fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)
Check Cross-Plugin Imports / check (push) Has been cancelled
Check Cross-Plugin Imports / check (push) Has been cancelled
Verifikation: Alle 17 Audit-Findings gegen den Code geprueft — alle bestaetigt. Backend-Lifecycle-Fixes umgesetzt; 4 Frontend-Plugin-Architektur-Punkte als Phase Q in die Roadmap eingeplant. - P1 list_workspaces: Module + User-Counts gebuendelt laden (Editor-Overwrite-Bug) - P1 active-manifests: Tenant-Deaktivierung (tenant_plugin_activation) filtern - P1 uninstall: volle Service-Deactivation VOR registry.uninstall() - P1 ContractRegistry: DB-Aktivstatus-Guard (Restart-Edge-Case) + Re-Activate - P1/P2 Field-Definitions: voller Lifecycle (register/unregister) im Service - P1/P2 Contact-Felddefinitionen (39) ins ContactsPlugin-Manifest verschoben - P1 12 fehlende Permission-Keys registriert (AST-Scan: 0 fehlend) - P2 contact_folder -> ContactsPlugin; ENTITY_PLUGIN_OWNERS wird befuellt - P2 Entity-Permission-Fallback fail-closed statt contacts:read - P2 forgejo_error_reporter is_core=False; DMS is_core=True (ADR-020) - P2 Worker: Contacts-Trash-Cleanup ins Plugin (get_job_modules-Discovery) - P1/P2 DSGVO-Export delegiert an DSAR-Collector (kein Core->Contacts) - P2 False-green Tests korrigiert (or True, veraltete Route-Count-Assertion) Verifikation: tests/test_audit_architecture_fixes.py 17/17; Regressionen gruen (contacts_lifecycle, entity_registry, workspace_scopes, rbac, lifecycle_service); Combo-Order-Test 35/35; Cross-Plugin-Checker 497/0; compileall sauber; ruff auf 7-Error-Baseline. Doku: PROGRESS.md Audit-Section, PLATFORM_ROADMAP.md Phase Q (Q1-Q4), plugin-development-guide.md Lifecycle, permissions.md Katalog.
This commit is contained in:
Agent Zero
@@ -70,6 +70,17 @@ CORE_PERMISSIONS: list[dict[str, str]] = [
|
||||
{"key": "dashboard:read", "label": "Dashboard: Read", "category": "core", "module": "dashboard"},
|
||||
{"key": "dashboard:write", "label": "Dashboard: Write", "category": "core", "module": "dashboard"},
|
||||
{"key": "system:admin", "label": "System: Admin (cross-tenant)", "category": "system", "module": "system"},
|
||||
# Audit P1 (permission catalog): these keys were required by core routes
|
||||
# but never registered, so non-admin roles could never be granted them.
|
||||
{"key": "automation:admin", "label": "Automation: Admin (backups, self-improvement)", "category": "core", "module": "automation"},
|
||||
{"key": "bank-accounts:read", "label": "Bank Accounts: Read", "category": "core", "module": "bank_accounts"},
|
||||
{"key": "bank-accounts:write", "label": "Bank Accounts: Write", "category": "core", "module": "bank_accounts"},
|
||||
{"key": "delegations:read", "label": "Delegations: Read", "category": "core", "module": "delegations"},
|
||||
{"key": "delegations:write", "label": "Delegations: Write", "category": "core", "module": "delegations"},
|
||||
{"key": "policies:read", "label": "Policies: Read", "category": "core", "module": "policies"},
|
||||
{"key": "policies:write", "label": "Policies: Write", "category": "core", "module": "policies"},
|
||||
{"key": "templates:read", "label": "Permission Templates: Read", "category": "core", "module": "templates"},
|
||||
{"key": "templates:write", "label": "Permission Templates: Write", "category": "core", "module": "templates"},
|
||||
# NOTE: Plugin permissions (calendar, dms, mail, tasks, comm, automation, ai,
|
||||
# tags, entity_links, reports, search, mcp, permissions, agents)
|
||||
# are registered dynamically via register_plugin_permissions() from plugin
|
||||
@@ -79,50 +90,12 @@ CORE_PERMISSIONS: list[dict[str, str]] = [
|
||||
|
||||
# ── Core field definitions for field-level permissions ──
|
||||
CORE_FIELD_DEFINITIONS: list[dict[str, str]] = [
|
||||
# ── Contact fields ──
|
||||
{"module": "contacts", "field": "firstname", "label": "First Name", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "surname", "label": "Last Name", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "displayname", "label": "Display Name", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "name", "label": "Name", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "email_1", "label": "Email 1", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "email_2", "label": "Email 2", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "phone_1", "label": "Phone 1", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "phone_2", "label": "Phone 2", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "mobilephone", "label": "Mobile", "sensitivity": "sensitive"},
|
||||
{"module": "contacts", "field": "function", "label": "Position", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "website", "label": "Website", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "status", "label": "Status", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "type", "label": "Type", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "gender", "label": "Gender", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "suffix", "label": "Suffix", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "ext_name_line", "label": "Extra Name Line", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "country", "label": "Country", "sensitivity": "normal"},
|
||||
# ── Financial / sensitive fields ──
|
||||
{"module": "contacts", "field": "code", "label": "Code", "sensitivity": "sensitive"},
|
||||
{"module": "contacts", "field": "accounting_code", "label": "Accounting Code", "sensitivity": "sensitive"},
|
||||
{"module": "contacts", "field": "vendor_accounting_code", "label": "Vendor Accounting Code", "sensitivity": "sensitive"},
|
||||
{"module": "contacts", "field": "vat_code", "label": "VAT Code", "sensitivity": "sensitive"},
|
||||
{"module": "contacts", "field": "fiscal_code", "label": "Fiscal Code", "sensitivity": "sensitive"},
|
||||
{"module": "contacts", "field": "commerce_code", "label": "Commerce Code", "sensitivity": "sensitive"},
|
||||
{"module": "contacts", "field": "purchase_number", "label": "Purchase Number", "sensitivity": "sensitive"},
|
||||
{"module": "contacts", "field": "bic", "label": "BIC", "sensitivity": "sensitive"},
|
||||
# ── Addresses ──
|
||||
{"module": "contacts", "field": "mailing_street", "label": "Mailing Street", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "mailing_city", "label": "Mailing City", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "mailing_postalcode", "label": "Mailing Postal Code", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "mailing_country", "label": "Mailing Country", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "visit_street", "label": "Visit Street", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "visit_city", "label": "Visit City", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "visit_postalcode", "label": "Visit Postal Code", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "visit_country", "label": "Visit Country", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "invoice_street", "label": "Invoice Street", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "invoice_city", "label": "Invoice City", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "invoice_postalcode", "label": "Invoice Postal Code", "sensitivity": "normal"},
|
||||
{"module": "contacts", "field": "invoice_country", "label": "Invoice Country", "sensitivity": "normal"},
|
||||
# ── Notes & Tags ──
|
||||
{"module": "contacts", "field": "notes", "label": "Notes", "sensitivity": "sensitive"},
|
||||
{"module": "contacts", "field": "tags", "label": "Tags", "sensitivity": "sensitive"},
|
||||
# ── User fields ──
|
||||
# Audit P1/P2 (contact field definitions): all contacts:* field
|
||||
# definitions moved to the ContactsPlugin manifest (field_definitions=)
|
||||
# so the plugin fully owns its field structure. The core keeps only
|
||||
# genuinely core-owned fields (users). Plugin field definitions are
|
||||
# registered at activation time via register_field_definitions().
|
||||
# ── User fields (core-owned) ──
|
||||
{"module": "users", "field": "email", "label": "Email", "sensitivity": "normal"},
|
||||
{"module": "users", "field": "name", "label": "Name", "sensitivity": "normal"},
|
||||
{"module": "users", "field": "role", "label": "Role", "sensitivity": "normal"},
|
||||
@@ -229,6 +202,18 @@ class PermissionRegistry:
|
||||
self._field_definitions[plugin_name] = field_defs
|
||||
logger.info("Registered %d field definitions for plugin '%s'", len(field_defs), plugin_name)
|
||||
|
||||
def unregister_field_definitions(self, plugin_name: str) -> None:
|
||||
"""Remove field definitions of a deactivated/uninstalled plugin.
|
||||
|
||||
Audit P1/P2 (field-definitions lifecycle): the contribution type was
|
||||
only half-integrated — register_field_definitions() existed but no
|
||||
matching unregister, so a deactivated plugin kept serving its field
|
||||
definitions in the permission UI.
|
||||
"""
|
||||
removed = self._field_definitions.pop(plugin_name, None)
|
||||
if removed is not None:
|
||||
logger.info("Unregistered %d field definitions for plugin '%s'", len(removed), plugin_name)
|
||||
|
||||
def get_all_field_definitions(self) -> list[dict[str, str]]:
|
||||
"""Return all registered field definitions."""
|
||||
result = list(self._core_field_definitions)
|
||||
|
||||
@@ -173,12 +173,15 @@ def _derive_policy_from_sensitivity(
|
||||
if field_name in entity_policy:
|
||||
return dict(entity_policy[field_name])
|
||||
|
||||
# Try to get sensitivity from permission registry (lazy import to avoid
|
||||
# circular dependencies at module load time).
|
||||
# Try to get sensitivity from the permission registry (lazy import to
|
||||
# avoid circular dependencies at module load time). Use the registry's
|
||||
# combined view (core + plugin field definitions) — contact fields moved
|
||||
# to the ContactsPlugin manifest (audit P1/P2), so CORE_FIELD_DEFINITIONS
|
||||
# alone no longer covers them.
|
||||
try:
|
||||
from app.core.permission_registry import CORE_FIELD_DEFINITIONS
|
||||
from app.core.permission_registry import get_permission_registry
|
||||
|
||||
for fd in CORE_FIELD_DEFINITIONS:
|
||||
for fd in get_permission_registry().get_all_field_definitions():
|
||||
if fd.get("module") == entity_type and fd.get("field") == field_name:
|
||||
sensitivity = fd.get("sensitivity", "normal")
|
||||
return dict(_SENSITIVITY_DEFAULTS.get(sensitivity, _ALL_ALLOWED))
|
||||
|
||||
+8
-10
@@ -396,7 +396,6 @@ async def cleanup_trash_job(ctx: dict[str, Any]) -> None:
|
||||
from sqlalchemy import text as sa_text
|
||||
|
||||
from app.core.db import get_worker_session_factory
|
||||
from app.models.contact import Contact
|
||||
from app.models.entity_attachment import EntityAttachment
|
||||
|
||||
factory = get_worker_session_factory()
|
||||
@@ -414,16 +413,9 @@ async def cleanup_trash_job(ctx: dict[str, Any]) -> None:
|
||||
{"tid": str(tenant_id)},
|
||||
)
|
||||
|
||||
# Delete soft-deleted contacts
|
||||
result = await db.execute(
|
||||
sa_delete(Contact).where(
|
||||
Contact.deleted_at.is_not(None),
|
||||
Contact.deleted_at < cutoff,
|
||||
)
|
||||
)
|
||||
total_deleted += result.rowcount
|
||||
|
||||
# Delete soft-deleted entity attachments
|
||||
# (Contacts trash cleanup moved to the contacts plugin:
|
||||
# cleanup_contacts_trash — audit P2, no core->contacts import)
|
||||
result = await db.execute(
|
||||
sa_delete(EntityAttachment).where(
|
||||
EntityAttachment.deleted_at.is_not(None),
|
||||
@@ -488,6 +480,12 @@ class WorkerSettings:
|
||||
_wrap_cron_with_lock("cleanup_trash", cleanup_trash_job, ttl_seconds=300),
|
||||
hour=4, minute=0,
|
||||
),
|
||||
# Contacts trash cleanup — daily at 04:15, owned by the contacts
|
||||
# plugin (audit P2: no core->contacts import in the worker).
|
||||
cron(
|
||||
_wrap_cron_with_lock("cleanup_contacts_trash", get_job("cleanup_contacts_trash"), ttl_seconds=300),
|
||||
hour=4, minute=15,
|
||||
),
|
||||
# Knowledge retention cleanup — daily at 05:00 (90 days, keeps approved).
|
||||
# Function comes from the knowledge plugin via the job registry.
|
||||
cron(
|
||||
|
||||
Reference in New Issue
Block a user