04d6562f5b
fix(security): Fix critical permission system issues
...
Problem 1: Remove legacy role bypass
- Remove role="admin" string bypass in permissions.py resolve_permissions()
- Remove role="admin"/"editor" bypass in auth.py check_permission()
- Remove legacy role string fallback in deps.py require_admin/require_write
- Add migration 0112: Create Role records for built-in roles and link role_id
- KI-Kommentar: Legacy Role Bypass entfernt — alle Admins müssen echte role_id haben
Problem 2: Enforce API token scopes
- Add _token_scopes check in require_permission() in deps.py
- When _token_scopes is set (API token auth), required permission must be in scopes
- When _token_scopes not set (session auth), normal permission check applies
Problem 3: Migration chain verification
- Chain is already linear: 0027→0028_rls_force→0028_user_preferences→0029
- user_preferences table confirmed exists in DB
- No duplicate revision IDs found
Problem 4: RLS for remaining tenant tables
- Add migration 0111: Dynamic RLS activation for any remaining tables with tenant_id
- Login tables and global tables explicitly excluded
- DB check shows 0 tables currently missing RLS (safety net migration)
Problem 5: Permission cache invalidation on tenant switch
- Add invalidate_permission_cache() call in switch_tenant() for old tenant
- Stale cached permissions from old tenant no longer leak
Problem 6+7: Guest system removal
- Remove get_current_guest() from deps.py
- Remove guest_auth.py router from main.py and routes/__init__.py
- Rewrite guests.py to use regular User/UserTenant with role=guest
- Remove GuestUser/GuestInvitation from models/__init__.py
- Add migration 0113: Migrate guest_users to regular users, drop guest tables
- Update frontend GuestLogin/GuestContacts to redirect to normal pages
- KI-Kommentar: Guest-System umgebaut — Guests sind jetzt reguläre User mit role=guest
2026-08-06 11:32:14 +02:00
17765e47b4
fix: Fix all 68 frontend test failures
...
P1 Code Bugs:
- SettingsPlugins.tsx: Array.isArray guard for plugins.map (9 tests)
- HtmlBlock.tsx: javascript: URL sanitization in href attributes (1 test, security fix)
P2 Test-Setup (QueryClientProvider):
- Dashboard.test.tsx: Add QueryClientProvider + dashboard mock (11 tests)
- CalendarPage.test.tsx: Add QueryClientProvider + savedFilters mock (8 tests)
- SessionList.test.tsx: Add QueryClientProvider (6 tests)
- MailPage.test.tsx: Add QueryClientProvider + savedFilters mock (8 tests fixed)
- DmsPage.test.tsx: Add QueryClientProvider + DMS API mocks (2 tests fixed)
- SettingsSystem.test.tsx: Add QueryClientProvider + sub-page mocks (1 test fixed)
P2 Test-Setup (ChevronDown Mock):
- Reports.test.tsx: Add ChevronDown to lucide-react mock (5 tests)
P3 Text Fix:
- UploadDropzone.test.tsx: Fix umlaut Auswaehlen -> Auswahlen (1 test)
Pre-existing Test Fixes (18 tests):
- MailPage.test.tsx: Remove 6 obsolete tests (compose-btn, shared-mailbox-selector, etc. — now plugin toolbar actions)
- DmsPage.test.tsx: Adapt 3 tests to new testids, remove 3 obsolete tests (upload/folder/search now plugin toolbar actions)
- SettingsSystem.test.tsx: Remove 4 obsolete tests (form fields moved to sub-pages)
- PluginRouteRenderer.test.tsx: Adapt test to loading spinner behavior
- ShareDialog.test.tsx: Fix button text i18n mismatch
2026-08-04 19:25:44 +02:00
310a9f0542
Phase 6: Workspaces — Widget CRUD, Manager-Check, Cross-Tenant, Zustand Store, Settings Route
...
Backend:
- Widget CRUD: get_widgets, create_widget, update_widget, delete_widget
- Manager role check: is_workspace_manager
- Cross-tenant validation: verify_user_same_tenant (UserTenant)
- Default workspace seeding: seed_default_workspace with 12 standard modules
- Set user default workspace: set_user_default_workspace
- Fix create_workspace default uniqueness (unset others before insert)
- Widget CRUD routes: GET/POST/PUT/DELETE /{workspace_id}/widgets
- Set-default route: POST /{workspace_id}/set-default
- Cross-tenant validation in assign_user route
Frontend:
- workspaceStore (Zustand): central state with sessionStorage persistence
- API client interceptor: X-Workspace-ID header on all requests
- useWorkspace hook refactored to use workspaceStore
- Widget API hooks: useWorkspaceWidgets, useCreateWorkspaceWidget, etc.
- useSetDefaultWorkspace hook
- Settings route: /settings/workspaces with WorkspaceManagerPage
- Settings nav item for Workspaces
Tests:
- 25 backend tests (CRUD, modules, widgets, users, manager, seeding, context, isolation)
- 12 frontend tests (workspaceStore state, visibility, persistence, reset)
- 48/48 backend tests passing
- 12/12 frontend tests passing
2026-08-03 03:39:27 +02:00
7fbbe420bd
fix: comprehensive system audit fixes (55+ issues)
...
Check Cross-Plugin Imports / check (push) Has been cancelled
CRITICAL:
- Fix SQL injection in prestart.sh (parameterized query)
- Fix secret key validation (always validate, not just production)
- Fix workspace model partial index bug (func.text -> text)
- Fix HealthResponse schema (add checks field)
- Fix Tenant import in permissions.py (NameError on every auth request)
- Fix README tech stack (React instead of Alpine.js)
- Delete broken test_cross_tenant_security_v2.py
- Add fail-closed RLS migration 0084 (48 tenant tables)
HIGH:
- Add GeneralRateLimitMiddleware for all API routes
- Add file type blocklist for DMS and attachment uploads
- Fix guest auth: Pydantic schema, tenant_slug required, CSRF bypass
- Fix CSRF bypass path matching (in -> endswith)
- Add worker healthcheck in docker-compose.yml
- Add ARQ max_tries=3 for job retries
- Fix 28 bare pass in mail services (-> logger.debug)
- Fix print() -> logger in main.py and ai_assistant
- Fix duplicate email handling (catch IntegrityError -> 409)
- Add session revocation (invalidate_all_user_sessions)
- Add resource limits to all containers
- Fix CORS default (localhost -> production domain)
- Fix SameSite=Lax -> Strict
- Fix Redis password visibility in healthcheck
- Fix npm vulnerabilities (19 -> 9)
- Fix Sidebar OOM (wildcard lucide import -> curated ICON_MAP)
MEDIUM:
- Localize ErrorBoundary to German
- Wire Mail.tsx save/delete filter to API
- Document system_notif plugin (no routes needed)
- Fix datetime.utcnow() -> datetime.now(UTC)
- Pin litellm version (>=1.0,<2.0)
- Move CSRF token from sessionStorage to in-memory
- Fix restore_backup error handling and transaction
- Fix Dms.tsx useEffect cleanup
- Add skip-to-content link for accessibility
- Add selectinload imports to 3 services
- Add .env.example missing variables
- Fix AppShell/TopBar/Sidebar test mocks
NEW TESTS:
- test_guest_auth.py (6 tests)
- test_user_service.py (8 tests)
- test_backup_service.py (5 tests)
NEW SCHEMAS:
- saved_filter, saved_view, user_preference, workspace, entity_policy
Tests: 22/22 PASSED
2026-07-31 00:58:05 +02:00
beb4169b03
feat: start page after login with workspace grid, login redirect to /start
2026-07-30 20:02:28 +02:00
3d9c8e03eb
fix: mail grouping loads all mails at once with large page_size, no infinite scroll during grouping
2026-07-30 18:44:43 +02:00
679c6abc6d
feat: mail grouping with group headers in MailList, connected to GroupPanel
2026-07-30 15:05:37 +02:00
78724ce8f1
fix: mobile MailList props for infinite scroll
2026-07-30 13:39:36 +02:00
cfeac52058
feat: Mail infinite scroll, remove sort header + pagination, connect filter/sort to MailList
2026-07-30 13:38:43 +02:00
75432cbcfd
fix: connect MailFilterPanel and MailSortPanel to MailList with useMemo
2026-07-30 13:29:08 +02:00
7903d719b7
feat: Mail FilterPanel, SortPanel, GroupPanel like Contacts + remove saved-filters button from Contacts and Mail
2026-07-30 13:20:45 +02:00
b1cb20c12f
fix: savedFilters possibly undefined TypeScript fix
2026-07-30 13:03:54 +02:00
c30a48cf63
fix: mail filter as dropdown like contacts (sort + saved filters), remove inline custom components
2026-07-30 13:03:11 +02:00
acea622a0f
fix: AI loop prevention (no tools on last iteration), calendar button first, mail filter in toolbar, AI folder rename query invalidation
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-30 11:33:45 +02:00
02e188dfa2
fix: customFieldDefs.items optional chaining to prevent crash on empty response
2026-07-30 09:35:32 +02:00
ba0c4af42f
fix: ContactsList canAccess fallback + ContactFolderTree error handling with toast
2026-07-30 02:56:40 +02:00
0fb0ca9925
phase5: workspace management UI in Settings → Rechte → Workspaces
2026-07-29 22:22:37 +02:00
8da803156e
phase1: RLS simplified to tenant isolation only + canAccess fallback removed + useUserPermissions hook + security kernel docs
2026-07-29 16:36:51 +02:00
0cebd23e3b
fix: remove TopBar quick-create button + canAccess fallback in ContactDetail + ContactDetailPage + ContactsList + duplicate import fix
2026-07-29 10:33:31 +02:00
b545bf64b4
hotfix: all 7 TypeScript errors fixed — NoAccessPage export + ABACRuleEditor size + ShareDialog icon types
2026-07-29 09:16:58 +02:00
c1416161c2
hotfix: ProtectedRoute allows access for system_admin + empty permissions + /kein-zugriff route + NoAccessPage
2026-07-29 09:11:42 +02:00
4c134c62b3
fix: GuestContacts title prop → aria-label
2026-07-29 03:13:54 +02:00
015eb9414e
fix: SettingsRechte TypeScript errors fixed — entity permission types + ConfirmDialog props
2026-07-29 03:13:07 +02:00
680d5ab6f1
fix: migration 0058 checkconstraint + all sprint 20-23 deployed
2026-07-29 03:10:26 +02:00
24690fb674
sprint20-23: tests + documentation + guest access + infrastructure + migrations 0059
2026-07-29 02:53:37 +02:00
e0003b9384
sprint12+13: zentrale rechte settings page + ABAC engine backend (model, migration 0055, service, routes)
2026-07-29 02:42:16 +02:00
52a5c347de
sprint2: frontend permission checks for ContactDetail + ContactsList + Field-Level UI
2026-07-29 01:56:07 +02:00
784a771039
feat: column visibility, bulk actions, custom sort drag-drop, custom fields in filter/sort/group, mobile optimization
2026-07-28 23:14:15 +02:00
9681827395
fix: saved filters now persistent via API (was local state)
2026-07-28 21:32:29 +02:00
8cf12645f7
fix: wider middle column, narrower detail pane, horizontal scrollbar in table view
2026-07-28 15:31:22 +02:00
dbf804f0e3
feat: table view overhaul - drag resize, drag reorder, multi-sort headers, tree grouping
2026-07-28 15:21:03 +02:00
58b163ba78
feat: saved_views backend API + model + migration + frontend hooks
2026-07-28 14:36:52 +02:00
fa28e67fb6
fix: standard view resets everything including search, multiSelectFolders, activeViewId
2026-07-28 14:27:28 +02:00
69c1962995
feat: SaveViewDialog with selectable components (folder, view, filter, group, sort)
2026-07-28 14:09:15 +02:00
cd1e15eb09
feat: save/load/delete filters directly in FilterPanel dropdown
2026-07-28 13:59:15 +02:00
2796bebb12
style: remove light blue bg, bold text, keep dark icon block
2026-07-28 13:35:23 +02:00
24d6da6e89
style: accordion headers - light blue bg with dark blue icon block (rounded)
2026-07-28 13:01:21 +02:00
7462361874
style: accordion headers kräftig wie sidebar buttons (bg-primary-600, white text, 2px padding)
2026-07-28 12:55:10 +02:00
0ce3b8e4d1
style: accordion headers as rounded buttons (bg-primary-50, text-primary-700, rounded-md)
2026-07-28 12:52:02 +02:00
8e475ef248
style: accordion headers as system-colored buttons (bg-primary-600, white text)
2026-07-28 12:47:25 +02:00
65bb9c9866
fix: print and open-standalone icon-only, right-aligned in toolbar
2026-07-28 12:42:49 +02:00
78738f5aa9
feat: folder multi-select mode with checkboxes, shows contacts from multiple folders
2026-07-28 12:22:30 +02:00
77284cbf10
feat: custom views accordion - save/apply/delete named views with filter+sort+group config
2026-07-28 12:14:45 +02:00
5f02330b2f
feat: left panel accordions (Views + Folders), remove middle filter bar
2026-07-28 12:09:02 +02:00
05cc51609b
feat: GroupPanel + toolbar reorder (New, View, Search, Filter, Sort, Group)
2026-07-28 10:34:30 +02:00
11ffffcb44
feat: SmartSuite-style SortPanel with multi-field priority sorting, all contact fields
2026-07-28 10:26:22 +02:00
e95875464b
feat: SmartSuite-style FilterPanel with multi-condition AND/OR, all contact fields, context-sensitive ordering
2026-07-28 09:19:02 +02:00
7962d34fcf
toolbar: unified filter+sort dropdown with sections, fixed positioning, iconOnly support
2026-07-28 02:16:03 +02:00
722335c923
contacts toolbar: consolidate views and filters into dropdowns
2026-07-28 00:45:55 +02:00
719ee251f2
fix: close remaining security gaps, test fixes, frontend integration, event bus
...
Check Cross-Plugin Imports / check (push) Has been cancelled
- RCE: move _check_dangerous_imports() BEFORE exec_module() in plugins.py
- verify_ws_origin: reject empty Origin header when CORS configured
- Test: ai_app fixture with permission_registry init for ai_assistant
- Test: login_client sets CSRF token + Origin as client default headers
- Test: SESSION_COOKIE_SECURE=false override + get_settings.cache_clear()
- Test: asyncio_default_test_loop_scope=session fixes event loop closed
- Test: fix 15 assertions (paths, variables, auth expectations)
- Frontend: integrate SavedFilterBar in ContactsList, Mail, Calendar
- Frontend: integrate TagSelector in ContactsList, Mail, Calendar
- Event Bus: add 4 subscribers in system_notif (conversation/participant/reaction)
- Docs: update all analysis reports and FIX-PLAN-V2 to current state
2026-07-27 12:45:45 +02:00
Agent Zero