 Agent Zero
|
ecc7a24c1c
|
feat(approvals): UI für Freigaben — Review-Queue mit Approve/Reject (Modul 1/16)
Backend:
- Phantom-Permission-Bug gefixt: approvals:read/write/approve fehlten in
CORE_PERMISSIONS (Rollen konnten sie nie zugewiesen bekommen — gleiche
Fehlerklasse wie dashboard:read in M2)
Frontend:
- api/approvals.ts: TanStack Hooks (list/detail/approve/reject/expire/create)
- pages/Approvals.tsx: Review-Queue — Status-Tabs (Offen/Alle/Genehmigt/
Abgelehnt/Abgelaufen), Karten mit Aktion/Entity/Requester/Metadata,
Approve/Reject mit Kommentar-Modal, Permission-Gating (approvals:approve)
- Route /approvals (PermissionRoute approvals:read), Sidebar-Eintrag
- i18n approvals.* + nav.approvals (de/en)
Verifikation: Vitest 10/10 (Rendering, Tabs, Approve/Reject-Flow,
Kommentar, Permission-Gating, Resolved-Zustände), RBAC-Regression 102/102,
tsc clean, Build OK
|
2026-09-08 23:26:56 +02:00 |
|
|
Agent Zero
|
b3e259fc25
|
feat(M2): Persönliche Dashboards — Tabelle, CRUD, Lazy-Seed, RLS (#360)
Check Cross-Plugin Imports / check (push) Has been cancelled
- dashboards-Tabelle (Layout JSONB, Tabs, is_default, partial unique name index)
- 6 CRUD-Endpoints /api/v1/dashboards, Owner-only (saved_views-Präzedenz), Audit
- Lazy Default-Seed aus MiniApp-Registry (permission-gefiltert, 12-Spalten-Flow)
- CORE_PERMISSIONS dashboard:read/write (fixt Phantom-Permission in dashboard.py)
- Migration 0144: RLS crm_api+crm_worker + konvergenter Fix der 3 Phase-L-Policies
- Tests: test_dashboards_backend.py 23/23 (TDD rot->grün); Regression 162/163
|
2026-08-30 16:21:34 +02:00 |
|
|
Agent Zero
|
e3fb4728d7
|
refactor(b3): dynamic entity registry, custom_fields permissions decoupled from contacts, write perms generated from registry
|
2026-08-23 20:54:04 +02:00 |
|
|
Agent Zero
|
abbe7a18fc
|
fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed
- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt
|
2026-08-16 01:17:18 +02:00 |
|
|
Agent Zero
|
4f970a11eb
|
Phase 1: Critical security fixes - 59 permissions, grants, RLS, mass-assignment, ownership, leaks, MIME
Check Cross-Plugin Imports / check (push) Has been cancelled
|
2026-08-03 22:32:03 +02:00 |
|
|
Agent Zero
|
3cbf92191e
|
Reparaturplan Fixes: Widget workspace_id check, total bug, context is_visible, permissions, fallbacks
Check Cross-Plugin Imports / check (push) Has been cancelled
Backend:
- Widget total: 0 bug fixed (now returns len(widgets))
- Widget update/delete: now verifies workspace_id + tenant_id (was only tenant_id)
- Workspace context: returns all modules with is_visible flag (was only visible modules)
- is_workspace_manager() removed (Plan 4.2: no manager checks)
- seed_default_workspace: removed hardcoded modules (Plan 4.7: no hardcoded tiles)
- Workspace permissions registered in CORE_PERMISSIONS (Plan 2.3)
Frontend:
- Permission fallback removed: Sidebar/TopBar show nothing while loading (Plan 2.4)
- workspaceStore isModuleVisible: fail-closed when isSystemAdmin undefined
- WorkspaceManager: AVAILABLE_MODULES replaced with dynamic core+plugin items (Plan 4.4)
Tests:
- 17 backend tests (removed is_workspace_manager test, adapted widget/context tests)
- 13 frontend tests (added undefined-isSystemAdmin test, adapted visibility tests)
|
2026-08-03 12:44:02 +02:00 |
|
|
Agent Zero
|
26bf8d3a31
|
P0+P1 fixes: RCE sandbox, SQL injection, RLS tenant isolation, DB roles, test syntax, attachment, permission registry, membership check
Check Cross-Plugin Imports / check (push) Has been cancelled
|
2026-07-29 12:28:08 +02:00 |
|
|
Agent Zero
|
71ed592aa2
|
sprint4+5: field-level permissions complete + universal ShareDialog frontend
|
2026-07-29 02:14:26 +02:00 |
|
|
Agent Zero
|
75a7063bff
|
feat(5.2): add User Preferences API with full-stack implementation
Backend:
- Create app/models/user_preference.py with TenantMixin (user_id, key, value JSONB)
- Create app/routes/user_preferences.py with GET/PUT/DELETE endpoints + RBAC
- Add user_preferences:read/write to CORE_PERMISSIONS
- Add user_preferences to legacy role permissions (admin/editor/viewer)
- Register route in app/main.py and app/routes/__init__.py
- Create alembic migration 0028_user_preferences
- Add UserPreference model to conftest.py for test schema
- Fix pre-existing conftest seed (Contact industry field removed in migration 0027)
Frontend:
- Create frontend/src/api/userPreferences.ts with React Query hooks
- Create frontend/src/hooks/useUserPreferences.ts syncing with uiStore
- Add i18n entries for de.json and en.json
Tests:
- 13 tests covering CRUD, tenant isolation, CSRF, unauthenticated access
- All tests passing
|
2026-07-23 20:39:42 +02:00 |
|
|
Agent Zero
|
879106c4eb
|
Phase 1C: Frontend unified contact UI
|
2026-07-23 17:17:32 +02:00 |
|
|
Agent Zero
|
beaca24480
|
feat: phase 3 - field-level permissions with plugin field definitions, service-layer filtering, 20 core field definitions
|
2026-07-15 23:02:30 +02:00 |
|
|
Agent Zero
|
08fd3ab72c
|
feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)
|
2026-07-15 22:35:50 +02:00 |
|
|
Agent Zero
|
b490a62322
|
feat: granular RBAC system with user groups, deny-list, permission registry, system-admin, self-mod prevention
|
2026-07-15 21:59:45 +02:00 |
|