fix: resolve menu duplicates, route prefix conflicts, API path bugs, permissions.deleted_at, remove test plugin from production

alembic/versions/0031_permissions_soft_delete.py

@@ -0,0 +1,37 @@
+"""Add deleted_at column to permissions and share_links tables.
+
+The Permission and ShareLink models inherit TenantMixin which includes
+SoftDeleteMixin (deleted_at), but the original plugin migration did not
+create this column. This migration adds it for existing databases.
+
+Revision ID: 0031_permissions_soft_delete
+Revises: 0030_contact_merge_history
+Create Date: 2025-07-24
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers
+revision = "0031_permissions_soft_delete"
+down_revision = "0030_contact_merge_history"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Add deleted_at to permissions table (if not exists)
+    op.add_column(
+        "permissions",
+        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
+    )
+    # Add deleted_at to share_links table (if not exists)
+    op.add_column(
+        "share_links",
+        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("share_links", "deleted_at")
+    op.drop_column("permissions", "deleted_at")

app/plugins/builtins/entity_links/plugin.py

@@ -19,7 +19,7 @@ class EntityLinksPlugin(BasePlugin):
         dependencies=[],
         routes=[
             PluginRouteDef(
-                path="/api/v1/dms",
+                path="/api/v1/entity-links",
                 module="app.plugins.builtins.entity_links.routes",
                 router_attr="router",
             ),

app/plugins/builtins/entity_links/routes.py

@@ -13,7 +13,7 @@ from app.deps import get_current_user, require_permission
 from app.plugins.builtins.entity_links.models import EntityLink
 from app.plugins.builtins.entity_links.schemas import EntityLinkRequest
 
-router = APIRouter(prefix="/api/v1/dms", tags=["entity-links"])
+router = APIRouter(prefix="/api/v1/entity-links", tags=["entity-links"])
 contact_router = APIRouter(prefix="/api/v1/contacts", tags=["entity-links"])
 
 VALID_ENTITY_TYPES = {"contact"}

app/plugins/builtins/migrations/0001_bad_migration.sql

@@ -1,7 +0,0 @@
--- Bad migration: creates table WITHOUT tenant_id (should be rejected by validator)
-CREATE TABLE IF NOT EXISTS plugin_bad_table (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    title VARCHAR(200) NOT NULL,
-    content TEXT,
-    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
-);

app/plugins/builtins/migrations/0001_test_plugin.sql

@@ -1,10 +0,0 @@
--- Test plugin migration: creates plugin_test_data table with tenant_id
-CREATE TABLE IF NOT EXISTS plugin_test_data (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    tenant_id UUID NOT NULL,
-    title VARCHAR(200) NOT NULL,
-    content TEXT,
-    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
-);
-CREATE INDEX IF NOT EXISTS ix_plugin_test_data_tenant ON plugin_test_data(tenant_id);

app/plugins/builtins/permissions/migrations/0001_initial.sql

@@ -6,6 +6,7 @@ CREATE TABLE IF NOT EXISTS permissions (
     user_id UUID NOT NULL,
     group_id UUID,
     access_level VARCHAR(10) NOT NULL DEFAULT 'read',
+    deleted_at TIMESTAMPTZ,
     created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
     updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
     CONSTRAINT uq_permissions_file_user_level UNIQUE (tenant_id, file_id, user_id, access_level)
@@ -22,6 +23,7 @@ CREATE TABLE IF NOT EXISTS share_links (
     expires_at TIMESTAMPTZ,
     access_level VARCHAR(10) NOT NULL DEFAULT 'download',
     created_by UUID,
+    deleted_at TIMESTAMPTZ,
     created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
     updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
 );

app/plugins/builtins/permissions/plugin.py

@@ -17,7 +17,7 @@ class PermissionsPlugin(BasePlugin):
         dependencies=[],
         routes=[
             PluginRouteDef(
-                path="/api/v1/dms",
+                path="/api/v1/permissions",
                 module="app.plugins.builtins.permissions.routes",
                 router_attr="router",
             ),

app/plugins/builtins/permissions/routes.py

@@ -20,7 +20,7 @@ from app.plugins.builtins.permissions.schemas import (
     ShareLinkVerifyRequest,
 )
 
-router = APIRouter(prefix="/api/v1/dms", tags=["permissions"])
+router = APIRouter(prefix="/api/v1/permissions", tags=["permissions"])
 public_router = APIRouter(prefix="/api/public", tags=["public-share"])
 
 

frontend/src/api/plugins.ts

@@ -73,7 +73,7 @@ export function useUploadPlugin() {
       const formData = new FormData();
       formData.append('file', file);
       const { default: apiClient } = await import('./client');
-      const res = await apiClient.post('/api/v1/plugins/upload', formData, {
+      const res = await apiClient.post('/plugins/upload', formData, {
         headers: { 'Content-Type': 'multipart/form-data' },
       });
       return res.data;
@@ -89,7 +89,7 @@ export function useInstallPluginFromUrl() {
   return useMutation({
     mutationFn: async (url: string) => {
       const { default: apiClient } = await import('./client');
-      const res = await apiClient.post('/api/v1/plugins/install-url', { url });
+      const res = await apiClient.post('/plugins/install-url', { url });
       return res.data;
     },
     onSuccess: () => {

frontend/src/api/search.ts

@@ -16,7 +16,7 @@ export interface SearchResponse {
 }
 
 export async function search(query: string, entityTypes?: string[], limit = 20): Promise<SearchResponse> {
-  const r = await apiClient.post('/api/v1/search', {
+  const r = await apiClient.post('/search', {
     query,
     entity_types: entityTypes,
     limit,
@@ -25,12 +25,12 @@ export async function search(query: string, entityTypes?: string[], limit = 20):
 }
 
 export async function searchSuggest(q: string): Promise<string[]> {
-  const r = await apiClient.get('/api/v1/search/suggest', { params: { q } });
+  const r = await apiClient.get('/search/suggest', { params: { q } });
   return r.data.suggestions;
 }
 
 export async function searchSimilar(entityType: string, entityId: string): Promise<SearchResult[]> {
-  const r = await apiClient.post('/api/v1/search/similar', {
+  const r = await apiClient.post('/search/similar', {
     entity_type: entityType,
     entity_id: entityId,
   });

frontend/src/components/layout/Sidebar.tsx

@@ -3,21 +3,10 @@ import clsx from 'clsx';
 import { NavLink, useLocation } from 'react-router-dom';
 import { useTranslation } from 'react-i18next';
 import { useUIStore } from '@/store/uiStore';
-import { Calendar, ChevronRight, FileText, Home, Mail, Monitor, Users } from 'lucide-react';
+import { ChevronRight, FileText, Home, Settings, Users } from 'lucide-react';
 import { usePluginStore } from '@/store/pluginStore';
 import * as LucideIcons from 'lucide-react';
 
-interface NavLeaf {
-  to: string;
-  labelKey: string;
-}
-
-interface NavTreeItem {
-  labelKey: string;
-  icon: React.ReactNode;
-  children: NavLeaf[];
-}
-
 interface NavSingleItem {
   to: string;
   labelKey: string;
@@ -33,40 +22,16 @@ function getIcon(name: string): React.ReactNode {
   return Icon ? <Icon className="h-4 w-4" /> : <LucideIcons.FileText className="h-4 w-4" />;
 }
 
+// Only non-plugin items: dashboard, contacts, settings.
+// All other menu entries (calendar, dms, mail, ai-assistant, automation, reports, tasks, communication)
+// are provided by plugin manifests via usePluginStore(s => s.getAllMenuItems()).
 const singleItems: NavSingleItem[] = [
   { to: '/dashboard', labelKey: 'nav.dashboard', icon: <Home className="w-5 h-5 flex-shrink-0" aria-hidden="true" strokeWidth={2} /> },
   { to: '/contacts', labelKey: 'nav.contacts', icon: <Users className="w-5 h-5 flex-shrink-0" aria-hidden="true" strokeWidth={2} /> },
 ];
 
-const treeItems: NavTreeItem[] = [
-  {
-    labelKey: 'nav.calendar',
-    icon: <Calendar className="w-5 h-5 flex-shrink-0" aria-hidden="true" strokeWidth={2} />,
-    children: [
-      { to: '/calendar', labelKey: 'nav.calendar' },
-      { to: '/calendar/kanban', labelKey: 'nav.calendarKanban' },
-    ],
-  },
-  {
-    labelKey: 'nav.files',
-    icon: <FileText className="w-5 h-5 flex-shrink-0" aria-hidden="true" strokeWidth={2} />,
-    children: [
-      { to: '/dms', labelKey: 'nav.files' },
-      { to: '/dms/trash', labelKey: 'nav.filesTrash' },
-    ],
-  },
-  {
-    labelKey: 'nav.email',
-    icon: <Mail className="w-5 h-5 flex-shrink-0" aria-hidden="true" strokeWidth={2} />,
-    children: [
-      { to: '/mail', labelKey: 'nav.email' },
-      { to: '/mail/settings', labelKey: 'nav.emailSettings' },
-    ],
-  },
-];
-
 const bottomItems: NavSingleItem[] = [
-  { to: '/ai-assistant', labelKey: 'nav.aiAssistant', icon: <Monitor className="w-5 h-5 flex-shrink-0" aria-hidden="true" strokeWidth={2} /> },
+  { to: '/settings', labelKey: 'nav.settings', icon: <Settings className="w-5 h-5 flex-shrink-0" aria-hidden="true" strokeWidth={2} /> },
 ];
 
 export function Sidebar() {
@@ -75,21 +40,20 @@ export function Sidebar() {
   const location = useLocation();
   const pluginMenuItems = usePluginStore(s => s.getAllMenuItems());
 
-  const initialExpanded = treeItems
+  const [expandedItems, setExpandedItems] = useState<Set<string>>(new Set());
-    .filter((item) => item.children.some((child) => location.pathname.startsWith(child.to)))
-    .map((item) => item.labelKey);
-  const [expandedItems, setExpandedItems] = useState<Set<string>>(new Set(initialExpanded));
 
   useEffect(() => {
     setExpandedItems((prev) => {
       const next = new Set(prev);
-      treeItems.forEach((item) => {
+      // Auto-expand plugin groups whose child route is active
-        const isActive = item.children.some((child) => location.pathname.startsWith(child.to));
+      for (const item of pluginMenuItems) {
-        if (isActive) next.add(item.labelKey);
+        if (item.group && location.pathname.startsWith(item.path)) {
-      });
+          next.add(`plugin-group-${item.group}`);
+        }
+      }
       return next;
     });
-  }, [location.pathname]);
+  }, [location.pathname, pluginMenuItems]);
 
   const toggleExpand = (labelKey: string) => {
     setExpandedItems((prev) => {
@@ -100,9 +64,6 @@ export function Sidebar() {
     });
   };
 
-  const isChildActive = (children: NavLeaf[]) =>
-    children.some((child) => location.pathname.startsWith(child.to));
-
   return (
     <>
       {sidebarOpen && (
@@ -148,62 +109,6 @@ export function Sidebar() {
               </li>
             ))}
 
-            {treeItems.map((item) => {
-              const expanded = expandedItems.has(item.labelKey);
-              const childActive = isChildActive(item.children);
-              return (
-                <li key={item.labelKey}>
-                  <div
-                    className={clsx(
-                      'flex items-center gap-2 px-3 py-2.5 rounded-md text-sm font-medium min-h-touch',
-                      'motion-safe:transition-colors cursor-pointer select-none',
-                      childActive
-                        ? 'text-white'
-                        : 'text-secondary-300 hover:bg-secondary-800 hover:text-white'
-                    )}
-                    onClick={() => toggleExpand(item.labelKey)}
-                    role="button"
-                    tabIndex={0}
-                    aria-expanded={expanded}
-                    aria-label={t(item.labelKey)}
-                    onKeyDown={(e) => {
-                      if (e.key === 'Enter' || e.key === ' ') {
-                        e.preventDefault();
-                        toggleExpand(item.labelKey);
-                      }
-                    }}
-                  >
-                    {item.icon}
-                    <span className="flex-1 truncate">{t(item.labelKey)}</span>
-                    {chevronIcon(expanded)}
-                  </div>
-                  {expanded && (
-                    <ul className="mt-1 ml-4 space-y-1 border-l border-secondary-700 pl-2" role="group">
-                      {item.children.map((child) => (
-                        <li key={child.to}>
-                          <NavLink
-                            to={child.to}
-                            className={({ isActive }) =>
-                              clsx(
-                                'flex items-center gap-2 px-3 py-2 rounded-md text-sm min-h-touch',
-                                'motion-safe:transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-primary-500',
-                                isActive
-                                  ? 'bg-primary-600 text-white font-medium'
-                                  : 'text-secondary-400 hover:bg-secondary-800 hover:text-white'
-                              )
-                            }
-                            aria-label={t(child.labelKey)}
-                          >
-                            <span className="truncate">{t(child.labelKey)}</span>
-                          </NavLink>
-                        </li>
-                      ))}
-                    </ul>
-                  )}
-                </li>
-              );
-            })}
-
             {pluginMenuItems.length > 0 && (
               <>
                 <li className="px-3 pt-4 pb-1">