Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Security fixes: P0-P2 complete (22 fixes)

Browse Source 
P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed
This commit is contained in:
Agent Zero
2026-07-25 21:03:46 +02:00
parent aaa7406929
commit 727d86614e
103 changed files with 6831 additions and 1053 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/routes/auth.py
+3 -3
View File
@@ -43,14 +43,14 @@ async def login(
settings.rate_limit_login_window,
)
result = await auth_service.login(db, redis, body.email, body.password)
result = await auth_service.login(db, redis, body.email, body.password, body.tenant_slug)
if result is None:
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail={"detail": "Invalid email or password", "code": "invalid_credentials"},
)
session_id, csrf_token, user, tenant = result
session_id, csrf_token, user, tenant, role = result
# Reset rate limit on success
await reset_rate_limit(f"auth:login:{ip}:{body.email}")
@@ -74,7 +74,7 @@ async def login(
"user_id": str(user.id),
"email": user.email,
"name": user.name,
"role": user.role,
"role": role,
"is_system_admin": user.is_system_admin,
"tenant_id": str(tenant.id),
"tenant_name": tenant.name,
app/routes/contacts.py
+51 -37
View File
@@ -1,8 +1,11 @@
"""Unified contact routes — CRUD, contactpersons, FTS search, export, soft-delete."""
"""Unified contact routes — CRUD, contactpersons, FTS search, export, soft-delete.
Write operations (create, update, delete, merge) are delegated to Commands.
Read operations (list, get, export, contact persons) use services directly.
"""
from __future__ import annotations
import csv
import io
import uuid
from typing import Any
@@ -11,8 +14,16 @@ from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
from fastapi.responses import StreamingResponse
from sqlalchemy.ext.asyncio import AsyncSession
import redis.asyncio as aioredis
from app.commands.contact_commands import (
CreateContactCommand,
UpdateContactCommand,
DeleteContactCommand,
MergeContactsCommand,
)
from app.core.db import get_db
from app.deps import require_permission
from app.deps import get_current_user, get_redis_dep, require_permission
from app.schemas.contact import (
ContactCreate,
ContactUpdate,
@@ -89,13 +100,16 @@ async def export_contacts(
async def create_contact(
body: ContactCreate,
db: AsyncSession = Depends(get_db),
redis: aioredis.Redis = Depends(get_redis_dep),
current_user: dict = Depends(require_permission("contacts:write")),
):
"""Create a new contact (company or person)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
"""Create a new contact (company or person) via CreateContactCommand."""
data = body.model_dump(exclude_none=True)
return await contact_service.create_contact(db, tenant_id, user_id, data)
cmd = CreateContactCommand(data=data)
result = await cmd.execute(db, redis, current_user)
if not result.success:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=result.error)
return result.data
@router.get("/merge-history")
@@ -129,16 +143,20 @@ async def update_contact(
contact_id: str,
body: ContactUpdate,
db: AsyncSession = Depends(get_db),
redis: aioredis.Redis = Depends(get_redis_dep),
current_user: dict = Depends(require_permission("contacts:write")),
):
"""Update a contact."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
"""Update a contact via UpdateContactCommand."""
data = body.model_dump(exclude_none=True)
try:
return await contact_service.update_contact(db, tenant_id, user_id, contact_id, data)
except ValueError as e:
raise HTTPException(status_code=404, detail=str(e))
cmd = UpdateContactCommand(contact_id=contact_id, data=data)
result = await cmd.execute(db, redis, current_user)
if not result.success:
if "not found" in (result.error or "").lower():
raise HTTPException(status_code=404, detail=result.error)
if "Invalid state transition" in (result.error or ""):
raise HTTPException(status_code=422, detail=result.error)
raise HTTPException(status_code=400, detail=result.error)
return result.data
@router.delete("/{contact_id}", status_code=status.HTTP_204_NO_CONTENT)
@@ -146,18 +164,15 @@ async def delete_contact(
contact_id: str,
hard: bool = Query(False, description="GDPR hard-delete"),
db: AsyncSession = Depends(get_db),
redis: aioredis.Redis = Depends(get_redis_dep),
current_user: dict = Depends(require_permission("contacts:write")),
):
"""Soft-delete (or hard-delete with ?hard=true) a contact."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
try:
if hard:
await contact_service.hard_delete_contact(db, tenant_id, contact_id)
else:
await contact_service.delete_contact(db, tenant_id, contact_id, user_id)
except ValueError as e:
raise HTTPException(status_code=404, detail=str(e))
"""Soft-delete (or hard-delete with ?hard=true) a contact via DeleteContactCommand."""
cmd = DeleteContactCommand(contact_id=contact_id, hard=hard)
result = await cmd.execute(db, redis, current_user)
if not result.success:
raise HTTPException(status_code=404, detail=result.error)
return Response(status_code=status.HTTP_204_NO_CONTENT)
# ── ContactPersons ──
@@ -244,18 +259,17 @@ async def find_duplicate_contacts(
async def merge_duplicate_contacts(
body: MergeRequest,
db: AsyncSession = Depends(get_db),
redis: aioredis.Redis = Depends(get_redis_dep),
current_user: dict = Depends(require_permission("contacts:write")),
):
"""Merge two contacts (source → target)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
try:
return await dedup_service.merge_contacts(
db, tenant_id, user_id,
source_id=body.source_contact_id,
target_id=body.target_contact_id,
field_overrides=body.field_overrides,
note=body.note,
)
except ValueError as e:
raise HTTPException(status_code=400, detail=str(e))
"""Merge two contacts (source → target) via MergeContactsCommand."""
cmd = MergeContactsCommand(
source_contact_id=body.source_contact_id,
target_contact_id=body.target_contact_id,
field_overrides=body.field_overrides,
note=body.note,
)
result = await cmd.execute(db, redis, current_user)
if not result.success:
raise HTTPException(status_code=400, detail=result.error)
return result.data
app/routes/metrics.py
+2 -2
View File
@@ -6,7 +6,7 @@ from fastapi import APIRouter, Depends
from fastapi.responses import PlainTextResponse
from app.core.monitoring import generate_metrics
from app.deps import get_current_user
from app.deps import require_admin
router = APIRouter(tags=["metrics"])
@@ -14,7 +14,7 @@ router = APIRouter(tags=["metrics"])
@router.get(
"/api/v1/metrics",
response_class=PlainTextResponse,
dependencies=[Depends(get_current_user)],
dependencies=[Depends(require_admin)],
)
async def metrics():
"""Prometheus metrics endpoint.
app/routes/plugins.py
+14 -204
View File
@@ -442,104 +442,13 @@ async def upload_plugin(
):
"""Upload and install a plugin from a ZIP file.
The ZIP must contain a plugin directory with a plugin.py that defines a BasePlugin subclass.
Validates the manifest, checks for conflicts, runs migrations, and installs the plugin.
DISABLED — Plugin upload is deactivated due to security vulnerabilities (RCE via exec_module before validation).
Will be re-enabled with signed plugin artifacts and sandboxed execution.
"""
import uuid as uuid_mod
# Validate file is a ZIP
if not file.filename or not file.filename.endswith(".zip"):
raise HTTPException(400, detail={"detail": "File must be a .zip archive", "code": "invalid_file"})
# Check file size
contents = await file.read()
if len(contents) > MAX_UPLOAD_SIZE:
raise HTTPException(
413,
detail={
"detail": f"File too large. Maximum size is {MAX_UPLOAD_SIZE // (1024*1024)} MB",
"code": "file_too_large",
},
)
# Write to temp file
tmp_zip = tempfile.NamedTemporaryFile(delete=False, suffix=".zip")
try:
tmp_zip.write(contents)
tmp_zip.close()
# Extract and validate
extract_dir, plugin_name, plugin_class = _extract_plugin_from_zip(tmp_zip.name)
# Check for name conflicts with existing plugins
service = get_plugin_service()
existing_plugins = await service.list_plugins(db)
existing_names = {p["name"] for p in existing_plugins}
if plugin_name in existing_names:
# Check if version is higher
existing_plugin = next(
(p for p in existing_plugins if p["name"] == plugin_name), None
)
if existing_plugin:
raise HTTPException(
409,
detail={
"detail": f"Plugin '{plugin_name}' already exists (version {existing_plugin.get('version', 'unknown')}). "
f"Uninstall the existing plugin first or upload a higher version.",
"code": "plugin_exists",
},
)
# Install the plugin directory
_install_plugin_from_dir(extract_dir, plugin_name, plugin_class)
# Run migrations and install via service
result = await service.install_plugin(
db,
plugin_name,
tenant_id=uuid_mod.UUID(current_user["tenant_id"]),
user_id=uuid_mod.UUID(current_user["user_id"]),
)
# Log audit
from app.core.audit import log_audit
await log_audit(
db,
uuid_mod.UUID(current_user["tenant_id"]),
uuid_mod.UUID(current_user["user_id"]),
action="plugin.upload",
entity_type="plugin",
changes={"name": plugin_name, "version": result.get("version"), "method": "upload"},
)
return {
**result,
"message": f"Plugin '{plugin_name}' uploaded and installed successfully",
}
except ValueError as exc:
raise HTTPException(400, detail={"detail": str(exc), "code": "plugin_validation_error"}) from None
except MigrationValidationError as exc:
raise HTTPException(
422, detail={"detail": str(exc), "code": "migration_validation_error"}
) from None
except Exception as exc:
logger.exception("Failed to upload plugin")
raise HTTPException(
500, detail={"detail": f"Failed to install plugin: {str(exc)}", "code": "install_error"}
) from None
finally:
# Clean up temp files
try:
os.unlink(tmp_zip.name)
except Exception:
pass
try:
if "extract_dir" in dir():
shutil.rmtree(extract_dir, ignore_errors=True)
except Exception:
pass
raise HTTPException(
status_code=403,
detail={"detail": "Plugin upload is disabled. Use signed plugin artifacts from the allowlist.", "code": "upload_disabled"},
)
@router.post("/install-url")
@@ -548,111 +457,12 @@ async def install_plugin_from_url(
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_permission("plugins:configure")),
):
"""Install a plugin from a URL (downloads ZIP and installs)."""
import uuid as uuid_mod
"""Install a plugin from a URL (downloads ZIP and installs).
if not body.url:
raise HTTPException(400, detail={"detail": "URL is required", "code": "missing_url"})
# Download ZIP from URL
tmp_zip = tempfile.NamedTemporaryFile(delete=False, suffix=".zip")
try:
async with httpx.AsyncClient(timeout=60.0) as client:
response = await client.get(body.url, follow_redirects=True)
response.raise_for_status()
content = response.content
if len(content) > MAX_UPLOAD_SIZE:
raise HTTPException(
413,
detail={
"detail": f"Downloaded file too large. Maximum size is {MAX_UPLOAD_SIZE // (1024*1024)} MB",
"code": "file_too_large",
},
)
tmp_zip.write(content)
tmp_zip.close()
# Extract and validate
extract_dir, plugin_name, plugin_class = _extract_plugin_from_zip(tmp_zip.name)
# Check for name conflicts
service = get_plugin_service()
existing_plugins = await service.list_plugins(db)
existing_names = {p["name"] for p in existing_plugins}
if plugin_name in existing_names:
raise HTTPException(
409,
detail={
"detail": f"Plugin '{plugin_name}' already exists. Uninstall the existing plugin first.",
"code": "plugin_exists",
},
)
# Install the plugin directory
_install_plugin_from_dir(extract_dir, plugin_name, plugin_class)
# Run migrations and install via service
result = await service.install_plugin(
db,
plugin_name,
tenant_id=uuid_mod.UUID(current_user["tenant_id"]),
user_id=uuid_mod.UUID(current_user["user_id"]),
)
# Log audit
from app.core.audit import log_audit
await log_audit(
db,
uuid_mod.UUID(current_user["tenant_id"]),
uuid_mod.UUID(current_user["user_id"]),
action="plugin.install_url",
entity_type="plugin",
changes={"name": plugin_name, "version": result.get("version"), "url": body.url},
)
return {
**result,
"message": f"Plugin '{plugin_name}' downloaded and installed successfully",
}
except httpx.HTTPStatusError as exc:
raise HTTPException(
400,
detail={
"detail": f"Failed to download plugin from URL: HTTP {exc.response.status_code}",
"code": "download_error",
},
) from None
except httpx.RequestError as exc:
raise HTTPException(
400,
detail={
"detail": f"Failed to download plugin from URL: {str(exc)}",
"code": "download_error",
},
) from None
except ValueError as exc:
raise HTTPException(400, detail={"detail": str(exc), "code": "plugin_validation_error"}) from None
except MigrationValidationError as exc:
raise HTTPException(
422, detail={"detail": str(exc), "code": "migration_validation_error"}
) from None
except Exception as exc:
logger.exception("Failed to install plugin from URL")
raise HTTPException(
500, detail={"detail": f"Failed to install plugin: {str(exc)}", "code": "install_error"}
) from None
finally:
# Clean up temp files
try:
os.unlink(tmp_zip.name)
except Exception:
pass
try:
if "extract_dir" in dir():
shutil.rmtree(extract_dir, ignore_errors=True)
except Exception:
pass
DISABLED — URL installation is deactivated due to SSRF and RCE vulnerabilities.
Will be re-enabled with signed plugin artifacts and allowlist.
"""
raise HTTPException(
status_code=403,
detail={"detail": "Plugin URL installation is disabled. Use signed plugin artifacts from the allowlist.", "code": "install_url_disabled"},
)
app/routes/users.py
+22 -25
View File
@@ -7,6 +7,7 @@ from typing import Any
from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy import select
from app.core.audit import log_audit
from app.core.auth import get_redis
@@ -14,6 +15,7 @@ from app.core.db import get_db
from app.core.notifications import create_notification
from app.core.permissions import invalidate_permission_cache
from app.deps import get_current_user, require_permission
from app.models.user import User, UserTenant
from app.schemas.user import UserCreate, UserUpdate, UserResponse, PaginatedUsers
from app.services.user_service import user_service, _UNSET
@@ -107,10 +109,10 @@ async def create_user(
"id": str(user.id),
"email": user.email,
"name": user.name,
"role": user.role,
"role_id": str(user.role_id) if user.role_id else None,
"role": body.role,
"role_id": str(role_id) if role_id else None,
"is_active": user.is_active,
"tenant_id": str(user.tenant_id),
"tenant_id": str(tenant_id),
}
@@ -129,18 +131,19 @@ async def get_user(
400, detail={"detail": "Invalid user_id", "code": "invalid_id"}
) from None
user = await user_service.get_user(db, tenant_id, uid)
if user is None:
result = await user_service.get_user(db, tenant_id, uid)
if result is None:
raise HTTPException(404, detail={"detail": "User not found", "code": "not_found"})
user, user_tenant = result
return {
"id": str(user.id),
"email": user.email,
"name": user.name,
"role": user.role,
"role_id": str(user.role_id) if user.role_id else None,
"role": user_tenant.role,
"role_id": str(user_tenant.role_id) if user_tenant.role_id else None,
"is_active": user.is_active,
"tenant_id": str(user.tenant_id),
"tenant_id": str(user_tenant.tenant_id),
}
@@ -211,7 +214,7 @@ async def update_user(
changes["password_changed"] = True
try:
user = await user_service.update_user(
result = await user_service.update_user(
db,
tenant_id,
uid,
@@ -228,9 +231,10 @@ async def update_user(
)
except ValueError as exc:
raise HTTPException(400, detail={"detail": str(exc), "code": "invalid_password"}) from None
if user is None:
if result is None:
raise HTTPException(404, detail={"detail": "User not found", "code": "not_found"})
user, user_tenant = result
await log_audit(db, tenant_id, acting_user_id, "update", "user", uid, changes=changes)
# Invalidate permission cache for the updated user
@@ -244,10 +248,10 @@ async def update_user(
"first_name": user.first_name,
"last_name": user.last_name,
"avatar_url": user.avatar_url,
"role": user.role,
"role_id": str(user.role_id) if user.role_id else None,
"role": user_tenant.role,
"role_id": str(user_tenant.role_id) if user_tenant.role_id else None,
"is_active": user.is_active,
"tenant_id": str(user.tenant_id),
"tenant_id": str(user_tenant.tenant_id),
}
@@ -268,9 +272,10 @@ async def delete_user(
) from None
# Get user snapshot for audit before deletion
user = await user_service.get_user(db, tenant_id, uid)
if user is None:
result = await user_service.get_user(db, tenant_id, uid)
if result is None:
raise HTTPException(404, detail={"detail": "User not found", "code": "not_found"})
user, user_tenant = result
success = await user_service.delete_user(db, tenant_id, uid)
if not success:
@@ -295,14 +300,10 @@ async def get_menu_order(
current_user: dict = Depends(get_current_user),
):
"""Get the current user's menu order preference."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
from sqlalchemy import select
from app.models.user import User
result = await db.execute(
select(User).where(User.id == user_id, User.tenant_id == tenant_id)
select(User).where(User.id == user_id)
)
user = result.scalar_one_or_none()
if user is None:
@@ -319,12 +320,8 @@ async def update_menu_order(
current_user: dict = Depends(get_current_user),
):
"""Update the current user's menu order preference."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
from sqlalchemy import select
from app.models.user import User
menu_order = body.get("menu_order")
if not isinstance(menu_order, list) or not all(isinstance(x, str) for x in menu_order):
raise HTTPException(
@@ -333,7 +330,7 @@ async def update_menu_order(
)
result = await db.execute(
select(User).where(User.id == user_id, User.tenant_id == tenant_id)
select(User).where(User.id == user_id)
)
user = result.scalar_one_or_none()
if user is None: