abbe7a18fc
fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed
...
- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt
2026-08-16 01:17:18 +02:00
3d9b76cea4
feat(E): Unified Search — 24 Tasks complete
...
Check Cross-Plugin Imports / check (push) Has been cancelled
- SPIKE-E: FTS+Vector+Permission benchmark on 10k records (all <30ms)
- E-PROV: supports_fts/vector/rag/graph capability flags on all providers
- E-FTS/VEC: All 11 providers refactored to BaseSearchProvider with permission filtering
- E-PERM: Over-fetch strategy for vector+permission (15x faster than ANY() filter)
- E-FUSE: rrf_fusion_multi() for N-way RRF over FTS+Vector+RAG+Graph
- E-LLM: Query understanding cleaned up to use central llm_complete()
- E-CHUNK: Document chunking module + document_chunks table with HNSW index
- E-EMB: Chunk embedding ARQ jobs (index_file_chunks, reindex_chunks)
- E-RAG: RAG retrieval via FileSearchProvider.search_rag()
- E-GRAPH: GraphRAG BFS traversal via GraphRAGSearchProvider.search_graph()
- E-IX-EVT: Auto-indexing via outbox events + delete/cleanup handlers
- E-IX-RE: Batch reindex with progress tracking + reindex_all job
- E-DATA-LIFE: Lifecycle module (remove/rebuild/restore/correct) + API endpoints
- E-K-MEM: AgentMemorySearchProvider
- E-P-AI: AIChatSearchProvider
- E-P-WF: WorkflowSearchProvider
- E-P-COMM: ConversationSearchProvider verified (already on BaseSearchProvider)
- E-API: Filter params (date_from/to, tags, sort) + /facets endpoint
- E-TOOL: unified_search AI tool registered in ToolRegistry
- E-MCP: Search tool in MCP server with normal RBAC/tenant checks
- E-UI-CMD: CommandPalette (Cmd+K) with debounced search + recent searches
- E-UI-FAC: SearchFacets, SearchResultCard, SavedSearches components
- E-TEST: 40 new tests in test_unified_search_phase_e.py (105 total green)
- E-DOC: api-documentation.md, plugin-development-guide.md, test-strategy.md updated
105 tests passing, TypeScript clean.
2026-08-14 01:34:58 +02:00
25b2581653
feat(C): Phase C — Core UI prüfen, vervollständigen, testen
...
C-ERR-BOUNDARY: ErrorBoundary erweitert (trace_id, Fallback-UI, PluginErrorBoundary)
C-NOTIF: NotificationDropdown mit System-Channel-Link
C-DOCS: ApiDocs.tsx Seite (Swagger UI iframe)
C-A11Y: aria-label, min-h-touch, focus-visible ergänzt
C-FE-TEST: 29 neue Tests (ErrorBoundary, ApiDocs, PrintButton, themeStore, NotificationDropdown)
C-DOC: ui-design-guidelines.md aktualisiert
Verifiziert (keine Änderungen nötig):
- C-TAGS, C-CF, C-FILTER, C-DEDUP, C-ONBOARD, C-THEME, C-PWA, C-PRINT
TSC: 0 errors, Build: erfolgreich, Vitest: 29/29 passed
2026-08-13 21:57:59 +02:00
fdabd2e74c
fix(frontend): E2E-Test-Suite vollständig grün machen
...
- Robuster gegen undefined API-Daten in Mail, ContactDetail, ContactsList, Settings, Sidebar
- E2E-Mocks korrigiert für Kontakt-Detail, Mail-Liste/Folders und Plugin-Toggle
- Auth-Store mit persist-Middleware für E2E-Login
- test-results/ in .gitignore aufgenommen
Playwright E2E: 34/34 passed
2026-08-07 22:03:11 +02:00
ea797b033a
Phase 4.5+4.6: Modul-Konfiguration pro Workspace + Sidebar useMemo Fix
...
4.5 Modul-Konfiguration pro Workspace:
- WorkspaceManager: Config-Editor pro Modul (JSON textarea)
- Pro Modul kann JSON config bearbeitet werden (z.B. sichtbare Ordner-IDs)
- Generisch: jedes Modul definiert selbst was in seiner config steht
4.6 Bugfixes:
- Sidebar useMemo: isModuleVisible zu Abhaengigkeiten hinzugefuegt
- Bei Workspacewechsel wird Sidebar jetzt sofort neu berechnet
Tests: 17 Backend + 13 Frontend = 30/30 bestanden
2026-08-03 13:58:27 +02:00
3cbf92191e
Reparaturplan Fixes: Widget workspace_id check, total bug, context is_visible, permissions, fallbacks
...
Check Cross-Plugin Imports / check (push) Has been cancelled
Backend:
- Widget total: 0 bug fixed (now returns len(widgets))
- Widget update/delete: now verifies workspace_id + tenant_id (was only tenant_id)
- Workspace context: returns all modules with is_visible flag (was only visible modules)
- is_workspace_manager() removed (Plan 4.2: no manager checks)
- seed_default_workspace: removed hardcoded modules (Plan 4.7: no hardcoded tiles)
- Workspace permissions registered in CORE_PERMISSIONS (Plan 2.3)
Frontend:
- Permission fallback removed: Sidebar/TopBar show nothing while loading (Plan 2.4)
- workspaceStore isModuleVisible: fail-closed when isSystemAdmin undefined
- WorkspaceManager: AVAILABLE_MODULES replaced with dynamic core+plugin items (Plan 4.4)
Tests:
- 17 backend tests (removed is_workspace_manager test, adapted widget/context tests)
- 13 frontend tests (added undefined-isSystemAdmin test, adapted visibility tests)
2026-08-03 12:44:02 +02:00
7fbbe420bd
fix: comprehensive system audit fixes (55+ issues)
...
Check Cross-Plugin Imports / check (push) Has been cancelled
CRITICAL:
- Fix SQL injection in prestart.sh (parameterized query)
- Fix secret key validation (always validate, not just production)
- Fix workspace model partial index bug (func.text -> text)
- Fix HealthResponse schema (add checks field)
- Fix Tenant import in permissions.py (NameError on every auth request)
- Fix README tech stack (React instead of Alpine.js)
- Delete broken test_cross_tenant_security_v2.py
- Add fail-closed RLS migration 0084 (48 tenant tables)
HIGH:
- Add GeneralRateLimitMiddleware for all API routes
- Add file type blocklist for DMS and attachment uploads
- Fix guest auth: Pydantic schema, tenant_slug required, CSRF bypass
- Fix CSRF bypass path matching (in -> endswith)
- Add worker healthcheck in docker-compose.yml
- Add ARQ max_tries=3 for job retries
- Fix 28 bare pass in mail services (-> logger.debug)
- Fix print() -> logger in main.py and ai_assistant
- Fix duplicate email handling (catch IntegrityError -> 409)
- Add session revocation (invalidate_all_user_sessions)
- Add resource limits to all containers
- Fix CORS default (localhost -> production domain)
- Fix SameSite=Lax -> Strict
- Fix Redis password visibility in healthcheck
- Fix npm vulnerabilities (19 -> 9)
- Fix Sidebar OOM (wildcard lucide import -> curated ICON_MAP)
MEDIUM:
- Localize ErrorBoundary to German
- Wire Mail.tsx save/delete filter to API
- Document system_notif plugin (no routes needed)
- Fix datetime.utcnow() -> datetime.now(UTC)
- Pin litellm version (>=1.0,<2.0)
- Move CSRF token from sessionStorage to in-memory
- Fix restore_backup error handling and transaction
- Fix Dms.tsx useEffect cleanup
- Add skip-to-content link for accessibility
- Add selectinload imports to 3 services
- Add .env.example missing variables
- Fix AppShell/TopBar/Sidebar test mocks
NEW TESTS:
- test_guest_auth.py (6 tests)
- test_user_service.py (8 tests)
- test_backup_service.py (5 tests)
NEW SCHEMAS:
- saved_filter, saved_view, user_preference, workspace, entity_policy
Tests: 22/22 PASSED
2026-07-31 00:58:05 +02:00
beb4169b03
feat: start page after login with workspace grid, login redirect to /start
2026-07-30 20:02:28 +02:00
25e70cf749
fix: canAccess + isModuleVisible fallback while permissions loading (contacts + settings link)
2026-07-30 01:53:30 +02:00
c5f0ef9d4d
fix: canAccess returns true while permissions are loading
2026-07-30 01:44:50 +02:00
fca7191269
phase5: workspace frontend — API hooks, useWorkspace hook, WorkspaceSwitcher, Sidebar workspace filter
2026-07-29 22:12:23 +02:00
8da803156e
phase1: RLS simplified to tenant isolation only + canAccess fallback removed + useUserPermissions hook + security kernel docs
2026-07-29 16:36:51 +02:00
0cebd23e3b
fix: remove TopBar quick-create button + canAccess fallback in ContactDetail + ContactDetailPage + ContactsList + duplicate import fix
2026-07-29 10:33:31 +02:00
9be0cd0909
hotfix: add useAuthStore import to Sidebar.tsx
2026-07-29 10:17:52 +02:00
14a1073c92
hotfix: sidebar + topbar canAccess fallback — show all items for system_admin or empty permissions
2026-07-29 10:17:03 +02:00
48b2dfdb11
sprint9: app visibility — sidebar permission filter + TopBar + ProtectedRoute + route guards
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 02:28:52 +02:00
65bb9c9866
fix: print and open-standalone icon-only, right-aligned in toolbar
2026-07-28 12:42:49 +02:00
e95875464b
feat: SmartSuite-style FilterPanel with multi-condition AND/OR, all contact fields, context-sensitive ordering
2026-07-28 09:19:02 +02:00
7962d34fcf
toolbar: unified filter+sort dropdown with sections, fixed positioning, iconOnly support
2026-07-28 02:16:03 +02:00
bbaded656f
fix: toolbar dropdown z-index and overflow for visibility
2026-07-28 00:50:39 +02:00
722335c923
contacts toolbar: consolidate views and filters into dropdowns
2026-07-28 00:45:55 +02:00
ee38b200f8
fix: tighten folder tree spacing + collapsible search icon in toolbar
2026-07-27 23:46:16 +02:00
b6e3afd28b
Phase 4 + M5: Low-priority fixes and frontend component integration
...
M5: TagBadge integrated into ContactDetail (replaces plain Badge)
M5: EntityHistoryPanel integrated into ContactDetail (timeline section)
L1: Replace document.write() with Blob URL in print.ts (XSS-safe)
L2: AI UI Control feedback storage capped at 100 entries (FIFO eviction)
L3: Backup & Restore documentation added to DEPLOY.md
Verified: Backend import OK, TypeScript 0 errors
2026-07-26 21:29:37 +02:00
79ece0fe2e
Phase 4: Webhooks, Backup/Restore UI, Onboarding/Tutorial
...
- Webhooks Backend: model, schema, service (HMAC-SHA256, httpx), routes, event bus dispatcher, migration 0042
- Webhooks Frontend: SettingsWebhooksPage (CRUD, test button, event multi-select), API client
- Backup/Restore Backend: model, schema, service (pg_dump/pg_restore), routes (admin-only), migration 0043
- Backup/Restore Frontend: SettingsBackupPage (create, list, restore dialog with RESTORE confirmation, auto-refresh)
- Onboarding: OnboardingTour (8 steps, custom CSS overlay), WelcomeDialog, onboardingStore (zustand + localStorage)
- Onboarding integrated into AppShell
- Routes: /settings/webhooks, /settings/backup registered
- Settings nav: Webhooks, Backup & Restore entries added
- Migration conflict fixed: 0042_webhooks → 0043_backups chain
2026-07-26 03:17:40 +02:00
10dcc8ae90
Phase 3: Saved Filters UI, Entity History UI, Activity Timeline, API Docs Link
...
- Saved Filters: SavedFilterBar (dropdown, apply, delete), SaveFilterDialog (name + save)
- Entity History: EntityHistoryPanel (timeline, restore, undo), HistoryDiff (field changes visual)
- Activity Timeline: ActivityTimelinePage (grouped by day, pagination), ActivityFilter (user/entity/action/date)
- API Docs Link: TopBar user menu entry, SettingsSystem Entwickler section (Swagger, ReDoc, OpenAPI)
- Routes: /activity registered
- Menu items: Aktivitäten added to automation plugin manifest
2026-07-26 03:08:26 +02:00
a7e3890634
Phase 2: Tags UI, Custom Fields UI, Notifications Bell
...
- Tags UI: TagsPage (CRUD, color picker), TagBadge, TagSelector (multi-select, inline creation)
- Custom Fields Backend: model, schema, service, routes, migration 0041
- Custom Fields Frontend: CustomFieldsPage (definitions CRUD), CustomFieldRenderer (dynamic field rendering)
- Custom Fields: _collect_custom_field_definitions() extended to merge DB definitions with plugin definitions
- Notifications Bell: NotificationBell (30s polling, unread badge), NotificationDropdown, NotificationItem
- NotificationBell integrated into TopBar
- Routes: /tags, /settings/custom-fields registered
- Settings nav: Custom Fields entry added
- Menu items: Tags added to automation plugin manifest
2026-07-26 03:02:25 +02:00
aaa7406929
perf: Fix all 7 code analysis issues
...
HIGH (Performance):
- Replace 8 sync file operations with aiofiles in async context (storage, mail,
report_generator, dms_bridge, ai_assistant)
- Frontend bundle splitting: manualChunks for react-vendor, ui-components, tanstack,
markdown, icons, utils, i18n (ui chunk 936K → ~19K)
MEDIUM (Architecture):
- Worker circular deps: Replace direct plugin imports with job_registry.py pattern
(register_job/get_all_jobs, importlib-based lazy loading)
- App-wide ErrorBoundary: New ErrorBoundary.tsx component, wrapped in AppShell
and all standalone routes
LOW (Code Quality):
- N+1 query fix: selectinload(Contact.contact_persons) in list_contacts()
- O(n²) dedup fix: SQL GROUP BY for email/phone duplicates, Dict-based name grouping
- Response format standardization: 7 routes converted from plain arrays to
{items: [...], total: N} format
2026-07-25 09:19:32 +02:00
35e87b5d51
feat: window management system with minimize, fullscreen, and AI chat split
...
- Window manager store (Zustand) for managing open/minimized/fullscreen windows
- Window component with header controls: KI-Chat toggle, fullscreen, minimize, close
- AI chat panel with streaming chat via existing /ai/sessions API
- WindowContainer renders all non-minimized windows
- TopBar shows minimized windows as clickable pills
- ContactEditForm extracted from ContactEditModal for window rendering
- ContactsList and ContactDetailPage use openWindow() instead of modal state
- Draggable windows with z-index management
2026-07-24 23:42:53 +02:00
8b3873d676
feat: restructure settings menu + add automation/agents to topbar
...
TopBar:
- Add Automation and Agenten to user dropdown menu
Settings restructure:
- Stammdaten: Firmendaten, Adressen (CRUD), Konten (CRUD), Sonstige Daten
- Nutzerverwaltung: Benutzer, Rollen, Gruppen as tabs
- System: Menü, Theme, Plugins as tabs
- Reduce nav items from 15+ to 8
- Add end prop to all settings NavLinks
2026-07-24 22:35:35 +02:00
b4121082f7
fix: add end prop to all NavLinks to prevent prefix-matching activation
2026-07-24 22:13:53 +02:00
046f00e464
fix: remove mail settings, automation/agents from sidebar + settings from bottom
...
- Remove Einstellungen from E-Mail group (accessible via Settings page)
- Remove Automation and Agenten from sidebar (accessible via Topbar profile menu)
- Remove Settings from sidebar bottom items
2026-07-24 22:04:45 +02:00
e017da9d12
feat: navigation restructure + drag-and-drop menu ordering
...
Navigation:
- Remove Plugins header from sidebar
- Merge static items and plugin items into unified sorted list
- Group related menu items (Dateien, E-Mail, Kalender, Automation)
- German labels for all menu items
- Sort by order field, alphabetical fallback for ties
Drag-and-Drop Menu:
- New backend endpoints: GET/PUT /api/v1/users/me/menu-order
- Store menu order in user preferences JSONB field
- New SettingsMenuOrder page with @dnd-kit drag-and-drop
- New Settings tab: Menu ordering
- Sidebar reads saved menu order and sorts accordingly
- Reset to default option
2026-07-24 21:46:27 +02:00
4b9cb5a098
fix: Zustand selector anti-pattern causing infinite re-render + plugin loader path
...
- Fix usePluginStore(s => s.getAll*()) selectors that returned new arrays
on every call, causing infinite re-render loops and permanent spinner
- Affected: Sidebar, Settings, ContactDetail, ContactEditModal, PluginRouteRenderer
- Use usePluginStore(s => s.manifests) + useMemo instead
- Fix PluginRouteRenderer: show spinner instead of null when manifests loading
- Fix PluginLoader: @/ path replacement ../ -> ../../ for correct dynamic imports
2026-07-24 19:29:48 +02:00
924d28cbf2
fix: resolve menu duplicates, route prefix conflicts, API path bugs, permissions.deleted_at, remove test plugin from production
2026-07-24 08:19:45 +02:00
903d649a0f
Phase 4: KI-UI-Steuerung — AI agent UI control via WebSocket
...
- New ai_ui_control plugin: WS endpoint /ws/ai-ui-control, REST API (POST /command, GET /command/{id}/status, GET /online-users)
- UI-Command-Protocol: 6 command types (navigate, filter, open_contact, modal, tab, settings) with Pydantic schemas
- WebSocket manager: per-user connections, command delivery, feedback storage, stale cleanup
- Frontend useAIUIControl hook: WS client with auto-reconnect, command dispatch, feedback sending
- aiUIControlStore: Zustand store for command state, active modal/tab, pending filter/settings
- AIUIControlIndicator: visual KI indication (Bot icon, toast, pulse animation)
- ContactDetail integration: syncs activeTab and personModalOpen from AI control store
- AppShell integration: useAIUIControl hook + AIUIControlIndicator
- i18n keys for DE/EN
- 18 Vitest tests: command protocol, store actions, feedback, visual indication
- TSC: 0 new errors (only 2 pre-existing Dms.tsx errors)
2026-07-23 20:13:39 +02:00
fc96a2f86c
Phase 3: Plugin-UI-System (WordPress-Style)
...
Backend:
- PluginManifest um 5 neue UI-Felder erweitert: menu_items, page_routes,
detail_tabs, settings_pages, dashboard_widgets (FrontendMenuItem,
FrontendPageRoute, FrontendDetailTab, FrontendSettingsPage,
FrontendDashboardWidget)
- GET /api/v1/plugins/active-manifests Endpoint liefert UI-Manifeste
aller aktiven Plugins
- Registry.get_active_manifests() + PluginService.get_active_manifests()
- 12 Built-in Plugins mit UI-Manifest-Daten gefuellt (menu_items,
page_routes, detail_tabs, settings_pages)
- Plugin-Install-System: POST /upload (ZIP), POST /install-url (URL)
mit Validierung (Manifest, dangerous imports, SQL migrations)
Frontend:
- pluginStore.ts (Zustand) mit PluginUiManifest Typen + Selektoren
- useActivePluginManifests() React Query Hook
- PluginRegistry.tsx — fetcht Manifeste beim App-Start
- PluginLoader.tsx — dynamisches React.lazy() mit ErrorBoundary
- PluginRouteRenderer.tsx — Catch-all fuer Plugin-Routes
- routes/index.tsx — Catch-all Routes fuer Plugin-Pages + Settings
- Sidebar.tsx — dynamische Plugin Menu-Items mit Grouping + Icons
- Settings.tsx — dynamische Plugin Settings-Pages
- ContactDetail.tsx — dynamische Plugin Detail-Tabs mit Permissions
- AppShell.tsx — PluginRegistry Provider eingebunden
- SettingsPlugins.tsx — Install-UI (ZIP Upload + URL Install)
- plugins.ts — useUploadPlugin() + useInstallPluginFromUrl() Hooks
Docs & Templates:
- docs/plugin-development-guide.md — komplette Entwickler-Doku
- templates/plugin-template/ — Boilerplate mit allen Manifest-Feldern
Tests:
- 34 Vitest-Tests (PluginRegistry, PluginLoader, PluginRouteRenderer,
pluginStore) — alle bestanden
- TSC: keine neuen Errors (nur pre-existing Dms.tsx)
2026-07-23 19:01:18 +02:00
57d18c1381
Phase 0.3: migrate date formatting to date-fns
2026-07-23 05:05:08 +02:00
4f8cda1566
Phase 0.2: migrate remaining SVGs to lucide-react icons
2026-07-23 03:21:05 +02:00
ba06214efa
fix: quick-access button title matching for plugin rooms (Assistent, Live KI, System)
2026-07-22 01:56:25 +02:00
cc3ac9a43d
feat: Unified Messaging System — kommunikation plugin, AI/Proactive/System participants, MessageSidebar, Rich Content Renderer
...
Phase 1: Backend plugin kommunikation (13 files, 10 tables, REST API, WebSocket, RBAC, DMS Bridge, Participant Registry, Mini-App Registry, Search Provider)
Phase 2: AI plugins as participants (ai_assistant + ai_proactive dock as participants, heartbeat job)
Phase 3: system_notif plugin (system events → chat messages, pinned System room)
Phase 4: Frontend MessageSidebar (replaces AISidebar, same design, comm API client, WebSocket hook, commStore)
Phase 5: Rich Content Block Renderer (11 components: Markdown, HTML, Image, Audio, Video, File, ActionCard, ContactCard, MiniApp, BlockRenderer)
BasePlugin: added services property + _container in on_activate
2026-07-22 01:22:15 +02:00
5980d38c66
AISidebar: add Team panel with users/groups and online status, add Chat panel placeholder
2026-07-21 23:11:17 +02:00
650f6e6723
AISidebar: rename Proaktiv to Live KI, align icon strip border with TopBar, notifications as slim cards
2026-07-21 23:01:21 +02:00
a4793991dd
AISidebar: replace horizontal tabs with icon strip layout, show active tab title below icons
2026-07-21 22:50:45 +02:00
b30d1e9300
AISidebar: robot icon for AI, move notifications from TopBar to AISidebar with own tab and bell icon
2026-07-21 22:38:45 +02:00
abdcd07b07
Sidebar toggle button: match sidebar background color
2026-07-21 22:28:05 +02:00
719a4773d7
Align sidebar header border with TopBar border (h-[58px])
2026-07-21 22:21:54 +02:00
5adaee25a0
Sidebar: narrower width (w-56), tree structure with expandable sub-menus for Calendar, Files, Email
2026-07-21 22:18:19 +02:00
157ff7dfc9
Move Profile to own page, add Profile menu item in TopBar user menu
2026-07-21 22:08:32 +02:00
beb4d7a9ff
UI: Einstellungen+AuditLog aus Sidebar entfernt, AuditLog ins User-Menü, Suchfeld höher, Benachrichtigungs-Icon größer
2026-07-20 00:10:22 +02:00
1d3b7a497b
Fix: Suchfeld Höhe reduziert, Roboter-Symbol aus TopBar entfernt (nicht Sidebar!), Sidebar-Eintrag wiederhergestellt, Lösch-Buttons funktionsfähig mit State, Badge-Zahl dynamisch
2026-07-19 23:50:37 +02:00
Agent Zero