leocrm

Leopoldadmin/leocrm

Fork 0

Commit Graph

Author	SHA1	Message	Date
Agent Zero	19ecc0cd71	fix(tests): adapt permission tests to new RBAC architecture - Add Role records for editor, viewer, guest in seed_full_data - Link UserTenant.role_id to Role records (legacy string roles no longer grant permissions) - Fixes 10 test failures caused by removal of Legacy Role Bypass - All 33 tests now pass	2026-08-06 14:51:49 +02:00
Agent Zero	8060505baa	refactor(cleanup): remove dead GuestUser/GuestInvitation code and fix test imports Deleted: - app/models/guest_user.py - app/models/guest_invitation.py - app/routes/guest_auth.py (was orphaned, not imported) - tests/test_guest_auth.py (tested removed guest auth system) Modified: - app/models/__init__.py: removed stale GuestUser/GuestInvitation comments - app/services/entity_permission_service.py: updated guest permission comment - tests/test_permission_system_live.py: replaced GuestUser with User+UserTenant(role=guest), changed principal_type from "guest" to "user", switched guest test from /api/v1/guest/login to regular /api/v1/auth/login endpoint Frontend: no guest components found, nothing to clean up. Alembic migrations: historical migrations referencing guest_users/guest_invitations tables are left intact (they document DB history).	2026-08-06 11:46:00 +02:00
Agent Zero	67015ef82b	fix(permissions): comprehensive live permission system tests + delete permission fixes - Add tests/test_permission_system_live.py: 33 live tests against real PostgreSQL testing RBAC, ABAC, RLS, cross-tenant isolation, guest access, entity sharing, field-level permissions, role invalidation, group permissions, membership suspension - fix(contacts): delete route uses contacts:delete instead of contacts:write The delete_contact and delete_contact_person routes were checking contacts:write permission instead of contacts:delete, allowing users without delete permission to delete contacts. - fix(contacts): DeleteContactCommand passes is_system_admin to service DeleteContactCommand.run() was not passing is_system_admin from the session to contact_service.delete_contact(), causing system admins to be blocked by the row-level admin access check. - fix(contacts): allow deletion of tenant-owned contacts contact_service.delete_contact() required admin-level entity access for ALL contacts, including tenant-owned ones (owner_id=None). Tenant-owned contacts can now be deleted by any user with contacts:delete permission (already verified by the route via require_permission).	2026-08-06 09:49:07 +02:00

Author

SHA1

Message

Date

Agent Zero

19ecc0cd71

fix(tests): adapt permission tests to new RBAC architecture

- Add Role records for editor, viewer, guest in seed_full_data
- Link UserTenant.role_id to Role records (legacy string roles no longer grant permissions)
- Fixes 10 test failures caused by removal of Legacy Role Bypass
- All 33 tests now pass

2026-08-06 14:51:49 +02:00

Agent Zero

8060505baa

refactor(cleanup): remove dead GuestUser/GuestInvitation code and fix test imports

Deleted:
- app/models/guest_user.py
- app/models/guest_invitation.py
- app/routes/guest_auth.py (was orphaned, not imported)
- tests/test_guest_auth.py (tested removed guest auth system)

Modified:
- app/models/__init__.py: removed stale GuestUser/GuestInvitation comments
- app/services/entity_permission_service.py: updated guest permission comment
- tests/test_permission_system_live.py: replaced GuestUser with User+UserTenant(role=guest),
  changed principal_type from "guest" to "user", switched guest test from
  /api/v1/guest/login to regular /api/v1/auth/login endpoint

Frontend: no guest components found, nothing to clean up.
Alembic migrations: historical migrations referencing guest_users/guest_invitations
  tables are left intact (they document DB history).

2026-08-06 11:46:00 +02:00

Agent Zero

67015ef82b

fix(permissions): comprehensive live permission system tests + delete permission fixes

- Add tests/test_permission_system_live.py: 33 live tests against real PostgreSQL
  testing RBAC, ABAC, RLS, cross-tenant isolation, guest access, entity sharing,
  field-level permissions, role invalidation, group permissions, membership suspension

- fix(contacts): delete route uses contacts:delete instead of contacts:write
  The delete_contact and delete_contact_person routes were checking contacts:write
  permission instead of contacts:delete, allowing users without delete permission
  to delete contacts.

- fix(contacts): DeleteContactCommand passes is_system_admin to service
  DeleteContactCommand.run() was not passing is_system_admin from the session
  to contact_service.delete_contact(), causing system admins to be blocked
  by the row-level admin access check.

- fix(contacts): allow deletion of tenant-owned contacts
  contact_service.delete_contact() required admin-level entity access for ALL
  contacts, including tenant-owned ones (owner_id=None). Tenant-owned contacts
  can now be deleted by any user with contacts:delete permission (already
  verified by the route via require_permission).

2026-08-06 09:49:07 +02:00

3 Commits