Leopoldadmin/leocrm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 1C: Frontend unified contact UI

Browse Source
This commit is contained in:
Agent Zero
2026-07-23 17:17:32 +02:00
parent a8331fbc2b
commit 879106c4eb
62 changed files with 552 additions and 1276 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/core/permissions.py
+9 -9
View File
@@ -5,7 +5,7 @@ Architecture:
- Redis cache: resolved:{user_id}:{tenant_id} with 5-min TTL.
- Permission-version stamping for immediate invalidation.
- Resolution: allowed = (role ∪ groups), denied = (role.denied ∪ groups.denied), resolved = allowed − denied.
- Wildcards: companies:*, *:read, *:* (bare * is forbidden).
- Wildcards: contacts:*, *:read, *:* (bare * is forbidden).
"""
from __future__ import annotations
@@ -35,8 +35,8 @@ def _matches_permission(granted: str, required: str) -> bool:
"""Check if a granted permission matches the required permission.
Supports wildcards:
- companies:read → exact match
- companies:* → all actions for companies
- contacts:read → exact match
- contacts:* → all actions for contacts
- *:read → all modules, read action
- *:* → everything (superadmin)
"""
@@ -67,9 +67,9 @@ def _normalize_permissions(permissions: Any) -> set[str]:
"""Normalize permissions from JSONB to a set of strings.
Supports formats:
- list[str]: ["companies:read", "contacts:write"]
- dict[str, bool]: {"companies:read": true, "contacts:write": false}
- dict[str, dict]: {"companies": {"read": true, "write": false}}
- list[str]: ["contacts:read", "contacts:write"]
- dict[str, bool]: {"contacts:read": true, "contacts:write": false}
- dict[str, dict]: {"contacts": {"read": true, "write": false}}
"""
result: set[str] = set()
if isinstance(permissions, list):
@@ -156,7 +156,7 @@ async def resolve_permissions(
if legacy_role == "admin":
allowed.add("*:*")
elif legacy_role == "editor":
allowed |= {"companies:read", "companies:write", "contacts:read", "contacts:write",
allowed |= {"contacts:read", "contacts:write", "contacts:read", "contacts:write",
"users:read", "roles:read", "audit:read", "attachments:read",
"attachments:write", "workflows:read", "workflows:write",
"sequences:read", "sequences:write", "addresses:read", "addresses:write",
@@ -164,7 +164,7 @@ async def resolve_permissions(
"notifications:read", "notifications:write", "import_export:read",
"import_export:write"}
elif legacy_role == "viewer":
allowed |= {"companies:read", "contacts:read", "users:read", "roles:read",
allowed |= {"contacts:read", "contacts:read", "users:read", "roles:read",
"audit:read", "attachments:read", "workflows:read", "sequences:read",
"addresses:read", "taxes:read", "currencies:read",
"notifications:read", "import_export:read"}
@@ -265,7 +265,7 @@ def check_permission(resolved: dict[str, Any], required: str) -> bool:
Args:
resolved: result from get_cached_permissions or resolve_permissions
required: permission string like "companies:read"
required: permission string like "contacts:read"
"""
if resolved.get("is_system_admin"):
return True