Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions 7 Packages Projects Releases 1 Wiki Activity
793 Commits 2 Branches 4 Tags
437c107ee87d36d115c499e57e5c0ef5eefe1dd3
Commit Graph

8 Commits

Author SHA1 Message Date
Agent Zero 100b9f705c phase1: separate DB roles, RLS restoration, login on crm_auth
Check Cross-Plugin Imports / check (push) Has been cancelled
Details 
- config.py: add auth_database_url, worker_database_url, migration_database_url
- db/__init__.py: separate engines for auth/worker/migration + get_auth_db/get_worker_db
- auth.py: all auth endpoints use get_auth_db (crm_auth role)
- auth_service.py: remove login fallback, require active membership, check status
- auth_service.py: switch_tenant checks active membership status
- alembic/env.py: use migration_database_url for Alembic
- docker-compose.yml: add AUTH_DATABASE_URL, WORKER_DATABASE_URL
- .env.example: add all 4 DB URLs with separate roles
- migration 0085: transfer ownership to crm_migration, fix BYPASSRLS,
  enable RLS+FORCE on all tenant tables, drop old policies, create new
  fail-closed policies scoped to crm_api+crm_worker, revoke excessive grants,
  grant minimal crm_auth access, drop crm_runtime, set default privileges
- tests/test_rls_coverage.py: automated RLS coverage check (13 tests)
- tests/test_cross_tenant_security_v2.py: RLS tests with unprivileged role
 2026-07-31 02:05:16 +02:00
Agent Zero 032a7e80a8 phase0: fix cross-plugin import, remove app.tenant_id, create cross-tenant v2 tests 
- Fix report_generator/jobs.py: use DmsContract instead of direct DMS import
- Remove app.tenant_id from set_tenant_context (only app.current_tenant_id)
- Create tests/test_cross_tenant_security_v2.py with real RLS tests using
  unprivileged crm_api role (NOSUPERUSER, NOBYPASSRLS)
- Fix existing tests referencing app.tenant_id
- Git baseline tag v-phase0-baseline at 11d6faa
- Production DB backup at /tmp/crm_backup_20260731_015514.dump
 2026-07-31 01:57:51 +02:00
Agent Zero 2836d6083e fix: add async_session_maker alias in db/__init__.py for plugin imports 2026-07-30 02:48:21 +02:00
Agent Zero 26bf8d3a31 P0+P1 fixes: RCE sandbox, SQL injection, RLS tenant isolation, DB roles, test syntax, attachment, permission registry, membership check
Check Cross-Plugin Imports / check (push) Has been cancelled
Details
2026-07-29 12:28:08 +02:00
Agent Zero 48647a58e0 sprint1: set_user_context + RLS policies on contacts + folder ACL migration 0051+0052 2026-07-29 01:30:25 +02:00
Leopoldadmin 02d5195c1c feat(core): add SoftDeleteMixin to db base, TenantMixin inherits from it 2026-07-04 00:31:44 +00:00
leocrm-bot a2452cc04b chore: fix all ruff lint errors + format — 0 errors, 306 tests pass 2026-06-29 17:43:56 +02:00
leocrm-bot 3ab4925783 T01: core infrastructure + auth + multi-tenant + RLS 
- 10 models: tenants, users, user_tenants, roles, sessions, audit_log, deletion_log, notifications, password_reset_tokens, api_tokens
- Session-based auth (Redis + PostgreSQL audit trail)
- Multi-tenant with ORM-level filtering + PostgreSQL RLS (set_config)
- RBAC with roles/permissions + field-level permissions
- CSRF protection via Origin header validation
- Auth rate limiting (Redis counters with TTL)
- CORS with explicit origins (no wildcard)
- Health endpoint (no auth required)
- Notification service + audit log middleware
- 29 tests, 26 ACs, all passing
- Coverage: 62% (infrastructure modules pending coverage in later tasks)
 2026-06-29 08:02:14 +02:00