a26405f15e
Phase 4: Circuit Breaker, DB Retry, Redis Graceful Degradation
...
- app/core/resilience.py: CircuitBreaker (CLOSED/OPEN/HALF_OPEN), retry_db,
redis_call_with_fallback, InMemoryRateLimiter, CircuitBreakerMiddleware
- app/core/auth.py: get_session_data now falls back to PostgreSQL sessions
table when Redis is unavailable
- app/core/permissions.py: get_cached_permissions falls back to direct DB
resolution when Redis circuit is open
- app/core/rate_limit.py: check_rate_limit falls back to in-memory limiter
when Redis is down; reset_rate_limit clears both Redis and in-memory
- app/core/middleware.py: CSRF validation uses get_session_data (Redis+DB
fallback); sliding session TTL is best-effort during outage
- app/core/db/__init__.py: get_db() wraps session creation with retry_db
for transient connection errors; records circuit breaker success/failure
- app/deps.py: refresh_session_ttl wrapped in try/except for Redis outage
- app/main.py: CircuitBreakerMiddleware registered (returns 503 when DB
circuit is OPEN, skips health/metrics endpoints)
- app/config.py: Added resilience settings (thresholds, cooldown, retries)
- tests/test_resilience.py: 30 tests covering all patterns
30/30 resilience tests pass. No regressions in plugin lifecycle tests.
2026-08-04 14:34:06 +02:00
67c05f39f1
Fix: require_active_plugin nutzt get_db Session + current_setting (keine neue Session)
2026-08-03 16:26:06 +02:00
1271101acd
Fix: require_active_plugin nutzt Request statt get_current_user Dependency
2026-08-03 16:23:21 +02:00
0260f3410d
Phase 7: Plugin-Gate, Event-Envelope, Pro-Handler Outbox-Verarbeitung
...
7.1 Plugin-Gate korrigiert:
- require_active_plugin nutzt current_user fuer tenant_id statt current_setting()
- Keine neue DB-Session mehr — nutzt bestehende get_db Dependency
- Fail-closed bei Fehlern
7.4 Einheitlicher Event-Envelope:
- Sauberes Envelope mit event_id, event_name, tenant_id, aggregate_type, aggregate_id, occurred_at, correlation_id, schema_version, data
- Keine _-Praefixe mehr im payload
- Handler empfangen envelope statt rohes payload
7.6 Verarbeitung pro Handler:
- Globaler consumer_inbox Check entfernt
- Pro-Handler Idempotency: outbox_deliveries pruefen ob Handler bereits erfolgreich
- Bereits erfolgreiche Handler werden uebersprungen
- consumer_inbox pro Handler geschrieben
7.7 no_handlers: Bereits implementiert (terminaler Status)
7.8 Cron-Jobs: Bereits mit Redis SET NX Locking implementiert
Tests: 23/23 Outbox-Tests bestanden
2026-08-03 15:20:06 +02:00
8ad0a19f25
Phase 5: AI/MCP Bearer-Auth + Delegationstoken + Audit
...
Check Cross-Plugin Imports / check (push) Has been cancelled
5.1 Delegationstoken (app/core/delegation_token.py):
- HMAC-SHA256 signiert mit SECRET_KEY, max 60s Lifetime
- Payload: user_id, tenant_id, agent_id, audience, expires_at, token_id
- Statelose Verifikation, Audience-Check, Expiry-Check
5.2 MCP Bearer-Auth:
- app/core/api_token.py: Token Service (create, verify, revoke, list)
- app/deps.py: get_current_user_bearer + get_current_user_or_bearer
- app/routes/api_tokens.py: Token CRUD Routes (create, list, revoke)
- MCP Server Routes: get_current_user_or_bearer akzeptiert Session + Bearer
5.3 Methodenrechte:
- MCP nutzt bereits mcp:read/mcp:write basierend auf tool_def.required_permission
5.5 Audit:
- MCP Tool-Ausfuehrung wird protokolliert (log_audit mit correlation_id)
Tests: 13/13 bestanden (7 API Token + 6 Delegation Token)
2026-08-03 14:06:55 +02:00
481125e29e
phase3: plugin routes static only (no dynamic registration) + require_active_plugin Redis cache + cache invalidation on activate/deactivate
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 17:40:40 +02:00
648d8d89d6
fix: outbox consumer_inbox idempotency logic + tenant_plugin_activation per-tenant check
2026-07-29 13:02:33 +02:00
8dacb739bd
P1 fixes: outbox no_handlers, HTML sanitization, WebSocket plugin check, fail-closed plugin gate, plugin admin-only
2026-07-29 12:33:46 +02:00
26bf8d3a31
P0+P1 fixes: RCE sandbox, SQL injection, RLS tenant isolation, DB roles, test syntax, attachment, permission registry, membership check
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 12:28:08 +02:00
24690fb674
sprint20-23: tests + documentation + guest access + infrastructure + migrations 0059
2026-07-29 02:53:37 +02:00
48647a58e0
sprint1: set_user_context + RLS policies on contacts + folder ACL migration 0051+0052
2026-07-29 01:30:25 +02:00
b281c541b2
fix: remove Request param from _check() — WebSocket can't resolve Request dependency
...
The Request parameter caused TypeError on WebSocket routes because
FastAPI cannot inject Request into WebSocket scope. Reverted to
parameterless _check(). WebSocket 403 is handled by CSRF middleware
which already skips WebSocket upgrade requests.
2026-07-27 01:45:08 +02:00
0c67eb0754
fix: WebSocket 403 — require_active_plugin skips WebSocket requests
...
Simpler approach: require_active_plugin._check() now accepts Request
parameter and returns early for WebSocket upgrade requests.
No route splitting needed — all routes stay in their original router.
2026-07-27 01:34:50 +02:00
d7eb610d76
Fix: require_active_plugin without get_current_user dependency — auth handled by individual routes
2026-07-26 21:46:02 +02:00
c11fdf58dc
Fix: require_active_plugin needs Request param for get_current_user injection
2026-07-26 21:43:44 +02:00
5ec1fc9b05
Phase 1: Fix all critical release blockers (B1-B10)
...
B1: Remove duplicate get_redis() — singleton no longer overwritten
B2: Plugin routes now enforce activation status via require_active_plugin()
B3: Fix UploadFile ForwardRef error — remove functools.wraps from wrap_plugin_route
B4: DMS upload uses true streaming via save_stream() instead of RAM accumulation
B5: Worker on_startup registers plugin event handlers + webhook dispatcher
B6: Implement send_password_reset_email job, remove raw token logging
B7: Webhook SSRF protection (IP validation, no redirects), secret removed from response
B8: RLS repair migration 0044 + separate crm_runtime DB user (NOSUPERUSER, NOBYPASSRLS)
B9: Fix .env.docker.example AUTH_SECRET → SECRET_KEY
B10: Remove Redis default password, remove exposed DB/Redis ports
Also: add frontend_url to config, add SMTP settings to .env.docker.example,
update prestart.sh to use MIGRATION_DATABASE_URL for alembic.
2026-07-26 20:45:42 +02:00
727d86614e
Security fixes: P0-P2 complete (22 fixes)
...
P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal
8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed
2026-07-25 21:03:46 +02:00
e2cd435861
feat: Generic CRM API tool - AI can control entire system
...
- Create call_crm_api tool: single tool that can call ANY CRM API endpoint
- Inject OpenAPI spec into system prompt so AI knows all available endpoints
- Always include call_crm_api in agent tools (not just via tool_ids)
- Extend get_current_user to support internal header-based auth (X-Internal-Call,
X-Tenant-Id, X-User-Id) for AI tool API access
- No more manual tool-per-endpoint registration needed
2026-07-25 02:31:33 +02:00
879106c4eb
Phase 1C: Frontend unified contact UI
2026-07-23 17:17:32 +02:00
ad41771b10
feat: implement sliding session - extend TTL on each authenticated request
2026-07-18 18:48:21 +02:00
b490a62322
feat: granular RBAC system with user groups, deny-list, permission registry, system-admin, self-mod prevention
2026-07-15 21:59:45 +02:00
a2452cc04b
chore: fix all ruff lint errors + format — 0 errors, 306 tests pass
2026-06-29 17:43:56 +02:00
3ab4925783
T01: core infrastructure + auth + multi-tenant + RLS
...
- 10 models: tenants, users, user_tenants, roles, sessions, audit_log, deletion_log, notifications, password_reset_tokens, api_tokens
- Session-based auth (Redis + PostgreSQL audit trail)
- Multi-tenant with ORM-level filtering + PostgreSQL RLS (set_config)
- RBAC with roles/permissions + field-level permissions
- CSRF protection via Origin header validation
- Auth rate limiting (Redis counters with TTL)
- CORS with explicit origins (no wildcard)
- Health endpoint (no auth required)
- Notification service + audit log middleware
- 29 tests, 26 ACs, all passing
- Coverage: 62% (infrastructure modules pending coverage in later tasks)
2026-06-29 08:02:14 +02:00
Agent Zero