Phase 1: Fix all critical release blockers (B1-B10)

B1: Remove duplicate get_redis() — singleton no longer overwritten
B2: Plugin routes now enforce activation status via require_active_plugin()
B3: Fix UploadFile ForwardRef error — remove functools.wraps from wrap_plugin_route
B4: DMS upload uses true streaming via save_stream() instead of RAM accumulation
B5: Worker on_startup registers plugin event handlers + webhook dispatcher
B6: Implement send_password_reset_email job, remove raw token logging
B7: Webhook SSRF protection (IP validation, no redirects), secret removed from response
B8: RLS repair migration 0044 + separate crm_runtime DB user (NOSUPERUSER, NOBYPASSRLS)
B9: Fix .env.docker.example AUTH_SECRET → SECRET_KEY
B10: Remove Redis default password, remove exposed DB/Redis ports

Also: add frontend_url to config, add SMTP settings to .env.docker.example,
update prestart.sh to use MIGRATION_DATABASE_URL for alembic.

This commit is contained in:

Agent Zero

2026-07-26 20:45:42 +02:00

parent 7a14973c68

commit 5ec1fc9b05

32 changed files with 1781 additions and 76 deletions

									
										app/schemas/webhook.py
									
		+1
		-1
	
												View File
												
				@@ -39,7 +39,7 @@ class WebhookResponse(BaseModel):

				    tenant_id: uuid.UUID

				    url: str

				    events: list[str]

				    secret: str | None = None

				    has_secret: bool = False  # Only indicate if a secret is set, never return it

				    is_active: bool = True

				    retry_count: int = 3

				    timeout_seconds: int = 30