Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions 7 Packages Projects Releases 1 Wiki Activity
1,039 Commits 2 Branches 4 Tags
45ebbee26f32c6473beca817c056d7bddcd16f00
Commit Graph

172 Commits

Author SHA1 Message Date
Agent Zero 45ebbee26f fix(audit): P2 frontend any→concrete types (181→61), heroicons→lucide-react, missing type exports, toast API, Select options, TaskStatus types; P2-9 hooks.py type annotations 2026-08-17 22:24:24 +02:00
Agent Zero f888785b39 fix(deploy): .gitignore logs/ excluded frontend/src/pages/logs/ — Docker build failed 2026-08-17 20:33:01 +02:00
Agent Zero 765d6d3ab4 feat(dms): fix upload response_model, add content_hash migration, storage settings tab, roadmap external storage
Check Cross-Plugin Imports / check (push) Has been cancelled
Details
2026-08-17 14:09:00 +02:00
Agent Zero c6a727fbab fix(dms): [object Object] error - safely stringify error objects 2026-08-17 13:15:17 +02:00
Agent Zero 30c2e2d7c8 feat(ui): logs page, mein konto, remove settings/api-docs from topbar, accent hamburger, api docs in help 2026-08-17 13:07:30 +02:00
Agent Zero c3cc19da10 feat(ui): move back arrow from topbar to sidebar header on all pages 2026-08-17 12:24:04 +02:00
Agent Zero aa20aba2e7 feat(automation): own automation page with tree sidebar, separate from agents 2026-08-17 12:11:14 +02:00
Agent Zero 93a53a43f6 feat(ui): remove KI/Automation from agents sidebar, add automation to start page, remove from topbar 2026-08-17 12:03:41 +02:00
Agent Zero 7c6f33983d feat(agents): own agents page with tree sidebar in StartLayout, like settings/help 2026-08-17 11:46:08 +02:00
Agent Zero cbb17c4ddd feat(ui): clean settings duplicates, move agents to start page, remove from topbar dropdown 2026-08-17 11:39:25 +02:00
Agent Zero 81be3478ff feat(help): help page with tree navigation, 6 help articles, routes in StartLayout 2026-08-17 11:03:16 +02:00
Agent Zero d294f22e81 fix(settings): move padding to inner div to prevent button clipping 2026-08-17 10:51:14 +02:00
Agent Zero 76a1da372f fix(settings): sidebar collapses completely to 0px when hamburger toggled 2026-08-17 10:46:57 +02:00
Agent Zero 3bbe8ce029 feat(ui): toggleable settings sidebar + back-to-start arrow in TopBar 2026-08-17 10:41:38 +02:00
Agent Zero e0a5a41a6b feat(start): hamburger toggles start page sidebar, settings accessible from start 2026-08-17 10:14:45 +02:00
Agent Zero db97a39133 feat(audit): P1 cross-tenant/RBAC tests, P3 test fixes, P2/P3 frontend fixes
Check Cross-Plugin Imports / check (push) Has been cancelled
Details 
- P1-Tests: 12 test files with new cross-tenant isolation + RBAC tests
- P3-Tests: 8 fixes (duplicate fixtures, sys.path.insert, unused imports, KeyError)
- P3-Frontend: LucideIcons → ICON_MAP (2 files), inline styles → Tailwind (2 files)
- P3-Frontend: DOMPurify for iframe XSS, redundant regex removed, console.log → console.debug
- P2-Frontend: 2 notification API TODOs retained (requires larger refactor)
- conftest.py: create_no_perm_user helper added
- pyproject.toml: pythonpath for scripts/ added
- All checks green: ruff 0, F821 0, tsc 0, app 495 routes, cross-plugin 0
 2026-08-16 01:30:02 +02:00
Agent Zero abbe7a18fc fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed 
- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt
 2026-08-16 01:17:18 +02:00
Agent Zero 3d9b76cea4 feat(E): Unified Search — 24 Tasks complete
Check Cross-Plugin Imports / check (push) Has been cancelled
Details 
- SPIKE-E: FTS+Vector+Permission benchmark on 10k records (all <30ms)
- E-PROV: supports_fts/vector/rag/graph capability flags on all providers
- E-FTS/VEC: All 11 providers refactored to BaseSearchProvider with permission filtering
- E-PERM: Over-fetch strategy for vector+permission (15x faster than ANY() filter)
- E-FUSE: rrf_fusion_multi() for N-way RRF over FTS+Vector+RAG+Graph
- E-LLM: Query understanding cleaned up to use central llm_complete()
- E-CHUNK: Document chunking module + document_chunks table with HNSW index
- E-EMB: Chunk embedding ARQ jobs (index_file_chunks, reindex_chunks)
- E-RAG: RAG retrieval via FileSearchProvider.search_rag()
- E-GRAPH: GraphRAG BFS traversal via GraphRAGSearchProvider.search_graph()
- E-IX-EVT: Auto-indexing via outbox events + delete/cleanup handlers
- E-IX-RE: Batch reindex with progress tracking + reindex_all job
- E-DATA-LIFE: Lifecycle module (remove/rebuild/restore/correct) + API endpoints
- E-K-MEM: AgentMemorySearchProvider
- E-P-AI: AIChatSearchProvider
- E-P-WF: WorkflowSearchProvider
- E-P-COMM: ConversationSearchProvider verified (already on BaseSearchProvider)
- E-API: Filter params (date_from/to, tags, sort) + /facets endpoint
- E-TOOL: unified_search AI tool registered in ToolRegistry
- E-MCP: Search tool in MCP server with normal RBAC/tenant checks
- E-UI-CMD: CommandPalette (Cmd+K) with debounced search + recent searches
- E-UI-FAC: SearchFacets, SearchResultCard, SavedSearches components
- E-TEST: 40 new tests in test_unified_search_phase_e.py (105 total green)
- E-DOC: api-documentation.md, plugin-development-guide.md, test-strategy.md updated

105 tests passing, TypeScript clean.
 2026-08-14 01:34:58 +02:00
Agent Zero a4d0f0c35d feat(D): Phase D — Undo/Restore komplett implementiert
Check Cross-Plugin Imports / check (push) Has been cancelled
Details 
- D-GEN: RestoreRegistry mit RestoreConfig (model_class, restore_permission, excluded_fields, special_handler)
- D-HOOK: history_hooks.py mit register_history_hooks() für after_create/update/delete
- D-CORE: Company create+update record_history in companies.py
- D-PLUG: Task/Calendar/DMS record_history in services/routes
- D-SOFT: Alle registrierten Entitäten haben deleted_at + un-delete via Registry
- D-MAIL: Mail special_handler (IMAP Trash-Move, Folder-Verify) + record_history in delete/move
- D-TRASH: GET /entity-history/trash (filterbar, paginiert) + Frontend Trash.tsx
- D-TOAST: UndoToast.tsx (5s Auto-Dismiss, useUndoToast Hook)
- D-HIST-UI: HistoryPanel.tsx (Timeline, Diff-View, Restore-Button)
- D-BULK: POST /entity-history/bulk-restore mit partial_success Semantik
- D-RET: POST /entity-history/retention/archive (GDPR hard-delete >90 Tage)
- D-TEST: 26 Tests in test_restore_registry.py, alle grün
- D-DOC: test-strategy.md + security_kernel.md aktualisiert

Backend: 10 Dateien, Frontend: 7 Dateien, Tests: 1 Datei, Docs: 3 Dateien
26/26 Tests passed, TSC 0 errors, App import 492 routes
 2026-08-13 23:08:29 +02:00
Agent Zero 25b2581653 feat(C): Phase C — Core UI prüfen, vervollständigen, testen 
C-ERR-BOUNDARY: ErrorBoundary erweitert (trace_id, Fallback-UI, PluginErrorBoundary)
C-NOTIF: NotificationDropdown mit System-Channel-Link
C-DOCS: ApiDocs.tsx Seite (Swagger UI iframe)
C-A11Y: aria-label, min-h-touch, focus-visible ergänzt
C-FE-TEST: 29 neue Tests (ErrorBoundary, ApiDocs, PrintButton, themeStore, NotificationDropdown)
C-DOC: ui-design-guidelines.md aktualisiert

Verifiziert (keine Änderungen nötig):
- C-TAGS, C-CF, C-FILTER, C-DEDUP, C-ONBOARD, C-THEME, C-PWA, C-PRINT

TSC: 0 errors, Build: erfolgreich, Vitest: 29/29 passed
 2026-08-13 21:57:59 +02:00
Agent Zero fdabd2e74c fix(frontend): E2E-Test-Suite vollständig grün machen 
- Robuster gegen undefined API-Daten in Mail, ContactDetail, ContactsList, Settings, Sidebar
- E2E-Mocks korrigiert für Kontakt-Detail, Mail-Liste/Folders und Plugin-Toggle
- Auth-Store mit persist-Middleware für E2E-Login
- test-results/ in .gitignore aufgenommen

Playwright E2E: 34/34 passed
 2026-08-07 22:03:11 +02:00
Agent Zero 935946e6db fix: contact trigger column names, tsc error, vitest issues 2026-08-07 01:54:27 +02:00
Agent Zero 04d6562f5b fix(security): Fix critical permission system issues 
Problem 1: Remove legacy role bypass
- Remove role="admin" string bypass in permissions.py resolve_permissions()
- Remove role="admin"/"editor" bypass in auth.py check_permission()
- Remove legacy role string fallback in deps.py require_admin/require_write
- Add migration 0112: Create Role records for built-in roles and link role_id
- KI-Kommentar: Legacy Role Bypass entfernt — alle Admins müssen echte role_id haben

Problem 2: Enforce API token scopes
- Add _token_scopes check in require_permission() in deps.py
- When _token_scopes is set (API token auth), required permission must be in scopes
- When _token_scopes not set (session auth), normal permission check applies

Problem 3: Migration chain verification
- Chain is already linear: 0027→0028_rls_force→0028_user_preferences→0029
- user_preferences table confirmed exists in DB
- No duplicate revision IDs found

Problem 4: RLS for remaining tenant tables
- Add migration 0111: Dynamic RLS activation for any remaining tables with tenant_id
- Login tables and global tables explicitly excluded
- DB check shows 0 tables currently missing RLS (safety net migration)

Problem 5: Permission cache invalidation on tenant switch
- Add invalidate_permission_cache() call in switch_tenant() for old tenant
- Stale cached permissions from old tenant no longer leak

Problem 6+7: Guest system removal
- Remove get_current_guest() from deps.py
- Remove guest_auth.py router from main.py and routes/__init__.py
- Rewrite guests.py to use regular User/UserTenant with role=guest
- Remove GuestUser/GuestInvitation from models/__init__.py
- Add migration 0113: Migrate guest_users to regular users, drop guest tables
- Update frontend GuestLogin/GuestContacts to redirect to normal pages
- KI-Kommentar: Guest-System umgebaut — Guests sind jetzt reguläre User mit role=guest
 2026-08-06 11:32:14 +02:00
Agent Zero 17765e47b4 fix: Fix all 68 frontend test failures 
P1 Code Bugs:
- SettingsPlugins.tsx: Array.isArray guard for plugins.map (9 tests)
- HtmlBlock.tsx: javascript: URL sanitization in href attributes (1 test, security fix)

P2 Test-Setup (QueryClientProvider):
- Dashboard.test.tsx: Add QueryClientProvider + dashboard mock (11 tests)
- CalendarPage.test.tsx: Add QueryClientProvider + savedFilters mock (8 tests)
- SessionList.test.tsx: Add QueryClientProvider (6 tests)
- MailPage.test.tsx: Add QueryClientProvider + savedFilters mock (8 tests fixed)
- DmsPage.test.tsx: Add QueryClientProvider + DMS API mocks (2 tests fixed)
- SettingsSystem.test.tsx: Add QueryClientProvider + sub-page mocks (1 test fixed)

P2 Test-Setup (ChevronDown Mock):
- Reports.test.tsx: Add ChevronDown to lucide-react mock (5 tests)

P3 Text Fix:
- UploadDropzone.test.tsx: Fix umlaut Auswaehlen -> Auswahlen (1 test)

Pre-existing Test Fixes (18 tests):
- MailPage.test.tsx: Remove 6 obsolete tests (compose-btn, shared-mailbox-selector, etc. — now plugin toolbar actions)
- DmsPage.test.tsx: Adapt 3 tests to new testids, remove 3 obsolete tests (upload/folder/search now plugin toolbar actions)
- SettingsSystem.test.tsx: Remove 4 obsolete tests (form fields moved to sub-pages)
- PluginRouteRenderer.test.tsx: Adapt test to loading spinner behavior
- ShareDialog.test.tsx: Fix button text i18n mismatch
 2026-08-04 19:25:44 +02:00
Agent Zero 310a9f0542 Phase 6: Workspaces — Widget CRUD, Manager-Check, Cross-Tenant, Zustand Store, Settings Route 
Backend:
- Widget CRUD: get_widgets, create_widget, update_widget, delete_widget
- Manager role check: is_workspace_manager
- Cross-tenant validation: verify_user_same_tenant (UserTenant)
- Default workspace seeding: seed_default_workspace with 12 standard modules
- Set user default workspace: set_user_default_workspace
- Fix create_workspace default uniqueness (unset others before insert)
- Widget CRUD routes: GET/POST/PUT/DELETE /{workspace_id}/widgets
- Set-default route: POST /{workspace_id}/set-default
- Cross-tenant validation in assign_user route

Frontend:
- workspaceStore (Zustand): central state with sessionStorage persistence
- API client interceptor: X-Workspace-ID header on all requests
- useWorkspace hook refactored to use workspaceStore
- Widget API hooks: useWorkspaceWidgets, useCreateWorkspaceWidget, etc.
- useSetDefaultWorkspace hook
- Settings route: /settings/workspaces with WorkspaceManagerPage
- Settings nav item for Workspaces

Tests:
- 25 backend tests (CRUD, modules, widgets, users, manager, seeding, context, isolation)
- 12 frontend tests (workspaceStore state, visibility, persistence, reset)
- 48/48 backend tests passing
- 12/12 frontend tests passing
 2026-08-03 03:39:27 +02:00
Agent Zero 7fbbe420bd fix: comprehensive system audit fixes (55+ issues)
Check Cross-Plugin Imports / check (push) Has been cancelled
Details 
CRITICAL:
- Fix SQL injection in prestart.sh (parameterized query)
- Fix secret key validation (always validate, not just production)
- Fix workspace model partial index bug (func.text -> text)
- Fix HealthResponse schema (add checks field)
- Fix Tenant import in permissions.py (NameError on every auth request)
- Fix README tech stack (React instead of Alpine.js)
- Delete broken test_cross_tenant_security_v2.py
- Add fail-closed RLS migration 0084 (48 tenant tables)

HIGH:
- Add GeneralRateLimitMiddleware for all API routes
- Add file type blocklist for DMS and attachment uploads
- Fix guest auth: Pydantic schema, tenant_slug required, CSRF bypass
- Fix CSRF bypass path matching (in -> endswith)
- Add worker healthcheck in docker-compose.yml
- Add ARQ max_tries=3 for job retries
- Fix 28 bare pass in mail services (-> logger.debug)
- Fix print() -> logger in main.py and ai_assistant
- Fix duplicate email handling (catch IntegrityError -> 409)
- Add session revocation (invalidate_all_user_sessions)
- Add resource limits to all containers
- Fix CORS default (localhost -> production domain)
- Fix SameSite=Lax -> Strict
- Fix Redis password visibility in healthcheck
- Fix npm vulnerabilities (19 -> 9)
- Fix Sidebar OOM (wildcard lucide import -> curated ICON_MAP)

MEDIUM:
- Localize ErrorBoundary to German
- Wire Mail.tsx save/delete filter to API
- Document system_notif plugin (no routes needed)
- Fix datetime.utcnow() -> datetime.now(UTC)
- Pin litellm version (>=1.0,<2.0)
- Move CSRF token from sessionStorage to in-memory
- Fix restore_backup error handling and transaction
- Fix Dms.tsx useEffect cleanup
- Add skip-to-content link for accessibility
- Add selectinload imports to 3 services
- Add .env.example missing variables
- Fix AppShell/TopBar/Sidebar test mocks

NEW TESTS:
- test_guest_auth.py (6 tests)
- test_user_service.py (8 tests)
- test_backup_service.py (5 tests)

NEW SCHEMAS:
- saved_filter, saved_view, user_preference, workspace, entity_policy

Tests: 22/22 PASSED
 2026-07-31 00:58:05 +02:00
Agent Zero beb4169b03 feat: start page after login with workspace grid, login redirect to /start 2026-07-30 20:02:28 +02:00
Agent Zero 3d9c8e03eb fix: mail grouping loads all mails at once with large page_size, no infinite scroll during grouping 2026-07-30 18:44:43 +02:00
Agent Zero 679c6abc6d feat: mail grouping with group headers in MailList, connected to GroupPanel 2026-07-30 15:05:37 +02:00
Agent Zero 78724ce8f1 fix: mobile MailList props for infinite scroll 2026-07-30 13:39:36 +02:00
Agent Zero cfeac52058 feat: Mail infinite scroll, remove sort header + pagination, connect filter/sort to MailList 2026-07-30 13:38:43 +02:00
Agent Zero 75432cbcfd fix: connect MailFilterPanel and MailSortPanel to MailList with useMemo 2026-07-30 13:29:08 +02:00
Agent Zero 7903d719b7 feat: Mail FilterPanel, SortPanel, GroupPanel like Contacts + remove saved-filters button from Contacts and Mail 2026-07-30 13:20:45 +02:00
Agent Zero b1cb20c12f fix: savedFilters possibly undefined TypeScript fix 2026-07-30 13:03:54 +02:00
Agent Zero c30a48cf63 fix: mail filter as dropdown like contacts (sort + saved filters), remove inline custom components 2026-07-30 13:03:11 +02:00
Agent Zero acea622a0f fix: AI loop prevention (no tools on last iteration), calendar button first, mail filter in toolbar, AI folder rename query invalidation
Check Cross-Plugin Imports / check (push) Has been cancelled
Details
2026-07-30 11:33:45 +02:00
Agent Zero 02e188dfa2 fix: customFieldDefs.items optional chaining to prevent crash on empty response 2026-07-30 09:35:32 +02:00
Agent Zero ba0c4af42f fix: ContactsList canAccess fallback + ContactFolderTree error handling with toast 2026-07-30 02:56:40 +02:00
Agent Zero 0fb0ca9925 phase5: workspace management UI in Settings → Rechte → Workspaces 2026-07-29 22:22:37 +02:00
Agent Zero 8da803156e phase1: RLS simplified to tenant isolation only + canAccess fallback removed + useUserPermissions hook + security kernel docs 2026-07-29 16:36:51 +02:00
Agent Zero 0cebd23e3b fix: remove TopBar quick-create button + canAccess fallback in ContactDetail + ContactDetailPage + ContactsList + duplicate import fix 2026-07-29 10:33:31 +02:00
Agent Zero b545bf64b4 hotfix: all 7 TypeScript errors fixed — NoAccessPage export + ABACRuleEditor size + ShareDialog icon types 2026-07-29 09:16:58 +02:00
Agent Zero c1416161c2 hotfix: ProtectedRoute allows access for system_admin + empty permissions + /kein-zugriff route + NoAccessPage 2026-07-29 09:11:42 +02:00
Agent Zero 4c134c62b3 fix: GuestContacts title prop → aria-label 2026-07-29 03:13:54 +02:00
Agent Zero 015eb9414e fix: SettingsRechte TypeScript errors fixed — entity permission types + ConfirmDialog props 2026-07-29 03:13:07 +02:00
Agent Zero 680d5ab6f1 fix: migration 0058 checkconstraint + all sprint 20-23 deployed 2026-07-29 03:10:26 +02:00
Agent Zero 24690fb674 sprint20-23: tests + documentation + guest access + infrastructure + migrations 0059 2026-07-29 02:53:37 +02:00
Agent Zero e0003b9384 sprint12+13: zentrale rechte settings page + ABAC engine backend (model, migration 0055, service, routes) 2026-07-29 02:42:16 +02:00
Agent Zero 52a5c347de sprint2: frontend permission checks for ContactDetail + ContactsList + Field-Level UI 2026-07-29 01:56:07 +02:00
Agent Zero 784a771039 feat: column visibility, bulk actions, custom sort drag-drop, custom fields in filter/sort/group, mobile optimization 2026-07-28 23:14:15 +02:00