Phase 0 Complete: Tasks 0.7-0.20

- 0.7: UI-Design-Richtlinien (docs/ui-design-guidelines.md, 535 lines)
- 0.8: Theme-Customization Backend (4 theme fields, migration 0023)
- 0.9: Theme-Customization Frontend (SettingsTheme.tsx, themeStore.ts, live preview)
- 0.10: RBAC-Audit (4 plugins secured, 53 routes with require_permission)
- 0.11: LiteLLM-Cleanup (llm_client.py migrated from httpx to litellm)
- 0.12: KI-Agent-Framework docs (plugin-development-guide.md, agent_capabilities field)
- 0.13: Heartbeat configurable (ProactiveSettings, migration 0024, frontend UI)
- 0.14: Unified Search Field-Level RBAC (resolve_permissions + filter_fields_by_permission)
- 0.15: Undo/History-System (EntityHistory model, service, routes, migration 0025, HistoryViewer)
- 0.16: Storage Backend (LocalStorage + S3Storage, DMS/attachments/mail updated)
- 0.17: Import/Export unified Contact fields (firstname, surname, email_1, phone_1)
- 0.18: .gitignore & Config-Cleanup (webui→frontend, python-jose removed, .env untracked)
- 0.19: Mail-Salt Security-Fix (per-account random salt, migration 0026)
- 0.20: AGPL replaced (PyMuPDF→pypdf, OnlyOffice→Collabora, LICENSE + THIRD_PARTY_LICENSES.md)

app/plugins/builtins/unified_search/routes.py

@@ -11,6 +11,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
 from app.core.jobs import enqueue_job
+from app.core.permissions import resolve_permissions, filter_fields_by_permission
 from app.deps import get_current_user, require_permission
 from app.plugins.builtins.unified_search.provider_registry import get_search_registry
 from app.plugins.builtins.unified_search.query_understanding import (
@@ -49,6 +50,7 @@ async def search(
 ) -> SearchResponse:
     """Perform hybrid search with KI query understanding."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
 
     # KI query understanding
     query_analysis = await llm_analyze_query(req.query, db=db, tenant_id=tenant_id)
@@ -62,6 +64,18 @@ async def search(
         limit=req.limit,
     )
 
+    # Resolve user permissions for field-level RBAC
+    resolved_perms = await resolve_permissions(db, user_id, tenant_id)
+
+    # Map entity_type to module name for field-level permissions
+    _ENTITY_TO_MODULE = {
+        "contact": "contacts",
+        "company": "contacts",
+        "mail": "mail",
+        "file": "dms",
+        "event": "calendar",
+    }
+
     # KI result aggregation
     aggregation = await llm_aggregate_results(results, req.query, db=db, tenant_id=tenant_id)
 
@@ -72,7 +86,11 @@ async def search(
             title=r.get("title", ""),
             snippet=r.get("snippet", ""),
             score=r.get("score", 0.0),
-            data=r.get("data", {}),
+            data=filter_fields_by_permission(
+                r.get("data", {}),
+                resolved_perms,
+                _ENTITY_TO_MODULE.get(r.get("entity_type", ""), r.get("entity_type", "")),
+            ),
         )
         for r in results
     ]

app/plugins/builtins/unified_search/text_extraction.py

@@ -14,7 +14,7 @@ async def extract_text_from_file(file_path: str, mime_type: str) -> str:
     """Extract text content from a file based on its MIME type.
 
     Supports:
-    - PDF (via PyMuPDF/fitz)
+    - PDF (via pypdf)
     - DOCX (via python-docx)
     - XLSX (via openpyxl)
     - PPTX (via python-pptx)
@@ -57,14 +57,15 @@ def _truncate(text: str) -> str:
 
 
 async def _extract_pdf(file_path: str) -> str:
-    """Extract text from PDF using PyMuPDF (fitz)."""
-    import fitz  # PyMuPDF
+    """Extract text from PDF using pypdf (BSD-licensed)."""
+    from pypdf import PdfReader
 
-    doc = fitz.open(file_path)
+    reader = PdfReader(file_path)
     parts: list[str] = []
-    for page in doc:
-        parts.append(page.get_text())
-    doc.close()
+    for page in reader.pages:
+        text = page.extract_text()
+        if text:
+            parts.append(text)
     return _truncate("\n".join(parts))