Phase 0 Complete: Tasks 0.7-0.20

- 0.7: UI-Design-Richtlinien (docs/ui-design-guidelines.md, 535 lines)
- 0.8: Theme-Customization Backend (4 theme fields, migration 0023)
- 0.9: Theme-Customization Frontend (SettingsTheme.tsx, themeStore.ts, live preview)
- 0.10: RBAC-Audit (4 plugins secured, 53 routes with require_permission)
- 0.11: LiteLLM-Cleanup (llm_client.py migrated from httpx to litellm)
- 0.12: KI-Agent-Framework docs (plugin-development-guide.md, agent_capabilities field)
- 0.13: Heartbeat configurable (ProactiveSettings, migration 0024, frontend UI)
- 0.14: Unified Search Field-Level RBAC (resolve_permissions + filter_fields_by_permission)
- 0.15: Undo/History-System (EntityHistory model, service, routes, migration 0025, HistoryViewer)
- 0.16: Storage Backend (LocalStorage + S3Storage, DMS/attachments/mail updated)
- 0.17: Import/Export unified Contact fields (firstname, surname, email_1, phone_1)
- 0.18: .gitignore & Config-Cleanup (webui→frontend, python-jose removed, .env untracked)
- 0.19: Mail-Salt Security-Fix (per-account random salt, migration 0026)
- 0.20: AGPL replaced (PyMuPDF→pypdf, OnlyOffice→Collabora, LICENSE + THIRD_PARTY_LICENSES.md)

app/plugins/builtins/calendar/plugin.py

@@ -34,5 +34,11 @@ class CalendarPlugin(BasePlugin):
         ],
         events=[],
         migrations=["0001_initial.sql"],
-        permissions=[],
+        permissions=[
+            "calendar:read",
+            "calendar:write",
+            "calendar:delete",
+            "calendar:share",
+            "calendar:admin",
+        ],
     )

app/plugins/builtins/calendar/routes.py

@@ -22,7 +22,7 @@ from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.deps import get_current_user, require_admin
+from app.deps import get_current_user, require_admin, require_permission
 from app.plugins.builtins.calendar.ics_utils import (
     export_entries_to_ics,
     ics_events_to_entry_data,
@@ -163,7 +163,7 @@ async def _check_write_permission(
 # ─── Calendar CRUD ───
 
 
-@calendar_router.get("")
+@calendar_router.get("", dependencies=[Depends(require_permission("calendar:read"))])
 async def list_calendars(
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(get_current_user),
@@ -180,7 +180,7 @@ async def list_calendars(
     return [_calendar_to_dict(c) for c in cals]
 
 
-@calendar_router.post("", status_code=status.HTTP_201_CREATED)
+@calendar_router.post("", status_code=status.HTTP_201_CREATED, dependencies=[Depends(require_permission("calendar:write"))])
 async def create_calendar(
     body: CalendarCreate,
     db: AsyncSession = Depends(get_db),
@@ -201,7 +201,7 @@ async def create_calendar(
     return _calendar_to_dict(cal)
 
 
-@calendar_router.patch("/{calendar_id}")
+@calendar_router.patch("/{calendar_id}", dependencies=[Depends(require_permission("calendar:write"))])
 async def update_calendar(
     calendar_id: str,
     body: CalendarUpdate,
@@ -226,7 +226,7 @@ async def update_calendar(
     return _calendar_to_dict(cal)
 
 
-@calendar_router.delete("/{calendar_id}", status_code=status.HTTP_204_NO_CONTENT)
+@calendar_router.delete("/{calendar_id}", status_code=status.HTTP_204_NO_CONTENT, dependencies=[Depends(require_permission("calendar:delete"))])
 async def delete_calendar(
     calendar_id: str,
     db: AsyncSession = Depends(get_db),
@@ -259,7 +259,7 @@ async def delete_calendar(
     return Response(status_code=204)
 
 
-@calendar_router.post("/{calendar_id}/share")
+@calendar_router.post("/{calendar_id}/share", dependencies=[Depends(require_permission("calendar:share"))])
 async def share_calendar(
     calendar_id: str,
     body: ShareRequest,
@@ -297,7 +297,7 @@ async def share_calendar(
     }
 
 
-@calendar_router.get("/{calendar_id}/permissions")
+@calendar_router.get("/{calendar_id}/permissions", dependencies=[Depends(require_permission("calendar:read"))])
 async def get_permissions(
     calendar_id: str,
     db: AsyncSession = Depends(get_db),
@@ -324,7 +324,7 @@ async def get_permissions(
 # ─── Entries ───
 
 
-@router.get("/calendar/entries")
+@router.get("/calendar/entries", dependencies=[Depends(require_permission("calendar:read"))])
 async def list_entries(
     start: str | None = None,
     end: str | None = None,
@@ -385,7 +385,7 @@ async def list_entries(
     return all_occurrences
 
 
-@router.post("/calendar/entries", status_code=status.HTTP_201_CREATED)
+@router.post("/calendar/entries", status_code=status.HTTP_201_CREATED, dependencies=[Depends(require_permission("calendar:write"))])
 async def create_entry(
     body: EntryCreate,
     db: AsyncSession = Depends(get_db),
@@ -458,7 +458,7 @@ async def create_entry(
     return _entry_to_dict(entry)
 
 
-@router.get("/calendar/entries/export")
+@router.get("/calendar/entries/export", dependencies=[Depends(require_permission("calendar:read"))])
 async def export_entries(
     format: str = "csv",
     db: AsyncSession = Depends(get_db),
@@ -519,7 +519,7 @@ async def export_entries(
     )
 
 
-@router.get("/calendar/entries/{entry_id}")
+@router.get("/calendar/entries/{entry_id}", dependencies=[Depends(require_permission("calendar:read"))])
 async def get_entry(
     entry_id: str,
     db: AsyncSession = Depends(get_db),
@@ -555,7 +555,7 @@ async def get_entry(
     return _entry_to_dict(entry, links, subtasks)
 
 
-@router.patch("/calendar/entries/{entry_id}")
+@router.patch("/calendar/entries/{entry_id}", dependencies=[Depends(require_permission("calendar:write"))])
 async def update_entry(
     entry_id: str,
     body: EntryUpdate,
@@ -611,7 +611,7 @@ async def update_entry(
     return _entry_to_dict(entry)
 
 
-@router.delete("/calendar/entries/{entry_id}", status_code=status.HTTP_204_NO_CONTENT)
+@router.delete("/calendar/entries/{entry_id}", status_code=status.HTTP_204_NO_CONTENT, dependencies=[Depends(require_permission("calendar:delete"))])
 async def delete_entry(
     entry_id: str,
     db: AsyncSession = Depends(get_db),
@@ -631,7 +631,7 @@ async def delete_entry(
     return Response(status_code=204)
 
 
-@router.post("/calendar/entries/{entry_id}/link")
+@router.post("/calendar/entries/{entry_id}/link", dependencies=[Depends(require_permission("calendar:write"))])
 async def link_entry(
     entry_id: str,
     body: LinkRequest,
@@ -658,7 +658,7 @@ async def link_entry(
     }
 
 
-@router.post("/calendar/entries/{entry_id}/subtasks", status_code=status.HTTP_201_CREATED)
+@router.post("/calendar/entries/{entry_id}/subtasks", status_code=status.HTTP_201_CREATED, dependencies=[Depends(require_permission("calendar:write"))])
 async def create_subtask(
     entry_id: str,
     body: SubtaskCreate,
@@ -684,7 +684,7 @@ async def create_subtask(
     }
 
 
-@router.patch("/calendar/entries/{entry_id}/subtasks/{sub_id}")
+@router.patch("/calendar/entries/{entry_id}/subtasks/{sub_id}", dependencies=[Depends(require_permission("calendar:write"))])
 async def update_subtask(
     entry_id: str,
     sub_id: str,
@@ -717,7 +717,7 @@ async def update_subtask(
 # ─── Bulk + Kanban + Export ───
 
 
-@router.post("/calendar/entries/bulk")
+@router.post("/calendar/entries/bulk", dependencies=[Depends(require_permission("calendar:write"))])
 async def bulk_action(
     body: BulkAction,
     db: AsyncSession = Depends(get_db),
@@ -751,7 +751,7 @@ async def bulk_action(
         return {"action": body.action, "affected": len(entry_ids)}
 
 
-@router.get("/calendar/kanban")
+@router.get("/calendar/kanban", dependencies=[Depends(require_permission("calendar:read"))])
 async def kanban_board(
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(get_current_user),
@@ -783,7 +783,7 @@ async def kanban_board(
 # ─── ICS Feed + Import ───
 
 
-@router.get("/calendar/{calendar_id}/ics-feed")
+@router.get("/calendar/{calendar_id}/ics-feed", dependencies=[Depends(require_permission("calendar:read"))])
 async def ics_feed(
     calendar_id: str,
     token: str | None = None,
@@ -820,7 +820,7 @@ async def ics_feed(
     return Response(content=ics_content, media_type="text/calendar")
 
 
-@router.post("/calendar/import")
+@router.post("/calendar/import", dependencies=[Depends(require_permission("calendar:write"))])
 async def import_ics(
     file: UploadFile = File(...),
     calendar_id: str | None = None,
@@ -879,7 +879,7 @@ async def import_ics(
 # ─── Resources ───
 
 
-@resource_router.post("", status_code=status.HTTP_201_CREATED)
+@resource_router.post("", status_code=status.HTTP_201_CREATED, dependencies=[Depends(require_permission("calendar:write"))])
 async def create_resource(
     body: ResourceCreate,
     db: AsyncSession = Depends(get_db),
@@ -897,7 +897,7 @@ async def create_resource(
     return {"id": str(resource.id), "name": resource.name, "type": resource.type}
 
 
-@router.post("/calendar/entries/{entry_id}/book-resource")
+@router.post("/calendar/entries/{entry_id}/book-resource", dependencies=[Depends(require_permission("calendar:write"))])
 async def book_resource(
     entry_id: str,
     body: BookResourceRequest,