Phase 0 Complete: Tasks 0.7-0.20

- 0.7: UI-Design-Richtlinien (docs/ui-design-guidelines.md, 535 lines)
- 0.8: Theme-Customization Backend (4 theme fields, migration 0023)
- 0.9: Theme-Customization Frontend (SettingsTheme.tsx, themeStore.ts, live preview)
- 0.10: RBAC-Audit (4 plugins secured, 53 routes with require_permission)
- 0.11: LiteLLM-Cleanup (llm_client.py migrated from httpx to litellm)
- 0.12: KI-Agent-Framework docs (plugin-development-guide.md, agent_capabilities field)
- 0.13: Heartbeat configurable (ProactiveSettings, migration 0024, frontend UI)
- 0.14: Unified Search Field-Level RBAC (resolve_permissions + filter_fields_by_permission)
- 0.15: Undo/History-System (EntityHistory model, service, routes, migration 0025, HistoryViewer)
- 0.16: Storage Backend (LocalStorage + S3Storage, DMS/attachments/mail updated)
- 0.17: Import/Export unified Contact fields (firstname, surname, email_1, phone_1)
- 0.18: .gitignore & Config-Cleanup (webui→frontend, python-jose removed, .env untracked)
- 0.19: Mail-Salt Security-Fix (per-account random salt, migration 0026)
- 0.20: AGPL replaced (PyMuPDF→pypdf, OnlyOffice→Collabora, LICENSE + THIRD_PARTY_LICENSES.md)

app/plugins/builtins/entity_links/plugin.py

@@ -36,7 +36,11 @@ class EntityLinksPlugin(BasePlugin):
         ],
         events=["company.deleted", "contact.deleted"],
         migrations=["0001_initial.sql"],
-        permissions=[],
+        permissions=[
+            "entity_links:read",
+            "entity_links:write",
+            "entity_links:delete",
+        ],
         is_core=True,
     )
 

app/plugins/builtins/entity_links/routes.py

@@ -9,7 +9,7 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.deps import get_current_user
+from app.deps import get_current_user, require_permission
 from app.plugins.builtins.entity_links.models import EntityLink
 from app.plugins.builtins.entity_links.schemas import EntityLinkRequest
 
@@ -29,7 +29,7 @@ def _parse_uuid(val: str, field: str) -> uuid.UUID:
         ) from None
 
 
-@router.post("/files/{file_id}/link")
+@router.post("/files/{file_id}/link", dependencies=[Depends(require_permission("entity_links:write"))])
 async def link_file_to_entity(
     file_id: str,
     body: EntityLinkRequest,
@@ -84,7 +84,7 @@ async def link_file_to_entity(
     }
 
 
-@router.delete("/files/{file_id}/link", status_code=status.HTTP_204_NO_CONTENT)
+@router.delete("/files/{file_id}/link", status_code=status.HTTP_204_NO_CONTENT, dependencies=[Depends(require_permission("entity_links:delete"))])
 async def unlink_file_from_entity(
     file_id: str,
     body: EntityLinkRequest = Body(...),
@@ -112,7 +112,7 @@ async def unlink_file_from_entity(
     return Response(status_code=status.HTTP_204_NO_CONTENT)
 
 
-@router.get("/files/{file_id}/links")
+@router.get("/files/{file_id}/links", dependencies=[Depends(require_permission("entity_links:read"))])
 async def list_file_links(
     file_id: str,
     db: AsyncSession = Depends(get_db),
@@ -140,7 +140,7 @@ async def list_file_links(
     ]
 
 
-@company_router.get("/{company_id}/files")
+@company_router.get("/{company_id}/files", dependencies=[Depends(require_permission("entity_links:read"))])
 async def list_company_files(
     company_id: str,
     db: AsyncSession = Depends(get_db),
@@ -169,7 +169,7 @@ async def list_company_files(
     ]
 
 
-@contact_router.get("/{contact_id}/files")
+@contact_router.get("/{contact_id}/files", dependencies=[Depends(require_permission("entity_links:read"))])
 async def list_contact_files(
     contact_id: str,
     db: AsyncSession = Depends(get_db),