Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/plugins/builtins/dms/contracts.py

@@ -0,0 +1,22 @@
+"""DMS plugin contract — public interface for cross-plugin access."""
+
+from __future__ import annotations
+
+from app.plugins.builtins.dms.models import File as DmsFile, Folder
+
+
+class DmsContract:
+    """Public contract for the DMS plugin."""
+
+    DmsFile = DmsFile
+    Folder = Folder
+
+
+_contract_instance: DmsContract | None = None
+
+
+def get_contract() -> DmsContract:
+    global _contract_instance
+    if _contract_instance is None:
+        _contract_instance = DmsContract()
+    return _contract_instance

app/plugins/builtins/dms/models.py

@@ -64,4 +64,5 @@ class File(Base, TenantMixin):
     mime_type: Mapped[str] = mapped_column(String(255), nullable=False)
     size_bytes: Mapped[int] = mapped_column(Integer, nullable=False)
     storage_path: Mapped[str] = mapped_column(String(1024), nullable=False)
+    content_hash: Mapped[str | None] = mapped_column(String(64), nullable=True)
     deleted_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)

app/plugins/builtins/dms/routes.py

@@ -34,7 +34,8 @@ from app.plugins.builtins.dms.schemas import (
     ShareRemoveRequest,
     ShareRequest,
 )
-from app.plugins.builtins.permissions.models import Permission
+from app.plugins.builtins.permissions.contracts import get_contract as get_perms_contract
+from app.plugins.builtins.permissions.models import Permission  # TODO: migrate to contract
 
 router = APIRouter(prefix="/api/v1/dms", tags=["dms"])
 
@@ -68,6 +69,28 @@ def _get_file_extension(filename: str) -> str:
     return os.path.splitext(filename)[1].lower()
 
 
+
+def _sanitize_filename(filename: str) -> str:
+    """Sanitize a filename for safe use in Content-Disposition headers."""
+    import re
+    # Extract basename only (strip any path components)
+    safe = os.path.basename(filename.replace('\\', '/'))
+    # Remove dangerous characters (keep alnum, dot, dash, underscore, space, unicode)
+    safe = re.sub(r'[^a-zA-Z0-9.\-_\u00c0-\u017f\u4e00-\u9fff ]', '_', safe)
+    # Collapse consecutive dots (path traversal prevention)
+    safe = re.sub(r'\.{2,}', '_', safe)
+    # Collapse multiple spaces
+    safe = re.sub(r' {2,}', ' ', safe)
+    # Strip leading dots and whitespace
+    safe = safe.lstrip('.').strip()
+    # Limit length
+    if len(safe) > 200:
+        name, ext = safe.rsplit('.', 1) if '.' in safe[:200] else (safe[:200], '')
+        safe = name[:200] + ('.' + ext if ext else '')
+    return safe or 'file'
+
+CHUNK_SIZE = 1024 * 1024  # 1MB chunks for streaming uploads
+
 # ─── Folders ───
 
 
@@ -418,14 +441,26 @@ async def upload_file(
         if folder_result.scalar_one_or_none() is None:
             raise HTTPException(404, detail={"detail": "Folder not found", "code": "not_found"})
 
-    # Read file content
-    content = await file.read()
-    file_size = len(content)
+    # Stream file in chunks — avoid loading entire file into RAM
+    import hashlib
+    CHUNK_SIZE = 1024 * 1024  # 1MB chunks
+    sha256 = hashlib.sha256()
+    file_size = 0
+    chunks: list[bytes] = []
 
-    if file_size > MAX_FILE_SIZE:
-        raise HTTPException(
-            413, detail={"detail": "File too large (max 100MB)", "code": "file_too_large"}
-        )
+    while True:
+        chunk = await file.read(CHUNK_SIZE)
+        if not chunk:
+            break
+        file_size += len(chunk)
+        if file_size > MAX_FILE_SIZE:
+            raise HTTPException(
+                413, detail={"detail": "File too large (max 100MB)", "code": "file_too_large"}
+            )
+        sha256.update(chunk)
+        chunks.append(chunk)
+
+    content_hash = sha256.hexdigest()
 
     # Create file record
     file_id = uuid.uuid4()
@@ -433,7 +468,8 @@ async def upload_file(
 
     # Save file via storage backend
     storage = get_storage_backend()
-    await storage.save(storage_path, content)
+    await storage.save(storage_path, b"".join(chunks))
+    del chunks  # Free memory
 
     mime_type = file.content_type or "application/octet-stream"
 
@@ -446,6 +482,7 @@ async def upload_file(
         mime_type=mime_type,
         size_bytes=file_size,
         storage_path=storage_path,
+        content_hash=content_hash,
     )
     db.add(dms_file)
     await db.flush()
@@ -457,7 +494,7 @@ async def upload_file(
         "uploaded_by": str(dms_file.uploaded_by),
         "mime_type": dms_file.mime_type,
         "size_bytes": dms_file.size_bytes,
-        "storage_path": dms_file.storage_path,
+        "content_hash": dms_file.content_hash,
         "deleted_at": None,
         "created_at": dms_file.created_at.isoformat() if dms_file.created_at else None,
         "updated_at": dms_file.updated_at.isoformat() if dms_file.updated_at else None,
@@ -492,7 +529,7 @@ async def get_file(
         "uploaded_by": str(dms_file.uploaded_by),
         "mime_type": dms_file.mime_type,
         "size_bytes": dms_file.size_bytes,
-        "storage_path": dms_file.storage_path,
+        "content_hash": dms_file.content_hash,
         "deleted_at": None,
         "created_at": dms_file.created_at.isoformat() if dms_file.created_at else None,
         "updated_at": dms_file.updated_at.isoformat() if dms_file.updated_at else None,
@@ -628,7 +665,7 @@ async def update_file(
         "uploaded_by": str(dms_file.uploaded_by),
         "mime_type": dms_file.mime_type,
         "size_bytes": dms_file.size_bytes,
-        "storage_path": dms_file.storage_path,
+        "content_hash": dms_file.content_hash,
         "deleted_at": None,
         "created_at": dms_file.created_at.isoformat() if dms_file.created_at else None,
         "updated_at": dms_file.updated_at.isoformat() if dms_file.updated_at else None,
@@ -695,7 +732,7 @@ async def restore_file(
         "uploaded_by": str(dms_file.uploaded_by),
         "mime_type": dms_file.mime_type,
         "size_bytes": dms_file.size_bytes,
-        "storage_path": dms_file.storage_path,
+        "content_hash": dms_file.content_hash,
         "deleted_at": None,
         "created_at": dms_file.created_at.isoformat() if dms_file.created_at else None,
         "updated_at": dms_file.updated_at.isoformat() if dms_file.updated_at else None,

app/plugins/builtins/dms/schemas.py

@@ -34,7 +34,7 @@ class FileMetadataResponse(BaseModel):
     uploaded_by: str
     mime_type: str
     size_bytes: int
-    storage_path: str
+    content_hash: str | None = None
     deleted_at: datetime | None = None
     created_at: datetime | None = None
     updated_at: datetime | None = None