2 Commits

Author	SHA1	Message	Date
Agent Zero	8060505baa	refactor(cleanup): remove dead GuestUser/GuestInvitation code and fix test imports ... Deleted: - app/models/guest_user.py - app/models/guest_invitation.py - app/routes/guest_auth.py (was orphaned, not imported) - tests/test_guest_auth.py (tested removed guest auth system) Modified: - app/models/__init__.py: removed stale GuestUser/GuestInvitation comments - app/services/entity_permission_service.py: updated guest permission comment - tests/test_permission_system_live.py: replaced GuestUser with User+UserTenant(role=guest), changed principal_type from "guest" to "user", switched guest test from /api/v1/guest/login to regular /api/v1/auth/login endpoint Frontend: no guest components found, nothing to clean up. Alembic migrations: historical migrations referencing guest_users/guest_invitations tables are left intact (they document DB history).	2026-08-06 11:46:00 +02:00
Agent Zero	67015ef82b	fix(permissions): comprehensive live permission system tests + delete permission fixes ... - Add tests/test_permission_system_live.py: 33 live tests against real PostgreSQL testing RBAC, ABAC, RLS, cross-tenant isolation, guest access, entity sharing, field-level permissions, role invalidation, group permissions, membership suspension - fix(contacts): delete route uses contacts:delete instead of contacts:write The delete_contact and delete_contact_person routes were checking contacts:write permission instead of contacts:delete, allowing users without delete permission to delete contacts. - fix(contacts): DeleteContactCommand passes is_system_admin to service DeleteContactCommand.run() was not passing is_system_admin from the session to contact_service.delete_contact(), causing system admins to be blocked by the row-level admin access check. - fix(contacts): allow deletion of tenant-owned contacts contact_service.delete_contact() required admin-level entity access for ALL contacts, including tenant-owned ones (owner_id=None). Tenant-owned contacts can now be deleted by any user with contacts:delete permission (already verified by the route via require_permission).	2026-08-06 09:49:07 +02:00