7 Commits

Author SHA1 Message Date
Agent Zero abbe7a18fc fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed
- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt
2026-08-16 01:17:18 +02:00
Agent Zero 24fb384cf9 fix: keep __annotations__ in wrap_plugin_route — body params need ForwardRef resolution
Removing __annotations__ broke body parameter resolution: FastAPI could
not resolve ForwardRef('ConversationCreate') etc. causing 422 on all
POST routes with body params. Now keeping annotations from functools.wraps
and only removing return_annotation.
2026-07-27 02:39:16 +02:00
Agent Zero 7968630840 fix: UploadFile ForwardRef + WebSocket 403 — root cause fixed
1. plugin_error_handler.py: Remove _UploadFile alias, import UploadFile directly
   so FastAPI can resolve ForwardRef('UploadFile') in the wrapper's namespace.
   Also import WebSocket for ForwardRef resolution.

2. main.py: Skip WebSocket routes in wrap_plugin_route — WebSocket endpoints
   must not be wrapped (different protocol, no JSONResponse on error)
2026-07-27 01:17:59 +02:00
Agent Zero 09cd1a5fe2 fix: UploadFile ForwardRef error + WebSocket 403 CSRF block
1. plugin_error_handler.py: Remove return_annotation from copied signature
   to prevent FastAPI ForwardRef('UploadFile') resolution failure on routes
   with file upload endpoints (dms, calendar, mail, kommunikation, ai_assistant)

2. middleware.py: Skip CSRF check for WebSocket upgrade requests
   WebSocket connections use GET with upgrade header — should not be
   blocked by CSRF middleware
2026-07-27 01:08:51 +02:00
Agent Zero 1c01bbccb7 fix: 422 errors on all plugin routes — wrapper(*args, **kwargs) was interpreted as query params by FastAPI
The wrap_plugin_route wrapper had *args, **kwargs as parameters.
FastAPI interpreted these as required query parameters 'args' and 'kwargs',
causing 422 Unprocessable Entity on EVERY plugin route (mail, calendar, dms, reports, etc.).

Fix: Use functools.wraps(handler) to copy the original signature,
then remove __annotations__ (to avoid ForwardRef('UploadFile') issues),
and manually set __signature__ from the original handler.
2026-07-27 01:02:10 +02:00
Agent Zero 5ec1fc9b05 Phase 1: Fix all critical release blockers (B1-B10)
B1: Remove duplicate get_redis() — singleton no longer overwritten
B2: Plugin routes now enforce activation status via require_active_plugin()
B3: Fix UploadFile ForwardRef error — remove functools.wraps from wrap_plugin_route
B4: DMS upload uses true streaming via save_stream() instead of RAM accumulation
B5: Worker on_startup registers plugin event handlers + webhook dispatcher
B6: Implement send_password_reset_email job, remove raw token logging
B7: Webhook SSRF protection (IP validation, no redirects), secret removed from response
B8: RLS repair migration 0044 + separate crm_runtime DB user (NOSUPERUSER, NOBYPASSRLS)
B9: Fix .env.docker.example AUTH_SECRET → SECRET_KEY
B10: Remove Redis default password, remove exposed DB/Redis ports

Also: add frontend_url to config, add SMTP settings to .env.docker.example,
update prestart.sh to use MIGRATION_DATABASE_URL for alembic.
2026-07-26 20:45:42 +02:00
Agent Zero c3e41906bf feat: add forgejo_error_reporter plugin for automatic error reporting to Forgejo issues 2026-07-26 12:49:39 +02:00