chore: Clean up dump.rdb, templates/, test_report.md; update .a0 status files

2026-08-04 15:12:36 +02:00
parent 157e454fcc
commit aaf2784a9a
20 changed files with 41 additions and 782 deletions
@@ -1,47 +1,31 @@
 # LeoCRM — Current Status
-**Phase**: Fix Branch — 20/22 FIX-PLAN Items erledigt
-**Last update**: 2026-07-26 16:25
-**Branch**: main (leocrm-fix)
+**Last update**: 2026-08-04
+**Branch**: main
+**Git HEAD**: 157e454
+**Alembic-Head**: 0103
+**Produktion**: https://crm.media-on.de — healthy

-## FIX-PLAN Überprüfung (2026-07-26)
-Alle 22 Items gegen Codebasis verifiziert. 20 erledigt, 2 offen.
+## Security Fix Plan — Alle Phasen abgeschlossen
+| Phase | Status |
+|-------|--------|
+| 1 — Kritische Sicherheitslücken | ✅ |
+| 2 — Visibility Filter & Owner ID | ✅ |
+| 3 — WebSocket CSRF, SameSite, FK CASCADE | ✅ |
+| 4 — Krisensicherheit (Circuit Breaker, Retry, Fallback) | ✅ |
+| 5 — Architektur-Lücken (9 Sub-Tasks) | ✅ |

-### Erledigt (20)
- P0-1: Auth-Bypass entfernt ✅
- P0-2: Migrationen repariert ✅
- P0-3: Plugin-Upload deaktiviert ✅
- P0-4: RLS FORCE + WITH CHECK ✅
- P0-5: Plugin-Doppelregistrierung behoben ✅
- P0-6: Persistent Volume ✅
- P1-1: User/Tenant-Modell bereinigt ✅
- P1-2: Redis zentralisiert ✅
- P1-3: Worker ausgelagert ✅
- P1-4: Transactional Outbox ✅
- P1-5: XSS-Stellen geschlossen ✅
- P1-6: DMS lastfest ✅
- P1-7: Permission-System vereinheitlicht ✅
- P1-8: Password Reset funktionsfähig ✅
- P1-9: Metrics abgesichert ✅
- P1-10: Coolify-Doku & Config korrigiert ✅
- P1-11: Cross-Tenant FK ✅
- P2-1: Contact Model normalisiert ✅
- P2-3: Commands & Statusmaschinen ✅
- P2-4: SPA Path-Traversal ✅
+## Implementierte Features (Phase 5)
+- PWA (VitePWA, manifest.json, service worker)
+- Public Plugin Endpoints (is_public, share-link routes)
+- Contacts Embedding (Vector(768), HNSW index)
+- 10 Search Providers (contact, company, mail, file, event, task, contactperson, tag, conversation, user)
+- Plugin-Marketplace (listing, download, Ed25519 verify, install)
+- Agent Memory (persistent, pgvector semantic search)
+- GraphRAG (entity relationships, BFS traversal, search provider)
+- Subagents/Multi-Agent (AgentCoordinator, subtask management)
+- External Agent API (Bearer token, SSE streaming, rate limiting)
+- Circuit Breaker + DB Retry + Redis Graceful Degradation

-### Offen (2)
- P0-7: App von öffentlicher Domain nehmen (operational — 30 Min)
- P2-2: Plugin-Cross-Imports reduzieren (228 Imports — 1-2 Wochen)
-
-## Previous: P1-4: Transactional Outbox — COMPLETE
- Migration 0040_outbox.py created (down_revision=0039_contact_normalize)
- event_outbox table: id, tenant_id, event_name, payload JSONB, status, attempts, max_attempts, next_retry_at, timestamps
- app/core/outbox.py: enqueue_outbox_event() + process_outbox_batch() with FOR UPDATE SKIP LOCKED, exponential backoff retry
- app/core/event_bus.py: added publish_with_results() for error-aware publishing; docstring note about outbox
- app/core/worker.py: process_outbox_job cron (every 5s, Redis distributed lock)
- app/services/contact_service.py: contact.created, lead.created, contact.updated → enqueue_outbox_event
- app/models/outbox.py: SQLAlchemy ORM model for event_outbox
- tests/test_outbox.py: 6 tests, all passing
- py_compile: OK, alembic heads: single head 0040_outbox
-
-## Previous: P2-1: Unified Contact Model normalisieren — COMPLETE
- Migration 0039_contact_normalize.py (down_revision=0038_dms_content_hash)
+## Offene Items
+- IMPLEMENTATION_PLAN.md: 14 Frontend-Features in 4 Phasen (nicht begonnen)
+- Test-Instanzen CRM2/CRM3 noch aktiv (können gelöscht werden)
@@ -1,10 +1,17 @@
 # LeoCRM — Next Steps

-## FIX-PLAN Offene Items (2026-07-26)
-1. P0-7: App von öffentlicher Domain nehmen (operational — 30 Min)
-2. P2-2: Plugin-Cross-Imports reduzieren (228 Imports — 1-2 Wochen)
+## Offene Items (2026-08-04)
+1. IMPLEMENTATION_PLAN.md — 14 Frontend-Features in 4 Phasen
+   - Phase 1: Workflows UI, Dedup/Merge UI, Import/Export UI, Print/PDF
+   - Phase 2: Tags UI, Custom Fields UI, Notifications Dropdown
+   - Phase 3: Saved Filters, Entity History, Activity Timeline, API Docs
+   - Phase 4: Webhooks, Backup/Restore UI, Onboarding
+2. Test-Instanzen CRM2/CRM3 können gelöscht werden
+3. Tests für neue Plugins (agent_memory, graph_rag, marketplace) schreiben

-## Abgeschlossen
- P2-1: Unified Contact Model normalisieren — COMPLETE
- P1-4: Transactional Outbox — COMPLETE
- 20/22 FIX-PLAN Items erledigt (siehe .a0/current_status.md)
+## Abgeschlossen (2026-08-04)
+- Security Fix Plan Phase 1-5 komplett
+- Alle alten Plan-Dateien gelöscht (Sanierungsplan, FIX-PLAN, etc.)
+- 3 neue Plugins: agent_memory, graph_rag, marketplace
+- Resilience-Features: Circuit Breaker, DB Retry, Redis Fallback
+- PWA, Public Endpoints, Search Coverage (10 providers)