a9a9476e9f
fix: contact_folder_service db.refresh after commit + AI stream own DB session in generator
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-30 12:49:53 +02:00
acea622a0f
fix: AI loop prevention (no tools on last iteration), calendar button first, mail filter in toolbar, AI folder rename query invalidation
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-30 11:33:45 +02:00
124846ae3b
fix: workflow route remove is_system_admin param not accepted by service
2026-07-30 11:16:56 +02:00
2cd3f30f82
fix: workflow 422 validation + report 500 DB data fetching + AI stream tenant context
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-30 10:54:28 +02:00
3f2f594847
fix: AI stream route missing set_tenant_context causing RLS INSERT failure
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-30 10:45:34 +02:00
2836d6083e
fix: add async_session_maker alias in db/__init__.py for plugin imports
2026-07-30 02:48:21 +02:00
88bcbfa9a8
fix: add app/core/redis.py shim re-exporting get_redis from auth
2026-07-30 02:01:28 +02:00
ee4b0de144
fix: /health/ready status mapping (up/down → ok/fail)
2026-07-29 23:25:56 +02:00
32db1498ba
fix: /health/ready dict handling
2026-07-29 23:23:52 +02:00
3e9cfbef8a
phase11: /health/live + /health/ready endpoints + monitoring docs + Prometheus metrics docs
2026-07-29 23:22:29 +02:00
a2c3f797f2
phase8: report generation isolated in worker (ARQ background job) + async endpoint + DMS output
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 23:10:50 +02:00
4e2c888505
phase7: command pattern infrastructure (CommandHandler, UnitOfWork, RequestContext) + example CreateContactCommand
2026-07-29 23:00:38 +02:00
54c275580f
phase6: standardized event envelope (aggregate_type, aggregate_id, occurred_at, correlation_id, schema_version) + outbox_deliveries table
2026-07-29 22:50:27 +02:00
f1c025f2ef
fix: workspaces router prefix /api/v1/workspaces
2026-07-29 18:36:40 +02:00
2423053477
phase5: workspace backend — models, service, routes, migration 0072
2026-07-29 18:32:35 +02:00
5e29b50bcc
fix: storage.load() → storage.read() for attachment download
2026-07-29 17:55:33 +02:00
8322adb73f
phase4: entity_attachments table + DMS unified storage + attachment service rewritten + download via DMS
2026-07-29 17:52:55 +02:00
481125e29e
phase3: plugin routes static only (no dynamic registration) + require_active_plugin Redis cache + cache invalidation on activate/deactivate
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 17:40:40 +02:00
0448962d08
fix: visibility.py Defense-in-Depth tenant_id filter + entity_permissions deleted_at migration + cross-tenant tests
2026-07-29 16:12:04 +02:00
f1a2484055
fix: WeasyPrint URL fetcher + attachment improvements + webhook error propagation + WebSocket conversation check + RLS disabled on system tables (bootstrap fix)
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 13:19:21 +02:00
648d8d89d6
fix: outbox consumer_inbox idempotency logic + tenant_plugin_activation per-tenant check
2026-07-29 13:02:33 +02:00
fd1a170f31
fix: plugin duplicate route registration + prestart.sh Python instead of psql + SMTP in docker-compose
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 12:48:25 +02:00
de53bcff25
fix: guest_sessions Redis index for revocation + RLS on all tenant tables (migration 0064)
2026-07-29 12:46:50 +02:00
8dacb739bd
P1 fixes: outbox no_handlers, HTML sanitization, WebSocket plugin check, fail-closed plugin gate, plugin admin-only
2026-07-29 12:33:46 +02:00
8539a6402c
P1.6: secure guest invitation tokens (secrets.token_urlsafe + SHA-256 hash + one-time use + session revocation)
2026-07-29 12:30:00 +02:00
26bf8d3a31
P0+P1 fixes: RCE sandbox, SQL injection, RLS tenant isolation, DB roles, test syntax, attachment, permission registry, membership check
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 12:28:08 +02:00
81ae5b7cb6
fix: redis cache invalidation in permission service + permission check in entity_permissions route + upsert cache invalidation + remove TopBar quick-create
2026-07-29 10:45:45 +02:00
da76b4636e
fix: require_permission decorator → Depends() in entity_permissions.py
2026-07-29 08:05:56 +02:00
24690fb674
sprint20-23: tests + documentation + guest access + infrastructure + migrations 0059
2026-07-29 02:53:37 +02:00
ddf73ee42e
sprint14-19: ABAC UI rule editor + permission templates + bulk share + analytics + delegation + resolution strategies + migrations 0056-0058
2026-07-29 02:47:03 +02:00
e0003b9384
sprint12+13: zentrale rechte settings page + ABAC engine backend (model, migration 0055, service, routes)
2026-07-29 02:42:16 +02:00
2c14368b90
sprint10+11: AI permission filter + API token scopes + merge check + owner transfer service + auto-transfer on deactivation
2026-07-29 02:37:51 +02:00
958e412152
sprint8: plugin entities owner_id migration 0054 + calendar owned_mixin
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 02:33:16 +02:00
48b2dfdb11
sprint9: app visibility — sidebar permission filter + TopBar + ProtectedRoute + route guards
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 02:28:52 +02:00
88c04286af
sprint6+7: permission notifications + audit trail + notification entity filter + mail account permissions + migration 0053
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 02:18:17 +02:00
71ed592aa2
sprint4+5: field-level permissions complete + universal ShareDialog frontend
2026-07-29 02:14:26 +02:00
b06aeeb720
sprint3: dashboard counts per user + import owner_id + export visibility filter
2026-07-29 02:11:29 +02:00
517e1b6d8b
sprint2+3: remaining services visibility filter + search provider permission-aware + dashboard route
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 02:05:14 +02:00
9fc84b7905
sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 01:52:47 +02:00
479ee04834
sprint2: visibility filter + contact service access checks + contacts route integration
2026-07-29 01:38:18 +02:00
ea1c1d5113
sprint1 complete: rate limiting on permission changes + sprint1 fully done
2026-07-29 01:31:09 +02:00
48647a58e0
sprint1: set_user_context + RLS policies on contacts + folder ACL migration 0051+0052
2026-07-29 01:30:25 +02:00
5afa1fa927
sprint1: entity_permissions table + owned_mixin + universal permission service + API + migrations 0049+0050
2026-07-29 01:28:13 +02:00
cc021cda99
feat: folder permissions (ACLs) - share folders with users/groups, inherit to subfolders, permission dialog UI
2026-07-28 23:58:19 +02:00
58b163ba78
feat: saved_views backend API + model + migration + frontend hooks
2026-07-28 14:36:52 +02:00
719ee251f2
fix: close remaining security gaps, test fixes, frontend integration, event bus
...
Check Cross-Plugin Imports / check (push) Has been cancelled
- RCE: move _check_dangerous_imports() BEFORE exec_module() in plugins.py
- verify_ws_origin: reject empty Origin header when CORS configured
- Test: ai_app fixture with permission_registry init for ai_assistant
- Test: login_client sets CSRF token + Origin as client default headers
- Test: SESSION_COOKIE_SECURE=false override + get_settings.cache_clear()
- Test: asyncio_default_test_loop_scope=session fixes event loop closed
- Test: fix 15 assertions (paths, variables, auth expectations)
- Frontend: integrate SavedFilterBar in ContactsList, Mail, Calendar
- Frontend: integrate TagSelector in ContactsList, Mail, Calendar
- Event Bus: add 4 subscribers in system_notif (conversation/participant/reaction)
- Docs: update all analysis reports and FIX-PLAN-V2 to current state
2026-07-27 12:45:45 +02:00
b24ac6883f
fix: remove wrap_plugin_route — it broke ForwardRef resolution for body params
...
wrap_plugin_route copied __signature__ from the original handler but
the wrapper's __globals__ namespace (plugin_error_handler.py) did not
contain the Pydantic models (ConversationCreate, MessageCreate, etc.).
FastAPI could not resolve ForwardRef('ConversationCreate') → 422 on
all POST routes with body parameters.
Removing the wrapper entirely fixes this. Plugin error isolation can
be re-added later using a different approach (middleware or exception handler).
2026-07-27 02:51:20 +02:00
24fb384cf9
fix: keep __annotations__ in wrap_plugin_route — body params need ForwardRef resolution
...
Removing __annotations__ broke body parameter resolution: FastAPI could
not resolve ForwardRef('ConversationCreate') etc. causing 422 on all
POST routes with body params. Now keeping annotations from functools.wraps
and only removing return_annotation.
2026-07-27 02:39:16 +02:00
d607803e86
fix: WebSocket 403 — SameSite=Strict blocked session cookie on WS connections
...
Check Cross-Plugin Imports / check (push) Has been cancelled
Root cause: session_cookie_samesite was 'strict' which prevents the
browser from sending the session cookie on WebSocket upgrade requests.
Changed to 'lax' which allows WebSocket cookies while still blocking
cross-site POST CSRF attacks.
Also removed debug logging from kommunikation routes.
2026-07-27 02:23:25 +02:00
35a9ce1e7b
debug: add WebSocket connection logging to find 403 cause
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-27 02:18:49 +02:00
Agent Zero