leocrm

Leopoldadmin/leocrm

Fork 0

Commit Graph

Author	SHA1	Message	Date
Agent Zero	abbe7a18fc	fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed - P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner - P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var - P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup - P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns - P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs) - P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import - P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default - P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed - P2: 28 frontend TODOs (hardcoded constants, deprecated notification API) - P3: dead code, duplicates, deprecated imports, private attr, __import__ inline - P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n) - ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix) - F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String) - Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt	2026-08-16 01:17:18 +02:00
Agent Zero	0eb6d7621e	fix(security): 16 mittlere Probleme behoben (P18-P33) Check Cross-Plugin Imports / check (push) Has been cancelled Details P18: require_permission zu forgejo_error_reporter und ai_ui_control routes hinzugefügt P19: Cross-Tenant Permission-Cache-Invalidierung bei Rollenänderungen P20: Session/Permission-Cache-Invalidierung bei Gruppen-Änderungen P21: ENTITY_MODELS Registry um fehlende Plugin-Modelle erweitert P22: Entity-Links prüfen verknüpfte Entity-Permissions P23: authStore persist Middleware entfernt (kein localStorage mehr) P24: 5xx Retry nur noch für GET-Requests P25: KI-Kommentar in address.py (bekannte Inkonsistenz) P26: DeletionLog in EntityHistory gemerged (action=delete) P27: KI-Kommentar in entity_policy.py (ABAC nicht aktiv genutzt) P28: db.commit() aus bulk_permission_service entfernt P29: CSV-Export in export_service.py ausgelagert P30: plugins.py Business-Logik in plugin_install_service.py ausgelagert P31: KI-Kommentar in session.py (Dual-System dokumentiert) P32: Migration 0115: crm_platform_admin Role droppen P33: Cross-Plugin Imports über contracts.py behoben (10 Violations → 0)	2026-08-06 13:23:58 +02:00
Agent Zero	cfb4c5ae8b	Phase 5.1-5.4: PWA, Public Plugin Endpoints, Contacts Embedding, Search Coverage Check Cross-Plugin Imports / check (push) Has been cancelled Details 5.1 Public Plugin Endpoints: - PluginRouteDef.is_public field in manifest.py - main.py: public routes mounted without auth dependency - permissions/public_routes.py: token-based share link access (info, verify, download) - permissions/plugin.py: public share route registered with is_public=True 5.2 PWA: - vite.config.ts: VitePWA plugin configured (autoUpdate, workbox, runtime caching) - frontend/public/manifest.json: PWA manifest with icons - index.html: theme-color, manifest link, apple-touch-icon, apple-mobile-web-app meta - Build generates sw.js + workbox (90 precache entries) 5.3 Contacts Embedding: - contact.py: embedding column (Vector(768)) added to Contact model - Migration 0002_embeddings.sql already exists (adds embedding + HNSW index) - ContactSearchProvider already queries embedding column 5.4 Search Coverage: - 5 new search providers: task, contactperson, tag, conversation, user - All providers implement FTS search with tenant_id + deleted_at filters - TagSearchProvider also supports vector search (384-dim embedding) - provider_registry.py: all 5 new providers auto-registered - Total: 10 search providers (was 5)	2026-08-04 14:49:35 +02:00

Author

SHA1

Message

Date

Agent Zero

abbe7a18fc

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt

2026-08-16 01:17:18 +02:00

Agent Zero

0eb6d7621e

fix(security): 16 mittlere Probleme behoben (P18-P33)

Check Cross-Plugin Imports / check (push) Has been cancelled

Details

P18: require_permission zu forgejo_error_reporter und ai_ui_control routes hinzugefügt
P19: Cross-Tenant Permission-Cache-Invalidierung bei Rollenänderungen
P20: Session/Permission-Cache-Invalidierung bei Gruppen-Änderungen
P21: ENTITY_MODELS Registry um fehlende Plugin-Modelle erweitert
P22: Entity-Links prüfen verknüpfte Entity-Permissions
P23: authStore persist Middleware entfernt (kein localStorage mehr)
P24: 5xx Retry nur noch für GET-Requests
P25: KI-Kommentar in address.py (bekannte Inkonsistenz)
P26: DeletionLog in EntityHistory gemerged (action=delete)
P27: KI-Kommentar in entity_policy.py (ABAC nicht aktiv genutzt)
P28: db.commit() aus bulk_permission_service entfernt
P29: CSV-Export in export_service.py ausgelagert
P30: plugins.py Business-Logik in plugin_install_service.py ausgelagert
P31: KI-Kommentar in session.py (Dual-System dokumentiert)
P32: Migration 0115: crm_platform_admin Role droppen
P33: Cross-Plugin Imports über contracts.py behoben (10 Violations → 0)

2026-08-06 13:23:58 +02:00

Agent Zero

cfb4c5ae8b

Phase 5.1-5.4: PWA, Public Plugin Endpoints, Contacts Embedding, Search Coverage

Check Cross-Plugin Imports / check (push) Has been cancelled

Details

5.1 Public Plugin Endpoints:
- PluginRouteDef.is_public field in manifest.py
- main.py: public routes mounted without auth dependency
- permissions/public_routes.py: token-based share link access (info, verify, download)
- permissions/plugin.py: public share route registered with is_public=True

5.2 PWA:
- vite.config.ts: VitePWA plugin configured (autoUpdate, workbox, runtime caching)
- frontend/public/manifest.json: PWA manifest with icons
- index.html: theme-color, manifest link, apple-touch-icon, apple-mobile-web-app meta
- Build generates sw.js + workbox (90 precache entries)

5.3 Contacts Embedding:
- contact.py: embedding column (Vector(768)) added to Contact model
- Migration 0002_embeddings.sql already exists (adds embedding + HNSW index)
- ContactSearchProvider already queries embedding column

5.4 Search Coverage:
- 5 new search providers: task, contactperson, tag, conversation, user
- All providers implement FTS search with tenant_id + deleted_at filters
- TagSearchProvider also supports vector search (384-dim embedding)
- provider_registry.py: all 5 new providers auto-registered
- Total: 10 search providers (was 5)

2026-08-04 14:49:35 +02:00

3 Commits