481125e29e
phase3: plugin routes static only (no dynamic registration) + require_active_plugin Redis cache + cache invalidation on activate/deactivate
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 17:40:40 +02:00
f1a2484055
fix: WeasyPrint URL fetcher + attachment improvements + webhook error propagation + WebSocket conversation check + RLS disabled on system tables (bootstrap fix)
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 13:19:21 +02:00
fd1a170f31
fix: plugin duplicate route registration + prestart.sh Python instead of psql + SMTP in docker-compose
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 12:48:25 +02:00
26bf8d3a31
P0+P1 fixes: RCE sandbox, SQL injection, RLS tenant isolation, DB roles, test syntax, attachment, permission registry, membership check
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 12:28:08 +02:00
958e412152
sprint8: plugin entities owner_id migration 0054 + calendar owned_mixin
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 02:33:16 +02:00
48b2dfdb11
sprint9: app visibility — sidebar permission filter + TopBar + ProtectedRoute + route guards
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 02:28:52 +02:00
88c04286af
sprint6+7: permission notifications + audit trail + notification entity filter + mail account permissions + migration 0053
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 02:18:17 +02:00
517e1b6d8b
sprint2+3: remaining services visibility filter + search provider permission-aware + dashboard route
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 02:05:14 +02:00
9fc84b7905
sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-29 01:52:47 +02:00
719ee251f2
fix: close remaining security gaps, test fixes, frontend integration, event bus
...
Check Cross-Plugin Imports / check (push) Has been cancelled
- RCE: move _check_dangerous_imports() BEFORE exec_module() in plugins.py
- verify_ws_origin: reject empty Origin header when CORS configured
- Test: ai_app fixture with permission_registry init for ai_assistant
- Test: login_client sets CSRF token + Origin as client default headers
- Test: SESSION_COOKIE_SECURE=false override + get_settings.cache_clear()
- Test: asyncio_default_test_loop_scope=session fixes event loop closed
- Test: fix 15 assertions (paths, variables, auth expectations)
- Frontend: integrate SavedFilterBar in ContactsList, Mail, Calendar
- Frontend: integrate TagSelector in ContactsList, Mail, Calendar
- Event Bus: add 4 subscribers in system_notif (conversation/participant/reaction)
- Docs: update all analysis reports and FIX-PLAN-V2 to current state
2026-07-27 12:45:45 +02:00
d607803e86
fix: WebSocket 403 — SameSite=Strict blocked session cookie on WS connections
...
Check Cross-Plugin Imports / check (push) Has been cancelled
Root cause: session_cookie_samesite was 'strict' which prevents the
browser from sending the session cookie on WebSocket upgrade requests.
Changed to 'lax' which allows WebSocket cookies while still blocking
cross-site POST CSRF attacks.
Also removed debug logging from kommunikation routes.
2026-07-27 02:23:25 +02:00
35a9ce1e7b
debug: add WebSocket connection logging to find 403 cause
Check Cross-Plugin Imports / check (push) Has been cancelled
2026-07-27 02:18:49 +02:00
98eb1d0d89
feat: Plugin-System Umbau — 6 Phasen komplett abgeschlossen
...
Check Cross-Plugin Imports / check (push) Has been cancelled
Phase 1: Contracts konsequent nutzen
- 12 neue contracts.py erstellt (alle 19 Plugins haben jetzt contracts)
- 4 bestehende contracts.py an zentrale ContractRegistry angepasst
- Alle 19 Plugins haben on_deactivate mit Contract-Unregister
- 0 echte problematische INTER-Plugin Imports
Phase 2: Hooks/Filters-System
- app/core/hooks.py (HookRegistry mit actions + filters)
- 15 Hook-Punkte in Core-Services (contact, auth, mail, calendar, user, dms)
- BasePlugin.on_deactivate meldet alle Hooks ab
Phase 3: Plugin-Isolation
- scripts/check_cross_plugin_imports.py (Linting-Regel)
- .github/workflows/check-cross-plugin-imports.yml (CI/CD)
- .pre-commit-cross-plugin.yaml (Pre-commit Hook)
- 155 Dateien geprueft, 0 Verstoesse
Phase 4: Plugin-Versioning
- app/plugins/semver.py (SemVer mit Parse, Compare, Pre-release)
- migration_runner.py erweitert: run_migration_down, rollback_to_version
- manifest.py: min_app_version Feld
- registry.py: App-Version-Compatibility-Check bei Installation
- GET /api/v1/plugins/updates Endpoint
Phase 5: Marketplace-Vorbereitung
- app/plugins/signature.py (Ed25519 Signatur-Validierung)
- app/plugins/quarantine.py (Plugin-Quarantine mit Validierung)
- app/models/plugin_allowlist.py + Migration 0046
- manifest.py: author, license, homepage, icon, screenshots, changelog, marketplace_tags, price
- registry.py: discover_external(), discover_all()
- POST /api/v1/plugins/install-marketplace (deaktiviert)
Phase 6: Manifest-Anpassung
- manifest.py: 12 neue Felder + SemVer/Hook-Name Validierung
- MANIFEST_SCHEMA_DOC aktualisiert
- Alle 19 Plugin-Manifeste aktualisiert
- Frontend PluginUiManifest Typ erweitert
Zusaetzliche Bug-Fixes:
- test_sample-Modul erstellt
- conftest.py Deadlock-Prevention
- SESSION_COOKIE_SECURE=true
- dump.rdb aus Git entfernt + .gitignore
- backup.py datetime.utcnow -> func.now()
- system_settings.py JSONB-Import nach oben
- tax.py Mapped[float] -> Mapped[Decimal]
- notification.py type_key-Laengen vereinheitlicht
Tests: 91 neue Tests, alle bestanden
2026-07-26 23:15:34 +02:00
b6e3afd28b
Phase 4 + M5: Low-priority fixes and frontend component integration
...
M5: TagBadge integrated into ContactDetail (replaces plain Badge)
M5: EntityHistoryPanel integrated into ContactDetail (timeline section)
L1: Replace document.write() with Blob URL in print.ts (XSS-safe)
L2: AI UI Control feedback storage capped at 100 entries (FIFO eviction)
L3: Backup & Restore documentation added to DEPLOY.md
Verified: Backend import OK, TypeScript 0 errors
2026-07-26 21:29:37 +02:00
604a2b7648
Phase 2: Fix high-priority security and stability issues (H1-H7)
...
H1: Sanitize error endpoint context (strip tokens/passwords, limit depth/size)
H2: Rate limiter IP spoofing fix (trusted proxy CIDR check for X-Forwarded-For)
H3: CSRF middleware uses Redis singleton instead of per-request connection
H4: WebSocket origin verification added to both kommunikation and ai_ui_control
H5: Storage path traversal protection, get_url() returns relative URL not filesystem path
H6: Security headers middleware (HSTS, X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy)
H7: Forward-repair migration 0045 for databases that ran original 0021/0027
Also: add trusted_proxy_cidrs to config, add verify_ws_origin to auth
2026-07-26 20:49:15 +02:00
5ec1fc9b05
Phase 1: Fix all critical release blockers (B1-B10)
...
B1: Remove duplicate get_redis() — singleton no longer overwritten
B2: Plugin routes now enforce activation status via require_active_plugin()
B3: Fix UploadFile ForwardRef error — remove functools.wraps from wrap_plugin_route
B4: DMS upload uses true streaming via save_stream() instead of RAM accumulation
B5: Worker on_startup registers plugin event handlers + webhook dispatcher
B6: Implement send_password_reset_email job, remove raw token logging
B7: Webhook SSRF protection (IP validation, no redirects), secret removed from response
B8: RLS repair migration 0044 + separate crm_runtime DB user (NOSUPERUSER, NOBYPASSRLS)
B9: Fix .env.docker.example AUTH_SECRET → SECRET_KEY
B10: Remove Redis default password, remove exposed DB/Redis ports
Also: add frontend_url to config, add SMTP settings to .env.docker.example,
update prestart.sh to use MIGRATION_DATABASE_URL for alembic.
2026-07-26 20:45:42 +02:00
a897bca390
fix: use label IDs instead of strings for Forgejo issue creation
2026-07-26 15:14:24 +02:00
14967fc70b
fix: remove unused Request param from forgejo error reporter status endpoint
2026-07-26 13:02:11 +02:00
227ab7546b
fix: add routes to forgejo_error_reporter plugin manifest
2026-07-26 12:57:19 +02:00
c3e41906bf
feat: add forgejo_error_reporter plugin for automatic error reporting to Forgejo issues
2026-07-26 12:49:39 +02:00
10dcc8ae90
Phase 3: Saved Filters UI, Entity History UI, Activity Timeline, API Docs Link
...
- Saved Filters: SavedFilterBar (dropdown, apply, delete), SaveFilterDialog (name + save)
- Entity History: EntityHistoryPanel (timeline, restore, undo), HistoryDiff (field changes visual)
- Activity Timeline: ActivityTimelinePage (grouped by day, pagination), ActivityFilter (user/entity/action/date)
- API Docs Link: TopBar user menu entry, SettingsSystem Entwickler section (Swagger, ReDoc, OpenAPI)
- Routes: /activity registered
- Menu items: Aktivitäten added to automation plugin manifest
2026-07-26 03:08:26 +02:00
a7e3890634
Phase 2: Tags UI, Custom Fields UI, Notifications Bell
...
- Tags UI: TagsPage (CRUD, color picker), TagBadge, TagSelector (multi-select, inline creation)
- Custom Fields Backend: model, schema, service, routes, migration 0041
- Custom Fields Frontend: CustomFieldsPage (definitions CRUD), CustomFieldRenderer (dynamic field rendering)
- Custom Fields: _collect_custom_field_definitions() extended to merge DB definitions with plugin definitions
- Notifications Bell: NotificationBell (30s polling, unread badge), NotificationDropdown, NotificationItem
- NotificationBell integrated into TopBar
- Routes: /tags, /settings/custom-fields registered
- Settings nav: Custom Fields entry added
- Menu items: Tags added to automation plugin manifest
2026-07-26 03:02:25 +02:00
a3a5a10514
Phase 1: Workflows UI, Dedup/Merge UI, Import/Export UI, Print/PDF
...
- Workflows UI: full page with definitions/instances tabs, step editor, instance detail with approve/reject
- Dedup/Merge UI: duplicate detection, side-by-side comparison, field-level merge dialog, merge history
- Import/Export UI: import wizard (dry-run preview), export panel (CSV/XLSX), backend export route added
- Print/PDF: PrintButton component, print.css, integrated in Contacts/Calendar/Reports/ContactDetail
- Backend: GET /api/v1/export endpoint, export_companies_csv() service function
- Routes: /workflows, /contacts/dedup, /import-export registered
- Menu items: Workflows, Import/Export, Duplikate added to automation plugin manifest
- IMPLEMENTATION_PLAN.md: audit-corrected plan for all 14 remaining features
2026-07-26 02:35:44 +02:00
727d86614e
Security fixes: P0-P2 complete (22 fixes)
...
P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal
8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed
2026-07-25 21:03:46 +02:00
aaa7406929
perf: Fix all 7 code analysis issues
...
HIGH (Performance):
- Replace 8 sync file operations with aiofiles in async context (storage, mail,
report_generator, dms_bridge, ai_assistant)
- Frontend bundle splitting: manualChunks for react-vendor, ui-components, tanstack,
markdown, icons, utils, i18n (ui chunk 936K → ~19K)
MEDIUM (Architecture):
- Worker circular deps: Replace direct plugin imports with job_registry.py pattern
(register_job/get_all_jobs, importlib-based lazy loading)
- App-wide ErrorBoundary: New ErrorBoundary.tsx component, wrapped in AppShell
and all standalone routes
LOW (Code Quality):
- N+1 query fix: selectinload(Contact.contact_persons) in list_contacts()
- O(n²) dedup fix: SQL GROUP BY for email/phone duplicates, Dict-based name grouping
- Response format standardization: 7 routes converted from plain arrays to
{items: [...], total: N} format
2026-07-25 09:19:32 +02:00
224a71ba56
fix: CronJobContribution tenant_id error - use default tenant from DB
...
- register_plugin_contributions was accessing cron_def.tenant_id which doesn't exist
- All Contribution Models (AgentDefinitionContribution, AutomationTemplateContribution,
CronJobContribution) lack tenant_id field
- Fix: Query default tenant from DB and use it for all contribution registrations
- Also fixes agent_def.tenant_id and auto_def.tenant_id which had the same issue
2026-07-25 03:40:37 +02:00
6e7e39d101
fix: Event-bus workflow trigger, RBAC on all routes, search provider, events, cron jobs
...
Critical fixes:
- Event Bus → Workflow auto-trigger: wildcard subscription starts workflows on matching events
- Kommunikation routes: require_permission on all 30+ endpoints (comm:read/write/delete/manage)
- Permissions routes: require_permission('permissions:admin') on all management endpoints
- CompanySearchProvider registered in auto_register_providers()
Medium fixes:
- system_notif events: 10 event_bus.publish() calls added (lead.created, contact.created/updated,
task.created/overdue, mail.received, user.created, workflow.completed, notification.created, backup.*)
- Cron jobs: backup_check (daily), search_index_check (daily), workflow_timeout (5min) registered
- AI tool permission: call_crm_api now requires 'ai:write' permission
- New file: automation/jobs.py with backup_check and search_index_check functions
2026-07-25 03:22:55 +02:00
b01c798739
fix: Chat search index, DMS group-share user_id, verify workflows and mail salt
...
- Implement CommSearchProvider: index_message(), reindex_all() with FTS + vector search
- Add migration 0035: search_tsv + embedding columns on comm_messages
- Fix DMS group-share: use current_user user_id instead of random uuid4()
- Workflows already DB-configurable (seed from onboarding.py, loaded from DB)
- Mail salt already dynamic with legacy fallback (migration 0026)
2026-07-25 03:02:41 +02:00
6412eb03a8
fix: Replace automation stubs with real execution engine
...
- Replace automation execute stub with run_automation() from execution_engine.py
- Replace agent execute stub with run_agent() from agent_runner.py
- Persist automation settings in system_settings.automation_config JSONB
- Add migration 0034 for automation_config column
- Settings are now saved and loaded from database instead of being ignored
2026-07-25 02:52:07 +02:00
46cadb5165
feat: MCP Server - generic CRM API access instead of 9 hardcoded tools
...
- Replace 9 hardcoded MCP tools with single call_crm_api tool
- MCP clients now have full access to all 259 CRM API endpoints
- Same generic approach as AI Assistant: method + path + body
- Internal auth via X-Internal-Call headers with tenant/user context
2026-07-25 02:41:55 +02:00
e2cd435861
feat: Generic CRM API tool - AI can control entire system
...
- Create call_crm_api tool: single tool that can call ANY CRM API endpoint
- Inject OpenAPI spec into system prompt so AI knows all available endpoints
- Always include call_crm_api in agent tools (not just via tool_ids)
- Extend get_current_user to support internal header-based auth (X-Internal-Call,
X-Tenant-Id, X-User-Id) for AI tool API access
- No more manual tool-per-endpoint registration needed
2026-07-25 02:31:33 +02:00
3e7abd4518
feat: Mini-Apps registry, Stammdaten backend persistence, bank accounts
...
- Register 6 mini-apps in kommunikation plugin (contact_picker, file_share,
calendar_invite, mail_forward, ai_search, task_create)
- Connect AdressenTab to backend API (GET/POST/PATCH/DELETE /addresses)
- Create BankAccount model, schema, service, routes + migration 0033
- Connect KontenTab to backend API (GET/POST/PATCH/DELETE /bank-accounts)
- AI tools already working: 7 tools registered (hybrid_search, get_contact_mails, etc.)
2026-07-25 02:11:29 +02:00
046f00e464
fix: remove mail settings, automation/agents from sidebar + settings from bottom
...
- Remove Einstellungen from E-Mail group (accessible via Settings page)
- Remove Automation and Agenten from sidebar (accessible via Topbar profile menu)
- Remove Settings from sidebar bottom items
2026-07-24 22:04:45 +02:00
26ee8f8853
fix: remove calendar kanban menu entry
2026-07-24 21:56:33 +02:00
e017da9d12
feat: navigation restructure + drag-and-drop menu ordering
...
Navigation:
- Remove Plugins header from sidebar
- Merge static items and plugin items into unified sorted list
- Group related menu items (Dateien, E-Mail, Kalender, Automation)
- German labels for all menu items
- Sort by order field, alphabetical fallback for ties
Drag-and-Drop Menu:
- New backend endpoints: GET/PUT /api/v1/users/me/menu-order
- Store menu order in user preferences JSONB field
- New SettingsMenuOrder page with @dnd-kit drag-and-drop
- New Settings tab: Menu ordering
- Sidebar reads saved menu order and sorts accordingly
- Reset to default option
2026-07-24 21:46:27 +02:00
6e930b814e
fix: add router prefix for ai_ui_control WebSocket and REST routes
...
- APIRouter had no prefix, so WebSocket was on /ws not /api/v1/ai-ui-control/ws
- This caused 403 on every WebSocket connection attempt
- Remove debug print statements
2026-07-24 17:35:14 +02:00
d8787ea007
debug: add print statements to ai_ui_control on_activate
2026-07-24 17:31:52 +02:00
2fd4bd123d
fix: restore API response formats + ai-ui-control ws + profile fields
...
- Restore {plugins: [...], total: N} for /plugins and /plugins/active-manifests
(flat array broke frontend PluginRegistry → no menu items → empty UI)
- Restore {count: N} for /notifications/unread-count
(scalar broke frontend notification badge)
- Fix ai_ui_control: on_install → on_activate for WS manager registration
(WS 403 on every reconnect after container restart)
- Fix double /api/v1 prefix in useAIContext.ts and SuggestionBadge.tsx
- Add first_name, last_name, avatar_url to User model + migration 0032
- Extend UserUpdate schema with profile + password change fields
- Extend user_service.update_user with profile fields + password change
- Extend frontend UserResponse/UserUpdate types
2026-07-24 17:17:53 +02:00
7b4a2c0791
fix: embedding migration, worker error handling, path traversal security, response mismatches (unread-count, plugins, manifests), frontend type safety
2026-07-24 14:23:28 +02:00
c3c5233e58
fix(automation): change list route from / to empty string to match without trailing slash
2026-07-24 10:44:32 +02:00
992d4b79d4
fix(automation): reorder routes — static paths before dynamic {id} to prevent 400 errors
2026-07-24 10:42:08 +02:00
7dd4865638
fix: register new deleted_at migration files in all plugin manifests
2026-07-24 10:37:44 +02:00
eaa71780d4
fix: add missing deleted_at columns to all plugin tables, fix system-settings response schema, fix transaction rollback in permissions
2026-07-24 10:34:38 +02:00
924d28cbf2
fix: resolve menu duplicates, route prefix conflicts, API path bugs, permissions.deleted_at, remove test plugin from production
2026-07-24 08:19:45 +02:00
c5588e64f6
fix(plugins): export AutomationPlugin and AIUIControlPlugin from __init__.py so they get discovered
2026-07-24 01:57:27 +02:00
2c9e74776e
feat(5.21): Tasks Plugin — activities with status, priority, due dates, ARQ reminders
...
- New builtin plugin app/plugins/builtins/tasks/ with full CRUD
- Task model with TenantMixin (title, description, status, priority, due_date, assigned_to, contact_id)
- Routes: GET/POST /tasks, GET/PATCH/DELETE /tasks/{id}, POST /tasks/{id}/assign, POST /tasks/{id}/status
- All routes RBAC-protected (tasks:read, tasks:write, tasks:delete)
- ARQ cron job tasks_due_reminder (daily 8:00) sends notifications for due tasks
- Migration 0001_initial.sql creates tasks table with indexes
- Frontend: Tasks.tsx page with list, filter, create/edit modal, detail modal
- Frontend: api/tasks.ts with React Query hooks
- Route /tasks in routes/index.tsx, sidebar entry via plugin manifest
- i18n keys for nav.tasks and tasks.* in de.json and en.json
- Tests: test_tasks.py (11 tests) + Tasks.test.tsx (3 tests)
- Registered TasksPlugin in conftest.py and worker.py
2026-07-23 23:41:34 +02:00
bdad91a649
feat(5.20): Custom Fields — plugin-defined fields in Contact UI
...
- Add CustomFieldDefinition to PluginManifest (text/number/date/select/multiselect/boolean)
- Add GET/PATCH /api/v1/contacts/{id}/custom-fields routes
- Merge plugin definitions with stored values in contacts.custom JSONB
- Add CustomFieldRenderer component (read + edit modes)
- Integrate into ContactDetail (read-only) and ContactEditModal (editable)
- Add custom_fields to pluginStore and active manifests API
- Add useCustomFields/useUpdateCustomFields React Query hooks
- Tests: test_custom_fields.py (9 tests) + CustomFieldRenderer.test.tsx (5 tests)
- i18n keys already present (contacts.customFields)
2026-07-23 23:35:35 +02:00
15f1a57c0f
Phase 5 Batch 5 Task 5.18: Report Generator PDF-Support & Druck-Funktionen
...
- Installed WeasyPrint 69.0 for PDF generation
- Created 5 Jinja2 HTML templates: contact_list, calendar_week, calendar_month, company_list, audit_log
- All templates: A4 landscape, print-optimized CSS (@media print, page margins)
- Extended output_format in schemas.py: added pdf and print
- Created pdf_generator.py: Jinja2 + WeasyPrint pipeline with preset support
- Modified routes.py: PDF/print generation, preset endpoints (/presets, /presets/generate)
- Added RBAC (require_permission) to all report endpoints
- Generate endpoints return StreamingResponse (file download) directly
- 7 backend tests: presets listing, PDF/CSV generation, template CRUD, RBAC
2026-07-23 23:22:33 +02:00
317d5c81f8
feat: MCP Client plugin (Task 5.17) - integrate external MCP servers for AI agents
...
- New plugin app/plugins/builtins/mcp_client/ with server config CRUD
- Models: McpServerConfig with TenantMixin (name, url, api_token, enabled)
- Routes: GET/POST/PATCH/DELETE /api/v1/mcp-client/servers
- Routes: GET /servers/{id}/tools, POST /servers/{id}/execute
- client.py: async MCP client using httpx for external server calls
- tool_registry_integration.py: registers external MCP tools in AI tool registry
- Migration: 0001_initial.sql for mcp_server_configs table
- Frontend: mcpClient.ts API client with React Query hooks
- Frontend: MCP Client settings UI in SettingsMcp.tsx (server CRUD, tool viewing)
- Tests: 8 tests covering CRUD, auth, tool registry integration
2026-07-23 23:02:07 +02:00
9d4f701a25
feat: MCP Server plugin (Task 5.16) - expose LeoCRM tools to external AI clients
...
- New plugin app/plugins/builtins/mcp_server/ with 9 MCP tools
- Tools: search_contacts, get_contact, create_contact, list_calendar_entries,
create_calendar_entry, list_emails, send_email, list_files, upload_file
- Routes: GET /api/v1/mcp/tools, POST /api/v1/mcp/tools/{name}/execute, GET /api/v1/mcp/config
- API-token auth via session + RBAC (mcp:read, mcp:write)
- Frontend: mcp.ts API client with React Query hooks
- Frontend: SettingsMcp.tsx settings page with tool listing and execution
- i18n: de.json and en.json updated with MCP entries
- Tests: 7 tests covering tool listing, config, execution, auth, schema validation
2026-07-23 23:01:59 +02:00
Agent Zero