fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)

Verifikation: Alle 17 Audit-Findings gegen den Code geprueft — alle bestaetigt.
Backend-Lifecycle-Fixes umgesetzt; 4 Frontend-Plugin-Architektur-Punkte
als Phase Q in die Roadmap eingeplant.

- P1 list_workspaces: Module + User-Counts gebuendelt laden (Editor-Overwrite-Bug)
- P1 active-manifests: Tenant-Deaktivierung (tenant_plugin_activation) filtern
- P1 uninstall: volle Service-Deactivation VOR registry.uninstall()
- P1 ContractRegistry: DB-Aktivstatus-Guard (Restart-Edge-Case) + Re-Activate
- P1/P2 Field-Definitions: voller Lifecycle (register/unregister) im Service
- P1/P2 Contact-Felddefinitionen (39) ins ContactsPlugin-Manifest verschoben
- P1 12 fehlende Permission-Keys registriert (AST-Scan: 0 fehlend)
- P2 contact_folder -> ContactsPlugin; ENTITY_PLUGIN_OWNERS wird befuellt
- P2 Entity-Permission-Fallback fail-closed statt contacts:read
- P2 forgejo_error_reporter is_core=False; DMS is_core=True (ADR-020)
- P2 Worker: Contacts-Trash-Cleanup ins Plugin (get_job_modules-Discovery)
- P1/P2 DSGVO-Export delegiert an DSAR-Collector (kein Core->Contacts)
- P2 False-green Tests korrigiert (or True, veraltete Route-Count-Assertion)

Verifikation: tests/test_audit_architecture_fixes.py 17/17; Regressionen
gruen (contacts_lifecycle, entity_registry, workspace_scopes, rbac,
lifecycle_service); Combo-Order-Test 35/35; Cross-Plugin-Checker 497/0;
compileall sauber; ruff auf 7-Error-Baseline.

Doku: PROGRESS.md Audit-Section, PLATFORM_ROADMAP.md Phase Q (Q1-Q4),
plugin-development-guide.md Lifecycle, permissions.md Katalog.

app/core/permission_registry.py

@@ -70,6 +70,17 @@ CORE_PERMISSIONS: list[dict[str, str]] = [
     {"key": "dashboard:read", "label": "Dashboard: Read", "category": "core", "module": "dashboard"},
     {"key": "dashboard:write", "label": "Dashboard: Write", "category": "core", "module": "dashboard"},
     {"key": "system:admin", "label": "System: Admin (cross-tenant)", "category": "system", "module": "system"},
+    # Audit P1 (permission catalog): these keys were required by core routes
+    # but never registered, so non-admin roles could never be granted them.
+    {"key": "automation:admin", "label": "Automation: Admin (backups, self-improvement)", "category": "core", "module": "automation"},
+    {"key": "bank-accounts:read", "label": "Bank Accounts: Read", "category": "core", "module": "bank_accounts"},
+    {"key": "bank-accounts:write", "label": "Bank Accounts: Write", "category": "core", "module": "bank_accounts"},
+    {"key": "delegations:read", "label": "Delegations: Read", "category": "core", "module": "delegations"},
+    {"key": "delegations:write", "label": "Delegations: Write", "category": "core", "module": "delegations"},
+    {"key": "policies:read", "label": "Policies: Read", "category": "core", "module": "policies"},
+    {"key": "policies:write", "label": "Policies: Write", "category": "core", "module": "policies"},
+    {"key": "templates:read", "label": "Permission Templates: Read", "category": "core", "module": "templates"},
+    {"key": "templates:write", "label": "Permission Templates: Write", "category": "core", "module": "templates"},
     # NOTE: Plugin permissions (calendar, dms, mail, tasks, comm, automation, ai,
     # tags, entity_links, reports, search, mcp, permissions, agents)
     # are registered dynamically via register_plugin_permissions() from plugin
@@ -79,50 +90,12 @@ CORE_PERMISSIONS: list[dict[str, str]] = [
 
 # ── Core field definitions for field-level permissions ──
 CORE_FIELD_DEFINITIONS: list[dict[str, str]] = [
-    # ── Contact fields ──
-    {"module": "contacts", "field": "firstname", "label": "First Name", "sensitivity": "normal"},
-    {"module": "contacts", "field": "surname", "label": "Last Name", "sensitivity": "normal"},
-    {"module": "contacts", "field": "displayname", "label": "Display Name", "sensitivity": "normal"},
-    {"module": "contacts", "field": "name", "label": "Name", "sensitivity": "normal"},
-    {"module": "contacts", "field": "email_1", "label": "Email 1", "sensitivity": "normal"},
-    {"module": "contacts", "field": "email_2", "label": "Email 2", "sensitivity": "normal"},
-    {"module": "contacts", "field": "phone_1", "label": "Phone 1", "sensitivity": "normal"},
-    {"module": "contacts", "field": "phone_2", "label": "Phone 2", "sensitivity": "normal"},
-    {"module": "contacts", "field": "mobilephone", "label": "Mobile", "sensitivity": "sensitive"},
-    {"module": "contacts", "field": "function", "label": "Position", "sensitivity": "normal"},
-    {"module": "contacts", "field": "website", "label": "Website", "sensitivity": "normal"},
-    {"module": "contacts", "field": "status", "label": "Status", "sensitivity": "normal"},
-    {"module": "contacts", "field": "type", "label": "Type", "sensitivity": "normal"},
-    {"module": "contacts", "field": "gender", "label": "Gender", "sensitivity": "normal"},
-    {"module": "contacts", "field": "suffix", "label": "Suffix", "sensitivity": "normal"},
-    {"module": "contacts", "field": "ext_name_line", "label": "Extra Name Line", "sensitivity": "normal"},
-    {"module": "contacts", "field": "country", "label": "Country", "sensitivity": "normal"},
-    # ── Financial / sensitive fields ──
-    {"module": "contacts", "field": "code", "label": "Code", "sensitivity": "sensitive"},
-    {"module": "contacts", "field": "accounting_code", "label": "Accounting Code", "sensitivity": "sensitive"},
-    {"module": "contacts", "field": "vendor_accounting_code", "label": "Vendor Accounting Code", "sensitivity": "sensitive"},
-    {"module": "contacts", "field": "vat_code", "label": "VAT Code", "sensitivity": "sensitive"},
-    {"module": "contacts", "field": "fiscal_code", "label": "Fiscal Code", "sensitivity": "sensitive"},
-    {"module": "contacts", "field": "commerce_code", "label": "Commerce Code", "sensitivity": "sensitive"},
-    {"module": "contacts", "field": "purchase_number", "label": "Purchase Number", "sensitivity": "sensitive"},
-    {"module": "contacts", "field": "bic", "label": "BIC", "sensitivity": "sensitive"},
-    # ── Addresses ──
-    {"module": "contacts", "field": "mailing_street", "label": "Mailing Street", "sensitivity": "normal"},
-    {"module": "contacts", "field": "mailing_city", "label": "Mailing City", "sensitivity": "normal"},
-    {"module": "contacts", "field": "mailing_postalcode", "label": "Mailing Postal Code", "sensitivity": "normal"},
-    {"module": "contacts", "field": "mailing_country", "label": "Mailing Country", "sensitivity": "normal"},
-    {"module": "contacts", "field": "visit_street", "label": "Visit Street", "sensitivity": "normal"},
-    {"module": "contacts", "field": "visit_city", "label": "Visit City", "sensitivity": "normal"},
-    {"module": "contacts", "field": "visit_postalcode", "label": "Visit Postal Code", "sensitivity": "normal"},
-    {"module": "contacts", "field": "visit_country", "label": "Visit Country", "sensitivity": "normal"},
-    {"module": "contacts", "field": "invoice_street", "label": "Invoice Street", "sensitivity": "normal"},
-    {"module": "contacts", "field": "invoice_city", "label": "Invoice City", "sensitivity": "normal"},
-    {"module": "contacts", "field": "invoice_postalcode", "label": "Invoice Postal Code", "sensitivity": "normal"},
-    {"module": "contacts", "field": "invoice_country", "label": "Invoice Country", "sensitivity": "normal"},
-    # ── Notes & Tags ──
-    {"module": "contacts", "field": "notes", "label": "Notes", "sensitivity": "sensitive"},
-    {"module": "contacts", "field": "tags", "label": "Tags", "sensitivity": "sensitive"},
-    # ── User fields ──
+    # Audit P1/P2 (contact field definitions): all contacts:* field
+    # definitions moved to the ContactsPlugin manifest (field_definitions=)
+    # so the plugin fully owns its field structure. The core keeps only
+    # genuinely core-owned fields (users). Plugin field definitions are
+    # registered at activation time via register_field_definitions().
+    # ── User fields (core-owned) ──
     {"module": "users", "field": "email", "label": "Email", "sensitivity": "normal"},
     {"module": "users", "field": "name", "label": "Name", "sensitivity": "normal"},
     {"module": "users", "field": "role", "label": "Role", "sensitivity": "normal"},
@@ -229,6 +202,18 @@ class PermissionRegistry:
         self._field_definitions[plugin_name] = field_defs
         logger.info("Registered %d field definitions for plugin '%s'", len(field_defs), plugin_name)
 
+    def unregister_field_definitions(self, plugin_name: str) -> None:
+        """Remove field definitions of a deactivated/uninstalled plugin.
+
+        Audit P1/P2 (field-definitions lifecycle): the contribution type was
+        only half-integrated — register_field_definitions() existed but no
+        matching unregister, so a deactivated plugin kept serving its field
+        definitions in the permission UI.
+        """
+        removed = self._field_definitions.pop(plugin_name, None)
+        if removed is not None:
+            logger.info("Unregistered %d field definitions for plugin '%s'", len(removed), plugin_name)
+
     def get_all_field_definitions(self) -> list[dict[str, str]]:
         """Return all registered field definitions."""
         result = list(self._core_field_definitions)

app/core/sensitive_data.py

@@ -173,12 +173,15 @@ def _derive_policy_from_sensitivity(
     if field_name in entity_policy:
         return dict(entity_policy[field_name])
 
-    # Try to get sensitivity from permission registry (lazy import to avoid
-    # circular dependencies at module load time).
+    # Try to get sensitivity from the permission registry (lazy import to
+    # avoid circular dependencies at module load time). Use the registry's
+    # combined view (core + plugin field definitions) — contact fields moved
+    # to the ContactsPlugin manifest (audit P1/P2), so CORE_FIELD_DEFINITIONS
+    # alone no longer covers them.
     try:
-        from app.core.permission_registry import CORE_FIELD_DEFINITIONS
+        from app.core.permission_registry import get_permission_registry
 
-        for fd in CORE_FIELD_DEFINITIONS:
+        for fd in get_permission_registry().get_all_field_definitions():
             if fd.get("module") == entity_type and fd.get("field") == field_name:
                 sensitivity = fd.get("sensitivity", "normal")
                 return dict(_SENSITIVITY_DEFAULTS.get(sensitivity, _ALL_ALLOWED))

app/core/worker.py

@@ -396,7 +396,6 @@ async def cleanup_trash_job(ctx: dict[str, Any]) -> None:
     from sqlalchemy import text as sa_text
 
     from app.core.db import get_worker_session_factory
-    from app.models.contact import Contact
     from app.models.entity_attachment import EntityAttachment
 
     factory = get_worker_session_factory()
@@ -414,16 +413,9 @@ async def cleanup_trash_job(ctx: dict[str, Any]) -> None:
                     {"tid": str(tenant_id)},
                 )
 
-                # Delete soft-deleted contacts
-                result = await db.execute(
-                    sa_delete(Contact).where(
-                        Contact.deleted_at.is_not(None),
-                        Contact.deleted_at < cutoff,
-                    )
-                )
-                total_deleted += result.rowcount
-
                 # Delete soft-deleted entity attachments
+                # (Contacts trash cleanup moved to the contacts plugin:
+                # cleanup_contacts_trash — audit P2, no core->contacts import)
                 result = await db.execute(
                     sa_delete(EntityAttachment).where(
                         EntityAttachment.deleted_at.is_not(None),
@@ -488,6 +480,12 @@ class WorkerSettings:
             _wrap_cron_with_lock("cleanup_trash", cleanup_trash_job, ttl_seconds=300),
             hour=4, minute=0,
         ),
+        # Contacts trash cleanup — daily at 04:15, owned by the contacts
+        # plugin (audit P2: no core->contacts import in the worker).
+        cron(
+            _wrap_cron_with_lock("cleanup_contacts_trash", get_job("cleanup_contacts_trash"), ttl_seconds=300),
+            hour=4, minute=15,
+        ),
         # Knowledge retention cleanup — daily at 05:00 (90 days, keeps approved).
         # Function comes from the knowledge plugin via the job registry.
         cron(

app/main.py

@@ -337,6 +337,22 @@ async def lifespan(app: FastAPI):
             if plugin and plugin.manifest.permissions:
                 register_plugin_permissions(record.name, plugin.manifest.permissions)
 
+        # Audit P1 (contract lazy loading, restart edge case): plugins that
+        # were already inactive in the DB when this process started never get
+        # a runtime deactivate() call, so the ContractRegistry would
+        # lazy-load their contracts module and resurrect the contract.
+        # Mark them once here so get_contract() fails closed for them.
+        inactive_result = await db.execute(
+            sa_select(PluginModel.name).where(PluginModel.active == False)  # noqa: E712
+        )
+        inactive_names = {row[0] for row in inactive_result}
+        if inactive_names:
+            from app.plugins.builtins.contracts import get_contract_registry
+            get_contract_registry().mark_db_inactive(inactive_names)
+            logger.info(
+                "Contract registry: %d plugins marked DB-inactive", len(inactive_names)
+            )
+
     init_permission_registry(active_plugin_names)
     logger.info("Permission registry initialized with %d active plugins", len(active_plugin_names))
 
@@ -359,7 +375,7 @@ async def lifespan(app: FastAPI):
         plugin = registry.get_plugin(name)
         if plugin:
             for entity_type, model_class in plugin.get_entity_models().items():
-                register_entity_model(entity_type, model_class)
+                register_entity_model(entity_type, model_class, plugin_name=name)
     logger.info("Entity models registered for %d active plugins", len(active_plugin_names))
 
     # Register field definitions from active plugins only

app/plugins/builtins/contacts/jobs.py

@@ -0,0 +1,64 @@
+"""ARQ background jobs for the contacts plugin.
+
+Registered via ``register_job()`` at import time; the worker discovers this
+module through ``ContactsPlugin.get_job_modules()`` — the core worker must
+not import contact models directly (audit P2: hidden core->contacts
+coupling in the trash cleanup).
+"""
+
+from __future__ import annotations
+
+import logging
+from datetime import UTC, datetime, timedelta
+from typing import Any
+
+from sqlalchemy import delete as sa_delete
+from sqlalchemy import text as sa_text
+
+from app.core.job_registry import register_job
+
+logger = logging.getLogger(__name__)
+
+_TRASH_RETENTION_DAYS = 90
+
+
+async def cleanup_contacts_trash_job(ctx: dict[str, Any]) -> None:
+    """Permanently delete soft-deleted contacts older than the retention window.
+
+    Runs daily. Iterates per-tenant for RLS compliance.
+    Moved from app.core.worker.cleanup_trash_job (audit P2) so the core
+    worker only handles core-owned entities (entity_attachments).
+    """
+    from app.core.db import get_worker_session_factory
+    from app.models.contact import Contact
+
+    factory = get_worker_session_factory()
+    async with factory() as db:
+        try:
+            tenant_result = await db.execute(sa_text("SELECT id FROM tenants"))
+            tenant_ids = [row[0] for row in tenant_result]
+
+            cutoff = datetime.now(UTC) - timedelta(days=_TRASH_RETENTION_DAYS)
+            total_deleted = 0
+            for tenant_id in tenant_ids:
+                await db.execute(
+                    sa_text("SELECT set_config('app.current_tenant_id', :tid, true)"),
+                    {"tid": str(tenant_id)},
+                )
+                result = await db.execute(
+                    sa_delete(Contact).where(
+                        Contact.deleted_at.is_not(None),
+                        Contact.deleted_at < cutoff,
+                    )
+                )
+                total_deleted += result.rowcount
+                await db.commit()
+
+            if total_deleted:
+                logger.info("Contacts trash cleanup: permanently deleted %d old contacts", total_deleted)
+        except Exception:
+            logger.error("Contacts trash cleanup failed", exc_info=True)
+            await db.rollback()
+
+
+register_job("cleanup_contacts_trash", cleanup_contacts_trash_job)

app/plugins/builtins/contacts/plugin.py

@@ -10,6 +10,7 @@ import logging
 
 from app.plugins.base import BasePlugin
 from app.plugins.manifest import (
+    FieldDefinition,
     FrontendDashboardWidget,
     FrontendMenuItem,
     FrontendPageRoute,
@@ -106,18 +107,70 @@ class ContactsPlugin(BasePlugin):
             "contacts:write",
             "contacts:delete",
         ],
+        # Audit P1/P2: contact field definitions are plugin-owned (moved
+        # from CORE_FIELD_DEFINITIONS) — registered at activation time via
+        # register_field_definitions() and removed on deactivation.
+        field_definitions=[
+            FieldDefinition(module="contacts", field="firstname", label="First Name", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="surname", label="Last Name", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="displayname", label="Display Name", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="name", label="Name", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="email_1", label="Email 1", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="email_2", label="Email 2", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="phone_1", label="Phone 1", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="phone_2", label="Phone 2", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="mobilephone", label="Mobile", sensitivity="sensitive"),
+            FieldDefinition(module="contacts", field="function", label="Position", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="website", label="Website", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="status", label="Status", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="type", label="Type", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="gender", label="Gender", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="suffix", label="Suffix", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="ext_name_line", label="Extra Name Line", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="country", label="Country", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="code", label="Code", sensitivity="sensitive"),
+            FieldDefinition(module="contacts", field="accounting_code", label="Accounting Code", sensitivity="sensitive"),
+            FieldDefinition(module="contacts", field="vendor_accounting_code", label="Vendor Accounting Code", sensitivity="sensitive"),
+            FieldDefinition(module="contacts", field="vat_code", label="VAT Code", sensitivity="sensitive"),
+            FieldDefinition(module="contacts", field="fiscal_code", label="Fiscal Code", sensitivity="sensitive"),
+            FieldDefinition(module="contacts", field="commerce_code", label="Commerce Code", sensitivity="sensitive"),
+            FieldDefinition(module="contacts", field="purchase_number", label="Purchase Number", sensitivity="sensitive"),
+            FieldDefinition(module="contacts", field="bic", label="BIC", sensitivity="sensitive"),
+            FieldDefinition(module="contacts", field="mailing_street", label="Mailing Street", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="mailing_city", label="Mailing City", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="mailing_postalcode", label="Mailing Postal Code", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="mailing_country", label="Mailing Country", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="visit_street", label="Visit Street", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="visit_city", label="Visit City", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="visit_postalcode", label="Visit Postal Code", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="visit_country", label="Visit Country", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="invoice_street", label="Invoice Street", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="invoice_city", label="Invoice City", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="invoice_postalcode", label="Invoice Postal Code", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="invoice_country", label="Invoice Country", sensitivity="normal"),
+            FieldDefinition(module="contacts", field="notes", label="Notes", sensitivity="sensitive"),
+            FieldDefinition(module="contacts", field="tags", label="Tags", sensitivity="sensitive"),
+        ],
         is_core=True,
         author="LeoCRM Team",
         min_app_version="1.0.0",
         contract_version="1.0.0",
     )
 
+    def get_job_modules(self) -> list[str]:
+        """Worker discovers the contacts trash-cleanup job here (audit P2)."""
+        return ["app.plugins.builtins.contacts.jobs"]
+
     def get_entity_models(self) -> dict[str, type]:
         from app.models.contact import Contact
+        from app.models.contact_folder import ContactFolder
         return {
             "contact": Contact,
             "contacts": Contact,
             "company": Contact,
+            # Audit P2: contact_folder is contacts-plugin-owned domain data
+            # (moved from the static core ENTITY_MODELS map).
+            "contact_folder": ContactFolder,
         }
 
     async def on_activate(self, db, service_container, event_bus) -> None:

app/plugins/builtins/contracts.py

@@ -60,6 +60,9 @@ class ContractRegistry:
             cls._instance._contracts: dict[str, Any] = {}
             cls._instance._loaded: set[str] = set()
             cls._instance._unregistered: set[str] = set()
+            # Plugins whose DB record says active=False (audit restart edge
+            # case) — marked once at API startup, see main.py lifespan.
+            cls._instance._db_inactive: set[str] = set()
         return cls._instance
 
     # ─── registration ───
@@ -92,20 +95,51 @@ class ContractRegistry:
 
         On first access the registry attempts to lazy-load the plugin's
         ``contracts`` module, which will register itself on import.
-        """
-        if plugin_name in self._contracts:
-            return self._contracts[plugin_name]
 
+        Audit P1 (contract lazy loading): the DB activation state is checked
+        BEFORE serving or lazy-loading. A plugin that was already inactive
+        when the process started never lands in ``_unregistered`` (it was
+        never deactivated at runtime), so the old guard alone let the lazy
+        loader import its contracts module and resurrect the contract.
+        The permission registry mirrors ``PluginModel.active`` at startup,
+        so an inactive plugin fails closed here. When the permission
+        registry is NOT initialized (worker process, early bootstrap)
+        the legacy lazy-load behaviour is kept.
+        """
         # Explicitly unregistered (deactivated): never resurrect via
         # lazy-loading (ARCH-014) — the deactivated contract must stay gone.
         if plugin_name in self._unregistered:
             return None
 
+        # DB activation guard (audit restart edge case): plugins whose DB
+        # record was already inactive when the process started never land in
+        # _unregistered (they were never deactivated at runtime), so lazy
+        # loading could resurrect their contracts. main.py marks them once
+        # at startup; activation clears the marker again.
+        if plugin_name in self._db_inactive:
+            return None
+
+        if plugin_name in self._contracts:
+            return self._contracts[plugin_name]
+
         if plugin_name not in self._loaded:
             self._try_lazy_load(plugin_name)
 
         return self._contracts.get(plugin_name)
 
+    def mark_db_inactive(self, plugin_names: set[str]) -> None:
+        """Mark plugins as DB-inactive (startup, audit restart edge case).
+
+        Called once from main.py lifespan with the names of plugins whose DB
+        record has active=False. get_contract() fails closed for these.
+        """
+        self._db_inactive.update(plugin_names)
+
+    def mark_plugin_active(self, plugin_name: str) -> None:
+        """Clear inactive markers (plugin activated/reinstalled at runtime)."""
+        self._db_inactive.discard(plugin_name)
+        self._unregistered.discard(plugin_name)
+
     def require_contract(self, plugin_name: str) -> Any:
         """Like :meth:`get_contract` but raise if unavailable."""
         contract = self.get_contract(plugin_name)
@@ -148,6 +182,7 @@ class ContractRegistry:
         """Clear all state — for unit tests only."""
         self._contracts.clear()
         self._loaded.clear()
+        self._db_inactive.clear()
 
 
 # ─── module-level helpers ───

app/plugins/builtins/dms/plugin.py

@@ -20,6 +20,11 @@ class DmsPlugin(BasePlugin):
         version="1.0.0",
         display_name="DMS",
         description="Document management: folder hierarchy, file upload, PDF preview, Collabora edit sessions, internal sharing, search, bulk ops.",
+        # Audit P1/P2 (ADR-020): DMS is a platform core plugin — the core schema
+        # (entity_attachments.files-FK) builds on the DMS files table, so DMS
+        # cannot be deactivated. Declared is_core=True so the registry enforces
+        # this instead of the FK being silently invalid.
+        is_core=True,
         dependencies=["permissions"],
         routes=[
             PluginRouteDef(

app/plugins/builtins/forgejo_error_reporter/plugin.py

@@ -23,7 +23,9 @@ class ForgejoErrorReporterPlugin(BasePlugin):
         version="1.0.0",
         display_name="Forgejo Error Reporter",
         description="Automatically reports errors to Forgejo as issues. Test environment only.",
-        is_core=True,
+        # Audit P2 (classification): a test/staging-only plugin must be
+        # deactivatable — is_core=True contradicts its own production guard.
+        is_core=False,
         dependencies=[],
         events=[],
         migrations=[],
@@ -33,7 +35,8 @@ class ForgejoErrorReporterPlugin(BasePlugin):
                 path="/api/v1/forgejo-error-reporter",
                 module="app.plugins.builtins.forgejo_error_reporter.routes",
                 router_attr="router",
-            ),
+        permissions=["system:read"],
+    ),
         ],
 
         author="LeoCRM Team",

app/plugins/builtins/permissions/plugin.py

@@ -30,7 +30,12 @@ class PermissionsPlugin(BasePlugin):
         ],
         events=[],
         migrations=["0001_initial.sql"],
-        permissions=[],
+        # Audit P1 (permission catalog): routes and settings pages use
+        # permissions:admin / permissions:read — they must be grantable.
+        permissions=[
+            "permissions:read",
+            "permissions:admin",
+        ],
         is_core=True,
         settings_pages=[
             FrontendSettingsPage(path='roles', label_key='settings.roles', label='Roles', component='@/pages/SettingsRoles', icon='Shield', order=10, permission='permissions:read'),

app/plugins/registry.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import importlib
 import logging
+import uuid
 from pathlib import Path
 from typing import Any
 
@@ -852,19 +853,43 @@ class PluginRegistry:
 
     # ── Active UI Manifests (Phase 3) ──
 
-    async def get_active_manifests(self, db: AsyncSession) -> list[dict[str, Any]]:
+    async def get_active_manifests(
+        self, db: AsyncSession, tenant_id: uuid.UUID | None = None
+    ) -> list[dict[str, Any]]:
         """Return UI manifests for all active plugins.
 
         Each entry contains the plugin name and its frontend UI contributions
         (menu_items, page_routes, detail_tabs, settings_pages, dashboard_widgets).
+
+        Audit P1 (tenant manifests): when *tenant_id* is given, plugins that are
+        deactivated for that tenant (tenant_plugin_activation.is_active=False)
+        are excluded — the manifest output must mirror require_active_plugin()
+        semantics so the UI never offers menus/routes the backend then blocks
+        with 403. No tenant row = default active (same as the API gate).
         """
         result = await db.execute(select(PluginModel).where(PluginModel.active.is_(True)))
         active_records = {row.name: row for row in result.scalars().all()}
 
+        # Per-tenant deactivations (same table/semantics as deps.require_active_plugin)
+        tenant_disabled: set[str] = set()
+        if tenant_id is not None:
+            from sqlalchemy import text as sa_text
+
+            rows = await db.execute(
+                sa_text(
+                    "SELECT plugin_name FROM tenant_plugin_activation "
+                    "WHERE tenant_id = :tid AND is_active = false"
+                ),
+                {"tid": tenant_id},
+            )
+            tenant_disabled = {row[0] for row in rows}
+
         manifests: list[dict[str, Any]] = []
         for name, plugin in self._plugins.items():
             if name not in active_records:
                 continue
+            if name in tenant_disabled:
+                continue
             m = plugin.manifest
             manifests.append(
                 {

app/routes/plugins.py

@@ -58,9 +58,21 @@ async def get_active_manifests(
     dashboard_widgets contributed by each active plugin. Used by the
     frontend PluginRegistry to dynamically register routes, sidebar items,
     settings pages, and detail tabs.
+
+    Audit P1 (tenant manifests): plugins deactivated for the caller's
+    tenant are excluded so UI and API gates agree (no 403-on-click menus).
     """
+    import uuid as uuid_mod
+
     service = get_plugin_service()
-    manifests = await service.get_active_manifests(db)
+    tenant_id: uuid_mod.UUID | None = None
+    raw_tid = current_user.get("tenant_id")
+    if raw_tid:
+        try:
+            tenant_id = uuid_mod.UUID(str(raw_tid))
+        except (ValueError, TypeError):
+            tenant_id = None
+    manifests = await service.get_active_manifests(db, tenant_id=tenant_id)
     return {"plugins": manifests, "total": len(manifests)}
 
 

app/routes/system_settings.py

@@ -192,25 +192,20 @@ async def dsgvo_export(
 ):
     """Export all personal data for a user (DSGVO/GDPR data subject access request).
 
-    Returns a JSON file with all data associated with the user:
-    - User profile
-    - Contacts owned by user
-    - Audit log entries
-    - Mail accounts
-    - Tasks assigned to user
-    - Calendar events
-    - Communication messages
+    Audit P1/P2 (DSGVO duplicate): this route previously held a second,
+    contact-aware export implementation parallel to the newer DSAR job
+    pipeline. It now delegates to the single authoritative collector
+    ``app.core.jobs._dsar_collect_user_data`` — core-owned categories are
+    collected there, plugin-owned categories (contacts, mail, tasks,
+    calendar, communication, ...) are contributed by the plugin contracts.
+    No core->contacts coupling here anymore.
     """
     import io
     import json
-    from datetime import UTC, datetime
 
     from fastapi.responses import StreamingResponse
-    from sqlalchemy import select as sa_select
 
-    from app.models.audit import AuditLog
-    from app.models.contact import Contact
-    from app.models.user import User
+    from app.core.jobs import _dsar_collect_user_data
 
     tenant_id = uuid.UUID(current_user["tenant_id"])
     try:
@@ -218,34 +213,7 @@ async def dsgvo_export(
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid user_id", "code": "invalid_id"}) from None
 
-    export_data = {"user_id": str(uid), "exported_at": datetime.now(UTC).isoformat(), "data": {}}
-
-    # User profile
-    user_result = await db.execute(sa_select(User).where(User.id == uid))
-    user = user_result.scalar_one_or_none()
-    if user:
-        export_data["data"]["profile"] = {
-            "email": user.email, "name": user.name, "role": user.role,
-            "is_active": user.is_active, "created_at": user.created_at.isoformat() if user.created_at else None,
-        }
-
-    # Contacts owned by user
-    contacts_result = await db.execute(
-        sa_select(Contact).where(Contact.tenant_id == tenant_id, Contact.owner_id == uid, Contact.deleted_at.is_(None))
-    )
-    export_data["data"]["contacts"] = [
-        {"id": str(c.id), "type": c.type, "displayname": c.displayname, "email_1": c.email_1, "email_2": c.email_2}
-        for c in contacts_result.scalars().all()
-    ]
-
-    # Audit log entries
-    audit_result = await db.execute(
-        sa_select(AuditLog).where(AuditLog.tenant_id == tenant_id, AuditLog.user_id == uid).limit(1000)
-    )
-    export_data["data"]["audit_log"] = [
-        {"action": a.action, "entity_type": a.entity_type, "timestamp": a.timestamp.isoformat() if a.timestamp else None}
-        for a in audit_result.scalars().all()
-    ]
+    export_data = await _dsar_collect_user_data(db, str(tenant_id), str(uid))
 
     # Log the DSGVO export
     from app.core.audit import log_audit

app/services/entity_permission_service.py

@@ -29,7 +29,9 @@ from app.core.notifications import post_system_message
 from app.models.address import Address
 from app.models.attachment import Attachment
 from app.models.bank_account import BankAccount
-from app.models.contact_folder import ContactFolder
+
+# NOTE (audit P2): ContactFolder moved to ContactsPlugin.get_entity_models() —
+# the core entity registry no longer imports contact domain models.
 from app.models.custom_field_definition import CustomFieldDefinition
 from app.models.entity_permission import EntityPermission
 from app.models.group import Group, UserGroup
@@ -66,7 +68,8 @@ ENTITY_MODELS: dict[str, type] = {
     "webhook": Webhook,
     "notification": Notification,
     "custom_field_definition": CustomFieldDefinition,
-    "contact_folder": ContactFolder,
+    # Audit P2: contact_folder moved to ContactsPlugin.get_entity_models()
+    # (it is plugin-owned domain data, not a core entity).
 }
 
 # W4b: Tracks which plugin registered which entity_type — used to derive
@@ -92,7 +95,12 @@ def get_entity_read_permission(entity_type: str) -> str:
         candidates = _core_module_keys(module, "read")
         if candidates:
             return candidates[0]
-    return "contacts:read"
+    # Audit P2: fail closed. An entity that cannot be mapped to an owning
+    # module must NOT silently default to contacts:read — the sentinel is
+    # not grantable to any role, so check_entity_read_permission() denies.
+    # Unknown entity types are already rejected earlier by
+    # validate_entity_type() (422) before this fallback can matter.
+    return "__unmapped__:read"
 
 
 def _core_module_keys(module: str, action: str) -> list[str]:

app/services/plugin_service.py

@@ -118,7 +118,19 @@ class PluginService:
                 if plugin:
                     from app.services.entity_permission_service import register_entity_model
                     for entity_type, model_class in plugin.get_entity_models().items():
-                        register_entity_model(entity_type, model_class)
+                        register_entity_model(entity_type, model_class, plugin_name=name)
+
+                # Register field definitions for field-level permissions
+                # (audit: contribution type now fully lifecycle-integrated)
+                if plugin:
+                    field_defs = plugin.get_field_definitions()
+                    if field_defs:
+                        get_permission_registry().register_field_definitions(name, field_defs)
+
+                # Contract registry: clear inactive markers so contracts of
+                # a re-activated plugin are served again (audit P1).
+                from app.plugins.builtins.contracts import get_contract_registry
+                get_contract_registry().mark_plugin_active(name)
 
             if tenant_id and user_id:
                 await log_audit(
@@ -188,6 +200,15 @@ class PluginService:
                     for entity_type in plugin.get_entity_models():
                         unregister_entity_model(entity_type)
 
+                # Unregister field definitions (audit: full lifecycle)
+                get_permission_registry().unregister_field_definitions(name)
+
+                # Contract registry: fail closed for the deactivated plugin
+                # (ARCH-014 / audit P1 — central, so every plugin is covered
+                # even if its own on_deactivate forgets the unregister).
+                from app.plugins.builtins.contracts import get_contract_registry
+                get_contract_registry().unregister(name)
+
             if tenant_id and user_id:
                 await log_audit(
                     db,
@@ -225,6 +246,16 @@ class PluginService:
         Deactivates, calls on_uninstall hook, optionally drops tables, removes DB record.
         """
         try:
+            # Audit P1 (uninstall lifecycle): run the FULL service-level
+            # deactivation first. registry.uninstall()'s internal fallback
+            # (registry.deactivate) does NOT clean PermissionRegistry,
+            # _active_plugins or ENTITY_MODELS — an active plugin uninstalled
+            # directly through the registry left stale registrations behind.
+            pre = await self._registry._get_plugin_record(db, name)
+            if pre is not None and pre.active:
+                await self.deactivate_plugin(
+                    db, name, tenant_id=tenant_id, user_id=user_id
+                )
             record = await self._registry.uninstall(db, name, remove_data=remove_data)
             dropped_tables = getattr(record, "dropped_tables", [])
             if tenant_id and user_id:
@@ -305,9 +336,16 @@ class PluginService:
 
         return MANIFEST_SCHEMA_DOC.model_dump()
 
-    async def get_active_manifests(self, db: AsyncSession) -> list[dict[str, Any]]:
-        """Return UI manifests for all active plugins."""
-        return await self._registry.get_active_manifests(db)
+    async def get_active_manifests(
+        self, db: AsyncSession, tenant_id: uuid.UUID | None = None
+    ) -> list[dict[str, Any]]:
+        """Return UI manifests for all active plugins.
+
+        Audit P1 (tenant manifests): *tenant_id* filters out plugins that are
+        deactivated for the caller's tenant (tenant_plugin_activation),
+        mirroring require_active_plugin() so UI and backend agree.
+        """
+        return await self._registry.get_active_manifests(db, tenant_id=tenant_id)
 
 
 # Global service instance

app/services/workspace_service.py

@@ -52,16 +52,44 @@ async def list_workspaces(
     result = await db.execute(q)
     workspaces = result.scalars().all()
 
-    items = []
-    for ws in workspaces:
-        # Count users
-        count_q = select(func.count()).select_from(WorkspaceUser).where(
-            WorkspaceUser.workspace_id == ws.id,
+    if not workspaces:
+        return {"items": [], "total": 0}
+
+    # Audit P1 (Workspace-Editor): load modules for ALL workspaces in one
+    # query. Previously list_workspaces() returned modules: [] for every
+    # workspace, so the WorkspaceManager module editor showed all modules
+    # as hidden (is_visible=false) and saving OVERWROTE the existing config.
+    ws_ids = [ws.id for ws in workspaces]
+    mod_result = await db.execute(
+        select(WorkspaceModule).where(
+            WorkspaceModule.workspace_id.in_(ws_ids),
+            WorkspaceModule.tenant_id == tenant_id,
+        ).order_by(WorkspaceModule.menu_order)
+    )
+    modules_by_ws: dict[uuid.UUID, list[WorkspaceModule]] = {}
+    for mod in mod_result.scalars().all():
+        modules_by_ws.setdefault(mod.workspace_id, []).append(mod)
+
+    # User counts for all workspaces in one query (avoids N+1)
+    count_result = await db.execute(
+        select(WorkspaceUser.workspace_id, func.count())
+        .where(
+            WorkspaceUser.workspace_id.in_(ws_ids),
             WorkspaceUser.tenant_id == tenant_id,
         )
-        count_result = await db.execute(count_q)
-        user_count = count_result.scalar() or 0
-        items.append(_workspace_to_dict(ws, user_count=user_count))
+        .group_by(WorkspaceUser.workspace_id)
+    )
+    counts_by_ws: dict[uuid.UUID, int] = dict(count_result.all())
+
+    items = []
+    for ws in workspaces:
+        items.append(
+            _workspace_to_dict(
+                ws,
+                modules=modules_by_ws.get(ws.id, []),
+                user_count=counts_by_ws.get(ws.id, 0),
+            )
+        )
 
     return {"items": items, "total": len(items)}