7968630840
fix: UploadFile ForwardRef + WebSocket 403 — root cause fixed
...
1. plugin_error_handler.py: Remove _UploadFile alias, import UploadFile directly
so FastAPI can resolve ForwardRef('UploadFile') in the wrapper's namespace.
Also import WebSocket for ForwardRef resolution.
2. main.py: Skip WebSocket routes in wrap_plugin_route — WebSocket endpoints
must not be wrapped (different protocol, no JSONResponse on error)
2026-07-27 01:17:59 +02:00
09cd1a5fe2
fix: UploadFile ForwardRef error + WebSocket 403 CSRF block
...
1. plugin_error_handler.py: Remove return_annotation from copied signature
to prevent FastAPI ForwardRef('UploadFile') resolution failure on routes
with file upload endpoints (dms, calendar, mail, kommunikation, ai_assistant)
2. middleware.py: Skip CSRF check for WebSocket upgrade requests
WebSocket connections use GET with upgrade header — should not be
blocked by CSRF middleware
2026-07-27 01:08:51 +02:00
1c01bbccb7
fix: 422 errors on all plugin routes — wrapper(*args, **kwargs) was interpreted as query params by FastAPI
...
The wrap_plugin_route wrapper had *args, **kwargs as parameters.
FastAPI interpreted these as required query parameters 'args' and 'kwargs',
causing 422 Unprocessable Entity on EVERY plugin route (mail, calendar, dms, reports, etc.).
Fix: Use functools.wraps(handler) to copy the original signature,
then remove __annotations__ (to avoid ForwardRef('UploadFile') issues),
and manually set __signature__ from the original handler.
2026-07-27 01:02:10 +02:00
ece3cdf75a
feat: report ALL errors to Forgejo — backend 4xx/5xx, unhandled exceptions, worker job failures
...
- main.py: RequestLoggingMiddleware reports 4xx/5xx responses and unhandled exceptions to Forgejo
- worker.py: Plugin activation failures and outbox job failures reported to Forgejo
- 401/403 are NOT reported (expected auth/permission behavior)
- All other errors (422, 404, 500, network, worker) ARE reported
2026-07-27 00:36:37 +02:00
1ba702f6fe
fix: report API errors (422, 404, 5xx, network) and React errors to Forgejo error reporter
...
- client.ts: logError() import added, API error interceptor now reports to /api/v1/errors
- ErrorBoundary.tsx: logError() import added, React rendering errors now reported
- 401 (auth) and 403 (permission) errors are NOT reported (expected behavior)
- 422 (validation), 404 (not found), 5xx (server), 0 (network) ARE reported
2026-07-26 23:45:59 +02:00
99643d25ab
fix: worker healthcheck — Redis ping instead of HTTP check for worker container
2026-07-26 23:31:07 +02:00
98eb1d0d89
feat: Plugin-System Umbau — 6 Phasen komplett abgeschlossen
...
Check Cross-Plugin Imports / check (push) Has been cancelled
Phase 1: Contracts konsequent nutzen
- 12 neue contracts.py erstellt (alle 19 Plugins haben jetzt contracts)
- 4 bestehende contracts.py an zentrale ContractRegistry angepasst
- Alle 19 Plugins haben on_deactivate mit Contract-Unregister
- 0 echte problematische INTER-Plugin Imports
Phase 2: Hooks/Filters-System
- app/core/hooks.py (HookRegistry mit actions + filters)
- 15 Hook-Punkte in Core-Services (contact, auth, mail, calendar, user, dms)
- BasePlugin.on_deactivate meldet alle Hooks ab
Phase 3: Plugin-Isolation
- scripts/check_cross_plugin_imports.py (Linting-Regel)
- .github/workflows/check-cross-plugin-imports.yml (CI/CD)
- .pre-commit-cross-plugin.yaml (Pre-commit Hook)
- 155 Dateien geprueft, 0 Verstoesse
Phase 4: Plugin-Versioning
- app/plugins/semver.py (SemVer mit Parse, Compare, Pre-release)
- migration_runner.py erweitert: run_migration_down, rollback_to_version
- manifest.py: min_app_version Feld
- registry.py: App-Version-Compatibility-Check bei Installation
- GET /api/v1/plugins/updates Endpoint
Phase 5: Marketplace-Vorbereitung
- app/plugins/signature.py (Ed25519 Signatur-Validierung)
- app/plugins/quarantine.py (Plugin-Quarantine mit Validierung)
- app/models/plugin_allowlist.py + Migration 0046
- manifest.py: author, license, homepage, icon, screenshots, changelog, marketplace_tags, price
- registry.py: discover_external(), discover_all()
- POST /api/v1/plugins/install-marketplace (deaktiviert)
Phase 6: Manifest-Anpassung
- manifest.py: 12 neue Felder + SemVer/Hook-Name Validierung
- MANIFEST_SCHEMA_DOC aktualisiert
- Alle 19 Plugin-Manifeste aktualisiert
- Frontend PluginUiManifest Typ erweitert
Zusaetzliche Bug-Fixes:
- test_sample-Modul erstellt
- conftest.py Deadlock-Prevention
- SESSION_COOKIE_SECURE=true
- dump.rdb aus Git entfernt + .gitignore
- backup.py datetime.utcnow -> func.now()
- system_settings.py JSONB-Import nach oben
- tax.py Mapped[float] -> Mapped[Decimal]
- notification.py type_key-Laengen vereinheitlicht
Tests: 91 neue Tests, alle bestanden
2026-07-26 23:15:34 +02:00
744d595cae
Fix: deploy.py DB verification accepts alembic version >= 0045
2026-07-26 22:14:47 +02:00
d7eb610d76
Fix: require_active_plugin without get_current_user dependency — auth handled by individual routes
2026-07-26 21:46:02 +02:00
c11fdf58dc
Fix: require_active_plugin needs Request param for get_current_user injection
2026-07-26 21:43:44 +02:00
a8b0043756
Fix: Migration 0044 down_revision must be 0043_backups not 0043
2026-07-26 21:41:23 +02:00
b6e3afd28b
Phase 4 + M5: Low-priority fixes and frontend component integration
...
M5: TagBadge integrated into ContactDetail (replaces plain Badge)
M5: EntityHistoryPanel integrated into ContactDetail (timeline section)
L1: Replace document.write() with Blob URL in print.ts (XSS-safe)
L2: AI UI Control feedback storage capped at 100 entries (FIFO eviction)
L3: Backup & Restore documentation added to DEPLOY.md
Verified: Backend import OK, TypeScript 0 errors
2026-07-26 21:29:37 +02:00
825d638130
Phase 3: Fix medium-priority issues (M1-M4, M6)
...
M1: Password complexity validation (min 8 chars, uppercase, lowercase, digit)
M2: Remove is_system_admin from login response (prevent role leaking)
M3: Permission cache invalidates on DB error instead of using stale data
M4: .env.docker.example already fixed in B9 (SECRET_KEY, FRONTEND_URL, SMTP)
M6: Frontend test setup auto-wraps with QueryClientProvider (fixes ~29 test failures)
Remaining: M5 (frontend component integration — WelcomeDialog, SavedFilterBar, etc.)
2026-07-26 20:51:40 +02:00
604a2b7648
Phase 2: Fix high-priority security and stability issues (H1-H7)
...
H1: Sanitize error endpoint context (strip tokens/passwords, limit depth/size)
H2: Rate limiter IP spoofing fix (trusted proxy CIDR check for X-Forwarded-For)
H3: CSRF middleware uses Redis singleton instead of per-request connection
H4: WebSocket origin verification added to both kommunikation and ai_ui_control
H5: Storage path traversal protection, get_url() returns relative URL not filesystem path
H6: Security headers middleware (HSTS, X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy)
H7: Forward-repair migration 0045 for databases that ran original 0021/0027
Also: add trusted_proxy_cidrs to config, add verify_ws_origin to auth
2026-07-26 20:49:15 +02:00
5ec1fc9b05
Phase 1: Fix all critical release blockers (B1-B10)
...
B1: Remove duplicate get_redis() — singleton no longer overwritten
B2: Plugin routes now enforce activation status via require_active_plugin()
B3: Fix UploadFile ForwardRef error — remove functools.wraps from wrap_plugin_route
B4: DMS upload uses true streaming via save_stream() instead of RAM accumulation
B5: Worker on_startup registers plugin event handlers + webhook dispatcher
B6: Implement send_password_reset_email job, remove raw token logging
B7: Webhook SSRF protection (IP validation, no redirects), secret removed from response
B8: RLS repair migration 0044 + separate crm_runtime DB user (NOSUPERUSER, NOBYPASSRLS)
B9: Fix .env.docker.example AUTH_SECRET → SECRET_KEY
B10: Remove Redis default password, remove exposed DB/Redis ports
Also: add frontend_url to config, add SMTP settings to .env.docker.example,
update prestart.sh to use MIGRATION_DATABASE_URL for alembic.
2026-07-26 20:45:42 +02:00
7a14973c68
chore: verify all FIX-PLAN items, remove completed, update status
...
- Verified all 22 FIX-PLAN items against codebase
- 20/22 items confirmed done (P0-1..P0-6, P1-1..P1-11, P2-1, P2-3, P2-4)
- Removed JWT vars from COOLIFY_SETUP.md (P1-10 final fix)
- Remaining: P0-7 (operational), P2-2 (228 cross-imports)
- Updated .a0/current_status.md and .a0/next_steps.md
2026-07-26 16:26:10 +02:00
a897bca390
fix: use label IDs instead of strings for Forgejo issue creation
2026-07-26 15:14:24 +02:00
14967fc70b
fix: remove unused Request param from forgejo error reporter status endpoint
2026-07-26 13:02:11 +02:00
227ab7546b
fix: add routes to forgejo_error_reporter plugin manifest
2026-07-26 12:57:19 +02:00
c3e41906bf
feat: add forgejo_error_reporter plugin for automatic error reporting to Forgejo issues
2026-07-26 12:49:39 +02:00
b9d05e2198
fix: exempt /api/v1/errors from CSRF for frontend error logging
2026-07-26 12:24:31 +02:00
808da564f3
fix: improve error handling and stability - no logout on transient errors, add ErrorBoundary, global error logging
2026-07-26 12:18:52 +02:00
e12b85c2ce
fix: correct Debian Trixie package name libgdk-pixbuf-2.0-0 in Dockerfile
2026-07-26 09:51:03 +02:00
32a991a7ad
fix: add weasyprint to requirements.txt and Dockerfile for PDF generation
2026-07-26 09:45:13 +02:00
4dbbc422ce
fix: repair print/PDF in Reports — fix document.write/appendChild mix, add printPdfBlob for print format
2026-07-26 09:40:43 +02:00
0571cc8193
Fix: Add updated_at and deleted_at columns to backups migration (TenantMixin)
2026-07-26 03:22:40 +02:00
79ece0fe2e
Phase 4: Webhooks, Backup/Restore UI, Onboarding/Tutorial
...
- Webhooks Backend: model, schema, service (HMAC-SHA256, httpx), routes, event bus dispatcher, migration 0042
- Webhooks Frontend: SettingsWebhooksPage (CRUD, test button, event multi-select), API client
- Backup/Restore Backend: model, schema, service (pg_dump/pg_restore), routes (admin-only), migration 0043
- Backup/Restore Frontend: SettingsBackupPage (create, list, restore dialog with RESTORE confirmation, auto-refresh)
- Onboarding: OnboardingTour (8 steps, custom CSS overlay), WelcomeDialog, onboardingStore (zustand + localStorage)
- Onboarding integrated into AppShell
- Routes: /settings/webhooks, /settings/backup registered
- Settings nav: Webhooks, Backup & Restore entries added
- Migration conflict fixed: 0042_webhooks → 0043_backups chain
2026-07-26 03:17:40 +02:00
10dcc8ae90
Phase 3: Saved Filters UI, Entity History UI, Activity Timeline, API Docs Link
...
- Saved Filters: SavedFilterBar (dropdown, apply, delete), SaveFilterDialog (name + save)
- Entity History: EntityHistoryPanel (timeline, restore, undo), HistoryDiff (field changes visual)
- Activity Timeline: ActivityTimelinePage (grouped by day, pagination), ActivityFilter (user/entity/action/date)
- API Docs Link: TopBar user menu entry, SettingsSystem Entwickler section (Swagger, ReDoc, OpenAPI)
- Routes: /activity registered
- Menu items: Aktivitäten added to automation plugin manifest
2026-07-26 03:08:26 +02:00
a7e3890634
Phase 2: Tags UI, Custom Fields UI, Notifications Bell
...
- Tags UI: TagsPage (CRUD, color picker), TagBadge, TagSelector (multi-select, inline creation)
- Custom Fields Backend: model, schema, service, routes, migration 0041
- Custom Fields Frontend: CustomFieldsPage (definitions CRUD), CustomFieldRenderer (dynamic field rendering)
- Custom Fields: _collect_custom_field_definitions() extended to merge DB definitions with plugin definitions
- Notifications Bell: NotificationBell (30s polling, unread badge), NotificationDropdown, NotificationItem
- NotificationBell integrated into TopBar
- Routes: /tags, /settings/custom-fields registered
- Settings nav: Custom Fields entry added
- Menu items: Tags added to automation plugin manifest
2026-07-26 03:02:25 +02:00
444c7fdb88
Fix: Remove function field from export/import — not on Contact model
2026-07-26 02:45:04 +02:00
d468456fe1
Fix: Contact model has phone_2 not mobilephone — fix export+import service
2026-07-26 02:42:07 +02:00
a3a5a10514
Phase 1: Workflows UI, Dedup/Merge UI, Import/Export UI, Print/PDF
...
- Workflows UI: full page with definitions/instances tabs, step editor, instance detail with approve/reject
- Dedup/Merge UI: duplicate detection, side-by-side comparison, field-level merge dialog, merge history
- Import/Export UI: import wizard (dry-run preview), export panel (CSV/XLSX), backend export route added
- Print/PDF: PrintButton component, print.css, integrated in Contacts/Calendar/Reports/ContactDetail
- Backend: GET /api/v1/export endpoint, export_companies_csv() service function
- Routes: /workflows, /contacts/dedup, /import-export registered
- Menu items: Workflows, Import/Export, Duplikate added to automation plugin manifest
- IMPLEMENTATION_PLAN.md: audit-corrected plan for all 14 remaining features
2026-07-26 02:35:44 +02:00
6d484ed747
Fix: handle paginated responses (items wrapper) for dms/automation/agents/ai hooks
2026-07-26 01:35:03 +02:00
15a6c9b6c6
Fix: useReportPresets handle paginated response (items wrapper)
2026-07-26 01:33:04 +02:00
90a6a1b929
Fix: useContactFolders handle paginated response (items wrapper)
2026-07-26 01:23:47 +02:00
b067369651
Fix: deploy.py status check — accept finished as success
2026-07-26 00:59:10 +02:00
30b94fc738
Fix: use direct plugin module imports instead of BUILTIN_PLUGINS
2026-07-26 00:52:27 +02:00
054ecb1c91
Fix: register plugin routes in create_app() not lifespan(); add status column to contacts migration 0039; add updated_at to user_tenants migration 0037
2026-07-26 00:42:31 +02:00
07da2216b6
Fix: Vite circular dependency — move zustand/immer to react-vendor chunk
2026-07-26 00:25:37 +02:00
e8401c280f
Add DEPLOY.md: deployment guide for Coolify and Docker Compose
2026-07-25 23:53:25 +02:00
12220cc640
Deploy: portable volume config via Coolify DB, works on any instance
2026-07-25 23:50:06 +02:00
745b634e7c
Deploy automation: 8-step pipeline with volume mounting, multi-container docker-compose
2026-07-25 22:48:38 +02:00
20e6545aa1
Add automated deploy script with RLS, worker, health checks
2026-07-25 22:42:05 +02:00
388fbdd109
Fix: ARQ cron second schedule must be set of ints, not string
2026-07-25 22:07:56 +02:00
3828e1b029
Fix: drop RLS policy on users before dropping tenant_id column in migration 0037
2026-07-25 21:29:17 +02:00
f6a099390e
Fix: remove updated_at from user_tenants INSERT in migration 0037
2026-07-25 21:24:30 +02:00
f8f0d3e52a
Fix: use pg_index.indisunique instead of pg_indexes.unique in migration 0037
2026-07-25 21:19:47 +02:00
2e9fafc289
Fix: correct SQL quoting for unique keyword in migration 0037
2026-07-25 21:15:20 +02:00
36fc5b868e
Fix: SQL syntax error in migration 0037 (unique keyword quoting)
2026-07-25 21:11:11 +02:00
727d86614e
Security fixes: P0-P2 complete (22 fixes)
...
P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal
8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed
2026-07-25 21:03:46 +02:00
Agent Zero