fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed
- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner - P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var - P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup - P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns - P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs) - P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import - P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default - P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed - P2: 28 frontend TODOs (hardcoded constants, deprecated notification API) - P3: dead code, duplicates, deprecated imports, private attr, __import__ inline - P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n) - ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix) - F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String) - Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt
This commit is contained in:
Agent Zero
@@ -18,9 +18,6 @@ logger = logging.getLogger(__name__)
|
||||
|
||||
# ── Core system permissions ──
|
||||
CORE_PERMISSIONS: list[dict[str, str]] = [
|
||||
{"key": "contacts:read", "label": "Contacts: Read", "category": "core", "module": "contacts"},
|
||||
{"key": "contacts:write", "label": "Contacts: Write", "category": "core", "module": "contacts"},
|
||||
{"key": "contacts:delete", "label": "Contacts: Delete", "category": "core", "module": "contacts"},
|
||||
{"key": "users:read", "label": "Users: Read", "category": "core", "module": "users"},
|
||||
{"key": "users:write", "label": "Users: Write", "category": "core", "module": "users"},
|
||||
{"key": "users:delete", "label": "Users: Delete", "category": "core", "module": "users"},
|
||||
@@ -66,66 +63,10 @@ CORE_PERMISSIONS: list[dict[str, str]] = [
|
||||
{"key": "workspaces:assign_users", "label": "Workspaces: Assign Users", "category": "core", "module": "workspaces"},
|
||||
{"key": "workspaces:configure_modules", "label": "Workspaces: Configure Modules", "category": "core", "module": "workspaces"},
|
||||
{"key": "system:admin", "label": "System: Admin (cross-tenant)", "category": "system", "module": "system"},
|
||||
# ── Plugin permissions (registered at startup, but also listed here for completeness) ──
|
||||
{"key": "ai:read", "label": "AI: Read", "category": "core", "module": "ai"},
|
||||
{"key": "ai:write", "label": "AI: Write", "category": "core", "module": "ai"},
|
||||
{"key": "ai:agents", "label": "AI: Agents", "category": "core", "module": "ai"},
|
||||
{"key": "ai:config", "label": "AI: Config", "category": "core", "module": "ai"},
|
||||
{"key": "ai_proactive:read", "label": "AI Proactive: Read", "category": "core", "module": "ai_proactive"},
|
||||
{"key": "ai_proactive:write", "label": "AI Proactive: Write", "category": "core", "module": "ai_proactive"},
|
||||
{"key": "ai_proactive:config", "label": "AI Proactive: Config", "category": "core", "module": "ai_proactive"},
|
||||
{"key": "agents:read", "label": "Agents: Read", "category": "core", "module": "agents"},
|
||||
{"key": "agents:write", "label": "Agents: Write", "category": "core", "module": "agents"},
|
||||
{"key": "agents:delete", "label": "Agents: Delete", "category": "core", "module": "agents"},
|
||||
{"key": "agents:execute", "label": "Agents: Execute", "category": "core", "module": "agents"},
|
||||
{"key": "automation:read", "label": "Automation: Read", "category": "core", "module": "automation"},
|
||||
{"key": "automation:write", "label": "Automation: Write", "category": "core", "module": "automation"},
|
||||
{"key": "automation:delete", "label": "Automation: Delete", "category": "core", "module": "automation"},
|
||||
{"key": "automation:execute", "label": "Automation: Execute", "category": "core", "module": "automation"},
|
||||
{"key": "automation:admin", "label": "Automation: Admin", "category": "core", "module": "automation"},
|
||||
{"key": "automation:configure", "label": "Automation: Configure", "category": "core", "module": "automation"},
|
||||
{"key": "calendar:read", "label": "Calendar: Read", "category": "core", "module": "calendar"},
|
||||
{"key": "calendar:write", "label": "Calendar: Write", "category": "core", "module": "calendar"},
|
||||
{"key": "calendar:delete", "label": "Calendar: Delete", "category": "core", "module": "calendar"},
|
||||
{"key": "calendar:share", "label": "Calendar: Share", "category": "core", "module": "calendar"},
|
||||
{"key": "comm:read", "label": "Comm: Read", "category": "core", "module": "comm"},
|
||||
{"key": "comm:write", "label": "Comm: Write", "category": "core", "module": "comm"},
|
||||
{"key": "comm:delete", "label": "Comm: Delete", "category": "core", "module": "comm"},
|
||||
{"key": "comm:manage", "label": "Comm: Manage", "category": "core", "module": "comm"},
|
||||
{"key": "dashboard:read", "label": "Dashboard: Read", "category": "core", "module": "dashboard"},
|
||||
{"key": "dms:read", "label": "DMS: Read", "category": "core", "module": "dms"},
|
||||
{"key": "dms:write", "label": "DMS: Write", "category": "core", "module": "dms"},
|
||||
{"key": "dms:delete", "label": "DMS: Delete", "category": "core", "module": "dms"},
|
||||
{"key": "dms:share", "label": "DMS: Share", "category": "core", "module": "dms"},
|
||||
{"key": "entity_links:read", "label": "Entity Links: Read", "category": "core", "module": "entity_links"},
|
||||
{"key": "entity_links:write", "label": "Entity Links: Write", "category": "core", "module": "entity_links"},
|
||||
{"key": "entity_links:delete", "label": "Entity Links: Delete", "category": "core", "module": "entity_links"},
|
||||
{"key": "mail:read", "label": "Mail: Read", "category": "core", "module": "mail"},
|
||||
{"key": "mail:write", "label": "Mail: Write", "category": "core", "module": "mail"},
|
||||
{"key": "mail:delete", "label": "Mail: Delete", "category": "core", "module": "mail"},
|
||||
{"key": "mail:send", "label": "Mail: Send", "category": "core", "module": "mail"},
|
||||
{"key": "mail:share", "label": "Mail: Share", "category": "core", "module": "mail"},
|
||||
{"key": "mail:config", "label": "Mail: Config", "category": "core", "module": "mail"},
|
||||
{"key": "mcp:read", "label": "MCP: Read", "category": "core", "module": "mcp"},
|
||||
{"key": "mcp:write", "label": "MCP: Write", "category": "core", "module": "mcp"},
|
||||
{"key": "permissions:admin", "label": "Permissions: Admin", "category": "core", "module": "permissions"},
|
||||
{"key": "permissions:delegations:read", "label": "Permissions: Delegations: Read", "category": "core", "module": "permissions"},
|
||||
{"key": "permissions:delegations:write", "label": "Permissions: Delegations: Write", "category": "core", "module": "permissions"},
|
||||
{"key": "permissions:policies:read", "label": "Permissions: Policies: Read", "category": "core", "module": "permissions"},
|
||||
{"key": "permissions:policies:write", "label": "Permissions: Policies: Write", "category": "core", "module": "permissions"},
|
||||
{"key": "permissions:templates:read", "label": "Permissions: Templates: Read", "category": "core", "module": "permissions"},
|
||||
{"key": "permissions:templates:write", "label": "Permissions: Templates: Write", "category": "core", "module": "permissions"},
|
||||
{"key": "reports:read", "label": "Reports: Read", "category": "core", "module": "reports"},
|
||||
{"key": "reports:generate", "label": "Reports: Generate", "category": "core", "module": "reports"},
|
||||
{"key": "reports:manage_templates", "label": "Reports: Manage Templates", "category": "core", "module": "reports"},
|
||||
{"key": "search:read", "label": "Search: Read", "category": "core", "module": "search"},
|
||||
{"key": "search:admin", "label": "Search: Admin", "category": "core", "module": "search"},
|
||||
{"key": "tags:read", "label": "Tags: Read", "category": "core", "module": "tags"},
|
||||
{"key": "tags:write", "label": "Tags: Write", "category": "core", "module": "tags"},
|
||||
{"key": "tags:delete", "label": "Tags: Delete", "category": "core", "module": "tags"},
|
||||
{"key": "tasks:read", "label": "Tasks: Read", "category": "core", "module": "tasks"},
|
||||
{"key": "tasks:write", "label": "Tasks: Write", "category": "core", "module": "tasks"},
|
||||
{"key": "tasks:delete", "label": "Tasks: Delete", "category": "core", "module": "tasks"},
|
||||
# NOTE: Plugin permissions (calendar, dms, mail, tasks, comm, automation, ai,
|
||||
# tags, entity_links, reports, search, mcp, permissions, agents, dashboard)
|
||||
# are registered dynamically via register_plugin_permissions() from plugin
|
||||
# manifests at activation time. They are NOT hardcoded here (P0-4 fix).
|
||||
]
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user