34c9c85aed
fix(i-g): 9 starlette-CVEs behoben — fastapi 0.141.1 + starlette 1.3.1
...
pip-audit fand 9 known vulnerabilities in starlette 0.46.2 (PYSEC-2026-161/248/249/1941/1942/2280/2281). Dilemma: fastapi 0.115.x pinnt starlette<0.47.0, Fixes brauchen >=0.47.2 bis 1.3.1 -> Fix erfordert FastAPI-Bump.
Loesung: fastapi 0.141.1 (verlangt nur starlette>=0.46.0 ohne Obergrenze) + starlette direkt auf 1.3.1 gepinnt in requirements.txt (>=1.3.1,<1.4), damit der Resolver nicht auf vulnerable Versionen fallen kann.
Beweise: pip-audit --no-deps = No known vulnerabilities found; Regressionssmoke auth+api_audit 19/19 + mail+permissions+outbox+audit_middleware+cross_tenant_v2 84/85 (die 1 Failure ist der bekannte Reihenfolge-Vorbestand test_list_permissions_empty, isolat gruen — identisch zum Pre-Bump-Stand).
2026-08-25 23:07:05 +02:00
7fbbe420bd
fix: comprehensive system audit fixes (55+ issues)
...
Check Cross-Plugin Imports / check (push) Has been cancelled
CRITICAL:
- Fix SQL injection in prestart.sh (parameterized query)
- Fix secret key validation (always validate, not just production)
- Fix workspace model partial index bug (func.text -> text)
- Fix HealthResponse schema (add checks field)
- Fix Tenant import in permissions.py (NameError on every auth request)
- Fix README tech stack (React instead of Alpine.js)
- Delete broken test_cross_tenant_security_v2.py
- Add fail-closed RLS migration 0084 (48 tenant tables)
HIGH:
- Add GeneralRateLimitMiddleware for all API routes
- Add file type blocklist for DMS and attachment uploads
- Fix guest auth: Pydantic schema, tenant_slug required, CSRF bypass
- Fix CSRF bypass path matching (in -> endswith)
- Add worker healthcheck in docker-compose.yml
- Add ARQ max_tries=3 for job retries
- Fix 28 bare pass in mail services (-> logger.debug)
- Fix print() -> logger in main.py and ai_assistant
- Fix duplicate email handling (catch IntegrityError -> 409)
- Add session revocation (invalidate_all_user_sessions)
- Add resource limits to all containers
- Fix CORS default (localhost -> production domain)
- Fix SameSite=Lax -> Strict
- Fix Redis password visibility in healthcheck
- Fix npm vulnerabilities (19 -> 9)
- Fix Sidebar OOM (wildcard lucide import -> curated ICON_MAP)
MEDIUM:
- Localize ErrorBoundary to German
- Wire Mail.tsx save/delete filter to API
- Document system_notif plugin (no routes needed)
- Fix datetime.utcnow() -> datetime.now(UTC)
- Pin litellm version (>=1.0,<2.0)
- Move CSRF token from sessionStorage to in-memory
- Fix restore_backup error handling and transaction
- Fix Dms.tsx useEffect cleanup
- Add skip-to-content link for accessibility
- Add selectinload imports to 3 services
- Add .env.example missing variables
- Fix AppShell/TopBar/Sidebar test mocks
NEW TESTS:
- test_guest_auth.py (6 tests)
- test_user_service.py (8 tests)
- test_backup_service.py (5 tests)
NEW SCHEMAS:
- saved_filter, saved_view, user_preference, workspace, entity_policy
Tests: 22/22 PASSED
2026-07-31 00:58:05 +02:00
32a991a7ad
fix: add weasyprint to requirements.txt and Dockerfile for PDF generation
2026-07-26 09:45:13 +02:00
02a757b673
fix(deps): add missing croniter package for automation plugin
2026-07-24 01:53:32 +02:00
ec81940178
Phase 0 Complete: Tasks 0.7-0.20
...
- 0.7: UI-Design-Richtlinien (docs/ui-design-guidelines.md, 535 lines)
- 0.8: Theme-Customization Backend (4 theme fields, migration 0023)
- 0.9: Theme-Customization Frontend (SettingsTheme.tsx, themeStore.ts, live preview)
- 0.10: RBAC-Audit (4 plugins secured, 53 routes with require_permission)
- 0.11: LiteLLM-Cleanup (llm_client.py migrated from httpx to litellm)
- 0.12: KI-Agent-Framework docs (plugin-development-guide.md, agent_capabilities field)
- 0.13: Heartbeat configurable (ProactiveSettings, migration 0024, frontend UI)
- 0.14: Unified Search Field-Level RBAC (resolve_permissions + filter_fields_by_permission)
- 0.15: Undo/History-System (EntityHistory model, service, routes, migration 0025, HistoryViewer)
- 0.16: Storage Backend (LocalStorage + S3Storage, DMS/attachments/mail updated)
- 0.17: Import/Export unified Contact fields (firstname, surname, email_1, phone_1)
- 0.18: .gitignore & Config-Cleanup (webui→frontend, python-jose removed, .env untracked)
- 0.19: Mail-Salt Security-Fix (per-account random salt, migration 0026)
- 0.20: AGPL replaced (PyMuPDF→pypdf, OnlyOffice→Collabora, LICENSE + THIRD_PARTY_LICENSES.md)
2026-07-23 08:42:26 +02:00
8cebb4f4e9
feat: unified_search + ai_proactive plugins with Ollama Cloud DeepSeek V4
...
- unified_search: Hybride Suche (PostgreSQL FTS + pgvector + RRF Fusion)
- 5 Search Providers (Contact, Company, Mail, File, Event)
- KI Query Understanding (Fuzzy, Facetten via LiteLLM)
- DMS Text-Extraction (PDF, DOCX, XLSX, PPTX)
- Embedding Pipeline (ollama/nomic-embed-text, 768 Dim)
- Background Jobs für Indexierung
- Plugin-basierte Provider Registry
- ai_proactive: Proaktiver KI-Agent
- Context-Tracking (Frontend → Backend → Event Bus)
- Proactive Engine mit LLM Suggestion-Generierung
- SSE Real-time Push an Frontend
- 6 AI Tools für Tool Registry
- Rate-Limiting + User Settings
- Deep Analysis Background Jobs
- Frontend Integration:
- useAIContext Hook, SuggestionSidebar, SuggestionBadge
- ProactiveAISettings Page, Search API Client
- Globale Suche auf neue API umgestellt
- Tests: test_unified_search.py + test_ai_proactive.py (alle bestanden)
- Config: Ollama Cloud DeepSeek V4 als Default, konfigurierbar
- Dependencies: PyMuPDF, python-docx, python-pptx, pgvector
- Bugfixes: notification type_key length, migration IF NOT EXISTS
2026-07-18 11:21:51 +02:00
26feadf179
AI Assistant plugin: backend with LiteLLM, agents, tools, streaming chat
2026-07-17 00:45:24 +02:00
1d3fccc1d3
fix: remove duplicate dependency entries from rebase conflict
2026-07-02 09:26:18 +02:00
50f4fa7152
fix: add missing production dependencies (httpx, email-validator, cryptography, python-jose, aioimaplib, aiosmtplib, pgpy, nh3)
...
These dependencies were missing from requirements.txt but are required
for production deployment. Discovered during Coolify deployment.
2026-07-02 09:25:10 +02:00
Leopoldadmin
f61cfc82b1
fix: add missing production dependencies (email-validator, cryptography, python-jose, aioimaplib, aiosmtplib, pgpy, nh3)
2026-07-02 06:59:30 +00:00
Leopoldadmin
811735f1f0
fix: add httpx to requirements.txt (missing dependency for llm_client.py)
2026-07-02 06:54:38 +00:00
69e91fd5d0
T10: Monitoring, Performance, Documentation & Environment Config — 38 tests, ruff clean, docs OK
...
- Extended health endpoint: DB+Redis+Storage+Worker checks with degraded status
- Prometheus metrics endpoint: admin-only, text/plain format
- Metrics: http_requests_total, db_pool_connections, arq_jobs_total
- Structured JSON logging (structlog): timestamp, level, method, path, status, duration_ms, tenant_id
- Performance: page_size max 100 enforced (422), streaming CSV export (StreamingResponse)
- Scripts: seed_perf_data.py, check_indexes.py
- Docs: admin-guide.md (Deploy, Backup, Restore, Env-Vars, Troubleshooting), api-overview.md
- README updated: prod setup, API section, env profiles, admin-guide link
- .env.example: added SECRET_KEY, STORAGE_PATH, SMTP_* vars
- 38 new tests, full regression 564/564 pass (0 failures)
- Ruff: all checks passed
2026-07-01 23:15:35 +02:00
dd16940bb2
T02: companies + contacts + import/export + N:M + soft-delete + GDPR + FTS
...
- Company CRUD with soft-delete, FTS search (tsvector + GIN), filter, pagination
- Contact CRUD with N:M company linking via company_contacts
- CSV/XLSX export, CSV import with dry-run preview
- GDPR hard-delete with deletion_log
- Audit log on all mutations
- 27 new tests (24 ACs), 56 total tests pass
- Migration 0002: contacts, company_contacts, FTS search_tsv
- Fixed T01 tests: POST→201, PATCH→PUT compatibility
2026-06-29 08:02:15 +02:00
3ab4925783
T01: core infrastructure + auth + multi-tenant + RLS
...
- 10 models: tenants, users, user_tenants, roles, sessions, audit_log, deletion_log, notifications, password_reset_tokens, api_tokens
- Session-based auth (Redis + PostgreSQL audit trail)
- Multi-tenant with ORM-level filtering + PostgreSQL RLS (set_config)
- RBAC with roles/permissions + field-level permissions
- CSRF protection via Origin header validation
- Auth rate limiting (Redis counters with TTL)
- CORS with explicit origins (no wildcard)
- Health endpoint (no auth required)
- Notification service + audit log middleware
- 29 tests, 26 ACs, all passing
- Coverage: 62% (infrastructure modules pending coverage in later tasks)
2026-06-29 08:02:14 +02:00
Leopoldadmin
c30c6a50fb
Upload requirements.txt
2026-06-29 08:01:44 +02:00
Leopoldadmin
850a953c13
Fix requirements.txt with correct dependencies
2026-06-15 22:04:44 +00:00
Leopoldadmin
2c1b5eab35
Add requirements.txt
2026-06-15 22:02:50 +00:00
Agent Zero
Leopoldadmin