## Sprint 2 — Row-Level Security (16h) 🔄 NÄCHSTER
- [x] Migration 0049: entity_permissions Tabelle — ✅ Ausgeführt in Produktion
- [x] Migration 0050: owner_id auf 15 Tabellen — ✅ Ausgeführt in Produktion
### Geplante Items:
- [ ] apply_visibility_filter() Helper
- [ ] Query-Filter in alle 28 Routes
- [ ] Child-Entity-Vererbung
- [ ] Batch-Resolution in Listen-Queries
- [ ] BaseSearchProvider mit Visibility-Filter
- [ ] ContactDetail/ContactsList Permission-Checks (Frontend)
- [ ] Copy/Duplicate Permission
- [ ] EXISTS-Optimization für RLS
- [x] OwnedMixin auf alle 13 Models angewendet:
- Contact, Address, Attachment, BankAccount, Workflow, Sequence
- SavedFilter, SavedView, Webhook, Notification, CustomFieldDefinition
- EntityHistory, AIConversation
- [x] Universeller Permission Service (`app/services/entity_permission_service.py`, 648 Zeilen)
- list_permissions, create_permission, update_permission, delete_permission
- get_effective_access (Owner → User → Group → Role → None)
- get_visible_ids (alle sichtbaren Datensätze für User)
- batch_get_effective_access (Batch-Resolution für Listen)
- get_cached_visible_ids (Redis Cache, 5 Min TTL)
- check_entity_access (einfacher Check)
- cleanup_expired_permissions (Background Worker)
- [x] Universelle Permission API (`app/routes/entity_permissions.py`, 151 Zeilen)
- GET /api/v1/permissions/{entity_type}/{entity_id}
- POST /api/v1/permissions/{entity_type}/{entity_id}
- PUT /api/v1/permissions/{entity_type}/{entity_id}/{permission_id}
- DELETE /api/v1/permissions/{entity_type}/{entity_id}/{permission_id}
- GET /api/v1/permissions/{entity_type}/{entity_id}/access
- GET /api/v1/permissions/registry
- [x] Schema erstellt (`app/schemas/entity_permission.py`)
- [x] Route in main.py registriert
- [x] Alle Imports getestet — OK
- [x] Container neu gestartet
- [x] Git committed und gepusht (5afa1fa)
### In Bearbeitung 🔄
- [ ] PostgreSQL RLS Policies + set_user_context()
- [ ] Rate Limiting auf Permission-Änderungen
- [ ] Folder ACLs migrieren (Migration 0051)
### Noch offen ⬜
- [ ] Sprint 2-23 (siehe ENTERPRISE_RBAC_PLAN.md)
## Sprint 3-23 ⬜
---
## Migrationen
| # | Beschreibung | Status |
|---|-------------|:---:|
| 0048 | contact_folder_permissions Tabelle | ✅ Ausgeführt |
| 0049 | entity_permissions Tabelle | ✅ Ausgeführt |
| 0050 | owner_id auf 15 Tabellen | ✅ Ausgeführt |
| 0051 | Folder ACLs → entity_permissions | ⬜ Geplant |
| 0048 | contact_folder_permissions Tabelle | ✅ |
| 0049 | entity_permissions Tabelle | ✅ |
| 0050 | owner_id auf 15 Tabellen | ✅ |
| 0051 | Folder ACLs → entity_permissions | ✅ |
| 0052 | RLS Policies auf contacts | ✅ |
## Git Commits
| Hash | Beschreibung |
|------|-------------|
| cc021cd | feat: folder permissions (ACLs) - share folders with users/groups |
| 5afa1fa | sprint1: entity_permissions table + owned_mixin + universal permission service + API + migrations 0049+0050 |
| cc021cd | feat: folder permissions (ACLs) |
| 5afa1fa | sprint1: entity_permissions + owned_mixin + service + API + migrations 0049+0050 |
| 48647a5 | sprint1: set_user_context + RLS policies + folder ACL migration 0051+0052 |
| ea1c1d5 | sprint1 complete: rate limiting on permission changes |
## Was in Produktion läuft
- entity_permissions Tabelle (universelle ACLs)
- owner_id auf 15 Tabellen (contacts, addresses, attachments, etc.)
- PostgreSQL RLS auf contacts (4 Policies: admin, owner, tenant-owned, shared)
- set_user_context() wird bei jedem Request gesetzt
- Universelle Permission API unter /api/v1/permissions/*
- Rate Limiting auf Permission-Änderungen
- Folder ACLs in entity_permissions migriert