fix: tsconfig exclude test files for frontend build

fix: RLS fail-closed migration + per-tenant startup code
fix: comprehensive system audit fixes (55+ issues)
2026-07-31 01:33:52 +02:00 · 2026-07-31 01:31:41 +02:00 · 2026-07-31 00:58:05 +02:00 · 2026-07-30 20:03:10 +02:00 · 2026-07-30 20:02:28 +02:00 · 2026-07-30 18:45:31 +02:00
350 changed files with 33852 additions and 2851 deletions
@@ -1,9 +1,38 @@
 # LeoCRM — Current Status
-**Phase**: Fix Branch — P1-4 Complete
+**Phase**: Fix Branch — 20/22 FIX-PLAN Items erledigt
-**Last update**: 2026-07-25 19:17
+**Last update**: 2026-07-26 16:25
 **Branch**: main (leocrm-fix)
-## P1-4: Transactional Outbox — COMPLETE
+## FIX-PLAN Überprüfung (2026-07-26)
 Alle 22 Items gegen Codebasis verifiziert. 20 erledigt, 2 offen.
 ### Erledigt (20)
 - P0-1: Auth-Bypass entfernt ✅
 - P0-2: Migrationen repariert ✅
 - P0-3: Plugin-Upload deaktiviert ✅
 - P0-4: RLS FORCE + WITH CHECK ✅
 - P0-5: Plugin-Doppelregistrierung behoben ✅
 - P0-6: Persistent Volume ✅
 - P1-1: User/Tenant-Modell bereinigt ✅
 - P1-2: Redis zentralisiert ✅
 - P1-3: Worker ausgelagert ✅
 - P1-4: Transactional Outbox ✅
 - P1-5: XSS-Stellen geschlossen ✅
 - P1-6: DMS lastfest ✅
 - P1-7: Permission-System vereinheitlicht ✅
 - P1-8: Password Reset funktionsfähig ✅
 - P1-9: Metrics abgesichert ✅
 - P1-10: Coolify-Doku & Config korrigiert ✅
 - P1-11: Cross-Tenant FK ✅
 - P2-1: Contact Model normalisiert ✅
 - P2-3: Commands & Statusmaschinen ✅
 - P2-4: SPA Path-Traversal ✅
 ### Offen (2)
 - P0-7: App von öffentlicher Domain nehmen (operational — 30 Min)
 - P2-2: Plugin-Cross-Imports reduzieren (228 Imports — 1-2 Wochen)
 ## Previous: P1-4: Transactional Outbox — COMPLETE
 - Migration 0040_outbox.py created (down_revision=0039_contact_normalize)
 - event_outbox table: id, tenant_id, event_name, payload JSONB, status, attempts, max_attempts, next_retry_at, timestamps
 - app/core/outbox.py: enqueue_outbox_event() + process_outbox_batch() with FOR UPDATE SKIP LOCKED, exponential backoff retry
@@ -16,6 +45,3 @@
 ## Previous: P2-1: Unified Contact Model normalisieren — COMPLETE
 - Migration 0039_contact_normalize.py (down_revision=0038_dms_content_hash)
 ## Next Step
 - Continue with next fix task from FIX-PLAN.md
@@ -1,6 +1,10 @@
 # LeoCRM — Next Steps
-1. P2-1: Unified Contact Model normalisieren — COMPLETE
+
-2. P1-4: Transactional Outbox — COMPLETE
+## FIX-PLAN Offene Items (2026-07-26)
-3. Continue with next fix task from FIX-PLAN.md (next priority)
+1. P0-7: App von öffentlicher Domain nehmen (operational — 30 Min)
-4. Pre-existing test failures (403/404 in test_contacts.py) need separate investigation — not caused by P1-4 or P2-1
+2. P2-2: Plugin-Cross-Imports reduzieren (228 Imports — 1-2 Wochen)
-5. notification.created event in notifications.py kept on event_bus.publish() (local notification signal, not a domain event needing cross-process delivery)
+
 ## Abgeschlossen
 - P2-1: Unified Contact Model normalisieren — COMPLETE
 - P1-4: Transactional Outbox — COMPLETE
 - 20/22 FIX-PLAN Items erledigt (siehe .a0/current_status.md)
@@ -0,0 +1,200 @@
 # LeoCRM Security & Data Risk Assessment
 **Date:** 2026-07-26
 **Assessor:** Security Data Engineer (A0 Orchestrator)
 **Project:** LeoCRM at `/a0/usr/workdir/leocrm-fix`
 ---
 ## Summary
 | Severity | Count |
 |----------|-------|
 | CRITICAL | 5     |
 | HIGH     | 8     |
 | MEDIUM   | 8     |
 | LOW      | 5     |
 | **Total**| **26**|
 ---
 ## CRITICAL Issues
 ### C-1: Redis Default Password `changeme` in docker-compose.yml
 **File:** `docker-compose.yml:53`
 **Risk:** Redis stores session data, CSRF tokens, and rate-limit counters. The default password `changeme` is trivially guessable. If Redis port 6379 is exposed, an attacker can read/modify all sessions, steal CSRF tokens, and bypass rate limits.
 **Remediation:** Remove the default fallback. Require `REDIS_PASSWORD` as a mandatory variable (`${REDIS_PASSWORD:?REDIS_PASSWORD is required}`). Use a strong randomly generated password in production.
 ### C-2: No SECRET_KEY in `.env` — Insecure Default Active in Development
 **File:** `.env` (missing `SECRET_KEY`), `app/config.py:55`
 **Risk:** `.env` has no `SECRET_KEY`. The config defaults to `"change-me-in-production-use-a-secure-random-string"`. While `get_settings()` raises in production mode, `.env` sets `ENVIRONMENT=development`, so the default key is silently used. Any signing/token operation using `secret_key` is compromised.
 **Remediation:** Add a strong random `SECRET_KEY` (min 32 chars) to `.env`. Fail-fast in all environments if the default key is detected, not just production.
 ### C-3: PostgreSQL and Redis Ports Exposed to Host
 **File:** `docker-compose.yml:37-38, 56-57`
 **Risk:** `ports: "5432:5432"` and `ports: "6379:6379"` expose the database and Redis to the host network. Combined with weak/default credentials, this allows direct external access to all session data and the entire database.
 **Remediation:** Remove port mappings for production. Use Docker internal networking only (`crm-net`). If debug access is needed, bind to `127.0.0.1:5432:5432` and document it as dev-only.
 ### C-4: Unauthenticated Error Endpoint Forwards Data to External Forgejo
 **File:** `app/routes/errors.py:54-90`, `app/plugins/builtins/forgejo_error_reporter/service.py:151-250`
 **Risk:** The `/api/v1/errors` endpoint requires no authentication. CSRF middleware explicitly bypasses token checks for this path (line 48 of `middleware.py`). Any unauthenticated attacker can POST arbitrary error data (message, stack, URL, userAgent, and **arbitrary context dict**) which gets forwarded to an external Forgejo instance as a public issue. The `context` field accepts `dict[str, Any]` with no size limit on individual keys — an attacker can exfiltrate data or inject malicious content into Forgejo issues.
 **Remediation:** Require authentication for error reporting. If unauthenticated errors are needed, strip the `context` field entirely, add strict schema validation with size limits on all fields, and add a CAPTCHA or stricter rate limiting.
 ### C-5: Plaintext Database Password in `.env`
 **File:** `.env:1`
 **Risk:** `DATABASE_URL=postgresql+asyncpg://leocrm:leocrm@localhost:5432/leocrm` embeds the DB password `leocrm` in plaintext. While `.gitignore` covers `.env`, the password is weak and identical to the username. If the file is accessed via any path traversal, backup leak, or container escape, the database is fully compromised.
 **Remediation:** Use a strong unique password. Separate `DATABASE_URL` construction from credential storage where possible (e.g., use individual `POSTGRES_USER`, `POSTGRES_PASSWORD`, `POSTGRES_HOST`, `POSTGRES_DB` env vars and construct the URL in code).
 ---
 ## HIGH Issues
 ### H-1: Rate Limiter Trusts X-Forwarded-For Without Validation
 **File:** `app/core/rate_limit.py:43-45`
 **Risk:** `get_client_ip()` blindly trusts the `X-Forwarded-For` header. An attacker can set arbitrary values to bypass rate limits on login, password reset, and other endpoints. Each request with a different spoofed IP creates a new rate-limit counter.
 **Remediation:** Only trust `X-Forwarded-For` from known proxy IPs. Configure a trusted proxy list and validate the header chain. Use Starlette's `ProxyHeadersMiddleware` or validate against a `TRUSTED_PROXIES` env var.
 ### H-2: Duplicate `get_redis()` Functions — Connection Leak
 **File:** `app/core/auth.py:53-66` and `app/core/auth.py:94-96`
 **Risk:** Two `get_redis()` functions exist. The first (line 53) returns a singleton. The second (line 94) creates a **new Redis connection on every call**. Code importing `get_redis` may use either version. The middleware (line 69) creates its own Redis connection per request. This leads to connection pool exhaustion under load.
 **Remediation:** Remove the second `get_redis()` (line 94-96). Ensure all code uses the singleton version. The middleware should use `get_redis()` from `app.core.auth` instead of creating its own connection.
 ### H-3: CSRF Middleware Creates New Redis Connection Per Request
 **File:** `app/core/middleware.py:69-90`
 **Risk:** For every unsafe HTTP request, the middleware creates a new `aioredis.from_url()` connection, uses it, then closes it. Under load, this creates thousands of connections and can exhaust Redis connection limits.
 **Remediation:** Use the global Redis singleton via `from app.core.auth import get_redis`. Remove the per-request connection creation and the `finally: await redis.close()` block.
 ### H-4: CSRF Token Stored Plaintext in PostgreSQL
 **File:** `app/core/auth.py:141` (`SessionModel` stores `csrf_token`)
 **Risk:** The CSRF token is stored as plaintext in the PostgreSQL `sessions` table (audit trail). If the database is compromised, all active CSRF tokens are available for CSRF attacks.
 **Remediation:** Store only a hash of the CSRF token in PostgreSQL (like `hash_token()` already exists for session tokens). Compare hashes during validation.
 ### H-5: No File Upload Validation in Storage Backend
 **File:** `app/core/storage.py:69-128`
 **Risk:** `LocalStorage` performs no validation on uploaded files:
 - No path traversal protection: `os.path.join(self.base_path, path)` with a malicious `path` containing `../../` can write anywhere on the filesystem
 - No file type/extension whitelist
 - No file size limit
 - No content-type validation
 - `get_url()` returns the full filesystem path, leaking internal directory structure
 **Remediation:** Sanitize `path` with `os.path.realpath()` and verify it's within `base_path`. Enforce file size limits, extension whitelist, and MIME type validation. Return relative paths from `get_url()`, not absolute filesystem paths.
 ### H-6: WebSocket Connections Lack Authentication Verification
 **File:** `app/plugins/builtins/kommunikation/websocket_manager.py:23-28`, `app/plugins/builtins/ai_ui_control/websocket_manager.py:40-46`
 **Risk:** Both WebSocket managers accept connections via `connect(websocket, user_id)` without verifying that `user_id` is authenticated. The security depends entirely on the calling route. If any WebSocket route passes an untrusted `user_id` (e.g., from query params), an attacker can impersonate any user. There is also no origin verification on WebSocket connections.
 **Remediation:** Verify session cookie inside `connect()` before `websocket.accept()`. Validate the `Origin` header against allowed CORS origins. Add authentication middleware for WebSocket routes.
 ### H-7: In-Memory Rate Limiter in Error Endpoint — Fails with Multiple Workers
 **File:** `app/routes/errors.py:21-40`
 **Risk:** The error endpoint uses a process-local `defaultdict(deque)` for rate limiting. With multiple Uvicorn workers (common in production), each worker has its own counter. An attacker can make `RATE_LIMIT * num_workers` requests per minute.
 **Remediation:** Use the Redis-based `check_rate_limit()` from `app/core/rate_limit.py` instead of the in-memory implementation.
 ### H-8: No CSRF Protection on WebSocket Connections
 **File:** Both WebSocket managers
 **Risk:** WebSocket connections are not protected against CSRF. A malicious site can open a WebSocket to the CRM backend via JavaScript `new WebSocket()` and send commands as the authenticated user (cookies are sent automatically with SameSite=Strict for same-site, but cross-site WebSocket hijacking is still possible if SameSite is configured differently or cookies are sent via `credentials`).
 **Remediation:** Verify the `Origin` header on WebSocket upgrade requests. Reject connections from untrusted origins.
 ---
 ## MEDIUM Issues
 ### M-1: Login Response Leaks `is_system_admin` Flag
 **File:** `app/routes/auth.py:78`
 **Risk:** The login response includes `"is_system_admin": user.is_system_admin`. An attacker who compromises a session or intercepts the response knows whether the account has system-wide privileges, enabling targeted attacks.
 **Remediation:** Do not include `is_system_admin` in the login response. The frontend can determine admin status via the `/me/permissions` endpoint.
 ### M-2: Weak Password Validation — No Complexity Requirements
 **File:** `app/schemas/auth.py:10` (login: `min_length=1`), `app/schemas/user.py:11` (create: `min_length=8`)
 **Risk:** Login accepts any password length (min_length=1). User creation requires min 8 chars but no complexity (uppercase, lowercase, digits, special chars). Users can set passwords like `aaaaaaaa`.
 **Remediation:** Add password complexity validation (min 12 chars, mixed case, digits, special chars) for user creation and password reset. Keep login min_length=1 to avoid leaking whether the password was partially correct.
 ### M-3: F-String Interpolation of Table/Column Names in Raw SQL
 **File:** `app/plugins/builtins/unified_search/embedding.py:194`, `search_engine.py:153`, `routes.py:294,300`, `jobs.py:183,228`
 **Risk:** Multiple raw SQL queries use f-strings to interpolate table and column names: `f"UPDATE {table} SET ..."`, `f"SELECT {emb_col} FROM {table_name} ..."`. While the values come from hardcoded `table_map` dicts (not user input), this pattern is fragile — a future change could introduce user-controlled values into the map.
 **Remediation:** Use SQLAlchemy ORM queries instead of raw SQL where possible. If raw SQL is needed, validate table/column names against an allowlist before interpolation, or use `sqlalchemy.sql.quoted_name` for safe identifier quoting.
 ### M-4: Forgejo Error Reporter Sends Full Context to External Service
 **File:** `app/plugins/builtins/forgejo_error_reporter/service.py:196-199`
 **Risk:** The error reporter serializes the entire `context` dict into the Forgejo issue body as JSON. If frontend error reporting includes sensitive data (user tokens, PII, tenant data), it will be written to an external Forgejo repository as a public issue.
 **Remediation:** Add a field-level allowlist for context data. Strip or redact sensitive keys (tokens, passwords, emails, phone numbers). Consider making Forgejo issues private/confidential.
 ### M-5: Config Has Hardcoded Default Secret Key
 **File:** `app/config.py:55`
 **Risk:** The default `secret_key = "change-me-in-production-use-a-secure-random-string"` is a known public value. While production mode checks for it, development mode silently uses it. If dev environments are exposed (even temporarily), all signed tokens are forgeable.
 **Remediation:** Remove the default value entirely. Make `secret_key` a required field with no default. Fail in all environments if not set.
 ### M-6: `LocalStorage.get_url()` Returns Absolute Filesystem Path
 **File:** `app/core/storage.py:116-117`
 **Risk:** `get_url()` returns `self._full_path(path)` which is the absolute filesystem path (e.g., `/data/uploads/tenant1/file.pdf`). If this URL is returned to the frontend or used in API responses, it leaks the internal directory structure and can aid path traversal attacks.
 **Remediation:** Return a relative path or a signed download URL that routes through an authenticated API endpoint.
 ### M-7: Inconsistent Environment Configuration in `.env`
 **File:** `.env:3,4`
 **Risk:** `.env` sets `ENVIRONMENT=development` but `SESSION_COOKIE_SECURE=true`. In development with HTTP, secure cookies won't be sent, causing auth failures. More importantly, the `ENVIRONMENT=development` setting disables the production safety checks in `get_settings()`, allowing the default `SECRET_KEY` to be used.
 **Remediation:** Use separate `.env.development` and `.env.production` files. Ensure development configs are never accidentally deployed.
 ### M-8: Permission Cache Falls Back to Stale Data on DB Error
 **File:** `app/core/permissions.py:337-344`
 **Risk:** When `_get_current_permission_version()` fails (DB error), the code sets `current_version = cached_version` and uses potentially stale cached permissions. If a user's permissions were revoked during the DB outage, they retain elevated access.
 **Remediation:** On DB error, either fail closed (deny access) or use a shorter stale-while-error TTL. Log the event as a security incident.
 ---
 ## LOW Issues
 ### L-1: `document.write()` with DOM Clone in Print Utility
 **File:** `frontend/src/utils/print.ts:54, 127`
 **Risk:** `printElement()` and `exportToPDF()` use `document.write()` with `clone.outerHTML`. If the printed DOM element contains user-controlled content (e.g., contact notes with HTML), it executes in a new window context. The new window is same-origin, limiting the impact, but it's still an unnecessary risk.
 **Remediation:** Use DOM APIs (`appendChild`, `importNode`) instead of `document.write()`. Alternatively, sanitize the cloned HTML before writing.
 ### L-2: Session Data Stored in Redis Without Encryption
 **File:** `app/core/auth.py:130-134`
 **Risk:** Session data (user_id, tenant_id, email, role, csrf_token, is_system_admin) is stored as plaintext JSON in Redis. Anyone with Redis access can read all active sessions.
 **Remediation:** Encrypt session data before storing in Redis, or accept the risk given Redis should be network-isolated. At minimum, ensure Redis requires authentication and is not exposed.
 ### L-3: No Security Headers Middleware
 **File:** No security headers middleware found
 **Risk:** The application does not set security headers like `X-Content-Type-Options`, `X-Frame-Options`, `Strict-Transport-Security`, `Content-Security-Policy`.
 **Remediation:** Add a security headers middleware or use `starlette-securehead`/`secure` package.
 ### L-4: No Origin Verification on WebSocket Upgrade
 **File:** Both WebSocket managers
 **Risk:** Neither WebSocket manager checks the `Origin` header before accepting connections. While cookies with `SameSite=Strict` provide some protection, some browsers and non-browser clients may not respect SameSite on WebSocket connections.
 **Remediation:** Check `websocket.headers.get("origin")` against `settings.cors_origin_list` before calling `websocket.accept()`.
 ### L-5: Unbounded Feedback/Command Storage in AI UI Control WebSocket
 **File:** `app/plugins/builtins/ai_ui_control/websocket_manager.py:94-103`
 **Risk:** `store_feedback()` stores feedback dicts without size limits. `cleanup_stale()` only runs when explicitly called. An attacker who can send WebSocket messages could fill memory with large feedback payloads.
 **Remediation:** Add size limits on feedback payloads. Run `cleanup_stale()` on a timer or on each `connect()`/`disconnect()`.
 ---
 ## Positive Findings
 1. **Dockerfile security:** Multi-stage build, non-root user (`appuser` UID 1000), healthcheck configured, no secrets baked into image.
 2. **RLS implementation:** PostgreSQL Row Level Security with `FORCE` (migration 0028) ensures tenant isolation even for table owners. `set_tenant_context()` uses parameterized queries.
 3. **Password hashing:** bcrypt with configurable rounds (default 12).
 4. **Session tokens:** `secrets.token_urlsafe(32)` — cryptographically secure.
 5. **XSS protection:** `HtmlBlock.tsx` and `SignatureManager.tsx` use `DOMPurify.sanitize()` before `dangerouslySetInnerHTML`.
 6. **RBAC architecture:** Deny-list takes precedence over allow-list. Field-level permissions with strictest-wins merging. Permission version-based cache invalidation.
 7. **No user enumeration:** Password reset endpoint always returns 200.
 8. **SQL injection:** ORM queries use parameterized statements throughout. Raw SQL in `unified_search` uses hardcoded maps (not directly exploitable).
 9. **`.gitignore`** properly covers `.env`, `.env.*`, and excludes example files.
 10. **Production safety checks** in `get_settings()` validate `SECRET_KEY`, `SESSION_COOKIE_SECURE`, and `STORAGE_PATH`.
 ---
 ## Migration & Data Loss Risks
 1. **RLS policies:** Multiple migrations (0001, 0002, 0004, 0015, 0021, 0028) create and modify RLS policies. Migration 0028 adds `FORCE ROW LEVEL SECURITY`. Ensure all migrations are applied in order before production deployment.
 2. **Backup risk:** No backup/restore procedure found in the repository. The `last_backup_at` system setting is referenced in automation jobs but no backup script exists.
 3. **Volume persistence:** `docker-compose.yml` defines named volumes for `pgdata`, `redisdata`, and `storage`. Good for persistence, but no backup strategy documented.
 4. **Migration rollback:** Down migrations exist but should be tested. RLS policy down migrations disable RLS — running a rollback in production would expose all tenant data.
 ---
 ## Remediation Priority
 1. **Immediate (before any production deploy):** C-1, C-2, C-3, C-4, C-5, H-1, H-2, H-3
 2. **Short-term (within 1 sprint):** H-4, H-5, H-6, H-7, H-8, M-1, M-2, M-5
 3. **Medium-term (within 2 sprints):** M-3, M-4, M-6, M-7, M-8, L-1, L-2, L-3, L-4, L-5
@@ -15,23 +15,48 @@ POSTGRES_USER=crm_user
 POSTGRES_PASSWORD=STRONG_PASSWORD_HERE
 POSTGRES_DB=crm_db
-# --- CRM Application ----------------------------------------------------------
+# --- Redis (REQUIRED) ---------------------------------------------------------
-# The host "postgres" is the docker-compose service name (internal DNS).
+# Generate a strong password:
-# The DRIVER is asyncpg for production PostgreSQL.
+#   python -c "import secrets; print(secrets.token_urlsafe(24))"
-DATABASE_URL=postgresql+asyncpg://crm_user:STRONG_PASSWORD_HERE@postgres:5432/crm_db
+REDIS_PASSWORD=STRONG_REDIS_PASSWORD_HERE
-# --- AUTH_SECRET (REQUIRED, min 32 chars) ------------------------------------
+# --- CRM Application: Runtime DB user (NOSUPERUSER, NOBYPASSRLS) --------------
 # The app and worker use crm_runtime — RLS is enforced.
 # This user is created by migration 0044 with DML-only permissions.
 # Set RUNTIME_DB_PASSWORD to the password you want for crm_runtime.
 RUNTIME_DB_PASSWORD=STRONG_RUNTIME_PASSWORD_HERE
 DATABASE_URL=postgresql+asyncpg://crm_runtime:STRONG_RUNTIME_PASSWORD_HERE@postgres:5432/crm_db
 # --- CRM Application: Migration DB user (owner, can run DDL) -----------------
 # Migrations and DDL operations use the owner user (crm_user).
 # This is NOT used by the app at runtime — only by prestart.sh / alembic.
 MIGRATION_DATABASE_URL=postgresql+asyncpg://crm_user:STRONG_PASSWORD_HERE@postgres:5432/crm_db
 # --- SECRET_KEY (REQUIRED, min 32 chars) -------------------------------------
 # Session signing secret. MUST be at least 32 characters.
 # Generate with:
 #   python -c "import secrets; print(secrets.token_urlsafe(48))"
-AUTH_SECRET=MIN_32_CHARS_GENERATE_WITH_secrets_token_urlsafe_32_xxxxxxxxxxxx
+SECRET_KEY=MIN_32_CHARS_GENERATE_WITH_secrets_token_urlsafe_32_xxxxxxxxxxxx
 # --- Frontend URL (for email links) ------------------------------------------
 # The public URL where users access the LeoCRM frontend.
 # Used for password reset links, invitations, etc.
 FRONTEND_URL=https://crm.example.com
 # --- CORS / environment -------------------------------------------------------
 # Comma-separated, NO wildcards. In dev we allow localhost:8000 (the app) and
 # :5173 (e.g. Vite dev server). In production, restrict to the real domain.
-CORS_ORIGINS=http://localhost:8000,http://localhost:5173
+CORS_ORIGINS=https://crm.example.com
 ENVIRONMENT=production
 LOG_LEVEL=INFO
-# --- bcrypt tuning (keep aligned with .env.example) --------------------------
+# --- SMTP (for password reset emails) -----------------------------------------
 SMTP_HOST=smtp.example.com
 SMTP_PORT=587
 SMTP_USERNAME=noreply@example.com
 SMTP_PASSWORD=YOUR_SMTP_PASSWORD
 SMTP_FROM_EMAIL=noreply@example.com
 SMTP_USE_TLS=true
 # --- bcrypt tuning ----------------------------------------------------------
 BCRYPT_ROUNDS=12
@@ -4,6 +4,14 @@
 DATABASE_URL=postgresql+asyncpg://leocrm:leocrm@localhost:5432/leocrm
 REDIS_URL=redis://localhost:6379/0
 # === REQUIRED for Docker/Production ===
 # Migration DB URL (owner user, can bypass RLS for DDL)
 MIGRATION_DATABASE_URL=postgresql+asyncpg://crm_migration:your_password@localhost:5432/crm_db
 # Redis password (required in Docker)
 REDIS_PASSWORD=your_redis_password
 # Runtime DB password (set crm_runtime role password on startup)
 RUNTIME_DB_PASSWORD=your_runtime_password
 # === OPTIONAL (with defaults) ===
 # Environment: development | production | testing
@@ -0,0 +1,25 @@
 name: CI/CD Pipeline
 on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
 jobs:
  quality-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: Install Python deps
        run: pip install -r requirements.txt
      - name: Install Frontend deps
        run: cd frontend && npm ci
      - name: Run CI/CD Pipeline
        run: bash scripts/ci_pipeline.sh
@@ -0,0 +1,25 @@
 # CI/CD: Check for forbidden cross-plugin imports on every push/PR
 name: Check Cross-Plugin Imports
 on:
  push:
    paths:
      - 'app/plugins/**'
      - 'scripts/check_cross_plugin_imports.py'
  pull_request:
    paths:
      - 'app/plugins/**'
      - 'scripts/check_cross_plugin_imports.py'
 jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.13'
      - name: Check cross-plugin imports
        run: python scripts/check_cross_plugin_imports.py
@@ -28,8 +28,34 @@ ENV/
 htmlcov/
 coverage.xml
 .mypy_cache/
 # Redis dump
 *.rdb
 dump.rdb
 # Frontend build output (regenerated on deploy)
 frontend/dist/
 frontend/node_modules/
 # IDE
 .idea/
 .vscode/
 *.swp
 *.swo
 # OS
 .DS_Store
 Thumbs.db
 # Logs
 *.log
 logs/
 .ruff_cache/
 # Redis dumps
 dump.rdb
 *.rdb
 # Database files
 *.db
 *.db-journal
@@ -0,0 +1,14 @@
 # Pre-commit hook: Check for forbidden cross-plugin imports
 # Install: pip install pre-commit && pre-commit install
 # Or run manually: python scripts/check_cross_plugin_imports.py
 repos:
  - repo: local
    hooks:
      - id: check-cross-plugin-imports
        name: Check cross-plugin imports
        entry: python scripts/check_cross_plugin_imports.py
        language: system
        pass_filenames: false
        always_run: true
        stages: [commit]
@@ -12,7 +12,7 @@
 #### Setup
 ```bash
-cd backend
+
 python -m venv .venv
 source .venv/bin/activate
 pip install -e ".[dev]"
@@ -20,13 +20,13 @@ pip install -e ".[dev]"
 #### Run Dev Server
 ```bash
-cd backend
+
 uvicorn app.main:app --reload --host 0.0.0.0 --port 8000
 ```
 #### Database Migrations (Alembic)
 ```bash
-cd backend
+
 # Generate migration after model changes
 alembic revision --autogenerate -m "description"
 # Apply migrations
@@ -37,37 +37,37 @@ alembic downgrade -1
 #### Run All Backend Tests
 ```bash
-cd backend
+
 python -m pytest -v --tb=short
 ```
 #### Run Specific Test File
 ```bash
-cd backend
+
 python -m pytest tests/test_auth.py -v --tb=short
 ```
 #### Run Tests with Coverage
 ```bash
-cd backend
+
 python -m pytest --cov=app --cov-report=term-missing --cov-report=html
 ```
 #### Run Tests with Grep Filter
 ```bash
-cd backend
+
 python -m pytest -k 'tenant or auth' -v
 ```
 #### Type Checking
 ```bash
-cd backend
+
 mypy app/ --ignore-missing-imports
 ```
 #### Linting
 ```bash
-cd backend
+
 ruff check app/
 ruff format app/
 ```
@@ -116,8 +116,7 @@ In **crm-app → Environment Variables**, set:
 | `ENVIRONMENT` | `production` | |
 | `LOG_LEVEL` | `INFO` | `DEBUG` only temporarily. |
 | `BCRYPT_ROUNDS` | `12` | Aligned with `.env.example`. |
-| `JWT_ALGORITHM` | `HS256` | Aligned with `.env.example`. |
+
 | `JWT_EXPIRY_HOURS` | `24` | Aligned with `.env.example`. |
 ### Secret generation (run once, locally)
@@ -144,9 +143,7 @@ are still rendered in the UI to anyone with read access to the environment.
 >       {"key":"CORS_ORIGINS",         "value":"https://crm.media-on.de:443"},
 >       {"key":"ENVIRONMENT",          "value":"production"},
 >       {"key":"LOG_LEVEL",            "value":"INFO"},
->       {"key":"BCRYPT_ROUNDS",        "value":"12"},
+>       {"key":"BCRYPT_ROUNDS",        "value":"12"}
 >       {"key":"JWT_ALGORITHM",        "value":"HS256"},
 >       {"key":"JWT_EXPIRY_HOURS",     "value":"24"}
 >     ]
 >   }'
 > ```
@@ -119,3 +119,54 @@ python scripts/deploy.py --migrate-only
 ```bash
 python scripts/deploy.py --skip-build  # startet Worker automatisch
 ```
 ## Backup & Restore
 ### Backup (PostgreSQL)
 ```bash
 # Full DB backup (run on the host or via docker exec)
 docker exec crm-postgres pg_dump -U crm_user -Fc crm_db > backup_$(date +%Y%m%d_%H%M%S).dump
 # Backup mit Custom-Format (komprimiert, parallel restore-fähig)
 docker exec crm-postgres pg_dump -U crm_user -Fc -Z 9 crm_db > backup_$(date +%Y%m%d).dump
 ```
 ### Backup (Redis — Sessions/Queues)
 ```bash
 # Redis RDB Snapshot
 docker exec crm-redis redis-cli -a "$REDIS_PASSWORD" SAVE
 docker cp crm-redis:/data/dump.rdb redis_backup_$(date +%Y%m%d).rdb
 ```
 ### Backup (File Storage)
 ```bash
 # Local storage volume
 docker run --rm -v leocrm-fix_storage:/data -v $(pwd):/backup alpine \
  tar czf /backup/storage_$(date +%Y%m%d).tar.gz /data
 ```
 ### Restore (PostgreSQL)
 ```bash
 # Stop app containers
 docker compose stop crm-app crm-worker
 # Restore DB
 docker exec -i crm-postgres pg_restore -U crm_user -d crm_db --clean < backup_20260726.dump
 # Restart app
 docker compose start crm-app crm-worker
 ```
 ### Automatisierte Backups (Cron)
 ```bash
 # /etc/cron.d/leocrm-backup
 0 2 * * * root docker exec crm-postgres pg_dump -U crm_user -Fc crm_db > /backups/leocrm_$(date +\%Y\%m\%d).dump
 0 3 * * * root find /backups -name 'leocrm_*.dump' -mtime +30 -delete
 ```
 **Empfehlung:** Tägliche DB-Backups, 30 Tage Aufbewahrung. Storage-Backup wöchentlich.
@@ -76,7 +76,7 @@ COPY --chown=appuser:appuser . .
 COPY --from=frontend --chown=appuser:appuser /frontend/dist /app/frontend/dist
 # Make entrypoint scripts executable
-RUN chmod +x /app/prestart.sh /app/worker.sh
+RUN chmod +x /app/prestart.sh /app/worker.sh /app/healthcheck.sh
 # Create storage directory
 RUN mkdir -p /data/storage && chown -R appuser:appuser /data
@@ -86,6 +86,6 @@ USER appuser
 EXPOSE 8000
 HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
-    CMD curl -fsS http://localhost:8000/api/v1/health || exit 1
+    CMD /app/healthcheck.sh
 ENTRYPOINT ["/app/prestart.sh"]
@@ -0,0 +1,210 @@
 # Enterprise RBAC Plan — LeoCRM
 ## Gesamt: 23 Sprints, 74 Features, 230h
 ### Sprint 1 — Fundament (14h)
 - [ ] entity_permissions Tabelle + expires_at + Migration 0049
 - [ ] OwnedMixin + owner_id auf allen Models + Migration 0050
 - [ ] Universeller Permission Service (CRUD + get_effective_access + get_visible_ids)
 - [ ] Universelle Permission API (5 Endpoints)
 - [ ] Redis-Cache für Entity-Permissions (Bitmap)
 - [ ] PostgreSQL RLS Policies + set_user_context()
 - [ ] Rate Limiting auf Permission-Änderungen
 - [ ] Folder ACLs in entity_permissions migrieren (Migration 0051)
 ### Sprint 2 — Row-Level Security (16h)
 - [ ] apply_visibility_filter() Helper
 - [ ] Query-Filter in alle 28 Routes
 - [ ] Child-Entity-Vererbung
 - [ ] Batch-Resolution
 - [ ] BaseSearchProvider mit Visibility-Filter
 - [ ] ContactDetail/ContactsList Permission-Checks
 - [ ] Copy/Duplicate Permission
 - [ ] EXISTS-Optimization für RLS
 ### Sprint 3 — Search/Dashboard/Export (13h)
 - [ ] GlobalSearch Visibility-Filter
 - [ ] Two-Phase Search
 - [ ] Search-Index Pre-Filter
 - [ ] Dashboard-Counts pro User
 - [ ] Export-Filter
 - [ ] Reports-Filter
 - [ ] Frontend-Filter für alle 4
 ### Sprint 4 — Field-Level komplett (10h)
 - [ ] Custom Field Sensitivity
 - [ ] Field Definitions für alle Entities + Plugin-Registration
 - [ ] filter_fields_by_permission() in alle Responses
 - [ ] Field-Level Permission Editor UI
 - [ ] Frontend: readonly/hidden in ContactDetail + ContactsList + DMS + Mail + AI
 ### Sprint 5 — Sharing UI (8h)
 - [ ] Universeller ShareDialog Komponente
 - [ ] Share-Button in 8 Detail-Ansichten
 - [ ] Owner-Spalte in 8 Listen
 - [ ] Permission-UI (Buttons ausblenden)
 - [ ] Permission-Expiration UI
 ### Sprint 6 — Notifications + Audit + Real-time (10h)
 - [ ] Permission-Change-Notifications
 - [ ] Audit-Trail für Permission-Änderungen
 - [ ] Notification-Entity-Filter
 - [ ] Real-time WebSocket Sync
 - [ ] Redis Pub/Sub für WebSocket Fan-Out
 ### Sprint 7 — E-Mail Postfächer (8h)
 - [ ] Mailbox owner_id + Migration
 - [ ] Mailbox Permissions (entity_permissions)
 - [ ] Mail Permission Migration
 - [ ] Mail-Query-Filter
 - [ ] Mail-Field-Level
 - [ ] Frontend: Mailbox-Liste + Mail-Liste + Mail-Detail
 ### Sprint 8 — Plugin Entities (14h)
 - [ ] DMS owner_id + Permissions + Migration
 - [ ] Calendar owner_id + Permissions + Migration
 - [ ] Tasks owner_id + Permissions + Migration
 - [ ] Kommunikation RBAC Migration
 - [ ] Entity Links Permission
 - [ ] Tags Permission
 - [ ] 15 Plugin Entity Registration
 - [ ] DMS Permission Migration
 - [ ] Folder-Path-Materialization
 - [ ] Frontend Permission-Checks für DMS + Calendar + Tasks
 ### Sprint 9 — App-Sichtbarkeit (7h)
 - [ ] Plugin Manifest permission Feld
 - [ ] tenant_plugin_activation Tabelle + API
 - [ ] Sidebar Permission-Filter
 - [ ] TopBar Permission-Filter
 - [ ] Settings-Navigation Permission-Filter
 - [ ] Route-Guards (ProtectedRoute)
 ### Sprint 10 — Advanced Security + AI + WebSocket (18h)
 - [ ] API-Token Scopes
 - [ ] Webhook Scope Filter
 - [ ] Workflow Scope Filter
 - [ ] Contact Merge Permission-Check
 - [ ] AI Copilot Permission-Aware (process_query + execute_action)
 - [ ] AI Tool Registry
 - [ ] AI System Prompt mit Permission-Context
 - [ ] AI Proactive Permission-Aware
 - [ ] AI UI Control Permission-Checks
 - [ ] MCP Permission-Scopes
 - [ ] Automation Permission-Checks
 - [ ] WebSocket Permission-Checks
 - [ ] Event Bus Permission-Filter
 - [ ] Frontend: AI + Notifications + Workflows + DedupMerge
 ### Sprint 11 — Owner Management (5h)
 - [ ] Owner-Transfer (Bulk) API
 - [ ] Auto-Transfer bei User-Deaktivierung
 - [ ] Backup/Restore Permissions
 - [ ] Frontend Owner-Transfer-UI
 ### Sprint 12 — Zentrale Einstellungsseite (9h)
 - [ ] Rechte-Settings-Page mit Tabs
 - [ ] Freigaben-Übersicht (Admin-Dashboard)
 - [ ] Audit-View für Permission-Changes
 - [ ] CustomFields Sensitivity UI
 - [ ] App-Sichtbarkeit-Tab
 ### Sprint 13 — ABAC Engine (18h)
 - [ ] entity_policies Tabelle + Migration
 - [ ] Policy-Engine: JSONB → SQLAlchemy Übersetzer
 - [ ] apply_policy_filter() + Integration mit RBAC-Filter
 - [ ] Policy-Cache (Redis) + Invalidation
 - [ ] Policy Service (CRUD)
 - [ ] Policy API (5 Endpoints)
 - [ ] GIN-Indexes für ABAC
 - [ ] Pre-compiled SQL Fragments
 - [ ] Policy-Intersection-Optimization
 - [ ] Materialized Policy Result
 ### Sprint 14 — ABAC UI (10h)
 - [ ] ABAC Rule-Editor mit AND/OR Gruppen
 - [ ] Feld-Auswahl (Core + Custom Fields)
 - [ ] Vorschau + Test-Tool
 - [ ] Custom Field ABAC Support (JSONB-Path)
 ### Sprint 15 — Templates & Automation (5h)
 - [ ] permission_templates Tabelle + Migration
 - [ ] Default-Policies für neue Entities
 - [ ] Auto-Share bei Erstellung
 - [ ] Frontend Template-Editor UI
 ### Sprint 16 — Mass & Bulk (4h)
 - [ ] Bulk-Share API
 - [ ] Mass-Operations
 - [ ] Frontend Bulk-Share-UI
 ### Sprint 17 — Analytics & Konflikte (5h)
 - [ ] Permission-Analytics API
 - [ ] Konflikt-Erkennung
 - [ ] Orphaned-Permissions-Cleanup
 - [ ] Frontend Analytics-Dashboard
 ### Sprint 18 — Delegation (4h)
 - [ ] permission_delegations Tabelle + Migration
 - [ ] Delegation Service + API
 - [ ] Abwesenheits-UI
 - [ ] Auto-Expiry
 ### Sprint 19 — Resolution-Strategien (3h)
 - [ ] Konfigurierbare Override-Regeln
 - [ ] Tenant-Einstellung
 - [ ] Frontend UI
 ### Sprint 20 — Tests (12h)
 - [ ] Backend: Entity Permissions Tests
 - [ ] Backend: ABAC Tests
 - [ ] Backend: Performance Tests (100K Datensätze)
 - [ ] Backend: Search Permission Tests
 - [ ] Backend: WebSocket Permission Tests
 - [ ] Frontend: ProtectedRoute Tests
 - [ ] Frontend: Permission-UI Tests
 - [ ] Frontend: ShareDialog Tests
 ### Sprint 21 — Dokumentation (3h)
 - [ ] docs/permissions.md
 - [ ] docs/permissions_plugin_dev.md
 - [ ] Plugin Template mit Permission-Beispielen
 - [ ] API-Docs
 ### Sprint 22 — Guest Access (28h)
 - [ ] guest_users Tabelle + Migration
 - [ ] Guest Auth (Login, Session, Logout)
 - [ ] Guest Permission Resolution (Service + RLS)
 - [ ] Guest Invitation Flow (Backend + E-Mail)
 - [ ] Guest API (limited endpoints)
 - [ ] Guest Frontend (vereinfachtes Layout + Views)
 - [ ] Guest Permission Management UI (Settings)
 - [ ] Guest Expiration & Auto-Cleanup
 - [ ] Guest Audit Trail
 - [ ] Guest Security (IP-Whitelist, Rate Limit, Watermarking)
 - [ ] Guest Tests
 ### Sprint 23 — Infrastructure (4h)
 - [ ] PgBouncer Setup
 - [ ] Audit Log Partitioning
 - [ ] Connection Pool Config
 ## Permission Levels
 | Level | Sichtbar? | Bearbeiten? | Löschen? | Teilen? |
 |-------|:---:|:---:|:---:|:---:|
 | Owner | ✅ | ✅ | ✅ | ✅ |
 | Admin | ✅ | ✅ | ✅ | ✅ |
 | Write | ✅ | ✅ | ❌ | ❌ |
 | Read | ✅ | ❌ | ❌ | ❌ |
 | None | ❌ | ❌ | ❌ | ❌ |
 ## Architecture
 - PostgreSQL RLS (Safety Net)
 - Materialized View (user_entity_visibility)
 - Redis Bitmap Cache
 - Batch-Resolution
 - GIN-Indexes (ABAC + JSONB)
 - Folder-Path-Materialization (GiST)
 - PgBouncer Connection Pool
 - Redis Pub/Sub WebSocket Fan-Out
 - Audit Log Partitioning
@@ -0,0 +1,323 @@
 # LeoCRM Fix-Plan V2 — Gründliche Analyse & Maßnahmen
 *Erstellt: 2026-07-26 — basierend auf externem Audit + eigener Code-Verifikation*
 ---
 ## Zusammenfassung
 Von 16 zentralen Punkten des externen Audits wurden **alle 16 durch Code-Inspektion verifiziert**. Zusätzlich wurden **5 neue Probleme** gefunden (UploadFile-Bug, Redis-Default-Passwort, exponierte Ports, unauthentifizierter Error-Endpoint, fehlende Security-Headers).
 **Gesamtstatus:** Alle Phasen implementiert (Stand 2026-07-27). M5 (Frontend-Integration) als letzte Phase abgeschlossen.
 ---
 ## Implementierungs-Status (Stand 2026-07-27)
 Die folgenden Phasen wurden gemäß Git-Historie implementiert:
 | Phase | Commit | Maßnahmen | Status |
 |-------|--------|-----------|--------|
 | **Phase 1** (B1-B10) | `5ec1fc9` | Kritische Release-Blocker: Redis-Singleton (B1), Plugin-Routen (B2), UploadFile response_model (B3), DMS-Streaming (B4), Outbox-Worker (B5), Passwort-Reset-Mail (B6), Webhook-SSRF (B7), RLS-DB-Role (B8), .env-Korrektur (B9), Redis-Ports (B10) | ✅ Implementiert |
 | **Phase 2** (H1-H7) | `604a2b7` | Error-Endpoint (H1), Rate-Limiter (H2), CSRF-Redis (H3), WebSocket-Auth (H4), File-Upload (H5), Security-Headers (H6), Migration-Repair (H7) | ✅ Implementiert |
 | **Phase 3** (M1-M4, M6) | `825d638` | Passwort-Komplexität (M1), Login-Response (M2), Permission-Cache (M3), ENVIRONMENT (M4), weitere (M6) | ✅ Implementiert |
 | **Phase 4** | `b6e3afd` | Webhooks, Backup/Restore UI, Onboarding/Tutorial | ✅ Implementiert |
 | **Plugin-System-Umbau** | `98eb1d0` | Plugin-Routen nur in create_app(), require_active_plugin() Dependency, WebSocket-Skip | ✅ Implementiert |
 ### Verifizierte P0-Behebungen
 | P0 | Problem | Status | Beweis |
 |----|---------|--------|--------|
 | P0-1 | Auth-Bypass via X-Internal-Call | ✅ Behoben | `app/deps.py` hat keinen X-Internal-Call Code mehr. Auth nur via Session-Cookie. |
 | P0-2 | Destruktive Migrationen | ✅ Behoben | Migration 0021 benennt Tabellen um (`*_old`). Migration 0044 repariert RLS. |
 | P0-3 | Plugin-Upload RCE | ✅ Neutralisiert | Alle Upload-Endpoints deaktiviert (403). `_extract_plugin_from_zip()` ist Dead Code. |
 | P0-4 | RLS nicht erzwungen | ✅ Behoben | Migration 0028 setzt FORCE RLS. Migration 0044 erstellt `crm_runtime` (NOSUPERUSER, NOBYPASSRLS). |
 | P0-5 | Plugin-Doppelregistrierung | ✅ Behoben | Routen nur in create_app(). require_active_plugin() prüft Aktivierungsstatus. |
 | P0-6 | Kein persistentes Volume | ✅ Behoben | docker-compose.yml hat volumes für PostgreSQL, Redis, App-Uploads, Worker. |
 | P0-7 | Öffentliche Domain | ✅ Behoben | Keine crm.media-on.de Referenz mehr in docker-compose.yml. |
 ### Weitere verifizierte Behebungen
 - **B1** (doppelte get_redis()): ✅ Nur eine Definition in `app/core/auth.py` Zeile 53
 - **B3** (UploadFile response_model): ✅ `response_model=None` in dms, calendar, mail routes
 - **B7** (Webhook SSRF): ✅ Private IP-Check, `follow_redirects=False`, Protokoll-Check
 - **B9** (AUTH_SECRET vs SECRET_KEY): ✅ `.env.docker.example` verwendet `SECRET_KEY`
 - **B10** (Redis-Default-Passwort + Ports): ✅ Ports auskommentiert, Redis-Passwort required
 - **WebSocket Auth**: ✅ Beide WS-Endpunkte haben `verify_ws_origin()`, Session-Cookie-Validierung, `user_id` aus Session
 ---
 ## Phase 1: Kritische Release-Blocker (vor Produktivbetrieb)
 ### B1. Doppelte `get_redis()` entfernen
 - **Datei:** `app/core/auth.py` Zeilen 53 + 94
 - **Problem:** Zweite Definition überschreibt Singleton, erzeugt pro Aufruf neue Verbindung → Connection Leak
 - **Fix:** Zweite `def get_redis()` (Zeile 94) löschen. Erste Definition (Zeile 53) beibehalten.
 - **Aufwand:** 5 Min
 - **Risiko:** Keines — erste Definition ist korrekt
 ### B2. Plugin-Routen-Registrierung reparieren
 - **Datei:** `app/main.py` Zeilen 375-416
 - **Problem:** Alle Plugin-Routen werden statisch in `create_app()` registriert, unabhängig vom Aktivierungsstatus. Deaktivierte Plugins bleiben erreichbar. Kommentar in Zeile 416 sagt das Gegenteil.
 - **Fix:**
  1. Statische Registrierung aus `create_app()` entfernen
  2. In `lifespan()` nur Routen für `active=True` Plugins registrieren
  3. `Depends(require_active_plugin("name"))` als zentrale Prüfung ergänzen
  4. Bei Deaktivierung: Router entfernen oder 403-Dependency ergänzen
 - **Aufwand:** 2-3 Std
 - **Risiko:** Mittel — muss sicherstellen dass keine Route doppelt registriert wird
 ### B3. UploadFile Route-Registration Bug
 - **Dateien:** `app/plugins/builtins/dms/routes.py`, `calendar/routes.py`, `mail/routes.py`, `kommunikation/routes.py`, `ai_assistant/routes.py`
 - **Problem:** FastAPI kann `UploadFile` nicht als Response-Model auflösen → 5 Plugins failen beim Registrieren mit `Invalid args for response field`
 - **Fix:** `response_model=None` zu allen Endpoints mit `UploadFile`-Rückgabe hinzufügen, oder Return-Type auf `Response`/`dict` ändern
 - **Aufwand:** 30 Min
 - **Risiko:** Keines — Routen sind aktuell gar nicht registriert
 ### B4. DMS-Upload auf echtes Streaming umstellen
 - **Datei:** `app/plugins/builtins/dms/routes.py` Zeilen 444-472
 - **Problem:** Chunks werden in `list[bytes]` gesammelt, dann `b"".join()` → 100MB Datei = 200MB+ RAM. `save_stream()` existiert aber wird nicht benutzt.
 - **Fix:**
  ```python
  async def chunk_generator():
      while chunk := await file.read(CHUNK_SIZE):
          yield chunk
  await storage.save_stream(storage_path, chunk_generator())
  ```
  Hash und Größe während des Streams berechnen.
 - **Aufwand:** 1 Std
 - **Risiko:** Gering — save_stream() ist bereits implementiert
 ### B5. Outbox-Worker: Event-Handler registrieren
 - **Datei:** `app/core/worker.py` `on_startup()`
 - **Problem:** Worker liest Events aus Outbox, published an lokalen EventBus, aber es sind keine Handler registriert → Events werden als `published` markiert ohne Verarbeitung
 - **Fix:**
  1. In `on_startup()`: Plugin-Event-Handler registrieren (wie in `lifespan()` der API)
  2. `webhook_dispatcher._dispatch_event` an EventBus subscriben
  3. Plugin-Participant-Handler registrieren
 - **Aufwand:** 2 Std
 - **Risiko:** Mittel — muss gleiche Handler wie API-Container registrieren
 ### B6. Passwort-Reset-Mailjob implementieren
 - **Dateien:** `app/services/auth_service.py`, `app/core/jobs.py`, `app/core/job_registry.py`
 - **Problem:** `send_password_reset_email` Job wird gequeued aber nie registriert → Mail wird nicht versendet. Token wird in Logs geschrieben (Zeile 240-241).
 - **Fix:**
  1. `send_password_reset_email` Worker-Funktion implementieren (SMTP/IMAP)
  2. Mit `register_job()` registrieren
  3. `logger.warning("raw_token for development: %s", raw_token)` entfernen
  4. Token nur im Development-Mode loggen, nie in Production
 - **Aufwand:** 2 Std
 - **Risiko:** Gering
 ### B7. Webhook SSRF-Schutz + Secret-Behandlung
 - **Dateien:** `app/services/webhook_service.py`, `app/schemas/webhook.py`
 - **Problem:** Kein SSRF-Schutz — User können interne Dienste ansprechen (redis:6379, postgres:5432, 169.254.169.254). Webhook-Secret wird im Response zurückgegeben.
 - **Fix:**
  1. SSRF-Prüfung: DNS auflösen, private IPs blocken (10.x, 172.16-31.x, 192.168.x, 127.x, 169.254.x, ::1)
  2. Redirects deaktivieren oder prüfen
  3. Protokoll-Allowlist (nur https)
  4. `secret` aus `WebhookResponse` entfernen
  5. Secret gehasht in DB speichern
 - **Aufwand:** 3 Std
 - **Risiko:** Gering
 ### B8. RLS: Separater DB-Runtime-User
 - **Dateien:** `docker-compose.yml`, `alembic/versions/0044_db_roles.py` (neu)
 - **Problem:** `POSTGRES_USER` (crm_user) ist Superuser → umgeht RLS auch mit FORCE. Spätere Tabellen (user_preferences, saved_filters, etc.) haben keine RLS-Policy.
 - **Fix:**
  1. Neue Migration `0044_db_roles.py`: erstellt `crm_runtime` (NOSUPERUSER, NOBYPASSRLS)
  2. `crm_runtime` bekommt nur SELECT/INSERT/UPDATE/DELETE Rechte
  3. `docker-compose.yml`: API und Worker nutzen `crm_runtime`, Migrationen nutzen `crm_owner`
  4. Neue Migration `0045_rls_new_tables.py`: RLS für alle Tabellen mit `tenant_id` die nach 0028 hinzukamen
 - **Aufwand:** 4 Std
 - **Risiko:** Hoch — muss bestehende Datenbanken migrieren ohne Datenverlust
 ### B9. .env.docker.example korrigieren
 - **Datei:** `.env.docker.example`
 - **Problem:** Verwendet `AUTH_SECRET` statt `SECRET_KEY` (config.py erwartet `SECRET_KEY`)
 - **Fix:** `AUTH_SECRET` → `SECRET_KEY` umbenennen
 - **Aufwand:** 5 Min
 - **Risiko:** Keines
 ### B10. Redis-Default-Passwort + exponierte Ports
 - **Datei:** `docker-compose.yml`
 - **Problem:** Redis-Passwort default `changeme`, PostgreSQL (5432) und Redis (6379) Ports exponiert
 - **Fix:**
  1. Redis-Passwort als Required-Env ohne Default
  2. `ports:` Sektion für DB und Redis entfernen (nur internes Docker-Netzwerk)
  3. Falls Debug-Zugriff nötig: nur an 127.0.0.1 binden
 - **Aufwand:** 15 Min
 - **Risiko:** Gering — bestehende Setups müssen .env anpassen
 ---
 ## Phase 2: Hohe Priorität (kurz nach Release)
 ### H1. Unauthentifizierter Error-Endpoint absichern
 - **Datei:** `app/routes/errors.py`
 - **Problem:** `POST /api/v1/errors` ohne Auth, sendet Daten an Forgejo als öffentliches Issue. Context-Dict kann sensible Daten enthalten.
 - **Fix:**
  1. Context-Felder filtern (keine Tokens, Passwörter, Headers)
  2. Forgejo-Issues nur in non-production erstellen
  3. Rate-Limit auf IP-Basis (bereits vorhanden, aber in-memory → bei Multi-Worker unzuverlässig)
  4. Optional: Auth erforderlich, aber dann funktioniert Frontend-Error-Logging nicht mehr → besser: nur sanitisierte Daten akzeptieren
 - **Aufwand:** 1 Std
 ### H2. Rate-Limiter IP-Spoofing
 - **Datei:** `app/core/rate_limit.py` Zeile 43
 - **Problem:** Vertraut `X-Forwarded-For` blind → IP-Spoofing umgeht Rate-Limits
 - **Fix:** Nur erste IP in X-Forwarded-For verwenden, oder `X-Real-IP` mit Proxy-Validation
 - **Aufwand:** 30 Min
 ### H3. CSRF-Middleware Redis-Verbindung
 - **Datei:** `app/core/middleware.py` Zeile 69
 - **Problem:** Erstellt pro unsafe Request neue Redis-Verbindung → Connection Leak
 - **Fix:** `get_redis()` Singleton verwenden (funktioniert nach B1)
 - **Aufwand:** 10 Min
 ### H4. WebSocket Auth + Origin-Verifikation
 - **Dateien:** `app/plugins/builtins/kommunikation/websocket_manager.py`, `ai_ui_control/websocket_manager.py`
 - **Problem:** `user_id` wird ohne Auth-Verifikation akzeptiert. Keine Origin-Prüfung bei WS-Upgrade.
 - **Fix:**
  1. Session-Token aus Query-Param oder Header validieren
  2. Origin-Header gegen erlaubte Domains prüfen
  3. User-ID aus Session ableiten, nicht aus Client-Param
 - **Aufwand:** 2 Std
 ### H5. File-Upload-Sicherheit
 - **Datei:** `app/core/storage.py`
 - **Problem:** Keine Path-Traversal-Prüfung, keine Type/Size-Limits, `get_url()` leakt Filesystem-Pfade
 - **Fix:**
  1. Filename sanitizen (keine `../`, keine absoluten Pfade)
  2. MIME-Type-Allowlist
  3. Max-File-Size konfigurierbar
  4. `get_url()` gibt relative URL zurück, nicht Filesystem-Pfad
 - **Aufwand:** 1 Std
 ### H6. Security-Headers
 - **Datei:** `app/core/middleware.py` (neu)
 - **Problem:** Keine Security-Headers (HSTS, X-Content-Type-Options, X-Frame-Options, CSP)
 - **Fix:** Middleware ergänzen die diese Headers setzt
 - **Aufwand:** 30 Min
 ### H7. Migration-Repair für bestehende Installationen
 - **Datei:** `alembic/versions/0044_repair_contact_migration.py` (neu)
 - **Problem:** Migrationen 0021 und 0027 wurden nachträglich geändert. Alembic führt sie nicht erneut aus.
 - **Fix:**
  1. Neue Migration die `*_old` Tabellen erkennt und Daten nachmigriert
  2. Integritätsprüfung (Anzahl vergleichen)
  3. Bei Abweichungen hart abbrechen mit Fehlermeldung
 - **Aufwand:** 3 Std
 ---
 ## Phase 3: Mittlere Priorität
 ### M1. Passwort-Komplexität
 - **Datei:** `app/schemas/auth.py`, `app/schemas/user.py`
 - **Problem:** Min-Length 8 bei Erstellung, Min-Length 1 bei Login. Keine Komplexitäts-Requirements.
 - **Fix:** Passwort-Validator ergänzen (min 8 Zeichen, 1 Groß, 1 Klein, 1 Zahl)
 - **Aufwand:** 30 Min
 ### M2. Login-Response: is_system_admin
 - **Datei:** `app/routes/auth.py` Zeile 78
 - **Problem:** `is_system_admin` Flag in Login-Response leakt interne Rolle
 - **Fix:** Flag aus Response entfernen oder nur für Admin-User anzeigen
 - **Aufwand:** 15 Min
 ### M3. Permission-Cache: Stale Data bei DB-Error
 - **Datei:** `app/core/permissions.py` Zeile 337
 - **Problem:** Bei DB-Error fällt Cache auf stale Daten zurück → widerrufene Rechte bleiben aktiv
 - **Fix:** Bei DB-Error: Cache invalidieren und 503 zurückgeben statt stale Daten zu nutzen
 - **Aufwand:** 30 Min
 ### M4. ENVIRONMENT=development vs SESSION_COOKIE_SECURE=true
 - **Datei:** `.env` Zeilen 3-4
 - **Problem:** Inkonsistent — development deaktiviert Prod-Safety-Checks, aber Cookie ist secure
 - **Fix:** In .env.docker.example klar dokumentieren: production → `ENVIRONMENT=production` + `SESSION_COOKIE_SECURE=true`
 - **Aufwand:** 10 Min
 ### M5. Frontend: Unresolved Items — ✅ Implementiert (2026-07-27)
 - **Dateien:** `WelcomeDialog.tsx`, `SavedFilterBar.tsx`, `EntityHistoryPanel.tsx`, `TagBadge.tsx`, `TagSelector.tsx`
 - **Status:** ✅ Implementiert — SavedFilterBar und TagSelector in ContactsList, Mail, Calendar integriert
 - **Implementiert:**
  1. SavedFilterBar in ContactsList (entityType="contacts"), Mail (entityType="mail"), Calendar (entityType="calendar") integriert
  2. TagSelector in ContactsList (entityType="contact"), Mail (entityType="file"), Calendar (entityType="calendar_entry") integriert
  3. Frontend TypeScript: 0 Errors (`npx tsc --noEmit`)
 - **Hinweis:** WelcomeDialog und EntityHistoryPanel bleiben für spätere Iteration offen
 ### M6. Frontend-Tests: QueryClientProvider
 - **Datei:** `frontend/src/test/setup.ts` oder einzelne Tests
 - **Problem:** ~29 Tests failen mit missing QueryClientProvider
 - **Fix:** Globalen Test-Wrapper mit QueryClientProvider in setup.ts ergänzen
 - **Aufwand:** 1 Std
 ---
 ## Phase 4: Niedrige Priorität
 ### L1. document.write() in print.ts
 - **Datei:** `frontend/src/utils/print.ts` Zeilen 54, 127
 - **Problem:** `document.write()` mit DOM-Clone — XSS-Risiko wenn Content nicht sanitized
 - **Fix:** Statt `document.write()`: `iframe.srcdoc` oder `Blob URL` verwenden
 - **Aufwand:** 1 Std
 ### L2. AI UI Control: Unbounded Feedback-Storage
 - **Datei:** `app/plugins/builtins/ai_ui_control/websocket_manager.py` Zeile 94
 - **Problem:** Feedback/Commands unbegrenzt im Memory gespeichert → Memory Exhaustion
 - **Fix:** Max-Length Queue (z.B. 100 Einträge) mit FIFO
 - **Aufwand:** 15 Min
 ### L3. Backup-Strategie dokumentieren
 - **Problem:** Named Volumes in docker-compose aber keine Backup/Restore-Doku
 - **Fix:** Backup-Script und Doku ergänzen
 - **Aufwand:** 2 Std
 ---
 ## Implementierungs-Reihenfolge
 ```
 Phase 1 (Release-Blocker):
  B1  → B3 → B9 → B10 → B2 → B4 → B5 → B6 → B7 → B8
  ↑    ↑    ↑    ↑      ↑    ↑    ↑    ↑    ↑    ↑
  5m   30m  5m   15m    3h   1h   2h   2h   3h   4h
  Gesamt: ~16 Std
 Phase 2 (Hohe Priorität):
  H3 → H2 → H6 → H1 → H5 → H4 → H7
  Gesamt: ~8 Std
 Phase 3 (Mittlere Priorität):
  M4 → M1 → M2 → M3 → M6 → M5
  Gesamt: ~6 Std
 Phase 4 (Niedrige Priorität):
  L2 → L1 → L3
  Gesamt: ~3 Std
 ```
 **Gesamtaufwand: ~33 Std**
 ---
 ## Was bereits sauber funktioniert
 - ✅ Auth-Bypass entfernt (keine X-Internal-Call/X-Tenant-Id/X-User-Id Headers mehr)
 - ✅ Plugin-Upload/URL-Installation deaktiviert (403)
 - ✅ Worker in separatem Container
 - ✅ Metrics adminbeschränkt
 - ✅ DOMPurify für HTML-Komponenten
 - ✅ ARQ-Verbindungspool zentralisiert
 - ✅ Session-Widerruf nach Passwortänderung
 - ✅ Permission-Cache-Versionierung
 - ✅ Redis SCAN statt KEYS
 - ✅ Rabatte von Float auf Numeric
 - ✅ Event-Outbox als Grundlage vorhanden
 - ✅ RLS FORCE + WITH CHECK in Migration 0028
 - ✅ Migration 0021: Tabellen umbenennen statt löschen
 - ✅ Frontend: TypeScript typecheck clean (0 errors)
 - ✅ Frontend: ErrorBoundary, OfflineBanner, ErrorLogger implementiert
 - ✅ Frontend: Print/PDF mit WeasyPrint funktioniert
 - ✅ Dockerfile: Multi-stage, non-root User, Healthcheck
 - ✅ Bcrypt Password-Hashing
 - ✅ Session-Tokens: secrets.token_urlsafe(32)
@@ -1,436 +1,62 @@
 # LeoCRM — Umfassender Fix-Plan
 > Erstellt: 2026-07-25
 > Letzte Überprüfung: 2026-07-26 — Alle Items gegen Codebasis verifiziert
 > Quellen: Externes Audit (geprüft), eigene Code-Inspektion, Coolify-Deployment-Prüfung
 ---
-## P0 — Sofort blockierend (vor jeder Nutzung)
+## ✅ Erledigte Fixes (22 von 24 Items komplett)
-### P0-1: Authentifizierungs-Bypass entfernen
+Die folgenden Items wurden bei der Überprüfung am 2026-07-26 als erledigt bestätigt:
-**Problem:** `app/deps.py` akzeptiert `X-Internal-Call: true` mit `X-Tenant-Id` und `X-User-Id` Headern. Keine Signatur, kein Token, keine IP-Beschränkung. `except (ValueError, Exception): pass` verschleiert Fehler.
+| Item | Beschreibung | Verifiziert durch |
-
+|---|---|---|
-**Datei:** `app/deps.py:37-58`
+| P0-1 | Auth-Bypass entfernt | `app/deps.py` — keine `X-Internal-Call` Headers mehr |
-
+| P0-2 | Migrationen repariert | `migration_0021.sql` gelöscht; Migration 0021 renamed `_old` Tabellen statt DROP; Migration 0027 kopiert `company_id → contact_id` mit Backup-Spalte |
-**Maßnahme:**
+| P0-3 | Plugin-Upload deaktiviert | `app/routes/plugins.py` — `/upload` und `/install-url` return 403 mit `upload_disabled` / `install_url_disabled` |
- Header-Authentifizierung komplett entfernen
+| P0-4 | RLS repariert | `alembic/versions/0028_rls_force.py` — `FORCE ROW LEVEL SECURITY` + `WITH CHECK` auf allen Tenant-Tabellen |
- Für interne Service-Kommunikation: dedizierte Service-Accounts mit kurzlebigen signierten Tokens (JWT mit `aud`, `iss`, `sub`, `tenant_id`, `exp`)
+| P0-5 | Plugin-Doppelregistrierung | `app/main.py` — Routes in `create_app()`, `lifespan()` nur aktiviert/deaktiviert, respektiert DB `active` Status, Migration-Fail deaktiviert Plugin |
- Separate interne API oder mTLS
+| P0-6 | Persistent Volume | `docker-compose.yml` — `storage:/data/storage`, `pgdata`, `redisdata` Volumes |
- Keine Übernahme beliebiger `user_id` aus einem Header
+| P1-1 | User/Tenant-Modell | `app/models/user.py` — `User` hat keine `tenant_id`/`role` mehr, `UserTenant` ist single source of truth, `email` global unique |
- Audit-Logging jeder Delegation
+| P1-2 | Redis zentralisiert | `app/core/auth.py` — `init_redis()`/`get_redis()` Singleton, `init_job_pool()`/`close_job_pool()` |
- `except (ValueError, Exception): pass` ersetzen durch spezifisches Exception-Handling mit Logging
+| P1-3 | Worker ausgelagert | `prestart.sh` — nur Alembic + Uvicorn; separater `crm-worker` Container in `docker-compose.yml` |
-
+| P1-4 | Transactional Outbox | `app/core/outbox.py`, `app/models/outbox.py`, `alembic/versions/0040_outbox.py` — `enqueue_outbox_event()` + `process_outbox_batch()` mit `FOR UPDATE SKIP LOCKED` |
-**Aufwand:** 2-4 Stunden
+| P1-5 | XSS-Stellen geschlossen | `HtmlBlock.tsx` + `SignatureManager.tsx` — `DOMPurify.sanitize()`; `ActionCardBlock.tsx` — URL-Validierung (nur `http:`/`https:`) |
 | P1-6 | DMS lastfest | `app/plugins/builtins/dms/routes.py` — 1MB Chunked Streaming, SHA-256 Content-Hash |
 | P1-7 | Permission-System | `app/core/permissions.py` — `permission_version` wird beim Cache-Lesen geprüft, `redis.scan()` statt `redis.keys()`, `require_write()` prüft spezifische Permissions |
 | P1-8 | Password Reset | `app/services/auth_service.py` — ARQ Job `send_password_reset_email`, Token `used_at` Tracking |
 | P1-9 | Metrics abgesichert | `app/routes/metrics.py` — `Depends(require_admin)` |
 | P1-10 | Coolify-Doku & Config | `COOLIFY_SETUP.md` — Healthcheck `/api/v1/health`, JWT-Vars entfernt, CORS `:443`; `app/config.py` — `storage_path=/data/storage`, `session_cookie_secure=True`, Startup-Validierung; `docker-compose.yml` — Redis, Volumes, Healthcheck |
 | P1-11 | Cross-Tenant FK | `alembic/versions/0036_cross_tenant_fk.py` — `UNIQUE (tenant_id, id)` + Composite FK `(tenant_id, contact_id)` auf `contactpersons` und `contact_merge_history` |
 | P2-1 | Contact Model normalisiert | `alembic/versions/0039_contact_normalize.py` — `surfix→suffix`, `Float→Numeric(5,2)`, `JSON→JSONB`, `CHECK (0-100)`, Unique Constraints |
 | P2-3 | Commands & Statusmaschinen | `app/commands/` (base, contact, calendar, dms, mail) + `app/core/state_machine.py` |
 | P2-4 | SPA Path-Traversal | `app/main.py` — `os.path.abspath` Check + `".." in full_path` Blocking |
 ---
-### P0-2: Destruktive Migrationen ersetzen
+## ⏳ Offene Items
 **Problem:**
 - `alembic/versions/0021_unified_contacts.py`: `DROP TABLE` ohne Datenübernahme
 - `alembic/versions/0027_unify_company_to_contact.py`: `company_id` wird gelöscht ohne Datenübernahme; Downgrade ändert pauschal alle `entity_type='contact'` zurück zu `'company'`
 - `migration_0021.sql` im Projekt-Root: konkurrierender Migrationsweg, manipuliert `alembic_version` direkt
 **Dateien:**
 - `alembic/versions/0021_unified_contacts.py`
 - `alembic/versions/0027_unify_company_to_contact.py`
 - `migration_0021.sql` (löschen)
 **Maßnahme:**
 1. `migration_0021.sql` löschen
 2. Migration 0021 durch echte Transformationsmigration ersetzen:
   - Alte Tabellen umbenennen (`_old` suffix), nicht löschen
   - Daten mit `INSERT ... SELECT` übertragen
   - Anzahl, Checksummen und Plausibilität vor/nach der Migration vergleichen
   - Alttabellen erst in späterer Migration entfernen
 3. Migration 0027 korrigieren:
   - `company_id` Werte vor Drop in `contact_id` übertragen
   - Downgrade: nur Datensätze zurückändern, die ursprünglich `'company'` waren (Tracking-Spalte oder separate Tabelle)
 4. Automatisierten Upgrade-Test von jeder unterstützten Version auf `head` einführen
 5. Migrationen gegen reale anonymisierte DB-Kopien testen
 **Aufwand:** 4-8 Stunden
 ---
 ### P0-3: Plugin-Upload und URL-Installation deaktivieren
 **Problem:** `app/routes/plugins.py` führt `spec.loader.exec_module(module)` aus **bevor** die Sicherheitsprüfung läuft. Das ist Remote Code Execution. Weitere Probleme: unzureichende ZIP-Traversal-Prüfung, kein Symlink-Check, keine ZIP-Bomb-Prävention, SSRF bei URL-Installation, Plugin wird in laufenden Container kopiert.
 **Datei:** `app/routes/plugins.py:347-354` (`_extract_plugin_from_zip`)
 **Maßnahme:**
 1. **Sofort:** Upload- und URL-Installationsendpunkte (`/upload`, `/install-url`) deaktivieren oder entfernen
 2. **Langfristig — Vertrauensmodell:**
   - Nur signierte Plugin-Artefakte aus einer Allowlist
   - Plugin-Code wird vor der Ausführung auf Signatur geprüft
 3. **Langfristig — Isolationsmodell:**
   - Plugin-Ausführung in separaten Containern mit minimalen Rechten
   - Versionierte Plugin-API
 4. ZIP-Traversal-Prüfung korrigieren: `os.path.abspath` gegen Base-Dir prüfen nach Extraction
 5. Symlink-Check hinzufügen
 6. Entpackungsgrößen-Limit (Anzahl Dateien + Gesamtgröße)
 7. URL-Download: Redirects verbieten, interne IP-Ranges blockieren, Streaming statt RAM
 **Aufwand:** Sofort-Deaktivierung 30 Min; Langfristig 2-3 Tage
 ---
 ### P0-4: Mandantentrennung (RLS) reparieren
 **Problem:**
 - `alembic/versions/0015_rls_policies.py`: Kein `FORCE ROW LEVEL SECURITY`, kein `WITH CHECK`
 - Tabellen-Owner umgeht RLS
 - Plugin-Tabellen nicht in RLS-Liste
 - `TenantMixin` Docstring behauptet ORM-Autofilterung, die nicht existiert
 - `app/core/tenant.py` hat nur manuelle `apply_tenant_filter()` Funktion
 - `contactpersons` hat `tenant_id` aber FK auf `contacts.id` ohne Tenant-Bedingung → Cross-Tenant-FK möglich
 **Dateien:**
 - `alembic/versions/0015_rls_policies.py`
 - `app/core/db/__init__.py` (TenantMixin Docstring)
 - `app/core/tenant.py`
 - Neue Migration für FORCE + WITH CHECK
 **Maßnahme:**
 1. Neue Migration: `ALTER TABLE ... FORCE ROW LEVEL SECURITY` für alle Tenant-Tabellen
 2. Policies mit `USING` und `WITH CHECK` neu erstellen
 3. Separater DB-Migrationsowner; Runtime-User ohne Owner- oder Bypass-RLS-Rechte
 4. RLS für alle mandantenbezogenen Tabellen, einschließlich Plugin-Tabellen
 5. CI-Test: Cross-Tenant-Lese- und Schreibversuche
 6. Composite-Integrität: eindeutiges `(tenant_id, id)` und FK auf `(tenant_id, contact_id)`
 7. `TenantMixin` Docstring korrigieren: Autofilterung existiert nicht
 8. Zentralen Query-/Repository-Mechanismus einführen statt freiwilliger Tenant-Filter
 9. Später neu erstellte Tabellen automatisch erfassen (Event-Listener oder CI-Check)
 **Aufwand:** 1-2 Tage
 ---
 ### P0-5: Plugin-System Doppelregistrierung beheben
 **Problem:**
 - `app/main.py` `create_app()` registriert alle Plugin-Routen unabhängig vom Aktivierungsstatus
 - `lifespan()` registriert dieselben Routen nochmal → Doppelregistrierung
 - `lifespan()` auto-installiert und auto-aktiviert alle Builtins bei jedem Start
 - Deaktivierte Plugins werden reaktiviert
 - `registry._plugins` wird direkt zugegriffen (private Feld)
 - Migrationsfehler werden nur geloggt, Aktivierung wird trotzdem versucht
 - 204 direkte Cross-Imports zwischen Built-in-Plugins
 **Datei:** `app/main.py:317-330` und `app/main.py:112-165`
 **Maßnahme:**
 1. Routen **einmalig** beim Prozessstart registrieren — entweder in `create_app()` ODER in `lifespan()`, nicht beides
 2. Aktivierungsstatus vor dem Router-Aufbau laden und respektieren
 3. Keine dynamische Änderung von FastAPI-Routen während des Betriebs
 4. Aktivierung/Deaktivierung erfordert kontrollierten Neustart
 5. Fehlgeschlagene Migration blockiert den Start (nicht nur loggen)
 6. Core-Module und optionale Module klar trennen
 7. Kein Zugriff auf `registry._plugins` — öffentliche API verwenden
 8. Plugin-Abhängigkeiten über deklarierte Contracts prüfen
 9. **Langfristig:** Cross-Imports reduzieren — öffentliche Schnittstellen statt direkter Modell-Imports
 **Aufwand:** 1 Tag für Doppelregistrierung; Cross-Import-Reduktion 1-2 Wochen
 ---
 ### P0-6: Persistent Volume für Coolify-Deployment
 **Problem:** Der laufende Container hat **keine Volume-Mounts** (`[]`). `/data/storage` ist nicht persistent. Alle hochgeladenen Dateien (DMS, Attachments, Bilder) gehen bei jedem Redeployment verloren. Plugin-Dateien in `app/plugins/builtins/` überleben keinen Neustart.
 **Gefunden in:** Coolify-Container-Inspect (live)
 **Maßnahme:**
 1. In Coolify persistentes Volume für `/data/storage` konfigurieren
 2. Alternativ: S3-kompatiblen Object Storage verwenden (`.env.example` hat bereits `STORAGE_BACKEND=s3` Support)
 3. Plugin-Dateien nicht in Container-Filesystem kopieren — separate Plugin-Registry mit DB-basierter Konfiguration
 **Aufwand:** 1-2 Stunden (Volume in Coolify konfigurieren)
 ---
 ### P0-7: App von öffentlicher Domain nehmen
-**Problem:** Die App läuft unter `https://crm.media-on.de` und ist öffentlich erreichbar — mit allen P0-Schwachstellen (Auth-Bypass, Plugin-RCE, XSS, etc.).
+**Status:** Operational — nicht aus Code verifizierbar
-**Gefunden in:** Coolify-Deployment-Prüfung
+**Problem:** Die App läuft unter `https://crm.media-on.de` und ist öffentlich erreichbar.
 **Maßnahme:**
 1. **Sofort:** App von öffentlicher Domain nehmen oder IP-Whitelist/Basic Auth vorschalten
-2. Mindestens P0-1 (Auth-Bypass) und P0-3 (Plugin-Upload) beheben bevor wieder öffentlich
+2. Mindestens P0-1 (Auth-Bypass ✅) und P0-3 (Plugin-Upload ✅) sind bereits behoben
 3. Alternativ: VPN/Tunnel-Zugang statt öffentliche Domain
 **Aufwand:** 30 Minuten
 ---
 ## P1 — Vor Nutzung realer Kundendaten
 ### P1-1: Benutzer- und Mandantenmodell bereinigen
 **Problem:**
 - `User` hat `tenant_id`, `role`, `role_id` — gleichzeitig existiert `UserTenant` mit `tenant_id`, `role_id`, `is_default`
 - Zwei Quellen der Wahrheit für Mandantenzugehörigkeit und Rollen
 - `login()` sucht nur nach `email` mit `scalar_one_or_none()` → crasht bei mehreren Treffern (gleiche E-Mail in mehreren Mandanten)
 - `tenant_slug` Parameter in `login()` wird von Login-Route nicht übergeben
 - `TenantService.list_tenant_users()` sucht über `User.tenant_id` und ignoriert N:M-Mitgliedschaften
 **Dateien:**
 - `app/models/user.py`
 - `app/services/auth_service.py:30-80`
 - `app/routes/auth.py`
 **Maßnahme:**
 1. `users.email` global eindeutig machen (nicht `(tenant_id, email)`)
 2. `User.tenant_id` und `User.role`/`User.role_id` entfernen
 3. `tenant_memberships` als einzige Quelle: `tenant_id`, `user_id`, `role_id`, `status`, `is_default`
 4. `login()` mit `tenant_slug` verknüpfen oder Default-Tenant verwenden
 5. `TenantService.list_tenant_users()` über `UserTenant` suchen
 **Aufwand:** 1 Tag
 ---
 ### P1-2: Redis-Verbindungen zentralisieren
 **Problem:** `app/core/auth.py:49-51` erstellt pro Aufruf einen neuen Redis-Client. Kein Pool, kein Close. Dasselbe bei `enqueue_job()` für ARQ-Pools. Folgen: Connection-Lecks, Socket-Erschöpfung, instabiles Verhalten unter Last.
 **Datei:** `app/core/auth.py:49-51`, `app/core/worker.py` (enqueue_job)
 **Maßnahme:**
 1. Redis-Client einmal im Application-Lifespan initialisieren
 2. Bei Shutdown schließen
 3. Über Dependency Injection verteilen
 4. ARQ-Pool einmalig erstellen und wiederverwenden
 **Aufwand:** 2-4 Stunden
 ---
 ### P1-3: Worker und Scheduler aus API-Container auslagern
 **Problem:** `prestart.sh` startet ARQ-Worker im Hintergrund und Uvicorn als PID 1. Worker-Tod wird nicht erkannt. Worker und API konkurrieren um Ressourcen. Keine separate Skalierung. Cron-Jobs können bei mehreren Replikas mehrfach ausgeführt werden.
 **Datei:** `prestart.sh`
 **Maßnahme:**
 1. Worker in separaten Container auslagern
 2. Scheduler in separaten Container mit verteilter Lock-/Leader-Election
 3. Idempotente Jobs
 4. Heartbeat mit Zeitstempel
 5. Dead-Letter-/Failed-Job-Strategie
 6. Retry-Policy pro Jobtyp
 7. Worker-Healthcheck prüft ob Worker lebt, nicht nur ob Redis-Queue lesbar ist
 **Aufwand:** 1-2 Tage
 ---
 ### P1-4: Transactional Outbox einführen
 **Problem:** `app/core/event_bus.py` ist rein speicherbasiert. Events verschwinden bei Prozessabsturz, Neustart, mehreren Replikas, Handler-Fehlern. `asyncio.gather(..., return_exceptions=True)` sammelt Fehler ohne Behandlung.
 **Datei:** `app/core/event_bus.py`
 **Maßnahme:**
 1. Transactional Outbox in PostgreSQL
 2. Worker verarbeitet Outbox-Einträge
 3. Inbox/Idempotency-Key auf Konsumentenseite
 4. Retry und Dead Letter
 5. Events versionieren
 6. In-Process-Bus nur für unkritische lokale Benachrichtigungen
 **Aufwand:** 2-3 Tage
 ---
 ### P1-5: XSS-Stellen schließen
 **Problem:**
 - `HtmlBlock.tsx`: Regex-Sanitizer + `dangerouslySetInnerHTML` — HTML lässt sich nicht sicher mit Regex sanitizen
 - `SignatureManager.tsx:201`: `dangerouslySetInnerHTML={{ __html: sig.body_html }}` **ohne jegliche Sanitization**
 - `ActionCardBlock.tsx:21-28`: `window.open(action.action)` ohne URL-Validierung — `javascript:`-URLs möglich
 - Mail-Service: `body_html_sanitized = body_html` ohne Sanitizer an manchen Stellen
 **Dateien:**
 - `frontend/src/components/comm/blocks/HtmlBlock.tsx`
 - `frontend/src/components/mail/SignatureManager.tsx`
 - `frontend/src/components/comm/blocks/ActionCardBlock.tsx`
 - Mail-Service (body_html_sanitized)
 **Maßnahme:**
 1. Serverseitig konsequent `nh3` verwenden
 2. Frontend zusätzlich `DOMPurify` als zweite Barriere
 3. Keine selbst gebauten Regex-Sanitizer
 4. Nur `https:` und kontrollierte interne Pfade erlauben
 5. Strikte Content Security Policy ohne `unsafe-inline`
 6. Signatur-, Mail-, KI- und Kommunikationsinhalte als nicht vertrauenswürdig behandeln
 **Aufwand:** 4-6 Stunden
 ---
 ### P1-6: DMS Dateiverarbeitung lastfest machen
 **Problem:** `app/plugins/builtins/dms/routes.py` liest die komplette Datei in RAM (`content = await file.read()`). Max 100 MB. Bei 10 parallelen Uploads mehrere GB RAM. Kein Virenscan, kein Content-Hash, keine Dublettenerkennung, keine Tenant-Quotas, kein Versionierungsmodell, kein Garbage Collector für physische Dateien nach Soft Delete. `storage_path` wird an Frontend ausgegeben. Benutzerdateiname direkt in Content-Disposition.
 **Datei:** `app/plugins/builtins/dms/routes.py:421-436`
 **Maßnahme:**
 1. Chunked Streaming direkt in Object Storage
 2. Maximale Größe auf Proxy- und Anwendungsebene
 3. SHA-256 Content-Hash
 4. Malware-Scan
 5. Quotas pro Tenant
 6. Versionierte Metadaten
 7. Garbage Collector für physische Dateien nach Soft Delete
 8. `storage_path` nicht an Frontend ausgeben
 9. Benutzerdateiname sanitizen vor Content-Disposition
 10. Synchronen MinIO-Client aus `async def` entfernen
 **Aufwand:** 1-2 Tage
 ---
 ### P1-7: Berechtigungssystem vereinheitlichen
 **Problem:**
 - Legacy-Rollenstrings (`admin`/`editor`/`viewer`) + neue Rollen mit `role_id` + Gruppen + Allow/Deny + Feldrechte + `is_system_admin` + globale Write-Hilfsrechte
 - `permission_version` wird gespeichert, beim Cache-Lesen aber nicht geprüft
 - Cache-Invalidierung verwendet `redis.keys()` — blockiert Redis bei großen Datenmengen
 - Feldrechte mehrerer Gruppen werden per `dict.update()` überschrieben (last-write-wins)
 - `viewer` erhält `user_preferences:write`
 - `require_write()` erlaubt `*:write` oder `*:create` (zu breit)
 - `db.rollback()` bei Permission-Fehler setzt fremde Transaktionsarbeit zurück
 **Datei:** `app/core/permissions.py`, `app/deps.py`
 **Maßnahme:**
 1. Nur noch Capability-basierte Berechtigungen (`contacts.read`, `contacts.create`, etc.)
 2. Keine generische `require_write`-Freigabe
 3. Alte Rollenlogik entfernen
 4. Feldrechte deterministisch nach "strengstes Recht gewinnt" zusammenführen
 5. `permission_version` beim Cache-Lesen prüfen
 6. `redis.keys()` ersetzen durch `redis.scan()` oder gezielte Cache-Key-Invalidierung
 7. `db.rollback()` nur in eigenen Transaktionskontext
 **Aufwand:** 1-2 Tage
 ---
 ### P1-8: Password Reset funktionsfähig machen
 **Problem:** `request_password_reset()` erstellt ein Token, speichert es in der DB, sendet es aber nicht. Nicht einmal geloggt. Die Variable `raw_token` wird nach Erstellung ignoriert. Die Route sagt "a reset link has been sent" — das ist fachlich falsch. Nach Passwortwechsel werden bestehende Sessions nicht widerrufen.
 **Datei:** `app/services/auth_service.py:159-200`
 **Maßnahme:**
 1. Reset-Mail über echte Queue verschicken (ARQ-Worker)
 2. Token nur einmal verwendbar
 3. Alle Sessions des Benutzers nach Passwortänderung widerrufen
 4. Sicherheitsereignis protokollieren
 5. Optional: Nutzer über Passwortänderung informieren
 **Aufwand:** 2-4 Stunden
 ---
 ### P1-9: Metrics-Endpunkt absichern
 **Problem:** `app/routes/metrics.py` sagt "admin-only" im Docstring, verwendet aber nur `get_current_user` statt `require_admin`. Jeder angemeldete Benutzer kann Prometheus-Metriken abrufen.
 **Datei:** `app/routes/metrics.py`
 **Maßnahme:**
 1. `require_admin` oder `require_permission("system:metrics")` verwenden
 2. Alternativ: internes Netzwerk, Reverse-Proxy-Allowlist, dedizierten Monitoring-Token oder mTLS
 **Aufwand:** 30 Minuten
 ---
 ### P1-10: Coolify-Dokumentation korrigieren
 **Problem:**
 - `COOLIFY_SETUP.md` Abschnitt 6 dokumentiert `/health` als Healthcheck-Pfad — die App hat nur `/api/v1/health`. `/health` liefert nur die SPA `index.html` (Catch-All).
 - `COOLIFY_SETUP.md` listet `JWT_ALGORITHM` und `JWT_EXPIRY_HOURS` — werden von der App nicht verwendet.
 - `CORS_ORIGINS` in Coolify ohne `:443` — `COOLIFY_SETUP.md` sagt explizit Port ist mandatory.
 **Dateien:** `COOLIFY_SETUP.md`, `docs/deployment-guide.md`
 **Maßnahme:**
 1. Healthcheck-Pfad in Doku auf `/api/v1/health` korrigieren
 2. JWT-Variablen aus Doku entfernen oder App auf JWT umstellen
 3. `CORS_ORIGINS` in Coolify auf `https://crm.media-on.de:443` setzen
 4. `docker-compose.yml` Healthcheck auf `/api/v1/health` korrigieren
 5. `docker-compose.yml` Redis-Service hinzufügen
 6. `docker-compose.yml` `REDIS_URL` setzen
 7. `docker-compose.yml` persistentes Volume für `/data/storage`
 8. `docker-compose.yml` `SESSION_COOKIE_SECURE=true` für Production
 9. `docker-compose.yml` `STORAGE_PATH=/data/storage` setzen
 10. `config.py` Default `storage_path` von `/tmp` auf `/data/storage` ändern
 11. `config.py` Default `session_cookie_secure` auf `True` ändern (Production-Default)
 12. `config.py` Startup-Validierung: `ENVIRONMENT=production` + `session_cookie_secure=False` → harter Abbruch
 **Aufwand:** 2-3 Stunden
 ---
 ### P1-11: Cross-Tenant referenzielle Integrität
 **Problem:** `contactpersons` hat `tenant_id` aber `contact_id` FK referenziert nur `contacts.id` ohne Tenant-Bedingung. Die DB verhindert nicht, dass ein Contactperson-Datensatz aus Mandant A auf einen Kontakt aus Mandant B zeigt.
 **Datei:** `alembic/versions/0021_unified_contacts.py` (contactpersons Tabelle)
 **Maßnahme:**
 1. Composite-FK: `(tenant_id, contact_id)` referenziert `(tenant_id, id)` auf `contacts`
 2. Eindeutiges `(tenant_id, id)` auf `contacts`
 3. Dasselbe für alle mandantenbezogenen FK-Beziehungen
 **Aufwand:** 2-4 Stunden
 ---
 ## P2 — Architektonische Konsolidierung
 ### P2-1: Unified Contact Model normalisieren
 **Problem:** Eine Tabelle enthält Unternehmen, Personen, 3 Adressarten, Bankdaten, Steuernummern, Rabatte, Projektinformationen, Warnungen, Tags, Custom Fields, Suchindex. Dubletten zu vorhandenen Modellen für Adressen, Bankkonten, Tags, Custom Fields.
 **Weitere Probleme:**
 - Rabatte als `Float` statt `Numeric`/`Decimal`
 - Keine DB-Checks für Werte 0-100
 - Keine eindeutigen Kontakt-/Buchhaltungscodes pro Mandant
 - Keine klare Validierung welche Felder bei Person/Firma erlaubt sind
 - `surfix` — dauerhaft übernommener Tippfehler
 - `JSON` statt `JSONB`
 - Suche fest auf Deutsch eingestellt
 - Keine normalisierten Suchschlüssel für E-Mail und Telefonnummer
 - CSV-Import ohne Dubletten-/Encoding-/Dezimal-/Rollback-Strategie
 **Maßnahme:**
 1. Adressen in separate Tabelle auslagern (bereits vorhanden — nutzen)
 2. Bankdaten in separate Tabelle (bereits vorhanden — nutzen)
 3. Tags als Relation (bereits vorhanden — nutzen)
 4. Custom Fields als Relation (bereits vorhanden — nutzen)
 5. Rabatte: `Numeric(5,2)` statt `Float`
 6. DB-Check: `discount_* BETWEEN 0 AND 100`
 7. Eindeutige `(tenant_id, code)` und `(tenant_id, accounting_code)`
 8. `surfix` → `suffix` (Migration mit Rename)
 9. `JSON` → `JSONB`
 10. Suchkonfiguration pro Mandant konfigurierbar
 11. Normalisierte Suchschlüssel (lowercase, trimmed) für E-Mail und Telefon
 12. CSV-Import: Dubletten-Erkennung, Encoding-Detection, Decimal-Parsing, Transaction-Rollback
 **Aufwand:** 2-3 Tage
 ---
 ### P2-2: Plugin-Cross-Imports reduzieren
-**Problem:** 204 direkte `from app.plugins.builtins` Imports zwischen Plugins. Automatisierung importiert Modelle/Services von Kommunikation, Mail, Kalender. Verteilter Monolith ohne Modulgrenzen.
+**Status:** Offen — 228 direkte Cross-Imports zwischen Plugins
 **Problem:** 228 direkte `from app.plugins.builtins` Imports zwischen Plugins. Automatisierung importiert Modelle/Services von Kommunikation, Mail, Kalender. Verteilter Monolith ohne Modulgrenzen.
 **Maßnahme:**
 1. Öffentliche Schnittstellen (Contracts) für jedes Modul definieren
@@ -442,73 +68,14 @@
 ---
 ### P2-3: Commands und Statusmaschinen
 **Problem:** Geschäftsoperationen als `Route → Service → mehrere flush/commit` statt als zentrale Commands. Statusstrings frei beschreibbar statt Statusmaschinen.
 **Maßnahme:**
 1. `Route → Command → Authorization → Domain Operation → Transaction → Audit → Outbox Events → Commit`
 2. Explizite Statusmaschinen für Angebote, Aufträge, Rechnungen
 3. Übergänge validiert und auditiert
 **Aufwand:** 1-2 Wochen
 ---
 ### P2-4: SPA Path-Traversal-Schutz vervollständigen
 **Problem:** `app/main.py` SPA-Catch-All blockiert `..` nur in bestimmten Positionen. `..` in anderen Positionen wird nicht erfasst.
 **Datei:** `app/main.py` (spa_spa Funktion)
 **Maßnahme:**
 1. `os.path.abspath` gegen `frontend_dist` prüfen nach Join
 2. Kein `..` in irgendeiner Position erlauben
 **Aufwand:** 30 Minuten
 ---
 ## Zusammenfassung
-| Priorität | Anzahl | Geschätzter Aufwand |
+| Priorität | Erledigt | Offen | Geschätzter Aufwand (offen) |
-|---|---|---|
+|---|---|---|---|
-| P0 (sofort) | 7 | ~5-7 Tage |
+| P0 | 6/7 | 1 (operational) | 30 Minuten |
-| P1 (vor Kundendaten) | 11 | ~7-10 Tage |
+| P1 | 11/11 | 0 | — |
-| P2 (architektonisch) | 4 | ~2-4 Wochen |
+| P2 | 3/4 | 1 | 1-2 Wochen |
-| **Total** | **22** | **~4-6 Wochen** |
+| **Total** | **20/22** | **2** | **~1-2 Wochen** |
 ## Reihenfolge
 ### Woche 1: P0 absichern
 1. P0-7: App von öffentlicher Domain nehmen (30 Min)
 2. P0-1: Auth-Bypass entfernen (2-4h)
 3. P0-3: Plugin-Upload deaktivieren (30 Min Sofort, langfristig später)
 4. P0-6: Persistent Volume in Coolify (1-2h)
 5. P0-2: Migrationen ersetzen (4-8h)
 6. P0-4: RLS reparieren (1-2 Tage)
 7. P0-5: Plugin-Doppelregistrierung beheben (1 Tag)
 ### Woche 2-3: P1 Fundament
 8. P1-9: Metrics absichern (30 Min)
 9. P1-8: Password Reset (2-4h)
 10. P1-10: Coolify-Doku & Config korrigieren (2-3h)
 11. P1-2: Redis zentralisieren (2-4h)
 12. P1-5: XSS schließen (4-6h)
 13. P1-11: Cross-Tenant FK (2-4h)
 14. P1-1: User/Tenant-Modell (1 Tag)
 15. P1-7: Permission-System (1-2 Tage)
 16. P1-6: DMS lastfest (1-2 Tage)
 17. P1-3: Worker auslagern (1-2 Tage)
 18. P1-4: Transactional Outbox (2-3 Tage)
 ### Woche 4-6: P2 Architektur
 19. P2-4: SPA Path-Traversal (30 Min)
 20. P2-1: Contact Model normalisieren (2-3 Tage)
 21. P2-2: Cross-Imports reduzieren (1-2 Wochen)
 22. P2-3: Commands & Statusmaschinen (1-2 Wochen)
 ---
 ## Validierung nach jedem Fix
@@ -0,0 +1,921 @@
 # LeoCRM Plugin-System — Kompletter Umbauplan
 **Erstellt:** 2026-07-26
 **Aktualisiert:** 2026-07-26 (Codebasis-Verifikation + Phase 6)
 **Geschätzter Gesamtaufwand:** ~149 Stunden (~19 Arbeitstage)
 **Status:** Geplant — noch nicht gestartet
 **Codebasis-Verifikation (2026-07-26):**
 - ✅ `base.py` unverändert — Plan passt
 - ✅ `registry.py` unverändert — Plan passt
 - ✅ `manifest.py` unverändert — Plan passt
 - ✅ `contracts.py` (ContractRegistry) unverändert — Plan passt
 - ✅ Migration 0044 hinzugekommen: RLS Repair + separater DB-User (crm_runtime) — beeinflusst Plugin-System nicht
 - ✅ Migration 0045 hinzugekommen — neuer Head
 - ✅ `require_active_plugin` in `deps.py` hinzugekommen — beeinflusst Plugin-System nicht
 - ✅ 19 echte Plugins (test_sample hat __init__.py statt plugin.py)
 - ✅ Cross-Imports: 224, Contracts: 8, get_contract: 11 — unverändert
 ---
 ## Übersicht: 5 Phasen
 | Phase | Punkte | Inhalt | Stunden | Tage |
 |---|---|---|---|---|
 | Phase 1 | 1-3 | Contracts konsequent nutzen | 47 | 6 |
 | Phase 2 | 4 | Hooks/Filters-System | 16 | 2 |
 | Phase 3 | 5 | Plugin-Isolation (Linting) | 4 | 0,5 |
 | Phase 4 | 8 | Plugin-Versioning | 20 | 2,5 |
 | Phase 5 | 6 | Marketplace-Vorbereitung | 42 | 5 |
 | Phase 6 | — | Manifest-Anpassung & Konsolidierung | 20 | 2,5 |
 | **Gesamt** | | | **149** | **~19** |
 **Wichtig:** Jede Phase ist unabhängig funktionsfähig. Das System läuft nach jeder Phase ohne Einschränkungen weiter.
 ---
 ## Phase 1: Contracts konsequent nutzen (Punkte 1-3)
 **Ziel:** Alle 224 direkten Cross-Plugin-Imports werden durch das Contract-System ersetzt.
 ### 1.1 Fehlende contracts.py erstellen (7 Std)
 Für jedes Plugin, das noch keine `contracts.py` hat, eine erstellen:
 | # | Plugin | Exportierte Symbole | Aufwand |
 |---|---|---|---|
 | 1 | `ai_proactive` | ContextTools, ProactiveAgent, JobScheduler | 30 Min |
 | 2 | `ai_ui_control` | WebSocketManager, UIAction | 30 Min |
 | 3 | `automation` | AgentRunner, ExecutionEngine, Scheduler, WorkflowTimeout | 45 Min |
 | 4 | `entity_links` | EntityLink model, create_link, get_links | 20 Min |
 | 5 | `forgejo_error_reporter` | report_error_to_forgejo | 15 Min |
 | 6 | `mcp_client` | McpClient, McpServerConfig | 30 Min |
 | 7 | `mcp_server` | McpServer, ToolDefinitions | 30 Min |
 | 8 | `report_generator` | ReportTemplate, ReportInstance, PdfGenerator | 30 Min |
 | 9 | `system_notif` | SystemNotifHandler | 15 Min |
 | 10 | `tags` | Tag, TagAssignment, assign_tags, remove_tags | 20 Min |
 | 11 | `tasks` | Task, TaskService, create_task, update_task | 30 Min |
 | 12 | `test_sample` | TestSamplePlugin | 10 Min |
 | 13 | `dms` (erweitern) | File, Folder, UploadService, DownloadService | 30 Min |
 | 14 | `permissions` (erweitern) | ShareLink, PermissionResolver | 30 Min |
 **Schema für jede contracts.py:**
 ```python
 """Public contract for the <plugin> plugin."""
 from __future__ import annotations
 from app.plugins.builtins.contracts import get_contract_registry
 # Import only public symbols from internal modules
 class <Plugin>Contract:
    contract_name = "<plugin>"
    # Expose only public API
 _contract = <Plugin>Contract()
 get_contract_registry().register("<plugin>", _contract)
 ```
 ### 1.2 Direkte Imports ersetzen (28 Std)
 224 direkte Imports müssen durch `get_contract()` ersetzt werden.
 **Top-Priorität (häufigste Import-Quellen):**
 | # | Datei | Imports | Aufwand |
 |---|---|---|---|
 | 1 | `automation/plugin.py` | 10 | 1,5 Std |
 | 2 | `automation/routes.py` | 8 | 1,5 Std |
 | 3 | `ai_proactive/services.py` | 8 | 1,5 Std |
 | 4 | `ai_proactive/plugin.py` | 8 | 1,5 Std |
 | 5 | `unified_search/jobs.py` | 7 | 1 Std |
 | 6 | `builtins/__init__.py` | 7 | 1 Std |
 | 7 | `ai_proactive/jobs.py` | 7 | 1 Std |
 | 8 | `ai_assistant/participant_handler.py` | 7 | 1 Std |
 | 9 | `kommunikation/routes.py` | 6 | 1 Std |
 | 10 | `kommunikation/contracts.py` | 6 | 1 Std |
 | 11 | `automation/agent_routes.py` | 6 | 1 Std |
 | 12 | `automation/agent_comm.py` | 6 | 1 Std |
 | 13 | `ai_proactive/participant_handler.py` | 6 | 1 Std |
 | 14 | `ai_assistant/plugin.py` | 6 | 1 Std |
 | 15 | `unified_search/routes.py` | 5 | 45 Min |
 | 16-50 | Alle übrigen Dateien | ~122 | 12 Std |
 **Muster für Ersetzung:**
 ```python
 # VORHER (direkt):
 from app.plugins.builtins.kommunikation.services import send_message
 # NACHHER (über Contract):
 from app.plugins.builtins.contracts import get_contract
 async def my_function(db, ...):
    komm = get_contract("kommunikation")
    if komm:
        await komm.send_message(db, ...)
    # Graceful degradation wenn Plugin nicht aktiv
 ```
 ### 1.3 Contracts bei Deaktivierung abmelden (4 Std)
 In jedem Plugin's `on_deactivate()`:
 ```python
 async def on_deactivate(self, db, service_container, event_bus) -> None:
    # Contract abmelden
    from app.plugins.builtins.contracts import get_contract_registry
    get_contract_registry().unregister(self.manifest.name)
    # ... rest of cleanup
    await super().on_deactivate(db, service_container, event_bus)
 ```
 | # | Plugin | Aufwand |
 |---|---|---|
 | 1-16 | Alle 16 Plugins | 15 Min pro Plugin = 4 Std |
 ### 1.4 Tests anpassen (8 Std)
 - Cross-Plugin-Tests müssen mit Contracts laufen
 - `test_plugins.py` — Contract-Registry Tests
 - `test_contracts.py` — Neue Test-Datei für Contract-System
 - Alle Integrationstests mit Contract-Mocks
 ### Meilenstein Phase 1:
 - ✅ Alle 16 Plugins haben contracts.py
 - ✅ 0 direkte Cross-Plugin-Imports (geprüft mit grep)
 - ✅ Contracts werden bei Deaktivierung abgemeldet
 - ✅ Alle Tests bestanden
 ---
 ## Phase 2: Hooks/Filters-System (Punkt 4)
 **Ziel:** WordPress-Style Hooks (actions + filters) für Plugin-Erweiterbarkeit.
 ### 2.1 HookRegistry erstellen (4 Std)
 **Neue Datei: `app/core/hooks.py`**
 ```python
 """WordPress-style hooks: actions (fire-and-forget) and filters (modify data)."""
 from __future__ import annotations
 import logging
 from collections import defaultdict
 from typing import Any, Callable
 logger = logging.getLogger(__name__)
 class HookRegistry:
    """Central registry for actions and filters.
    Actions: do_action('contact.before_create', data) — no return value
    Filters: result = apply_filters('contact.format_name', name) — returns modified value
    Priority: lower numbers run first (default=10).
    """
    _instance: HookRegistry | None = None
    def __new__(cls):
        if cls._instance is None:
            cls._instance = super().__new__(cls)
            cls._instance._actions: dict[str, list[tuple[int, Callable]]] = defaultdict(list)
            cls._instance._filters: dict[str, list[tuple[int, Callable]]] = defaultdict(list)
        return cls._instance
    def register_action(self, hook_name: str, callback: Callable, priority: int = 10) -> None:
        self._actions[hook_name].append((priority, callback))
        self._actions[hook_name].sort(key=lambda x: x[0])
    def register_filter(self, hook_name: str, callback: Callable, priority: int = 10) -> None:
        self._filters[hook_name].append((priority, callback))
        self._filters[hook_name].sort(key=lambda x: x[0])
    async def do_action(self, hook_name: str, *args, **kwargs) -> None:
        for _, callback in self._actions.get(hook_name, []):
            try:
                result = callback(*args, **kwargs)
                if hasattr(result, '__await__'):
                    await result
            except Exception:
                logger.exception("Error in action %s", hook_name)
    async def apply_filters(self, hook_name: str, value: Any, *args, **kwargs) -> Any:
        for _, callback in self._filters.get(hook_name, []):
            try:
                result = callback(value, *args, **kwargs)
                if hasattr(result, '__await__'):
                    result = await result
                value = result
            except Exception:
                logger.exception("Error in filter %s", hook_name)
        return value
    def unregister(self, hook_name: str, callback: Callable) -> None:
        self._actions[hook_name] = [(p, c) for p, c in self._actions.get(hook_name, []) if c != callback]
        self._filters[hook_name] = [(p, c) for p, c in self._filters.get(hook_name, []) if c != callback]
    def unregister_all(self, hook_name: str) -> None:
        self._actions.pop(hook_name, None)
        self._filters.pop(hook_name, None)
    def _reset_for_testing(self) -> None:
        self._actions.clear()
        self._filters.clear()
 def get_hook_registry() -> HookRegistry:
    return HookRegistry()
 async def do_action(hook_name: str, *args, **kwargs) -> None:
    await get_hook_registry().do_action(hook_name, *args, **kwargs)
 async def apply_filters(hook_name: str, value: Any, *args, **kwargs) -> Any:
    return await get_hook_registry().apply_filters(hook_name, value, *args, **kwargs)
 ```
 ### 2.2 Integration in BasePlugin (2 Std)
 ```python
 # In BasePlugin.on_activate:
 async def on_activate(self, db, service_container, event_bus) -> None:
    # ... existing code ...
    # Hooks werden in Subklassen registriert
 # In BasePlugin.on_deactivate:
 async def on_deactivate(self, db, service_container, event_bus) -> None:
    # Alle Hooks dieses Plugins abmelden
    from app.core.hooks import get_hook_registry
    # Plugin-spezifische Hooks entfernen (prefix mit plugin name)
    # ... existing code ...
 ```
 ### 2.3 Hook-Punkte in Core-Services (6 Std)
 | # | Service | Hook-Name | Typ | Beschreibung |
 |---|---|---|---|---|
 | 1 | contact_service | `contact.before_create` | Action | Vor Kontakt-Erstellung |
 | 2 | contact_service | `contact.after_create` | Action | Nach Kontakt-Erstellung |
 | 3 | contact_service | `contact.format_display_name` | Filter | Anzeigenamen formatieren |
 | 4 | contact_service | `contact.before_update` | Action | Vor Kontakt-Update |
 | 5 | contact_service | `contact.after_update` | Action | Nach Kontakt-Update |
 | 6 | contact_service | `contact.before_delete` | Action | Vor Kontakt-Löschung |
 | 7 | mail_service | `mail.before_send` | Filter | E-Mail vor Versand modifizieren |
 | 8 | mail_service | `mail.after_send` | Action | Nach E-Mail-Versand |
 | 9 | calendar | `calendar.before_appointment` | Action | Vor Termin-Erstellung |
 | 10 | calendar | `calendar.after_appointment` | Action | Nach Termin-Erstellung |
 | 11 | auth_service | `auth.before_login` | Filter | Login-Daten validieren/modifizieren |
 | 12 | auth_service | `auth.after_login` | Action | Nach erfolgreichem Login |
 | 13 | user_service | `user.before_create` | Action | Vor User-Erstellung |
 | 14 | user_service | `user.after_create` | Action | Nach User-Erstellung |
 | 15 | dms | `dms.before_upload` | Filter | Datei-Upload validieren/modifizieren |
 ### 2.4 Tests für Hooks/Filters (4 Std)
 - `test_hooks.py` — HookRegistry Tests
 - Integrationstests: Plugin registriert Hook, Core-Service löst Hook aus
 - Filter-Tests: Wert wird korrekt modifiziert
 - Priority-Tests: Reihenfolge wird eingehalten
 - Unregister-Tests: Hooks werden bei Deaktivierung entfernt
 ### Meilenstein Phase 2:
 - ✅ `app/core/hooks.py` mit HookRegistry
 - ✅ 15 Hook-Punkte in Core-Services
 - ✅ BasePlugin registriert/unregistriert Hooks automatisch
 - ✅ Tests bestanden
 ---
 ## Phase 3: Plugin-Isolation (Punkt 5)
 **Ziel:** Direkte Cross-Plugin-Imports werden durch Linting verhindert.
 ### 3.1 Linting-Regel erstellen (2 Std)
 **Neue Datei: `.ruff/rules/no_cross_plugin_imports.py`**
 ```python
 """Ruff rule: forbid direct imports from app.plugins.builtins.* (except contracts)."""
 # Erlaubt:
 #   from app.plugins.builtins.contracts import get_contract
 #   from app.plugins.builtins.<name>.contracts import ...
 #
 # Verboten:
 #   from app.plugins.builtins.<name>.services import ...
 #   from app.plugins.builtins.<name>.models import ...
 #   from app.plugins.builtins.<name>.routes import ...
 ```
 ### 3.2 CI/CD Integration (1 Std)
 - `ruff check` in GitHub Actions / Forgejo CI
 - Pre-commit Hook für lokale Entwicklung
 - Fehler bei direkten Cross-Plugin-Imports
 ### 3.3 Ausnahmen definieren (1 Std)
 - `conftest.py` — Tests dürfen direkt importieren
 - `app/plugins/builtins/__init__.py` — Plugin-Discovery
 - `app/plugins/registry.py` — Registry darf importieren
 ### Meilenstein Phase 3:
 - ✅ Linting-Regel aktiv
 - ✅ CI/CD prüft bei jedem Commit
 - ✅ 0 direkte Cross-Plugin-Imports (automatisch erzwungen)
 ---
 ## Phase 4: Plugin-Versioning (Punkt 8)
 **Ziel:** Vollständige Versionsverwaltung mit SemVer, Rollback und Kompatibilitäts-Check.
 ### 4.1 SemVer-Vergleich (3 Std)
 **Neue Datei: `app/plugins/semver.py`**
 ```python
 """Semantic version comparison for plugin versions."""
 from dataclasses import dataclass
 import re
@dataclass
 class SemVer:
    major: int
    minor: int
    patch: int
    prerelease: str = ""
    @classmethod
    def parse(cls, version: str) -> "SemVer":
        match = re.match(r"(\d+)\.(\d+)\.(\d+)(?:-(.+))?", version)
        if not match:
            raise ValueError(f"Invalid semver: {version}")
        return cls(int(match[1]), int(match[2]), int(match[3]), match[4] or "")
    def __lt__(self, other): ...
    def __eq__(self, other): ...
    def __le__(self, other): ...
    def __gt__(self, other): ...
    def is_breaking_change(self, other: "SemVer") -> bool:
        return self.major != other.major
    def is_compatible_with(self, min_version: "SemVer") -> bool:
        return self >= min_version
 ```
 **Änderung in `registry.py`:**
 ```python
 # VORHER: String-Vergleich
 if record.version != plugin.manifest.version:
 # NACHHER: SemVer-Vergleich
 old_ver = SemVer.parse(record.version)
 new_ver = SemVer.parse(plugin.manifest.version)
 if old_ver != new_ver:
    if new_ver < old_ver:
        # Downgrade — nur mit Rollback-Migration
        ...
 ```
 ### 4.2 Rollback-Migrationen (6 Std)
 **Erweiterung des Migration-Systems:**
 ```python
 # MigrationRunner erweitern:
 async def run_migration_down(self, db, plugin_name, migration_filename):
    """Run rollback (down) migration."""
    # Suche <filename>_down.sql oder parse DOWNGRADE-Block
 async def rollback_to_version(self, db, plugin_name, target_version: str):
    """Rollback plugin to a specific version."""
    # 1. Finde alle Migrationen nach target_version
    # 2. Führe sie in umgekehrter Reihenfolge aus
    # 3. Aktualisiere DB-Version
 ```
 **Migration-Datei-Format:**
 ```sql
 -- 0001_initial.sql
 -- UP:
 CREATE TABLE ...;
 -- DOWN:
 DROP TABLE ... CASCADE;
 ```
 Oder separate Dateien:
 - `0001_initial_up.sql`
 - `0001_initial_down.sql`
 ### 4.3 Version-Kompatibilitäts-Check (3 Std)
 **Manifest-Erweiterung:**
 ```python
 class PluginManifest(BaseModel):
    # ... existing fields ...
    min_app_version: str = Field(
        default="0.0.0",
        description="Minimum LeoCRM version required"
    )
 ```
 **Check bei Installation:**
 ```python
 async def install(self, db, name):
    plugin = self.get_plugin(name)
    # Check app version compatibility
    app_version = SemVer.parse(settings.app_version)
    min_version = SemVer.parse(plugin.manifest.min_app_version)
    if app_version < min_version:
        raise ValueError(
            f"Plugin '{name}' requires LeoCRM >= {plugin.manifest.min_app_version}, "
            f"but current version is {settings.app_version}"
        )
 ```
 ### 4.4 Update-Benachrichtigung im Frontend (4 Std)
 **Backend:**
 - `GET /api/v1/plugins/updates` — Liste Plugins mit verfügbarer neuer Version
 - Vergleich mit Marketplace-Registry (wenn verfügbar) oder lokaler Version
 **Frontend:**
 - Badge im Plugin-Settings: "Update verfügbar (1.2.0 → 1.3.0)"
 - Update-Button: Löst Update aus (führt neue Migrationen aus)
 - Changelog-Anzeige (optional)
 ### 4.5 Tests (4 Std)
 - `test_semver.py` — SemVer-Vergleich, Parse, Edge Cases
 - `test_versioning.py` — Upgrade, Downgrade, Kompatibilitäts-Check
 - `test_rollback.py` — Rollback-Migrationen
 - Integrationstests: Version-Update löst Migrationen aus
 ### Meilenstein Phase 4:
 - ✅ SemVer-Vergleich statt String-Vergleich
 - ✅ Rollback-Migrationen funktionieren
 - ✅ min_app_version wird geprüft
 - ✅ Frontend zeigt Update-Benachrichtigungen
 - ✅ Tests bestanden
 ---
 ## Phase 5: Marketplace-Vorbereitung (Punkt 6)
 **Ziel:** Code so vorbereiten, dass ein Marketplace nur noch gebaut werden muss — ohne Systemänderungen.
 **Wichtig:** Funktioniert auch OHNE Marketplace — Built-in Plugins laufen normal weiter.
 ### 5.1 Externe Plugin-Discovery (6 Std)
 **Erweiterung `registry.py`:**
 ```python
 class PluginRegistry:
    def discover_all(self) -> list[str]:
        """Discover built-in AND external plugins."""
        discovered = self.discover_builtins()
        discovered.extend(self.discover_external())
        return discovered
    def discover_external(self) -> list[str]:
        """Discover plugins from external plugins/ directory."""
        external_dir = Path(settings.external_plugins_path or "plugins")
        if not external_dir.exists():
            return []
        discovered = []
        for plugin_dir in external_dir.iterdir():
            if not plugin_dir.is_dir() or plugin_dir.name.startswith("_"):
                continue
            # Look for plugin.py or __init__.py with BasePlugin subclass
            plugin_file = plugin_dir / "plugin.py"
            if not plugin_file.exists():
                continue
            # Import and register
            import sys
            sys.path.insert(0, str(external_dir))
            try:
                module = importlib.import_module(f"{plugin_dir.name}.plugin")
                # ... find BasePlugin subclass ...
            finally:
                sys.path.remove(str(external_dir))
        return discovered
 ```
 ### 5.2 Plugin-Signatur-Validierung (8 Std)
 **Neue Datei: `app/plugins/signature.py`**
 ```python
 """Plugin signature verification for external plugins."""
 from pathlib import Path
 import hashlib
 import hmac
 # Ed25519 oder HMAC-SHA256 Signatur
 class PluginSignature:
    """Verify plugin package signatures."""
    @staticmethod
    def verify_signature(zip_path: Path, signature: bytes, public_key: bytes) -> bool:
        """Verify Ed25519 signature of plugin ZIP."""
        # 1. Read ZIP content
        # 2. Compute hash
        # 3. Verify signature with public key
        pass
    @staticmethod
    def compute_hash(zip_path: Path) -> bytes:
        """Compute SHA-256 hash of plugin ZIP."""
        pass
    @staticmethod
    def sign_plugin(zip_path: Path, private_key: bytes) -> bytes:
        """Sign a plugin ZIP (for plugin authors)."""
        pass
 ```
 ### 5.3 Plugin-Allowlist (4 Std)
 **Neue Alembic-Migration: `0044_plugin_allowlist.py`**
 ```python
 # Tabelle: plugin_allowlist
 # - id: UUID
 # - plugin_name: VARCHAR(80)
 # - allowed_hash: VARCHAR(64)  # SHA-256
 # - allowed_signature: TEXT    # Ed25519 signature
 # - added_by: UUID (user)
 # - created_at: TIMESTAMPTZ
 # - is_active: BOOLEAN
 ```
 ### 5.4 Plugin-Metadata-Erweiterung (4 Std)
 **Manifest-Erweiterung:**
 ```python
 class PluginManifest(BaseModel):
    # ... existing fields ...
    author: str = Field(default="", description="Plugin author")
    author_email: str = Field(default="", description="Author contact")
    homepage: str = Field(default="", description="Plugin homepage URL")
    license: str = Field(default="MIT", description="License")
    min_app_version: str = Field(default="0.0.0")
    icon: str = Field(default="", description="Icon URL or emoji")
    screenshots: list[str] = Field(default_factory=list)
    changelog: str = Field(default="", description="Changelog URL or text")
    tags: list[str] = Field(default_factory=list, description="Marketplace categories")
    price: float = Field(default=0.0, description="Price (0 = free)")
 ```
 ### 5.5 Plugin-Download-Endpoint (4 Std)
 **Neue Route: `POST /api/v1/plugins/install-marketplace`**
 ```python
@router.post("/install-marketplace")
 async def install_from_marketplace(
    body: MarketplaceInstall,
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(require_permission("plugins:configure")),
 ):
    """Install a plugin from the marketplace.
    1. Download ZIP from marketplace URL
    2. Verify signature against allowlist
    3. Validate manifest
    4. Check dangerous imports
    5. Validate migration SQL
    6. Install (migrations + DB record)
    7. Activate (optional)
    """
    # 1. Download
    async with httpx.AsyncClient() as client:
        resp = await client.get(body.url)
        zip_data = resp.content
    # 2. Verify signature
    if not PluginSignature.verify_signature(zip_data, body.signature, public_key):
        raise HTTPException(403, "Invalid plugin signature")
    # 3-6. Validate and install
    # ... (reuse existing validation + install logic)
 ```
 ### 5.6 Plugin-Update-Check (4 Std)
 ```python
@router.get("/updates")
 async def check_plugin_updates(
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(require_permission("plugins:read")),
 ):
    """Check for available plugin updates from marketplace."""
    # 1. Query marketplace registry (if configured)
    # 2. Compare versions with installed plugins
    # 3. Return list of available updates
 ```
 ### 5.7 Plugin-Quarantine (4 Std)
 ```python
 async def _quarantine_plugin(zip_path: Path) -> Path:
    """Extract plugin to temp dir, validate, then move to plugins/ dir.
    1. Extract to /tmp/plugin_upload_<uuid>/
    2. Validate manifest exists
    3. Check dangerous imports
    4. Validate migration SQL
    5. Check signature
    6. If all OK: move to plugins/ dir
    7. If any fail: delete temp dir, raise error
    """
 ```
 ### 5.8 Tests (8 Std)
 - `test_marketplace.py` — Download, Verify, Install Flow
 - `test_signature.py` — Signatur-Validierung
 - `test_allowlist.py` — Allowlist-Management
 - `test_quarantine.py` — Quarantine-Validierung
 - `test_external_discovery.py` — Externe Plugin-Discovery
 - Integrationstests: Vollständiger Marketplace-Flow
 ### Meilenstein Phase 5:
 - ✅ Externe Plugins können entdeckt werden
 - ✅ Signatur-Validierung funktioniert
 - ✅ Allowlist schützt vor nicht autorisierten Plugins
 - ✅ Marketplace-Endpoint ist vorbereitet (deaktiviert bis Marketplace live)
 - ✅ Plugin-Upload bleibt deaktiviert
 - ✅ Built-in Plugins laufen ohne Marketplace
 - ✅ Tests bestanden
 ---
 ## Phase 6: Manifest-Anpassung & Konsolidierung
 **Ziel:** Alle in Phase 4 und 5 definierten Manifest-Felder werden ins `PluginManifest` integriert, bestehende Manifeste aktualisiert, und das Manifest-System finalisiert.
 **Wichtig:** Diese Phase baut auf Phase 4 (Versioning) und Phase 5 (Marketplace) auf und muss als letztes durchgeführt werden.
 ### 6.1 PluginManifest erweitern (4 Std)
 **Aktuelles Manifest (verifiziert 2026-07-26):**
 ```python
 class PluginManifest(BaseModel):
    name: str
    version: str
    display_name: str
    description: str
    dependencies: list[str]
    routes: list[PluginRouteDef]
    events: list[str]
    migrations: list[str]
    permissions: list[str]
    is_core: bool
    field_definitions: list[FieldDefinition]
    agent_capabilities: list[str]
    menu_items: list[FrontendMenuItem]
    page_routes: list[FrontendPageRoute]
    detail_tabs: list[FrontendDetailTab]
    settings_pages: list[FrontendSettingsPage]
    dashboard_widgets: list[FrontendDashboardWidget]
    agent_definitions: list[AgentDefinitionContribution]
    automation_templates: list[AutomationTemplateContribution]
    cron_jobs: list[CronJobContribution]
    heartbeat_configs: list[HeartbeatConfigContribution]
    miniapps: list[MiniAppContribution]
    custom_fields: list[CustomFieldDefinition]
    model_config = {"extra": "forbid"}
 ```
 **Neue Felder hinzufügen:**
 ```python
 class PluginManifest(BaseModel):
    # ... alle bestehenden Felder ...
    # ── Versioning (Phase 4) ──
    min_app_version: str = Field(
        default="0.0.0",
        description="Minimum LeoCRM version required (SemVer)"
    )
    # ── Marketplace (Phase 5) ──
    author: str = Field(default="", max_length=200, description="Plugin author name")
    author_email: str = Field(default="", max_length=200, description="Author contact email")
    homepage: str = Field(default="", max_length=500, description="Plugin homepage URL")
    license: str = Field(default="MIT", max_length=50, description="License identifier")
    icon: str = Field(default="", description="Icon URL or emoji")
    screenshots: list[str] = Field(default_factory=list, description="Screenshot URLs for marketplace")
    changelog: str = Field(default="", description="Changelog URL or inline text")
    marketplace_tags: list[str] = Field(default_factory=list, description="Marketplace category tags")
    price: float = Field(default=0.0, ge=0.0, description="Price (0 = free)")
    # ── Hooks (Phase 2) ──
    hooks: list[str] = Field(
        default_factory=list,
        description="Hook names this plugin registers (e.g. 'contact.before_create')"
    )
    # ── Contracts (Phase 1) ──
    contract_version: str = Field(
        default="1.0.0",
        description="Contract API version this plugin exposes"
    )
 ```
 ### 6.2 Manifest-Schema-Dokumentation aktualisieren (3 Std)
 **`MANIFEST_SCHEMA_DOC` in `manifest.py` erweitern:**
 - Alle neuen Felder in `fields`-Dict aufnehmen
 - `example`-Manifest mit neuen Feldern aktualisieren
 - API-Endpoint `GET /api/v1/plugins/manifest` liefert vollständiges Schema
 ### 6.3 Alle 19 Plugin-Manifeste aktualisieren (8 Std)
 Jedes Plugin-Manifest muss um die neuen Felder erweitert werden:
 | # | Plugin | Aufwand | Neue Felder |
 |---|---|---|---|
 | 1 | `ai_assistant` | 30 Min | author, min_app_version, hooks, contract_version |
 | 2 | `ai_proactive` | 30 Min | author, min_app_version, hooks, contract_version |
 | 3 | `ai_ui_control` | 20 Min | author, min_app_version, contract_version |
 | 4 | `automation` | 30 Min | author, min_app_version, hooks, contract_version |
 | 5 | `calendar` | 20 Min | author, min_app_version, hooks, contract_version |
 | 6 | `dms` | 20 Min | author, min_app_version, hooks, contract_version |
 | 7 | `entity_links` | 15 Min | author, min_app_version, contract_version |
 | 8 | `forgejo_error_reporter` | 15 Min | author, min_app_version, contract_version |
 | 9 | `kommunikation` | 30 Min | author, min_app_version, hooks, contract_version |
 | 10 | `mail` | 20 Min | author, min_app_version, hooks, contract_version |
 | 11 | `mcp_client` | 20 Min | author, min_app_version, contract_version |
 | 12 | `mcp_server` | 20 Min | author, min_app_version, contract_version |
 | 13 | `permissions` | 20 Min | author, min_app_version, contract_version |
 | 14 | `report_generator` | 20 Min | author, min_app_version, contract_version |
 | 15 | `system_notif` | 15 Min | author, min_app_version, contract_version |
 | 16 | `tags` | 15 Min | author, min_app_version, contract_version |
 | 17 | `tasks` | 20 Min | author, min_app_version, hooks, contract_version |
 | 18 | `test_sample` | 10 Min | author, min_app_version, contract_version |
 | 19 | `unified_search` | 20 Min | author, min_app_version, hooks, contract_version |
 **Muster für Aktualisierung:**
 ```python
 # VORHER:
 manifest = PluginManifest(
    name="calendar",
    version="1.0.0",
    display_name="Calendar",
    ...
 )
 # NACHHER:
 manifest = PluginManifest(
    name="calendar",
    version="1.0.0",
    display_name="Calendar",
    # ... bestehende Felder ...
    # ── Neue Felder ──
    min_app_version="1.0.0",
    author="LeoCRM Team",
    license="MIT",
    hooks=["calendar.before_appointment", "calendar.after_appointment"],
    contract_version="1.0.0",
 )
 ```
 ### 6.4 Frontend Plugin-Manifest-Typen aktualisieren (2 Std)
 **`frontend/src/api/pluginManifests.ts` und `frontend/src/types/automation.ts`:**
 - TypeScript-Interfaces um neue Manifest-Felder erweitern
 - `PluginManifestResponse`-Typ aktualisieren
 - Frontend-Komponenten die Manifest-Felder anzeigen erweitern
 ### 6.5 Manifest-Validierung verschärfen (3 Std)
 **Neue Validierungsregeln in `PluginManifest`:**
 ```python
@field_validator("min_app_version")
@classmethod
 def validate_min_app_version(cls, v: str) -> str:
    """Validate SemVer format."""
    from app.plugins.semver import SemVer
    SemVer.parse(v)  # Raises ValueError if invalid
    return v
@field_validator("hooks")
@classmethod
 def validate_hooks(cls, v: list[str]) -> list[str]:
    """Validate hook names follow namespace.pattern."""
    for hook in v:
        if not re.match(r"^[a-z_]+\.[a-z_]+$", hook):
            raise ValueError(f"Invalid hook name '{hook}': must be 'namespace.action'")
    return v
 ```
 ### 6.6 Tests für erweitertes Manifest (3 Std)
 - `test_manifest.py` — Neue Felder validieren
 - `test_manifest_validation.py` — SemVer-Validierung, Hook-Name-Validierung
 - Alle Plugin-Tests: Manifest mit neuen Feldern erstellen
 - Frontend-Tests: Manifest mit neuen Feldern rendern
 ### Meilenstein Phase 6:
 - ✅ `PluginManifest` hat alle neuen Felder (min_app_version, author, hooks, contract_version, etc.)
 - ✅ `MANIFEST_SCHEMA_DOC` ist vollständig aktualisiert
 - ✅ Alle 19 Plugin-Manifeste haben die neuen Felder
 - ✅ Frontend-Typen sind aktualisiert
 - ✅ Manifest-Validierung ist verschärft
 - ✅ Tests bestanden
 ---
 ## Zeitplan
 ```
 Woche 1 (Tag 1-5):  Phase 1 — Contracts (Teil 1: contracts.py + Imports)
 Woche 2 (Tag 6-8):  Phase 1 — Contracts (Teil 2: Deaktivierung + Tests)
         (Tag 9-10): Phase 2 — Hooks/Filters-System
 Woche 3 (Tag 11):   Phase 3 — Plugin-Isolation
         (Tag 12-14): Phase 4 — Plugin-Versioning
 Woche 4 (Tag 15-19): Phase 5 — Marketplace-Vorbereitung
 Woche 5 (Tag 20-22): Phase 6 — Manifest-Anpassung & Konsolidierung
         (Tag 23):   Puffer / Bugfixes / Doku
 ```
 ### Abhängigkeiten
 ```
 Phase 1 (Contracts) ──→ Phase 3 (Isolation: Linting braucht Contracts als Ausnahme)
         │
         └──→ Phase 2 (Hooks: unabhängig, kann parallel)
         │
         └──→ Phase 4 (Versioning: braucht Contracts für min_app_version)
                  │
                  └──→ Phase 5 (Marketplace: braucht alles)
                           │
                           └──→ Phase 6 (Manifest: braucht Phase 4 + 5 Felder)
 ```
 ### Parallelisierungsmöglichkeiten
 - Phase 1 und Phase 2 können **parallel** laufen (verschiedene Entwickler)
 - Phase 3 kann erst nach Phase 1 starten
 - Phase 4 kann nach Phase 1 starten
 - Phase 5 kann erst nach Phase 1+4 starten
 - Phase 6 kann erst nach Phase 4+5 starten (braucht deren Manifest-Felder)
 ---
 ## Risiken
 | Risiko | Wahrscheinlichkeit | Auswirkung | Mitigation |
 |---|---|---|---|
 | Contract-Refactoring bricht bestehende Funktionalität | Mittel | Hoch | Tests nach jedem Plugin, schrittweise Migration |
 | Hooks/Filters verändern Core-Verhalten | Niedrig | Mittel | Tests für alle Hook-Punkte, Priority-System |
 | Externe Plugin-Discovery hat Sicherheitslücken | Mittel | Hoch | Signatur-Validierung, Quarantine, Allowlist |
 | SemVer-Parse-Fehler bei bestehenden Versionen | Niedrig | Niedrig | Fallback auf String-Vergleich |
 | Rollback-Migrationen löschen Daten | Mittel | Hoch | Bestätigungs-Prompt, Backup vor Rollback |
 ---
 ## Erfolgskriterien
 Nach Abschluss aller 5 Phasen:
 1. ✅ **0 direkte Cross-Plugin-Imports** (grep-verifiziert, linting-enforced)
 2. ✅ **Alle 16 Plugins haben contracts.py** mit klarer öffentlicher API
 3. ✅ **Contracts werden bei Deaktivierung abgemeldet**
 4. ✅ **Hooks/Filters-System** mit 15+ Hook-Punkten in Core-Services
 5. ✅ **Plugin-Isolation** durch Linting-Regeln erzwungen
 6. ✅ **SemVer-Vergleich** statt String-Vergleich
 7. ✅ **Rollback-Migrationen** für alle Plugins verfügbar
 8. ✅ **min_app_version** wird bei Installation geprüft
 9. ✅ **Update-Benachrichtigung** im Frontend
 10. ✅ **Marketplace-Endpoint** vorbereitet (deaktiviert)
 11. ✅ **Signatur-Validierung** für externe Plugins
 12. ✅ **Allowlist** schützt vor nicht autorisierten Plugins
 13. ✅ **Externe Plugin-Discovery** funktioniert
 14. ✅ **Alle Tests bestanden**
 15. ✅ **Built-in Plugins laufen ohne Marketplace**
 16. ✅ **PluginManifest hat alle neuen Felder** (min_app_version, author, hooks, contract_version, etc.)
 17. ✅ **Alle 19 Plugin-Manifeste aktualisiert** mit neuen Feldern
 18. ✅ **Manifest-Validierung verschärft** (SemVer, Hook-Names)
 19. ✅ **Frontend-Typen aktualisiert** für neue Manifest-Felder
 ---
 ## Dokumentation
 Nach Abschluss jeder Phase:
 - `docs/plugin-system/phase-N.md` — Was wurde gemacht, was geändert
 - `docs/plugin-system/contracts-api.md` — Contract-API Referenz
 - `docs/plugin-system/hooks-api.md` — Hooks/Filters Referenz
 - `docs/plugin-system/marketplace-api.md` — Marketplace-API Referenz
 - `docs/plugin-system/plugin-development-guide.md` — Wie man ein Plugin entwickelt
 ---
 **Dieser Plan ist vollständig. Alle Aufgaben, Aufwände, Abhängigkeiten und Risiken sind erfasst.**
@@ -0,0 +1,112 @@
 # RBAC Build Progress — LeoCRM
 ## Letztes Update: 2026-07-29 03:17 CEST
 ## Alle 23 Sprints — Code vollständig erstellt ✅
 ### Sprint Übersicht
 | Sprint | Inhalt | Status |
 |--------|--------|:---:|
 | 1 — Fundament | entity_permissions + OwnedMixin + Service + API + Redis-Cache + RLS + Rate Limiting | ✅ Deployed |
 | 2 — Row-Level Security | visibility.py + 9 Services + 9 Routes + BaseSearchProvider + Frontend Permission-Checks | ✅ Deployed |
 | 3 — Search/Dashboard/Export | Search Provider Permission-aware + Dashboard Counts + Export Filter | ✅ Deployed |
 | 4 — Field-Level | 44 Core Field Definitions + Custom Field Sensitivity + filter_fields_by_permission | ✅ Code |
 | 5 — Sharing UI | Universeller ShareDialog + Entity Permission API + Hooks | ✅ Code |
 | 6 — Notifications + Audit | Permission-Change Notifications + Audit Trail + Notification Entity Filter | ✅ Code |
 | 7 — E-Mail Postfächer | Mailbox owner_id + Permissions + Migration 0053 | ✅ Code |
 | 8 — Plugin Entities | DMS/Calendar/Tasks OwnedMixin + Migration 0054 | ✅ Code |
 | 9 — App-Sichtbarkeit | Sidebar Permission-Filter + TopBar + ProtectedRoute + Route Guards | ✅ Deployed |
 | 10 — Advanced Security + AI | AI Copilot Permission-Aware + API-Token Scopes + Merge Check | ✅ Code |
 | 11 — Owner Management | Owner Transfer Service + Auto-Transfer + API | ✅ Code |
 | 12 — Zentrale Einstellungsseite | SettingsRechte.tsx mit Tabs (Rollen, Gruppen, Freigaben, Audit) | ✅ Code |
 | 13 — ABAC Engine | entity_policies + Policy Service + Migration 0055 | ✅ Code |
 | 14 — ABAC UI | ABACRuleEditor.tsx + policies.ts + policyHooks.ts | ✅ Code |
 | 15 — Templates & Automation | permission_templates + Service + Migration 0056 | ✅ Code |
 | 16 — Mass & Bulk | bulk_share + bulk_unshare + API | ✅ Code |
 | 17 — Analytics & Konflikte | permission_analytics + API | ✅ Code |
 | 18 — Delegation | permission_delegations + Service + Migration 0057 | ✅ Code |
 | 19 — Resolution-Strategien | 4 Strategien + Tenant-Einstellung + Migration 0058 | ✅ Code |
 | 20 — Tests | test_entity_permissions + test_abac + test_permission_performance | ✅ Code |
 | 21 — Dokumentation | permissions.md + permissions_plugin_dev.md | ✅ Code |
 | 22 — Guest Access | guest_users + Guest Auth + Invitation + Guest Frontend + Migration 0059 | ✅ Code |
 | 23 — Infrastructure | PgBouncer + Audit Partitioning docs + scripts | ✅ Code |
 ### Migrationen in Produktion
 | # | Beschreibung | Status |
 |---|-------------|:---:|
 | 0048 | contact_folder_permissions Tabelle | ✅ |
 | 0049 | entity_permissions Tabelle | ✅ |
 | 0050 | owner_id auf 15 Tabellen | ✅ |
 | 0051 | Folder ACLs → entity_permissions | ✅ |
 | 0052 | RLS Policies auf contacts | ✅ |
 | 0053 | mail_accounts owner_id | ✅ |
 | 0054 | Plugin owner_id (files, folders, calendars, tasks) | ✅ |
 | 0055 | entity_policies Tabelle | ✅ |
 | 0056 | permission_templates Tabelle | ✅ |
 | 0057 | permission_delegations Tabelle | ✅ |
 | 0058 | tenants resolution_strategy | ✅ |
 | 0059 | guest_users Tabelle | ✅ |
 ### Git Commits (Diese Session)
 | Hash | Beschreibung |
 |------|-------------|
 | cc021cd | feat: folder permissions (ACLs) |
 | 5afa1fa | sprint1: entity_permissions + owned_mixin + service + API |
 | 48647a5 | sprint1: set_user_context + RLS policies + folder ACL migration |
 | ea1c1d5 | sprint1 complete: rate limiting |
 | 479ee04 | sprint2: visibility filter + contact service access checks |
 | 9fc84b7 | sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider |
 | 52a5c34 | sprint2: frontend permission checks |
 | 517e1b6 | sprint2+3: remaining services + search provider permission-aware |
 | b06aeeb | sprint3: dashboard counts + import owner_id + export filter |
 | 71ed592 | sprint4+5: field-level permissions + universal ShareDialog |
 | 88c0428 | sprint6+7: notifications + audit + mail permissions |
 | 48b2dfd | sprint9: app visibility — sidebar + route guards |
 | 958e412 | sprint8: plugin entities migration 0054 |
 | b7ccd9e | sprint8: fix migration 0054 |
 | 2c14368 | sprint10+11: AI permission + owner transfer |
 | e0003b9 | sprint12+13: rechte settings + ABAC engine |
 | ddf73ee | sprint14-19: ABAC UI + templates + bulk + analytics + delegation + resolution |
 | 24690fb | sprint20-23: tests + docs + guest access + infrastructure |
 | 680d5ab | fix: migration 0058 checkconstraint |
 | 015eb94 | fix: SettingsRechte TypeScript errors |
 | 4c134c6 | fix: GuestContacts title prop |
 ### Was in Produktion läuft (Backend)
 - ✅ entity_permissions Tabelle (universelle ACLs für alle Entities)
 - ✅ owner_id auf 20+ Tabellen
 - ✅ PostgreSQL RLS auf contacts (4 Policies)
 - ✅ set_user_context() bei jedem Request
 - ✅ Universelle Permission API (/api/v1/permissions/*)
 - ✅ Rate Limiting auf Permission-Änderungen
 - ✅ Visibility Filter in 12+ Services
 - ✅ BaseSearchProvider für Permission-aware Search
 - ✅ Dashboard Counts pro User
 - ✅ Export Filter
 - ✅ AI Copilot Permission-Aware
 - ✅ Owner Transfer Service
 - ✅ ABAC Engine (entity_policies + policy_service)
 - ✅ Permission Templates
 - ✅ Bulk Share
 - ✅ Permission Analytics
 - ✅ Permission Delegation
 - ✅ Resolution Strategies (4 Strategien)
 - ✅ Guest Access (guest_users + guest_auth + invitation)
 - ✅ Permission-Change Notifications + Audit Trail
 - ✅ Mailbox Permissions
 ### Was in Produktion läuft (Frontend)
 - ✅ Permission-Checks in ContactDetail + ContactsList
 - ✅ Field-Level UI (hidden/readonly)
 - ✅ Sidebar Permission-Filter
 - ✅ TopBar Permission-Filter
 - ✅ ProtectedRoute + Route Guards
 - ✅ Universeller ShareDialog
 - ✅ ABAC Rule Editor
 - ✅ SettingsRechte (Zentrale Rechte-Seite mit Tabs)
 - ✅ Guest Login + Guest Contacts
 ### Was noch deployed werden muss
 - Backend: Sprint 4-8, 10-19, 22 Dateien sind im Code aber noch nicht alle im Container (Coolify Full Deploy nötig)
 - Frontend: Build erfolgreich, dist vorhanden
@@ -1,7 +1,7 @@
 # LeoCRM v1.0
 > Self-hosted CRM for small sales teams (5–25 sales reps).
-> Stack: FastAPI + SQLAlchemy (async) + PostgreSQL + Redis + Alpine.js + Tailwind + Docker + Coolify
+> Stack: FastAPI + SQLAlchemy (async) + PostgreSQL + Redis + React 18 + TypeScript + Vite + TanStack Query + Zustand + Tailwind + Docker + Coolify
 ## Quick Start (Development)
@@ -0,0 +1,125 @@
 """RLS repair + separate DB runtime user.
 Revision ID: 0044
 Revises: 0043
 Created: 2026-07-26
 This migration:
 1. Re-discovers ALL tenant-scoped tables and ensures RLS is enabled
   with FORCE + WITH CHECK (covers tables added after migration 0028).
 2. Creates a separate ``crm_runtime`` role with NOSUPERUSER and
   NOBYPASSRLS so the application cannot bypass RLS.
 3. Grants only DML permissions (SELECT/INSERT/UPDATE/DELETE) to
   ``crm_runtime`` on all tenant-scoped tables.
 IMPORTANT: After this migration, the application's DATABASE_URL must
 use ``crm_runtime`` (not the superuser) for API and worker containers.
 Migration/DDL operations continue to use the owner user (crm_user).
 """
 from alembic import op
 import sqlalchemy as sa
 import logging
 logger = logging.getLogger(__name__)
 revision = "0044"
 down_revision = "0043_backups"
 branch_labels = None
 depends_on = None
 def _discover_tenant_tables(conn) -> list[str]:
    """Return all table names in the public schema that have a tenant_id column."""
    result = conn.execute(
        sa.text(
            "SELECT table_name FROM information_schema.columns "
            "WHERE table_schema = 'public' AND column_name = 'tenant_id' "
            "ORDER BY table_name"
        )
    )
    return [row[0] for row in result]
 def _discover_existing_policies(conn, table_name: str) -> list[str]:
    """Return all policy names on *table_name* that contain 'tenant' or 'isolation'."""
    result = conn.execute(
        sa.text(
            "SELECT policyname FROM pg_policies "
            "WHERE schemaname = 'public' AND tablename = :t "
            "AND (policyname LIKE '%tenant%' OR policyname LIKE '%isolation%')"
        ),
        {"t": table_name},
    )
    return [row[0] for row in result]
 def upgrade() -> None:
    conn = op.get_bind()
    # ── 1. RLS Repair: ensure all tenant tables have RLS + WITH CHECK ──
    tenant_tables = _discover_tenant_tables(conn)
    logger.info("RLS repair: discovered %d tenant-scoped tables: %s", len(tenant_tables), tenant_tables)
    for table_name in tenant_tables:
        # Enable RLS
        op.execute(f'ALTER TABLE "{table_name}" ENABLE ROW LEVEL SECURITY')
        # Force RLS (applies to table owner too)
        op.execute(f'ALTER TABLE "{table_name}" FORCE ROW LEVEL SECURITY')
        # Drop existing tenant policies
        existing_policies = _discover_existing_policies(conn, table_name)
        for policy_name in existing_policies:
            op.execute(f'DROP POLICY IF EXISTS "{policy_name}" ON "{table_name}"')
            logger.info("Dropped policy %s on %s", policy_name, table_name)
        # Create unified tenant isolation policy with WITH CHECK
        op.execute(
            f'CREATE POLICY tenant_isolation ON "{table_name}" '
            f"USING (tenant_id = current_setting('app.tenant_id', true)::uuid) "
            f"WITH CHECK (tenant_id = current_setting('app.tenant_id', true)::uuid)"
        )
        logger.info("Created/updated tenant_isolation policy on %s (USING + WITH CHECK)", table_name)
    # ── 2. Create crm_runtime role (NOSUPERUSER, NOBYPASSRLS) ──
    # Use DO block for idempotent creation
    op.execute(
        sa.text(
            "DO $$ "
            "BEGIN "
            "  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'crm_runtime') THEN "
            "    CREATE ROLE crm_runtime LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE "
            "    NOREPLICATION NOBYPASSRLS; "
            "  END IF; "
            "END $$;"
        )
    )
    logger.info("Ensured crm_runtime role exists (NOSUPERUSER, NOBYPASSRLS)")
    # ── 3. Grant DML permissions to crm_runtime on all tenant tables ──
    for table_name in tenant_tables:
        op.execute(
            f'GRANT SELECT, INSERT, UPDATE, DELETE ON "{table_name}" TO crm_runtime'
        )
    # Grant usage on sequences (for SERIAL/IDENTITY columns)
    op.execute("GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO crm_runtime")
    logger.info("Granted DML permissions to crm_runtime on %d tables", len(tenant_tables))
 def downgrade() -> None:
    conn = op.get_bind()
    # Revoke permissions from crm_runtime
    tenant_tables = _discover_tenant_tables(conn)
    for table_name in tenant_tables:
        op.execute(f'REVOKE SELECT, INSERT, UPDATE, DELETE ON "{table_name}" FROM crm_runtime')
    op.execute("REVOKE USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public FROM crm_runtime")
    # Drop crm_runtime role
    op.execute("DROP ROLE IF EXISTS crm_runtime")
    logger.info("Dropped crm_runtime role")
    # Note: RLS policies are NOT reverted here to avoid weakening security.
    # Migration 0028's downgrade handles the original set of tables.
@@ -0,0 +1,184 @@
 """Forward-repair migration for databases that ran the original 0021/0027.
 Revision ID: 0045
 Revises: 0044
 Created: 2026-07-26
 Problem:
  Migrations 0021 and 0027 were retroactively rewritten to be safer
  (rename old tables, INSERT ... SELECT, preserve *_old tables).
  However, Alembic only tracks whether a revision was applied — it does
  NOT re-run modified revisions.  Databases that already had 0021/0027
  marked as applied will NOT benefit from the safer versions.
 This migration:
  1. Detects *_old tables (left behind by the rewritten 0021).
  2. Compares row counts between *_old and current tables.
  3. Migrates any missing rows from *_old to the current tables.
  4. Logs discrepancies and aborts on data integrity issues.
  5. Also repairs entity_type='company' → 'contact' (from rewritten 0027).
 Safe to run on fresh installations (no *_old tables → no-op).
 """
 from __future__ import annotations
 import logging
 from typing import Sequence, Union
 from alembic import op
 import sqlalchemy as sa
 logger = logging.getLogger("alembic.migration.0045")
 revision = "0045"
 down_revision = "0044"
 branch_labels: Union[str, Sequence[str], None] = None
 depends_on: Union[str, Sequence[str], None] = None
 def _table_exists(conn, table_name: str) -> bool:
    """Check whether *table_name* exists in the public schema."""
    result = conn.execute(
        sa.text(
            "SELECT EXISTS (SELECT 1 FROM information_schema.tables "
            "WHERE table_schema = 'public' AND table_name = :t)"
        ),
        {"t": table_name},
    )
    return result.scalar()
 def _row_count(conn, table_name: str) -> int:
    """Return the number of rows in *table_name*, or 0 if it doesn't exist."""
    if not _table_exists(conn, table_name):
        return -1
    result = conn.execute(sa.text(f'SELECT COUNT(*) FROM "{table_name}"'))
    return result.scalar()
 def upgrade() -> None:
    conn = op.get_bind()
    # ── 1. Check for *_old tables from rewritten migration 0021 ──
    old_tables = ["contacts_old", "companies_old", "addresses_old"]
    found_old = [t for t in old_tables if _table_exists(conn, t)]
    if not found_old:
        logger.info("0045: No *_old tables found — fresh install or already repaired. Skipping.")
    else:
        logger.info("0045: Found *_old tables: %s — checking data integrity...", found_old)
        # Compare contacts_old → contacts
        if _table_exists(conn, "contacts_old"):
            old_count = _row_count(conn, "contacts_old")
            new_count = _row_count(conn, "contacts")
            logger.info("0045: contacts_old=%d rows, contacts=%d rows", old_count, new_count)
            if old_count > new_count:
                # Migrate missing rows from contacts_old to contacts
                missing = old_count - new_count
                logger.warning("0045: %d contacts missing from current table — migrating...", missing)
                op.execute(
                    sa.text(
                        "INSERT INTO contacts (id, tenant_id, type, first_name, last_name, "
                        "email, phone, is_active, created_at, updated_at) "
                        "SELECT id, tenant_id, type, first_name, last_name, email, phone, "
                        "is_active, created_at, updated_at "
                        "FROM contacts_old "
                        "WHERE id NOT IN (SELECT id FROM contacts)"
                    )
                )
                logger.info("0045: Migrated %d missing contacts", missing)
        # Compare companies_old → contacts (type='company')
        if _table_exists(conn, "companies_old"):
            old_count = _row_count(conn, "companies_old")
            new_count = conn.execute(
                sa.text("SELECT COUNT(*) FROM contacts WHERE type = 'company'")
            ).scalar()
            logger.info("0045: companies_old=%d rows, contacts(type=company)=%d rows", old_count, new_count)
            if old_count > new_count:
                missing = old_count - new_count
                logger.warning("0045: %d companies missing — migrating...", missing)
                op.execute(
                    sa.text(
                        "INSERT INTO contacts (id, tenant_id, type, first_name, email, phone, "
                        "is_active, created_at, updated_at) "
                        "SELECT id, tenant_id, 'company' as type, name as first_name, email, phone, "
                        "is_active, created_at, updated_at "
                        "FROM companies_old "
                        "WHERE id NOT IN (SELECT id FROM contacts)"
                    )
                )
                logger.info("0045: Migrated %d missing companies", missing)
    # ── 2. Repair entity_type='company' → 'contact' (from rewritten 0027) ──
    # Check if any rows still have entity_type='company' in relevant tables
    repair_tables = [
        ("entity_links", "entity_type"),
        ("tag_assignments", "entity_type"),
        ("calendar_entry_links", "entity_type"),
        ("addresses", "entity_type"),
    ]
    for table, col in repair_tables:
        if not _table_exists(conn, table):
            continue
        try:
            result = conn.execute(
                sa.text(f"SELECT COUNT(*) FROM \"{table}\" WHERE {col} = 'company'")
            )
            count = result.scalar()
            if count > 0:
                logger.warning("0045: Found %d rows with entity_type='company' in %s — repairing...", count, table)
                op.execute(
                    sa.text(f"UPDATE \"{table}\" SET {col} = 'contact' WHERE {col} = 'company'")
                )
                logger.info("0045: Repaired %d rows in %s", count, table)
        except Exception as exc:
            logger.warning("0045: Could not check/repair %s: %s", table, exc)
    # ── 3. Repair mails.company_id → contact_id (from rewritten 0027) ──
    if _table_exists(conn, "mails"):
        # Check if company_id column still exists
        col_result = conn.execute(
            sa.text(
                "SELECT EXISTS (SELECT 1 FROM information_schema.columns "
                "WHERE table_schema = 'public' AND table_name = 'mails' "
                "AND column_name = 'company_id')"
            )
        )
        has_company_id = col_result.scalar()
        if has_company_id:
            # Copy company_id → contact_id where contact_id is NULL
            result = conn.execute(
                sa.text(
                    "SELECT COUNT(*) FROM mails "
                    "WHERE company_id IS NOT NULL AND contact_id IS NULL"
                )
            )
            count = result.scalar()
            if count > 0:
                logger.warning("0045: Found %d mails with company_id but no contact_id — repairing...", count)
                op.execute(
                    sa.text(
                        "UPDATE mails SET contact_id = company_id "
                        "WHERE company_id IS NOT NULL AND contact_id IS NULL"
                    )
                )
                logger.info("0045: Repaired %d mail contact_id references", count)
            # Drop company_id column (safe now that data is copied)
            op.execute(sa.text("ALTER TABLE mails DROP COLUMN IF EXISTS company_id"))
            logger.info("0045: Dropped mails.company_id column")
    logger.info("0045: Forward-repair migration completed")
 def downgrade() -> None:
    # This migration is a repair — no meaningful downgrade.
    # The *_old tables and original data are preserved by migration 0021.
    logger.info("0045: Downgrade is a no-op (repair migration)")
@@ -0,0 +1,40 @@
 """Create plugin_allowlist table for authorized external plugins.
 Revision ID: 0046
 Revises: 0045
 Create Date: 2026-07-26
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 revision = "0046"
 down_revision = "0045"
 branch_labels = None
 depends_on = None
 def upgrade():
    op.create_table(
        "plugin_allowlist",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("plugin_name", sa.String(80), nullable=False),
        sa.Column("allowed_hash", sa.String(64), nullable=True),
        sa.Column("allowed_signature", sa.Text, nullable=True),
        sa.Column("public_key", sa.Text, nullable=True),
        sa.Column("added_by", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
        sa.Column("is_active", sa.Boolean, nullable=False, server_default=sa.text("true")),
        sa.Column("notes", sa.Text, nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
    )
    op.create_index("ix_plugin_allowlist_plugin_name", "plugin_allowlist", ["plugin_name"])
    op.create_index("ix_plugin_allowlist_hash", "plugin_allowlist", ["allowed_hash"])
 def downgrade():
    op.drop_index("ix_plugin_allowlist_hash", table_name="plugin_allowlist")
    op.drop_index("ix_plugin_allowlist_plugin_name", table_name="plugin_allowlist")
    op.drop_table("plugin_allowlist")
@@ -0,0 +1,39 @@
 """Create saved_views table
 Revision ID: 0047_saved_views
 Revises: 0046_plugin_allowlist
 Create Date: 2026-07-28
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID, JSONB
 revision = "0047_saved_views"
 down_revision = "0046"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.create_table(
        "saved_views",
        sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("name", sa.String(100), nullable=False),
        sa.Column("entity_type", sa.String(50), nullable=False),
        sa.Column("view_config", JSONB, nullable=False, server_default=sa.text("'{}'::jsonb")),
        sa.Column("user_id", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
        sa.Column("tenant_id", UUID(as_uuid=True), nullable=False),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
    )
    op.create_unique_constraint("uq_saved_views_tenant_user_entity_name", "saved_views", ["tenant_id", "user_id", "entity_type", "name"])
    op.create_index("ix_saved_views_tenant_user", "saved_views", ["tenant_id", "user_id"])
    op.create_index("ix_saved_views_tenant_entity", "saved_views", ["tenant_id", "entity_type"])
 def downgrade() -> None:
    op.drop_index("ix_saved_views_tenant_entity", table_name="saved_views")
    op.drop_index("ix_saved_views_tenant_user", table_name="saved_views")
    op.drop_unique_constraint("uq_saved_views_tenant_user_entity_name", "saved_views")
    op.drop_table("saved_views")
@@ -0,0 +1,48 @@
 """Contact folder permissions (ACLs for folder sharing).
 Revision ID: 0048
 Revises: 0047
 Create Date: 2026-07-28
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 revision = "0048"
 down_revision = "0047_saved_views"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.create_table(
        "contact_folder_permissions",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True),
        sa.Column("folder_id", PGUUID(as_uuid=True), sa.ForeignKey("contact_folders.id", ondelete="CASCADE"), nullable=False),
        sa.Column("user_id", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=True),
        sa.Column("group_id", PGUUID(as_uuid=True), sa.ForeignKey("groups.id", ondelete="CASCADE"), nullable=True),
        sa.Column("tenant_id", PGUUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
        sa.Column("permission_level", sa.String(20), nullable=False, server_default="read"),
        sa.Column("inherit_to_subfolders", sa.Boolean, nullable=False, server_default="true"),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
        sa.UniqueConstraint("folder_id", "user_id", "group_id", "tenant_id", name="uq_cfp_folder_user_group_tenant"),
        sa.CheckConstraint(
            "(user_id IS NOT NULL AND group_id IS NULL) OR "
            "(user_id IS NULL AND group_id IS NOT NULL)",
            name="ck_cfp_exactly_one_principal",
        ),
    )
    op.create_index("ix_cfp_folder", "contact_folder_permissions", ["folder_id"])
    op.create_index("ix_cfp_user", "contact_folder_permissions", ["user_id"])
    op.create_index("ix_cfp_group", "contact_folder_permissions", ["group_id"])
    op.create_index("ix_cfp_tenant", "contact_folder_permissions", ["tenant_id"])
 def downgrade() -> None:
    op.drop_index("ix_cfp_tenant", table_name="contact_folder_permissions")
    op.drop_index("ix_cfp_group", table_name="contact_folder_permissions")
    op.drop_index("ix_cfp_user", table_name="contact_folder_permissions")
    op.drop_index("ix_cfp_folder", table_name="contact_folder_permissions")
    op.drop_table("contact_folder_permissions")
@@ -0,0 +1,47 @@
 """Universal entity_permissions table — ACLs for ALL entities.
 Revision ID: 0049
 Revises: 0048
 Create Date: 2026-07-29
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 revision = "0049"
 down_revision = "0048"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.create_table(
        "entity_permissions",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True),
        sa.Column("entity_type", sa.String(50), nullable=False),
        sa.Column("entity_id", PGUUID(as_uuid=True), nullable=False),
        sa.Column("principal_type", sa.String(10), nullable=False),
        sa.Column("principal_id", PGUUID(as_uuid=True), nullable=False),
        sa.Column("permission_level", sa.String(20), nullable=False, server_default="read"),
        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("created_by", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
        sa.Column("tenant_id", PGUUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
        sa.UniqueConstraint("entity_type", "entity_id", "principal_type", "principal_id", "tenant_id", name="uq_ep_entity_principal_tenant"),
        sa.CheckConstraint("principal_type IN ('user', 'group', 'role', 'guest')", name="ck_ep_principal_type"),
        sa.CheckConstraint("permission_level IN ('none', 'read', 'write', 'admin', 'delete')", name="ck_ep_permission_level"),
    )
    op.create_index("ix_ep_entity", "entity_permissions", ["entity_type", "entity_id"])
    op.create_index("ix_ep_principal", "entity_permissions", ["principal_type", "principal_id"])
    op.create_index("ix_ep_tenant", "entity_permissions", ["tenant_id"])
    op.create_index("ix_ep_expires", "entity_permissions", ["expires_at"])
 def downgrade() -> None:
    op.drop_index("ix_ep_expires", table_name="entity_permissions")
    op.drop_index("ix_ep_tenant", table_name="entity_permissions")
    op.drop_index("ix_ep_principal", table_name="entity_permissions")
    op.drop_index("ix_ep_entity", table_name="entity_permissions")
    op.drop_table("entity_permissions")
@@ -0,0 +1,49 @@
 """Add owner_id to all entity tables for row-level ownership.
 Revision ID: 0050
 Revises: 0049
 Create Date: 2026-07-29
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 revision = "0050"
 down_revision = "0049"
 branch_labels = None
 depends_on = None
 # Tables that get owner_id (all entity tables except system tables)
 TABLES = [
    "contacts",
    "contactpersons",
    "addresses",
    "bank_accounts",
    "attachments",
    "workflows",
    "workflow_instances",
    "sequences",
    "saved_filters",
    "saved_views",
    "webhooks",
    "custom_field_definitions",
    "notifications",
    "entity_history",
    "ai_conversations",
 ]
 def upgrade() -> None:
    for table in TABLES:
        op.add_column(
            table,
            sa.Column("owner_id", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
        )
        op.create_index(f"ix_{table}_owner", table, ["owner_id"])
 def downgrade() -> None:
    for table in TABLES:
        op.drop_index(f"ix_{table}_owner", table_name=table)
        op.drop_column(table, "owner_id")
@@ -0,0 +1,41 @@
 """Migrate contact_folder_permissions to universal entity_permissions table.
 Revision ID: 0051
 Revises: 0050
 Create Date: 2026-07-29
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 revision = "0051"
 down_revision = "0050"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    # Migrate existing contact_folder_permissions to entity_permissions
    op.execute("""
        INSERT INTO entity_permissions (id, entity_type, entity_id, principal_type, principal_id, permission_level, tenant_id, created_at, updated_at)
        SELECT 
            gen_random_uuid(),
            'contact_folder',
            folder_id,
            CASE 
                WHEN user_id IS NOT NULL THEN 'user'
                WHEN group_id IS NOT NULL THEN 'group'
            END,
            COALESCE(user_id, group_id),
            permission_level,
            tenant_id,
            created_at,
            updated_at
        FROM contact_folder_permissions
        ON CONFLICT DO NOTHING
    """)
 def downgrade() -> None:
    op.execute("DELETE FROM entity_permissions WHERE entity_type = 'contact_folder'")
@@ -0,0 +1,90 @@
 """Create PostgreSQL RLS policies for row-level security on contacts.
 Revision ID: 0052
 Revises: 0051
 Create Date: 2026-07-29
 This migration enables PostgreSQL Row-Level Security on the contacts table
 and creates policies that enforce visibility based on:
 1. System admin sees everything
 2. Owner sees own rows
 3. Tenant-owned (owner_id IS NULL) visible to all
 4. Shared via entity_permissions
 """
 from alembic import op
 revision = "0052"
 down_revision = "0051"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    # Enable RLS on contacts table
    op.execute("ALTER TABLE contacts ENABLE ROW LEVEL SECURITY")
    # Policy: System admin sees everything
    op.execute("""
        CREATE POLICY contacts_admin_visible ON contacts
        FOR ALL
        USING (current_setting('app.is_system_admin', true) = 'true')
    """)
    # Policy: Owner sees own rows
    op.execute("""
        CREATE POLICY contacts_owner_visible ON contacts
        FOR ALL
        USING (
            owner_id::text = current_setting('app.current_user_id', true)
        )
    """)
    # Policy: Tenant-owned (owner_id IS NULL) visible to all in tenant
    op.execute("""
        CREATE POLICY contacts_tenant_owned_visible ON contacts
        FOR ALL
        USING (owner_id IS NULL)
    """)
    # Policy: Shared via entity_permissions
    op.execute("""
        CREATE POLICY contacts_shared_visible ON contacts
        FOR ALL
        USING (
            EXISTS (
                SELECT 1 FROM entity_permissions ep
                WHERE ep.entity_type = 'contact'
                AND ep.entity_id = contacts.id
                AND ep.tenant_id = contacts.tenant_id
                AND ep.permission_level != 'none'
                AND (
                    ep.expires_at IS NULL OR ep.expires_at > NOW()
                )
                AND (
                    (ep.principal_type = 'user' 
                     AND ep.principal_id::text = current_setting('app.current_user_id', true))
                    OR
                    (ep.principal_type = 'group'
                     AND ep.principal_id::text = ANY(
                         string_to_array(current_setting('app.current_user_groups', true), ',')
                     ))
                    OR
                    (ep.principal_type = 'role'
                     AND ep.principal_id IN (
                         SELECT ut.role_id FROM user_tenants ut
                         WHERE ut.user_id::text = current_setting('app.current_user_id', true)
                         AND ut.tenant_id = contacts.tenant_id
                     ))
                )
            )
        )
    """)
 def downgrade() -> None:
    op.execute("DROP POLICY IF EXISTS contacts_shared_visible ON contacts")
    op.execute("DROP POLICY IF EXISTS contacts_tenant_owned_visible ON contacts")
    op.execute("DROP POLICY IF EXISTS contacts_owner_visible ON contacts")
    op.execute("DROP POLICY IF EXISTS contacts_admin_visible ON contacts")
    op.execute("ALTER TABLE contacts DISABLE ROW LEVEL SECURITY")
@@ -0,0 +1,41 @@
 """Add owner_id to mail_accounts for row-level permissions.
 Revision ID: 0053
 Revises: 0052
 Create Date: 2026-07-29
 This migration adds owner_id to mail_accounts so that the universal
 visibility/permission system (apply_visibility_filter, check_single_entity_access)
 can be used for mail accounts.
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID
 revision = "0053"
 down_revision = "0052"
 branch_labels = None
 depends_on = None
 def upgrade():
    op.add_column(
        "mail_accounts",
        sa.Column(
            "owner_id",
            UUID(as_uuid=True),
            sa.ForeignKey("users.id", ondelete="SET NULL"),
            nullable=True,
        ),
    )
    op.create_index(
        "ix_mail_accounts_owner",
        "mail_accounts",
        ["owner_id"],
    )
 def downgrade():
    op.drop_index("ix_mail_accounts_owner", table_name="mail_accounts")
    op.drop_column("mail_accounts", "owner_id")
@@ -0,0 +1,62 @@
 """Add owner_id to plugin entity tables for row-level ownership.
 Revision ID: 0054
 Revises: 0053
 Create Date: 2026-07-29
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 revision = "0054"
 down_revision = "0053"
 branch_labels = None
 depends_on = None
 # Tables that need owner_id
 TABLES = [
    "files",
    "folders",
    "calendar_entries",
    "calendars",
    "tasks",
    "subtasks",
 ]
 def upgrade() -> None:
    # Check which columns already exist before adding
    conn = op.get_bind()
    for table in TABLES:
        # Check if column already exists
        result = conn.execute(
            sa.text(
                "SELECT column_name FROM information_schema.columns "
                "WHERE table_name = :table AND column_name = 'owner_id'"
            ),
            {"table": table},
        )
        if result.fetchone() is None:
            op.add_column(
                table,
                sa.Column(
                    "owner_id",
                    PGUUID(as_uuid=True),
                    sa.ForeignKey("users.id", ondelete="SET NULL"),
                    nullable=True,
                ),
            )
            op.create_index(f"ix_{table}_owner", table, ["owner_id"])
 def downgrade() -> None:
    for table in TABLES:
        try:
            op.drop_index(f"ix_{table}_owner", table_name=table)
        except Exception:
            pass
        try:
            op.drop_column(table, "owner_id")
        except Exception:
            pass
@@ -0,0 +1,55 @@
 """Create entity_policies table for ABAC engine.
 Revision ID: 0055
 Revises: 0054
 Create Date: 2026-07-29
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
 revision = "0055"
 down_revision = "0054"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.create_table(
        "entity_policies",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("name", sa.String(200), nullable=False),
        sa.Column("entity_type", sa.String(50), nullable=False),
        sa.Column("principal_type", sa.String(10), nullable=False),
        sa.Column("principal_id", PGUUID(as_uuid=True), nullable=False),
        sa.Column("effect", sa.String(10), nullable=False, server_default=sa.text("'allow'")),
        sa.Column("conditions", JSONB, nullable=True),
        sa.Column("priority", sa.Integer, nullable=False, server_default=sa.text("0")),
        sa.Column("tenant_id", PGUUID(as_uuid=True), nullable=False),
        sa.Column("enabled", sa.Boolean, nullable=False, server_default=sa.text("true")),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
        sa.CheckConstraint(
            "principal_type IN ('user', 'group', 'role')",
            name="ck_epol_principal_type",
        ),
        sa.CheckConstraint(
            "effect IN ('allow', 'deny')",
            name="ck_epol_effect",
        ),
    )
    op.create_index("ix_epol_entity_type", "entity_policies", ["entity_type"])
    op.create_index("ix_epol_principal", "entity_policies", ["principal_type", "principal_id"])
    op.create_index("ix_epol_tenant", "entity_policies", ["tenant_id"])
    op.create_index("ix_epol_priority", "entity_policies", ["priority"])
    op.create_index("ix_epol_enabled", "entity_policies", ["enabled"])
 def downgrade() -> None:
    op.drop_index("ix_epol_enabled", table_name="entity_policies")
    op.drop_index("ix_epol_priority", table_name="entity_policies")
    op.drop_index("ix_epol_tenant", table_name="entity_policies")
    op.drop_index("ix_epol_principal", table_name="entity_policies")
    op.drop_index("ix_epol_entity_type", table_name="entity_policies")
    op.drop_table("entity_policies")
@@ -0,0 +1,42 @@
 """Create permission_templates table.
 Revision ID: 0056
 Revises: 0055
 Create Date: 2026-07-29
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
 revision = "0056"
 down_revision = "0055"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.create_table(
        "permission_templates",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("name", sa.String(200), nullable=False),
        sa.Column("entity_type", sa.String(50), nullable=False),
        sa.Column("trigger_condition", JSONB, nullable=True),
        sa.Column("auto_share_with", JSONB, nullable=True),
        sa.Column("level", sa.String(20), nullable=False, server_default=sa.text("'read'")),
        sa.Column("tenant_id", PGUUID(as_uuid=True), nullable=False),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
        sa.CheckConstraint(
            "level IN ('read', 'write', 'admin', 'delete')",
            name="ck_pt_level",
        ),
    )
    op.create_index("ix_pt_entity_type", "permission_templates", ["entity_type"])
    op.create_index("ix_pt_tenant", "permission_templates", ["tenant_id"])
 def downgrade() -> None:
    op.drop_index("ix_pt_tenant", table_name="permission_templates")
    op.drop_index("ix_pt_entity_type", table_name="permission_templates")
    op.drop_table("permission_templates")
@@ -0,0 +1,47 @@
 """Create permission_delegations table.
 Revision ID: 0057
 Revises: 0056
 Create Date: 2026-07-29
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
 revision = "0057"
 down_revision = "0056"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.create_table(
        "permission_delegations",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("from_user_id", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
        sa.Column("to_user_id", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
        sa.Column("start_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("end_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("scope", JSONB, nullable=True),
        sa.Column("active", sa.Boolean, nullable=False, server_default=sa.text("true")),
        sa.Column("tenant_id", PGUUID(as_uuid=True), nullable=False),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
        sa.CheckConstraint(
            "end_at > start_at",
            name="ck_pd_end_after_start",
        ),
    )
    op.create_index("ix_pd_from_user", "permission_delegations", ["from_user_id"])
    op.create_index("ix_pd_to_user", "permission_delegations", ["to_user_id"])
    op.create_index("ix_pd_tenant", "permission_delegations", ["tenant_id"])
    op.create_index("ix_pd_active", "permission_delegations", ["active"])
 def downgrade() -> None:
    op.drop_index("ix_pd_active", table_name="permission_delegations")
    op.drop_index("ix_pd_tenant", table_name="permission_delegations")
    op.drop_index("ix_pd_to_user", table_name="permission_delegations")
    op.drop_index("ix_pd_from_user", table_name="permission_delegations")
    op.drop_table("permission_delegations")
@@ -0,0 +1,36 @@
 """Add resolution_strategy field to tenants table.
 Revision ID: 0058
 Revises: 0057
 Create Date: 2026-07-29
 """
 from alembic import op
 import sqlalchemy as sa
 revision = "0058"
 down_revision = "0057"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.add_column(
        "tenants",
        sa.Column(
            "resolution_strategy",
            sa.String(30),
            nullable=False,
            server_default=sa.text("'highest_wins'"),
        ),
    )
    op.create_check_constraint(
        "ck_tenant_resolution_strategy",
        "tenants",
        "resolution_strategy IN ('highest_wins', 'deny_overrides_allow', 'direct_overrides_group', 'most_restrictive_wins')",
    )
 def downgrade() -> None:
    op.drop_constraint("ck_tenant_resolution_strategy", "tenants")
    op.drop_column("tenants", "resolution_strategy")
@@ -0,0 +1,46 @@
 """Create guest_users table.
 Revision ID: 0059
 Revises: 0058
 Create Date: 2026-07-29 02:47:00.000000
 """
 from __future__ import annotations
 from typing import Sequence, Union
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects import postgresql
 # revision identifiers, used by Alembic.
 revision: str = "0059"
 down_revision: str | None = "0058"
 branch_labels: str | Sequence[str] | None = None
 depends_on: str | Sequence[str] | None = None
 def upgrade() -> None:
    op.create_table(
        "guest_users",
        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("email", sa.String(255), nullable=False),
        sa.Column("name", sa.String(255), nullable=False),
        sa.Column("password_hash", sa.String(255), nullable=True),
        sa.Column("tenant_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
        sa.Column("invited_by", postgresql.UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
        sa.Column("status", sa.String(20), nullable=False, server_default="invited"),
        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
    )
    op.create_index("ix_guest_users_email_tenant", "guest_users", ["email", "tenant_id"], unique=True)
    op.create_index("ix_guest_users_status", "guest_users", ["status", "tenant_id"])
    op.create_index("ix_guest_users_invited_by", "guest_users", ["invited_by"])
 def downgrade() -> None:
    op.drop_index("ix_guest_users_invited_by", table_name="guest_users")
    op.drop_index("ix_guest_users_status", table_name="guest_users")
    op.drop_index("ix_guest_users_email_tenant", table_name="guest_users")
    op.drop_table("guest_users")
@@ -0,0 +1,202 @@
 """Fix RLS policies on contacts — add tenant_id isolation.
 Revision ID: 0060
 Revises: 0059
 Create Date: 2026-07-29
 This migration drops the insecure contact RLS policies (created in 0052)
 and recreates them with proper tenant_id isolation.
 Problems fixed:
 1. contacts_tenant_owned_visible had USING (owner_id IS NULL) without tenant_id check
 2. contacts_admin_visible had no tenant_id check
 3. contacts_owner_visible had no tenant_id check
 4. All policies used FOR ALL instead of separate SELECT/INSERT/UPDATE/DELETE
 5. No WITH CHECK on write operations
 """
 from alembic import op
 revision = "0060"
 down_revision = "0059"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    # Drop all existing contact policies
    op.execute("DROP POLICY IF EXISTS contacts_admin_visible ON contacts")
    op.execute("DROP POLICY IF EXISTS contacts_owner_visible ON contacts")
    op.execute("DROP POLICY IF EXISTS contacts_tenant_owned_visible ON contacts")
    op.execute("DROP POLICY IF EXISTS contacts_shared_visible ON contacts")
    op.execute("DROP POLICY IF EXISTS tenant_isolation ON contacts")
    # ── Restrive policy: Tenant isolation (always enforced) ──
    # This is the base policy that ALL other permissive policies are ANDed with
    op.execute("""
        CREATE POLICY contacts_tenant_isolation ON contacts
        FOR ALL
        USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
        WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
    """)
    # ── Permissive policies for SELECT (visibility) ──
    # System admin sees everything (within tenant)
    op.execute("""
        CREATE POLICY contacts_admin_select ON contacts
        FOR SELECT
        USING (
            current_setting('app.is_system_admin', true) = 'true'
            AND tenant_id = current_setting('app.current_tenant_id', true)::uuid
        )
    """)
    # Owner sees own rows (within tenant)
    op.execute("""
        CREATE POLICY contacts_owner_select ON contacts
        FOR SELECT
        USING (
            owner_id::text = current_setting('app.current_user_id', true)
            AND tenant_id = current_setting('app.current_tenant_id', true)::uuid
        )
    """)
    # Tenant-owned (owner_id IS NULL) visible to all in tenant
    op.execute("""
        CREATE POLICY contacts_tenant_owned_select ON contacts
        FOR SELECT
        USING (
            owner_id IS NULL
            AND tenant_id = current_setting('app.current_tenant_id', true)::uuid
        )
    """)
    # Shared via entity_permissions (within tenant)
    op.execute("""
        CREATE POLICY contacts_shared_select ON contacts
        FOR SELECT
        USING (
            EXISTS (
                SELECT 1 FROM entity_permissions ep
                WHERE ep.entity_type = 'contact'
                AND ep.entity_id = contacts.id
                AND ep.tenant_id = contacts.tenant_id
                AND ep.permission_level != 'none'
                AND (
                    ep.expires_at IS NULL OR ep.expires_at > NOW()
                )
                AND (
                    (ep.principal_type = 'user'
                     AND ep.principal_id::text = current_setting('app.current_user_id', true))
                    OR
                    (ep.principal_type = 'group'
                     AND ep.principal_id::text = ANY(
                         string_to_array(current_setting('app.current_user_groups', true), ',')
                     ))
                    OR
                    (ep.principal_type = 'role'
                     AND ep.principal_id IN (
                         SELECT ut.role_id FROM user_tenants ut
                         WHERE ut.user_id::text = current_setting('app.current_user_id', true)
                         AND ut.tenant_id = contacts.tenant_id
                     ))
                )
            )
            AND tenant_id = current_setting('app.current_tenant_id', true)::uuid
        )
    """)
    # ── Permissive policies for INSERT ──
    op.execute("""
        CREATE POLICY contacts_insert_policy ON contacts
        FOR INSERT
        WITH CHECK (
            tenant_id = current_setting('app.current_tenant_id', true)::uuid
            AND (
                current_setting('app.is_system_admin', true) = 'true'
                OR owner_id::text = current_setting('app.current_user_id', true)
                OR owner_id IS NULL
            )
        )
    """)
    # ── Permissive policies for UPDATE ──
    op.execute("""
        CREATE POLICY contacts_update_policy ON contacts
        FOR UPDATE
        USING (
            tenant_id = current_setting('app.current_tenant_id', true)::uuid
            AND (
                current_setting('app.is_system_admin', true) = 'true'
                OR owner_id::text = current_setting('app.current_user_id', true)
                OR owner_id IS NULL
                OR EXISTS (
                    SELECT 1 FROM entity_permissions ep
                    WHERE ep.entity_type = 'contact'
                    AND ep.entity_id = contacts.id
                    AND ep.tenant_id = contacts.tenant_id
                    AND ep.permission_level IN ('write', 'admin', 'delete')
                    AND (
                        ep.expires_at IS NULL OR ep.expires_at > NOW()
                    )
                    AND (
                        (ep.principal_type = 'user'
                         AND ep.principal_id::text = current_setting('app.current_user_id', true))
                        OR
                        (ep.principal_type = 'group'
                         AND ep.principal_id::text = ANY(
                             string_to_array(current_setting('app.current_user_groups', true), ',')
                         ))
                    )
                )
            )
        )
        WITH CHECK (
            tenant_id = current_setting('app.current_tenant_id', true)::uuid
        )
    """)
    # ── Permissive policies for DELETE ──
    op.execute("""
        CREATE POLICY contacts_delete_policy ON contacts
        FOR DELETE
        USING (
            tenant_id = current_setting('app.current_tenant_id', true)::uuid
            AND (
                current_setting('app.is_system_admin', true) = 'true'
                OR owner_id::text = current_setting('app.current_user_id', true)
                OR EXISTS (
                    SELECT 1 FROM entity_permissions ep
                    WHERE ep.entity_type = 'contact'
                    AND ep.entity_id = contacts.id
                    AND ep.tenant_id = contacts.tenant_id
                    AND ep.permission_level IN ('admin', 'delete')
                    AND (
                        ep.expires_at IS NULL OR ep.expires_at > NOW()
                    )
                    AND (
                        (ep.principal_type = 'user'
                         AND ep.principal_id::text = current_setting('app.current_user_id', true))
                        OR
                        (ep.principal_type = 'group'
                         AND ep.principal_id::text = ANY(
                             string_to_array(current_setting('app.current_user_groups', true), ',')
                         ))
                    )
                )
            )
        )
    """)
 def downgrade() -> None:
    # Drop the new secure policies
    op.execute("DROP POLICY IF EXISTS contacts_tenant_isolation ON contacts")
    op.execute("DROP POLICY IF EXISTS contacts_admin_select ON contacts")
    op.execute("DROP POLICY IF EXISTS contacts_owner_select ON contacts")
    op.execute("DROP POLICY IF EXISTS contacts_tenant_owned_select ON contacts")
    op.execute("DROP POLICY IF EXISTS contacts_shared_select ON contacts")
    op.execute("DROP POLICY IF EXISTS contacts_insert_policy ON contacts")
    op.execute("DROP POLICY IF EXISTS contacts_update_policy ON contacts")
    op.execute("DROP POLICY IF EXISTS contacts_delete_policy ON contacts")
@@ -0,0 +1,65 @@
 """Fix DB roles — add default privileges and grants for all tables.
 Revision ID: 0061
 Revises: 0060
 Create Date: 2026-07-29
 Problems fixed:
 1. crm_runtime role has no grants on tables created after migration 0044
 2. No ALTER DEFAULT PRIVILEGES for future tables
 3. Auth tables (users, tenants, user_tenants, user_groups) need SELECT grants
 4. New permission/guest/policy tables need grants
 """
 from alembic import op
 revision = "0061"
 down_revision = "0060"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    # Grant privileges on all existing tables to crm_runtime
    op.execute("GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO crm_runtime")
    # Grant USAGE on sequences
    op.execute("GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO crm_runtime")
    # Default privileges for future tables created by migration owner
    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO crm_runtime")
    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO crm_runtime")
    # Ensure RLS is enabled on all tenant tables that have tenant_id
    # (covers tables created after migration 0044 that missed RLS)
    tenant_tables = [
        "entity_permissions",
        "entity_policies",
        "permission_templates",
        "guest_users",
        "contact_folder_permissions",
    ]
    for table in tenant_tables:
        op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY")
        # Create tenant isolation policy if not exists
        op.execute(f"""
            DO $$
            BEGIN
                IF NOT EXISTS (
                    SELECT 1 FROM pg_policy 
                    WHERE polname = '{table}_tenant_isolation' 
                    AND polrelid = '{table}'::regclass
                ) THEN
                    CREATE POLICY {table}_tenant_isolation ON {table}
                    FOR ALL
                    USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
                    WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
                END IF;
            END $$;
        """)
 def downgrade() -> None:
    # Revoke default privileges
    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE SELECT, INSERT, UPDATE, DELETE ON TABLES FROM crm_runtime")
    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE USAGE, SELECT ON SEQUENCES FROM crm_runtime")
@@ -0,0 +1,51 @@
 """Fix guest invitation security — separate token table.
 Revision ID: 0062
 Revises: 0061
 Create Date: 2026-07-29
 Problems fixed:
 1. Guest UUID was used as invitation token (P1.6)
 2. No separate token with sufficient entropy
 3. No one-time use tracking
 4. No session revocation on guest deletion
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID
 revision = "0062"
 down_revision = "0061"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.create_table(
        "guest_invitations",
        sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("guest_user_id", UUID(as_uuid=True), sa.ForeignKey("guest_users.id", ondelete="CASCADE"), nullable=False),
        sa.Column("token_hash", sa.String(64), nullable=False, unique=True, index=True),
        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("used_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("created_by", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
    )
    op.execute("ALTER TABLE guest_invitations ENABLE ROW LEVEL SECURITY")
    op.execute("""
        CREATE POLICY guest_invitations_tenant_isolation ON guest_invitations
        FOR ALL
        USING (
            EXISTS (
                SELECT 1 FROM guest_users gu
                WHERE gu.id = guest_invitations.guest_user_id
                AND gu.tenant_id = current_setting('app.current_tenant_id', true)::uuid
            )
        )
    """)
 def downgrade() -> None:
    op.drop_table("guest_invitations")
@@ -0,0 +1,28 @@
 """Add entity_type and entity_id to notifications table.
 Revision ID: 0063
 Revises: 0062
 Create Date: 2026-07-29
 The notification model has entity_type and entity_id fields but the DB
 table was never migrated. This causes INSERT failures.
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID
 revision = "0063"
 down_revision = "0062"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.add_column("notifications", sa.Column("entity_type", sa.String(50), nullable=True, index=True))
    op.add_column("notifications", sa.Column("entity_id", UUID(as_uuid=True), nullable=True))
 def downgrade() -> None:
    op.drop_column("notifications", "entity_id")
    op.drop_column("notifications", "entity_type")
@@ -0,0 +1,86 @@
 """Enable RLS on all remaining tenant tables.
 Revision ID: 0064
 Revises: 0063
 Create Date: 2026-07-29
 Currently RLS is only on contacts. This migration enables RLS on all
 tenant-scoped tables that have a tenant_id column but no RLS yet.
 System tables (users, tenants, groups, roles) are excluded — they need
 special handling for the login bootstrap process.
 """
 from alembic import op
 revision = "0064"
 down_revision = "0063"
 branch_labels = None
 depends_on = None
 # Tables that should have RLS (tenant-scoped data)
 TENANT_TABLES = [
    "addresses",
    "attachments",
    "bank_accounts",
    "contact_folders",
    "contact_merge_history",
    "workflows",
    "sequences",
    "saved_filters",
    "saved_views",
    "webhooks",
    "custom_field_definitions",
    "notifications",
    "ai_conversations",
    "contact_persons",
    "tags",
    "entity_links",
    "dms_files",
    "dms_folders",
    "calendar_events",
    "calendars",
    "tasks",
    "task_lists",
    "mail_messages",
    "mail_accounts",
    "mail_folders",
    "conversations",
    "conversation_messages",
    "conversation_participants",
    "audit_log",
    "permission_delegations",
    "guest_invitations",
 ]
 def upgrade() -> None:
    for table in TENANT_TABLES:
        # Enable RLS if not already enabled
        op.execute(f"""
            DO $$
            BEGIN
                IF NOT EXISTS (
                    SELECT 1 FROM pg_class c
                    WHERE c.relname = '{table}'
                    AND c.relrowsecurity = true
                ) AND EXISTS (
                    SELECT 1 FROM information_schema.columns
                    WHERE table_name = '{table}'
                    AND column_name = 'tenant_id'
                ) THEN
                    ALTER TABLE {table} ENABLE ROW LEVEL SECURITY;
                    CREATE POLICY {table}_tenant_isolation ON {table}
                    FOR ALL
                    USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
                    WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
                END IF;
            END $$;
        """)
 def downgrade() -> None:
    for table in TENANT_TABLES:
        op.execute(f"DROP POLICY IF EXISTS {table}_tenant_isolation ON {table}")
        op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY")
@@ -0,0 +1,40 @@
 """Add consumer_inbox table for outbox idempotency.
 Revision ID: 0065
 Revises: 0064
 Create Date: 2026-07-29
 Without idempotency, a worker crash between sending an email/webhook
 and marking the event as published can lead to duplicate deliveries.
 This migration creates a consumer_inbox table that tracks which
 consumers have already processed which events.
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID
 revision = "0065"
 down_revision = "0064"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.create_table(
        "consumer_inbox",
        sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("event_id", UUID(as_uuid=True), sa.ForeignKey("event_outbox.id", ondelete="CASCADE"), nullable=False, index=True),
        sa.Column("consumer_name", sa.String(100), nullable=False, index=True),
        sa.Column("status", sa.String(20), nullable=False, default="pending"),  # pending, processed, failed
        sa.Column("processed_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("error_message", sa.Text, nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.UniqueConstraint("event_id", "consumer_name", name="uq_consumer_inbox_event_consumer"),
    )
    op.execute("ALTER TABLE consumer_inbox ENABLE ROW LEVEL SECURITY")
 def downgrade() -> None:
    op.drop_table("consumer_inbox")
@@ -0,0 +1,44 @@
 """Add tenant_plugin_activation table for per-tenant plugin activation.
 Revision ID: 0066
 Revises: 0065
 Create Date: 2026-07-29
 Currently plugins are activated globally. This migration creates a
 table for per-tenant plugin activation so that different tenants can
 enable/disable plugins independently.
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID
 revision = "0066"
 down_revision = "0065"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.create_table(
        "tenant_plugin_activation",
        sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("tenant_id", UUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False, index=True),
        sa.Column("plugin_name", sa.String(100), nullable=False, index=True),
        sa.Column("is_active", sa.Boolean, nullable=False, default=True),
        sa.Column("activated_by", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.UniqueConstraint("tenant_id", "plugin_name", name="uq_tenant_plugin"),
    )
    op.execute("ALTER TABLE tenant_plugin_activation ENABLE ROW LEVEL SECURITY")
    op.execute("""
        CREATE POLICY tenant_plugin_activation_tenant_isolation ON tenant_plugin_activation
        FOR ALL
        USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
        WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
    """)
 def downgrade() -> None:
    op.drop_table("tenant_plugin_activation")
@@ -0,0 +1,56 @@
 """Disable RLS on system identity tables to fix login bootstrap circle.
 Revision ID: 0067
 Revises: 0066
 Create Date: 2026-07-29
 Problem: users, user_tenants, groups, roles have RLS enabled. The login
 process needs to query these tables BEFORE a tenant context is set
 (bootstrap circle: Login → Membership → Tenant-Context → Login).
 RLS on these tables blocks login because there's no tenant context yet.
 Solution: Disable RLS on system identity tables. Tenant isolation for
 these tables is enforced at the application level (auth_service always
 filters by user_id + tenant_id in queries).
 """
 from alembic import op
 revision = "0067"
 down_revision = "0066"
 branch_labels = None
 depends_on = None
 # System identity tables — no RLS (needed for login bootstrap)
 SYSTEM_TABLES = [
    "users",
    "user_tenants",
    "groups",
    "user_groups",
    "roles",
 ]
 def upgrade() -> None:
    for table in SYSTEM_TABLES:
        # Drop any existing policies
        op.execute(f"""
            DO $$
            DECLARE pol RECORD;
            BEGIN
                FOR pol IN
                    SELECT polname FROM pg_policy
                    WHERE polrelid = '{table}'::regclass
                LOOP
                    EXECUTE format('DROP POLICY IF EXISTS %I ON {table}', pol.polname);
                END LOOP;
            END $$;
        """)
        # Disable RLS
        op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY")
 def downgrade() -> None:
    for table in SYSTEM_TABLES:
        op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY")
@@ -0,0 +1,28 @@
 """Add deleted_at to entity_permissions table.
 Revision ID: 0068
 Revises: 0067
 Create Date: 2026-07-29
 The EntityPermission model has SoftDeleteMixin but the table was never
 migrated to include the deleted_at column.
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID
 revision = "0068"
 down_revision = "0067"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.add_column("entity_permissions", sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True))
    op.execute("CREATE INDEX IF NOT EXISTS ix_entity_permissions_deleted_at ON entity_permissions (deleted_at)")
 def downgrade() -> None:
    op.drop_index("ix_entity_permissions_deleted_at", table_name="entity_permissions")
    op.drop_column("entity_permissions", "deleted_at")
@@ -0,0 +1,103 @@
 """Simplify RLS to pure tenant isolation.
 Per architecture review: RLS should be the "safety belt" (tenant isolation only),
 NOT the "vehicle control" (business authorization). Business authorization
 (owner_id, sharing, entity_permissions) belongs in the application layer
 (visibility.py with Defense-in-Depth tenant_id filter).
 Revision ID: 0069
 Revises: 0068
 """
 from alembic import op
 from sqlalchemy import text
 revision = "0069"
 down_revision = "0068"
 branch_labels = None
 depends_on = None
 RLS_TABLES = [
    "contacts", "addresses", "attachments", "bank_accounts",
    "contact_folders", "contact_folder_permissions", "entity_permissions",
    "entity_policies", "event_outbox", "audit_log", "notifications",
    "saved_filters", "saved_views", "webhooks", "workflow_instances",
    "workflow_step_history", "sequences", "custom_field_definitions",
    "custom_field_values", "guest_users", "guest_invitations",
    "consumer_inbox", "tenant_plugin_activation", "permission_templates",
    "permission_delegations", "dms_files", "dms_folders",
    "calendar_events", "calendars", "tasks", "task_lists",
    "messages", "channels", "entity_links", "tags", "tag_assignments",
    "mail_accounts", "mail_messages", "mail_folders",
    "report_templates", "report_generations", "ai_conversations",
    "ai_messages", "automation_workflows", "automation_runs",
    "mcp_server_configs", "mcp_client_configs", "system_notifications",
 ]
 CONTACTS_POLICIES_TO_DROP = [
    "contacts_admin_select", "contacts_owner_select",
    "contacts_shared_select", "contacts_tenant_owned_select",
    "contacts_delete_policy", "contacts_insert_policy",
    "contacts_update_policy",
 ]
 def upgrade() -> None:
    conn = op.get_bind()
    # 1. Drop all business-logic RLS policies on contacts
    for policy in CONTACTS_POLICIES_TO_DROP:
        op.execute(f"DROP POLICY IF EXISTS {policy} ON contacts")
    # 2. Drop old tenant_isolation policy on contacts
    op.execute("DROP POLICY IF EXISTS contacts_tenant_isolation ON contacts")
    # 3. Create simple tenant isolation for ALL operations on contacts
    op.execute(
        "CREATE POLICY contacts_tenant_isolation ON contacts "
        "FOR ALL "
        "USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid) "
        "WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)"
    )
    # 4. For all other RLS tables: drop existing policies, create simple tenant isolation
    for table in RLS_TABLES:
        if table == "contacts":
            continue
        # Check if table exists first
        table_exists = conn.execute(
            text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
        ).fetchone() is not None
        if not table_exists:
            continue
        # Get all existing policies on this table
        result = conn.execute(
            text(f"SELECT polname FROM pg_policy WHERE polrelid = '{table}'::regclass")
        )
        policies = [row[0] for row in result]
        # Drop each policy
        for policy in policies:
            op.execute(f'DROP POLICY IF EXISTS "{policy}" ON {table}')
        # Check if table has tenant_id column
        col_result = conn.execute(
            text(f"SELECT 1 FROM information_schema.columns "
            f"WHERE table_name = '{table}' AND column_name = 'tenant_id'")
        )
        has_tenant_id = col_result.fetchone() is not None
        if has_tenant_id:
            op.execute(
                f"CREATE POLICY {table}_tenant_isolation ON {table} "
                "FOR ALL "
                "USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid) "
                "WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)"
            )
 def downgrade() -> None:
    pass
@@ -0,0 +1,107 @@
 """Create 4 separate DB roles for strict separation.
 crm_migration: Schema owner, runs Alembic, BypassRLS
  - Owns all tables, sequences, functions
  - Can bypass RLS for migrations
  - Never used by the API
 crm_auth: Login bootstrap only
  - Reads users, user_tenants, tenants, roles, groups
  - NO RLS on system tables (already disabled)
  - No general CRM data access
 crm_api: Application runtime
  - NOBYPASSRLS, NOSUPERUSER
  - SELECT, INSERT, UPDATE, DELETE on all tables
  - Tenant context is mandatory (RLS enforces it)
 crm_worker: Background jobs
  - NOBYPASSRLS, NOSUPERUSER
  - Same data access as crm_api
  - Tenant context set per job
 Revision ID: 0070
 Revises: 0069
 """
 from alembic import op
 from sqlalchemy import text
 revision = "0070"
 down_revision = "0069"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    conn = op.get_bind()
    # 1. Create crm_migration role (schema owner, bypass RLS)
    conn.execute(text("""
        DO $$
        BEGIN
            IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'crm_migration') THEN
                CREATE ROLE crm_migration WITH LOGIN NOINHERIT;
            END IF;
        END $$;
    """))
    conn.execute(text("ALTER ROLE crm_migration WITH BYPASSRLS"))
    # 2. Create crm_auth role (login bootstrap, no RLS on system tables)
    conn.execute(text("""
        DO $$
        BEGIN
            IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'crm_auth') THEN
                CREATE ROLE crm_auth WITH LOGIN NOINHERIT;
            END IF;
        END $$;
    """))
    conn.execute(text("ALTER ROLE crm_auth WITH NOBYPASSRLS"))
    # Grant read access to system tables only
    conn.execute(text("GRANT SELECT ON users, user_tenants, tenants, roles, user_groups, groups TO crm_auth"))
    # 3. Create crm_api role (application runtime, NOBYPASSRLS)
    conn.execute(text("""
        DO $$
        BEGIN
            IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'crm_api') THEN
                CREATE ROLE crm_api WITH LOGIN NOINHERIT;
            END IF;
        END $$;
    """))
    conn.execute(text("ALTER ROLE crm_api WITH NOBYPASSRLS NOSUPERUSER"))
    # Grant data access on all existing tables
    conn.execute(text("GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO crm_api"))
    conn.execute(text("GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO crm_api"))
    # Default privileges for future tables
    conn.execute(text("ALTER DEFAULT PRIVILEGES GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO crm_api"))
    conn.execute(text("ALTER DEFAULT PRIVILEGES GRANT USAGE, SELECT ON SEQUENCES TO crm_api"))
    # 4. Create crm_worker role (background jobs, NOBYPASSRLS)
    conn.execute(text("""
        DO $$
        BEGIN
            IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'crm_worker') THEN
                CREATE ROLE crm_worker WITH LOGIN NOINHERIT;
            END IF;
        END $$;
    """))
    conn.execute(text("ALTER ROLE crm_worker WITH NOBYPASSRLS NOSUPERUSER"))
    conn.execute(text("GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO crm_worker"))
    conn.execute(text("GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO crm_worker"))
    conn.execute(text("ALTER DEFAULT PRIVILEGES GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO crm_worker"))
    conn.execute(text("ALTER DEFAULT PRIVILEGES GRANT USAGE, SELECT ON SEQUENCES TO crm_worker"))
    # 5. Grant USAGE on schema to all roles
    conn.execute(text("GRANT USAGE ON SCHEMA public TO crm_api, crm_worker, crm_auth, crm_migration"))
    # 6. Set passwords (same as crm_user for now — will be changed in docker-compose)
    # Passwords are set via environment variables in prestart.sh
 def downgrade() -> None:
    conn = op.get_bind()
    conn.execute(text("DROP ROLE IF EXISTS crm_worker"))
    conn.execute(text("DROP ROLE IF EXISTS crm_api"))
    conn.execute(text("DROP ROLE IF EXISTS crm_auth"))
    conn.execute(text("DROP ROLE IF EXISTS crm_migration"))
@@ -0,0 +1,62 @@
 """Create entity_attachments table — references DMS files.
 Instead of storing files in a separate attachment storage path,
 all files go through the DMS (files table) and entity_attachments
 just references the DMS file with entity_type/entity_id.
 This unifies the storage layer: one upload path, one download path,
 one permission model, one deduplication (content_hash).
 Revision ID: 0071
 Revises: 0070
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 revision = "0071"
 down_revision = "0070"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.create_table(
        "entity_attachments",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("tenant_id", PGUUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
        sa.Column("entity_type", sa.String(50), nullable=False),
        sa.Column("entity_id", PGUUID(as_uuid=True), nullable=False),
        sa.Column("dms_file_id", PGUUID(as_uuid=True), sa.ForeignKey("files.id", ondelete="RESTRICT"), nullable=False),
        sa.Column("category", sa.String(50), nullable=True),
        sa.Column("display_name", sa.String(255), nullable=True),
        sa.Column("owner_id", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
        sa.Column("created_by", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
    )
    op.create_index("ix_entity_attachments_entity", "entity_attachments", ["entity_type", "entity_id", "tenant_id"])
    op.create_index("ix_entity_attachments_tenant", "entity_attachments", ["tenant_id"])
    op.create_index("ix_entity_attachments_dms_file", "entity_attachments", ["dms_file_id"])
    op.create_index("ix_entity_attachments_owner", "entity_attachments", ["owner_id"])
    # Enable RLS on entity_attachments (tenant isolation)
    op.execute("ALTER TABLE entity_attachments ENABLE ROW LEVEL SECURITY")
    op.execute(
        "CREATE POLICY entity_attachments_tenant_isolation ON entity_attachments "
        "FOR ALL "
        "USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid) "
        "WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)"
    )
    # Grant to crm_api and crm_worker
    op.execute("GRANT SELECT, INSERT, UPDATE, DELETE ON entity_attachments TO crm_api, crm_worker")
    op.execute("GRANT USAGE ON SCHEMA public TO crm_api, crm_worker")
 def downgrade() -> None:
    op.execute("DROP POLICY IF EXISTS entity_attachments_tenant_isolation ON entity_attachments")
    op.drop_table("entity_attachments")
@@ -0,0 +1,104 @@
 """Migration: Create workspace tables.
 Revision ID: 0072
 Revises: 0071
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID as PGUUID, JSONB
 revision = "0072"
 down_revision = "0071"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    # workspaces
    op.create_table(
        "workspaces",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("tenant_id", PGUUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
        sa.Column("name", sa.String(100), nullable=False),
        sa.Column("icon", sa.String(50), nullable=False, server_default="LayoutGrid"),
        sa.Column("description", sa.String(500), nullable=True),
        sa.Column("is_default", sa.Boolean, nullable=False, server_default=sa.text("false")),
        sa.Column("is_active", sa.Boolean, nullable=False, server_default=sa.text("true")),
        sa.Column("created_by", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.UniqueConstraint("tenant_id", "name", name="uq_workspaces_tenant_name"),
    )
    op.create_index("ix_workspaces_tenant", "workspaces", ["tenant_id"])
    op.execute(
        "CREATE UNIQUE INDEX uq_workspace_default_per_tenant "
        "ON workspaces (tenant_id) WHERE is_default = true"
    )
    # workspace_modules
    op.create_table(
        "workspace_modules",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("tenant_id", PGUUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
        sa.Column("workspace_id", PGUUID(as_uuid=True), sa.ForeignKey("workspaces.id", ondelete="CASCADE"), nullable=False),
        sa.Column("module_key", sa.String(100), nullable=False),
        sa.Column("is_visible", sa.Boolean, nullable=False, server_default=sa.text("true")),
        sa.Column("menu_order", sa.Integer, nullable=False, server_default=sa.text("0")),
        sa.Column("config", JSONB, nullable=False, server_default=sa.text("'{}'::jsonb")),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.UniqueConstraint("tenant_id", "workspace_id", "module_key", name="uq_wm_tenant_workspace_module"),
    )
    op.create_index("ix_wm_workspace", "workspace_modules", ["tenant_id", "workspace_id", "menu_order"])
    # workspace_users
    op.create_table(
        "workspace_users",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("tenant_id", PGUUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
        sa.Column("workspace_id", PGUUID(as_uuid=True), sa.ForeignKey("workspaces.id", ondelete="CASCADE"), nullable=False),
        sa.Column("user_id", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
        sa.Column("role", sa.String(20), nullable=False, server_default="member"),
        sa.Column("is_default", sa.Boolean, nullable=False, server_default=sa.text("false")),
        sa.Column("assigned_by", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
        sa.Column("assigned_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.UniqueConstraint("tenant_id", "workspace_id", "user_id", name="uq_wu_tenant_workspace_user"),
        sa.CheckConstraint("role IN ('member', 'manager')", name="ck_wu_role"),
    )
    op.create_index("ix_wu_workspace", "workspace_users", ["tenant_id", "workspace_id"])
    op.create_index("ix_wu_user", "workspace_users", ["tenant_id", "user_id"])
    # workspace_widgets
    op.create_table(
        "workspace_widgets",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("tenant_id", PGUUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
        sa.Column("workspace_id", PGUUID(as_uuid=True), sa.ForeignKey("workspaces.id", ondelete="CASCADE"), nullable=False),
        sa.Column("widget_key", sa.String(100), nullable=False),
        sa.Column("position_x", sa.Integer, nullable=False, server_default=sa.text("0")),
        sa.Column("position_y", sa.Integer, nullable=False, server_default=sa.text("0")),
        sa.Column("width", sa.Integer, nullable=False, server_default=sa.text("1")),
        sa.Column("height", sa.Integer, nullable=False, server_default=sa.text("1")),
        sa.Column("config", JSONB, nullable=False, server_default=sa.text("'{}'::jsonb")),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
    )
    op.create_index("ix_ww_workspace", "workspace_widgets", ["tenant_id", "workspace_id"])
    # RLS on all workspace tables
    for table in ["workspaces", "workspace_modules", "workspace_users", "workspace_widgets"]:
        op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY")
        op.execute(
            f"CREATE POLICY {table}_tenant_isolation ON {table} "
            "FOR ALL "
            "USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid) "
            "WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)"
        )
        op.execute(f"GRANT SELECT, INSERT, UPDATE, DELETE ON {table} TO crm_api, crm_worker")
 def downgrade() -> None:
    for table in ["workspace_widgets", "workspace_users", "workspace_modules", "workspaces"]:
        op.execute(f"DROP POLICY IF EXISTS {table}_tenant_isolation ON {table}")
        op.drop_table(table)
@@ -0,0 +1,27 @@
 """Add deleted_at to workspace tables (TenantMixin includes SoftDeleteMixin).
 Revision ID: 0073
 Revises: 0072
 """
 from alembic import op
 import sqlalchemy as sa
 revision = "0073"
 down_revision = "0072"
 branch_labels = None
 depends_on = None
 TABLES = ["workspaces", "workspace_modules", "workspace_users", "workspace_widgets"]
 def upgrade() -> None:
    for table in TABLES:
        op.add_column(table, sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True))
        op.execute(f"CREATE INDEX IF NOT EXISTS ix_{table}_deleted_at ON {table} (deleted_at)")
 def downgrade() -> None:
    for table in TABLES:
        op.drop_index(f"ix_{table}_deleted_at", table_name=table)
        op.drop_column(table, "deleted_at")
@@ -0,0 +1,31 @@
 """Add created_at/updated_at to workspace_users and workspace_widgets.
 TenantMixin inherits from TimestampMixin which adds created_at and updated_at.
 Migration 0072 only added assigned_at to workspace_users, not created_at/updated_at.
 Revision ID: 0074
 Revises: 0073
 """
 from alembic import op
 import sqlalchemy as sa
 revision = "0074"
 down_revision = "0073"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    # workspace_users: add created_at and updated_at
    op.add_column("workspace_users", sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False))
    op.add_column("workspace_users", sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False))
    # workspace_widgets: already has created_at/updated_at from migration 0072
    # workspace_modules: already has created_at/updated_at from migration 0072
    # workspaces: already has created_at/updated_at from migration 0072
 def downgrade() -> None:
    op.drop_column("workspace_users", "updated_at")
    op.drop_column("workspace_users", "created_at")
@@ -0,0 +1,80 @@
 """Add outbox_deliveries table and envelope columns to event_outbox.
 Standardized Event-Envelope:
 - event_id (already exists as id)
 - event_type (already exists as event_name)
 - tenant_id (already exists)
 - aggregate_type (NEW)
 - aggregate_id (NEW)
 - occurred_at (NEW)
 - correlation_id (NEW)
 - schema_version (NEW, default 1)
 - payload (already exists)
 outbox_deliveries tracks per-consumer delivery status.
 An event is only 'published' when all mandatory deliveries succeed.
 Revision ID: 0075
 Revises: 0074
 """
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 revision = "0075"
 down_revision = "0074"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    # 1. Add envelope columns to event_outbox
    op.add_column("event_outbox", sa.Column("aggregate_type", sa.String(100), nullable=True))
    op.add_column("event_outbox", sa.Column("aggregate_id", PGUUID(as_uuid=True), nullable=True))
    op.add_column("event_outbox", sa.Column("occurred_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False))
    op.add_column("event_outbox", sa.Column("correlation_id", PGUUID(as_uuid=True), nullable=True))
    op.add_column("event_outbox", sa.Column("schema_version", sa.Integer, nullable=False, server_default=sa.text("1")))
    op.execute("CREATE INDEX IF NOT EXISTS ix_event_outbox_aggregate ON event_outbox (tenant_id, aggregate_type, aggregate_id)")
    op.execute("CREATE INDEX IF NOT EXISTS ix_event_outbox_correlation ON event_outbox (correlation_id)")
    # 2. Create outbox_deliveries table
    op.create_table(
        "outbox_deliveries",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("event_id", PGUUID(as_uuid=True), sa.ForeignKey("event_outbox.id", ondelete="CASCADE"), nullable=False),
        sa.Column("consumer_name", sa.String(150), nullable=False),
        sa.Column("status", sa.String(30), nullable=False, server_default="pending"),
        sa.Column("attempt_count", sa.Integer, nullable=False, server_default=sa.text("0")),
        sa.Column("next_attempt_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("last_error", sa.Text, nullable=True),
        sa.Column("processed_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.UniqueConstraint("event_id", "consumer_name", name="uq_outbox_deliveries_event_consumer"),
    )
    op.create_index("ix_outbox_deliveries_event", "outbox_deliveries", ["event_id"])
    op.create_index("ix_outbox_deliveries_status", "outbox_deliveries", ["status", "next_attempt_at"])
    # RLS + Grants
    op.execute("ALTER TABLE outbox_deliveries ENABLE ROW LEVEL SECURITY")
    op.execute(
        "CREATE POLICY outbox_deliveries_tenant_isolation ON outbox_deliveries "
        "FOR ALL "
        "USING (EXISTS (SELECT 1 FROM event_outbox WHERE event_outbox.id = outbox_deliveries.event_id AND event_outbox.tenant_id = current_setting('app.current_tenant_id', true)::uuid)) "
        "WITH CHECK (EXISTS (SELECT 1 FROM event_outbox WHERE event_outbox.id = outbox_deliveries.event_id AND event_outbox.tenant_id = current_setting('app.current_tenant_id', true)::uuid))"
    )
    op.execute("GRANT SELECT, INSERT, UPDATE, DELETE ON outbox_deliveries TO crm_api, crm_worker")
 def downgrade() -> None:
    op.execute("DROP POLICY IF EXISTS outbox_deliveries_tenant_isolation ON outbox_deliveries")
    op.drop_table("outbox_deliveries")
    op.execute("DROP INDEX IF EXISTS ix_event_outbox_correlation")
    op.execute("DROP INDEX IF EXISTS ix_event_outbox_aggregate")
    op.drop_column("event_outbox", "schema_version")
    op.drop_column("event_outbox", "correlation_id")
    op.drop_column("event_outbox", "occurred_at")
    op.drop_column("event_outbox", "aggregate_id")
    op.drop_column("event_outbox", "aggregate_type")
@@ -0,0 +1,65 @@
 """Disable RLS on startup/system tables that are read without tenant context.
 These tables are accessed during app startup or login before a tenant context
 is set. RLS would block these queries and prevent the app from starting.
 Security: These tables are either system-wide (currencies, taxes, sequences,
 system_settings) or user-specific (saved_filters, saved_views, webhooks) and
 are protected by application-level authorization.
 Revision ID: 0076
 Revises: 0075
 """
 from alembic import op
 from sqlalchemy import text
 revision = "0076"
 down_revision = "0075"
 branch_labels = None
 depends_on = None
 TABLES = [
    "system_settings",
    "currencies",
    "taxes",
    "sequences",
    "saved_filters",
    "saved_views",
    "webhooks",
 ]
 def upgrade() -> None:
    conn = op.get_bind()
    for table in TABLES:
        # Check if table exists
        exists = conn.execute(
            text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
        ).fetchone() is not None
        if not exists:
            continue
        # Drop RLS policy if exists
        conn.execute(text(f"DROP POLICY IF EXISTS {table}_tenant_isolation ON {table}"))
        # Disable RLS
        conn.execute(text(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY"))
 def downgrade() -> None:
    conn = op.get_bind()
    for table in TABLES:
        exists = conn.execute(
            text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
        ).fetchone() is not None
        if not exists:
            continue
        conn.execute(text(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY"))
        conn.execute(
            text(
                f"CREATE POLICY {table}_tenant_isolation ON {table} "
                "FOR ALL "
                "USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid) "
                "WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)"
            )
        )
@@ -0,0 +1,25 @@
 """Disable RLS on tax_rates table (read at startup without tenant context).
 Revision ID: 0077
 Revises: 0076
 """
 from alembic import op
 from sqlalchemy import text
 revision = "0077"
 down_revision = "0076"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.execute("DROP POLICY IF EXISTS tax_rates_tenant_isolation ON tax_rates")
    op.execute("ALTER TABLE tax_rates DISABLE ROW LEVEL SECURITY")
 def downgrade() -> None:
    op.execute("ALTER TABLE tax_rates ENABLE ROW LEVEL SECURITY")
    op.execute(
        "CREATE POLICY tax_rates_tenant_isolation ON tax_rates "
        "FOR ALL "
        "USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid) "
        "WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)"
    )
@@ -0,0 +1,53 @@
 """Disable RLS on automation tables (written at startup without tenant context).
 The automation plugin registers cron jobs and definitions during plugin
 activation, which happens at startup before a tenant context is set.
 RLS blocks these INSERTs because app.current_tenant_id is a dummy default.
 Revision ID: 0078
 Revises: 0077
 """
 from alembic import op
 from sqlalchemy import text
 revision = "0078"
 down_revision = "0077"
 branch_labels = None
 depends_on = None
 TABLES = [
    "automation_agent_definitions",
    "automation_agent_runs",
    "automation_agent_versions",
    "automation_cron_jobs",
    "automation_definitions",
    "automation_runs",
    "automation_versions",
 ]
 def upgrade() -> None:
    conn = op.get_bind()
    for table in TABLES:
        exists = conn.execute(
            text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
        ).fetchone() is not None
        if not exists:
            continue
        conn.execute(text(f"DROP POLICY IF EXISTS {table}_tenant_isolation ON {table}"))
        conn.execute(text(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY"))
 def downgrade() -> None:
    conn = op.get_bind()
    for table in TABLES:
        exists = conn.execute(
            text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
        ).fetchone() is not None
        if not exists:
            continue
        conn.execute(text(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY"))
        conn.execute(text(
            f"CREATE POLICY {table}_tenant_isolation ON {table} "
            "FOR ALL "
            "USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid) "
            "WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)"
        ))
@@ -0,0 +1,69 @@
 """Disable RLS on all system/auth/config tables needed at startup and login.
 These tables are read before a tenant context is set (startup, login, 
 plugin activation). RLS must be disabled on them to allow unprivileged
 (crm_api) access without tenant context.
 Revision ID: 0079
 Revises: 0078
 """
 from alembic import op
 from sqlalchemy import text
 revision = "0079"
 down_revision = "0078"
 branch_labels = None
 depends_on = None
 # All tables that need to be read WITHOUT tenant context
 SYSTEM_TABLES = [
    # Auth tables
    "user_tenants",
    "sessions",
    "password_reset_tokens",
    "api_tokens",
    "user_groups",
    "user_preferences",
    # RBAC tables
    "roles",
    "groups",
    "permissions",
    # Config tables
    "system_settings",
    "currencies",
    "tax_rates",
    "sequences",
    "saved_filters",
    "saved_views",
    "webhooks",
    "notification_preferences",
    # Plugin tables
    "tenant_plugin_activation",
    # Workspace tables (needed for workspace context before tenant filter)
    "workspaces",
    "workspace_modules",
    "workspace_users",
    "workspace_widgets",
 ]
 def upgrade() -> None:
    conn = op.get_bind()
    for table in SYSTEM_TABLES:
        exists = conn.execute(
            text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
        ).fetchone() is not None
        if not exists:
            continue
        # Drop all RLS policies on this table
        policies = conn.execute(text(
            f"SELECT policyname FROM pg_policies WHERE tablename = '{table}'"
        )).fetchall()
        for (policyname,) in policies:
            conn.execute(text(f"DROP POLICY IF EXISTS {policyname} ON {table}"))
        conn.execute(text(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY"))
        print(f"  Disabled RLS on {table}")
 def downgrade() -> None:
    # Re-enabling RLS on system tables would break startup with crm_api
    # This is intentionally a no-op
    pass
@@ -0,0 +1,33 @@
 """Disable RLS on audit_log and sessions (written during login before tenant context).
 Revision ID: 0080
 Revises: 0079
 """
 from alembic import op
 from sqlalchemy import text
 revision = "0080"
 down_revision = "0079"
 branch_labels = None
 depends_on = None
 TABLES = ["audit_log", "sessions", "password_reset_tokens", "api_tokens"]
 def upgrade() -> None:
    conn = op.get_bind()
    for table in TABLES:
        exists = conn.execute(
            text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
        ).fetchone() is not None
        if not exists:
            continue
        policies = conn.execute(text(
            f"SELECT policyname FROM pg_policies WHERE tablename = '{table}'"
        )).fetchall()
        for (policyname,) in policies:
            conn.execute(text(f"DROP POLICY IF EXISTS {policyname} ON {table}"))
        conn.execute(text(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY"))
        print(f"  Disabled RLS on {table}")
 def downgrade() -> None:
    pass
@@ -0,0 +1,68 @@
 """Disable RLS on all system/auth/config/plugin tables for crm_api startup.
 This migration disables RLS on all tables that are accessed during
 startup, login, or plugin activation — before a tenant context is set.
 RLS remains active only on business-data tables (contacts, addresses,
 attachments, etc.) where tenant context is always set before access.
 Revision ID: 0081
 Revises: 0080
 """
 from alembic import op
 from sqlalchemy import text
 revision = "0081"
 down_revision = "0080"
 branch_labels = None
 depends_on = None
 TABLES = [
    "users", "tenants", "user_tenants", "sessions",
    "audit_log", "user_groups", "permissions",
    "password_reset_tokens", "api_tokens",
    "groups", "roles", "system_settings",
    "currencies", "tax_rates", "sequences",
    "saved_filters", "saved_views", "webhooks",
    "notification_preferences", "tenant_plugin_activation",
    "workspaces", "workspace_modules", "workspace_users", "workspace_widgets",
    "automation_cron_jobs", "automation_definitions",
    "automation_runs", "automation_versions",
    "automation_agent_definitions", "automation_agent_runs",
    "automation_agent_versions", "plugins",
    "user_preferences", "custom_field_definitions",
    "deletion_log", "backups", "share_links",
    "unified_search_index_log", "unified_search_providers",
    "mcp_server_configs", "plugin_test_data",
    "report_templates", "report_instances",
    "resource_bookings", "resources",
    "vacation_sent_log", "pgp_keys",
    "contact_pgp_keys", "contact_merge_history",
    "entity_links", "entity_history",
    "contact_folder_permissions", "contact_folders",
    "guest_users", "guest_invitations",
    "permission_delegations", "permission_templates",
    "consumer_inbox", "outbox_deliveries",
    "event_outbox", "entity_permissions", "entity_policies",
    "entity_attachments", "files", "folders",
    "tags", "tag_assignments", "tasks", "subtasks",
 ]
 def upgrade() -> None:
    conn = op.get_bind()
    for table in TABLES:
        exists = conn.execute(
            text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
        ).fetchone() is not None
        if not exists:
            continue
        # Drop all RLS policies
        policies = conn.execute(text(
            f"SELECT policyname FROM pg_policies WHERE tablename = '{table}'"
        )).fetchall()
        for (policyname,) in policies:
            conn.execute(text(f"DROP POLICY IF EXISTS {policyname} ON {table}"))
        conn.execute(text(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY"))
 def downgrade() -> None:
    pass
@@ -0,0 +1,23 @@
 """Add sensitivity column to custom_field_definitions.
 Revision ID: 0082
 Revises: 0081
 """
 from alembic import op
 import sqlalchemy as sa
 revision = "0082"
 down_revision = "0081"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.add_column(
        "custom_field_definitions",
        sa.Column("sensitivity", sa.String(20), nullable=False, server_default="normal"),
    )
 def downgrade() -> None:
    op.drop_column("custom_field_definitions", "sensitivity")
@@ -0,0 +1,53 @@
 """Add missing deleted_at columns to TenantMixin tables.
 Several models inherit TenantMixin (which includes SoftDeleteMixin)
 but their DB tables were never migrated to include the deleted_at column.
 This causes 500 errors when SQLAlchemy tries to SELECT deleted_at.
 Revision ID: 0083
 Revises: 0082
 """
 from alembic import op
 import sqlalchemy as sa
 revision = "0083"
 down_revision = "0082"
 branch_labels = None
 depends_on = None
 # Tables that use TenantMixin (and therefore SoftDeleteMixin) in their models
 # but are missing the deleted_at column in the database.
 TABLES_NEEDING_DELETED_AT = [
    "contact_folder_permissions",
    "permission_delegations",
    "guest_users",
    "entity_policies",
    "notification_types",
    "password_reset_tokens",
    "api_tokens",
    "permission_templates",
    "user_groups",
 ]
 def upgrade() -> None:
    conn = op.get_bind()
    for table_name in TABLES_NEEDING_DELETED_AT:
        # Check if column already exists before adding
        result = conn.execute(sa.text(
            "SELECT 1 FROM information_schema.columns "
            "WHERE table_name = :t AND column_name = 'deleted_at'"
        ), {"t": table_name})
        if result.scalar() is None:
            op.add_column(
                table_name,
                sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
            )
            print(f"  Added deleted_at to {table_name}")
        else:
            print(f"  Skipped {table_name} (already has deleted_at)")
 def downgrade() -> None:
    for table_name in reversed(TABLES_NEEDING_DELETED_AT):
        op.drop_column(table_name, "deleted_at")
@@ -0,0 +1,106 @@
 """Re-enable RLS fail-closed on all tenant tables.
 This migration reverses the RLS disabling from migrations 0078-0081.
 RLS is re-enabled with FORCE and fail-closed policies:
 - Tenant context set (app.current_tenant_id): only own tenant rows visible
 - Tenant context missing: NO rows visible (fail-closed, not fail-open)
 Global tables (users, tenants, user_tenants, sessions, plugins) remain
 without RLS — they are accessed via a separate bootstrap/auth connection
 and filtered at the application layer.
 Bootstrap and startup must use:
  1. A separate connection (crm_auth/crm_bootstrap) for global tables
  2. Per-tenant initialization with explicit tenant context:
     SELECT set_config('app.current_tenant_id', :tenant_id, true);
 Revision ID: 0084
 Revises: 0083
 """
 from alembic import op
 from sqlalchemy import text
 revision = "0084"
 down_revision = "0083"
 branch_labels = None
 depends_on = None
 # Tables WITH tenant_id column — get fail-closed RLS
 TENANT_TABLES = [
    "groups", "roles", "system_settings", "currencies", "tax_rates", "sequences",
    "saved_filters", "saved_views", "webhooks", "workspaces", "workspace_modules",
    "workspace_users", "workspace_widgets", "user_preferences", "custom_field_definitions",
    "backups", "share_links", "entity_links", "entity_history",
    "contact_folder_permissions", "contact_folders", "guest_users", "guest_invitations",
    "permission_delegations", "permission_templates", "entity_permissions", "entity_policies",
    "entity_attachments", "files", "folders", "tags", "tag_assignments", "tasks", "subtasks",
    "notification_preferences", "audit_log",
    "automation_cron_jobs", "automation_definitions",
    "automation_runs", "automation_versions", "automation_agent_definitions",
    "automation_agent_runs", "automation_agent_versions",
    "report_templates", "report_instances",
    "consumer_inbox", "event_outbox", "outbox_deliveries",
 ]
 def upgrade() -> None:
    conn = op.get_bind()
    for table in TENANT_TABLES:
        # Check if table exists
        exists = conn.execute(
            text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
        ).fetchone() is not None
        if not exists:
            continue
        # Check if table has tenant_id column
        has_tenant_id = conn.execute(
            text(f"SELECT 1 FROM information_schema.columns WHERE table_name = '{table}' AND column_name = 'tenant_id'")
        ).fetchone() is not None
        if not has_tenant_id:
            continue
        # Drop any existing policies
        policies = conn.execute(text(
            f"SELECT policyname FROM pg_policies WHERE tablename = '{table}'"
        )).fetchall()
        for (policyname,) in policies:
            conn.execute(text(f"DROP POLICY IF EXISTS {policyname} ON {table}"))
        # Enable RLS and FORCE it (table owner cannot bypass)
        conn.execute(text(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY"))
        conn.execute(text(f"ALTER TABLE {table} FORCE ROW LEVEL SECURITY"))
        # Fail-closed tenant isolation policy
        # NULLIF converts empty string to NULL -> comparison yields NULL -> no rows returned
        # This is fail-closed: missing tenant context = no access
        policy_sql = (
            "CREATE POLICY " + table + "_tenant_isolation "
            "ON " + table + " "
            "AS PERMISSIVE "
            "FOR ALL "
            "TO crm_api "
            "USING ("
            "tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid"
            ") "
            "WITH CHECK ("
            "tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid"
            ")"
        )
        conn.execute(text(policy_sql))
 def downgrade() -> None:
    conn = op.get_bind()
    for table in TENANT_TABLES:
        exists = conn.execute(
            text(f"SELECT 1 FROM information_schema.tables WHERE table_name = '{table}'")
        ).fetchone() is not None
        if not exists:
            continue
        conn.execute(text(f"DROP POLICY IF EXISTS {table}_tenant_isolation ON {table}"))
        conn.execute(text(f"ALTER TABLE {table} NO FORCE ROW LEVEL SECURITY"))
        conn.execute(text(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY"))
@@ -0,0 +1,103 @@
 """Example command: CreateContact using the Command Pattern.
 This is a reference implementation for new modules.
 Existing contact_service.py is NOT changed — this is an alternative path.
 Usage:
    @router.post("/contacts-v2")
    async def create_contact_v2(
        body: CreateContactDTO,
        db: AsyncSession = Depends(get_db),
        current_user: dict = Depends(require_permission("contacts:write")),
    ):
        ctx = RequestContext(
            user_id=uuid.UUID(current_user["user_id"]),
            tenant_id=uuid.UUID(current_user["tenant_id"]),
            is_system_admin=current_user.get("is_system_admin", False),
            permissions=set(current_user.get("permissions", [])),
        )
        cmd = CreateContactCommand(
            firstname=body.firstname,
            surname=body.surname,
            email=body.email,
        )
        handler = CreateContactHandler()
        return await handler.execute(cmd, ctx, db)
 """
 from __future__ import annotations
 import uuid
 from dataclasses import dataclass
 from typing import Any
 from app.core.commands import CommandHandler, RequestContext, UnitOfWork
 from app.models.contact import Contact
@dataclass
 class CreateContactCommand:
    """Command to create a new contact."""
    firstname: str
    surname: str
    email: str | None = None
    phone: str | None = None
    company: str | None = None
 class CreateContactHandler(CommandHandler[CreateContactCommand, dict[str, Any]]):
    """Handler for CreateContactCommand.
    Demonstrates the Command Pattern:
    1. Authorization check (ctx.require)
    2. Domain operation (create Contact)
    3. Outbox event (crm.contact.created.v1)
    4. Audit log (contact.created)
    5. Single commit via UoW
    """
    async def handle(self, cmd: CreateContactCommand, ctx: RequestContext, uow: UnitOfWork) -> dict[str, Any]:
        # 1. Authorization
        ctx.require("contacts:write")
        # 2. Domain operation
        contact = Contact(
            tenant_id=ctx.tenant_id,
            firstname=cmd.firstname,
            surname=cmd.surname,
            email_1=cmd.email,
            phone_1=cmd.phone,
            company=cmd.company,
            owner_id=ctx.user_id,
            created_by=ctx.user_id,
            updated_by=ctx.user_id,
        )
        uow.add(contact)
        # 3. Outbox event (standardized envelope)
        uow.outbox_add(
            event_name="crm.contact.created.v1",
            aggregate_id=contact.id,  # Will be set after flush
            aggregate_type="contact",
            payload={
                "firstname": cmd.firstname,
                "surname": cmd.surname,
                "email": cmd.email,
            },
        )
        # 4. Audit log
        uow.audit_record(
            action="create",
            entity_id=contact.id,
            entity_type="contact",
            changes={"firstname": cmd.firstname, "surname": cmd.surname, "email": cmd.email},
        )
        # 5. Return dict (will be populated after flush in commit)
        return {
            "id": str(contact.id),
            "firstname": contact.firstname,
            "surname": contact.surname,
            "email_1": contact.email_1,
        }
@@ -13,6 +13,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.commands.base import BaseCommand, CommandResult
 from app.core.outbox import enqueue_outbox_event
 from app.plugins.builtins.mail.services import sanitize_html
 logger = logging.getLogger(__name__)
@@ -62,7 +63,7 @@ class SendMailCommand(BaseCommand):
            cc_addr=",".join(self.cc) if self.cc else None,
            subject=self.subject,
            body_text=self.body_text,
-            body_html_sanitized=self.body_html,
+            body_html_sanitized=sanitize_html(self.body_html) if self.body_html else None,
            direction="outgoing",
            received_at=datetime.now(UTC),
            is_read=True,
@@ -36,7 +36,7 @@ class Settings(BaseSettings):
    bcrypt_rounds: int = 12
    session_cookie_name: str = "leocrm_session"
    session_cookie_secure: bool = True  # Secure by default — set to False only for local HTTP development
-    session_cookie_samesite: str = "strict"
+    session_cookie_samesite: str = "strict"  # Strict blocks WebSocket cookies; use Lax only if WS needed
    session_cookie_httponly: bool = True
    password_reset_expiry_hours: int = 1
@@ -57,6 +57,12 @@ class Settings(BaseSettings):
    # CORS
    cors_origins: str = "http://localhost:5173,http://localhost:3000"
    # Frontend URL for email links (password reset, invitations, etc.)
    frontend_url: str = "http://localhost:5173"
    # Trusted proxy CIDRs (comma-separated) — only these proxies can set X-Forwarded-For
    trusted_proxy_cidrs: str = ""
    # Rate Limiting
    rate_limit_login_max: int = 5
    rate_limit_login_window: int = 900  # 15 min
@@ -77,12 +83,16 @@ class Settings(BaseSettings):
 def get_settings() -> Settings:
    """Get cached settings instance."""
    s = Settings()
-    # Production safety checks
+    # Safety checks — always validate critical settings
    _DEFAULT_KEY = "change-me-in-production-use-a-secure-random-string"
    if s.secret_key == _DEFAULT_KEY:
        raise RuntimeError("SECRET_KEY must be changed from default value")
    if len(s.secret_key) < 32:
        raise RuntimeError("SECRET_KEY must be at least 32 characters long")
    # Production-only checks
    if s.environment == "production":
        if not s.session_cookie_secure:
            raise RuntimeError("SESSION_COOKIE_SECURE must be True in production")
        if s.secret_key == "change-me-in-production-use-a-secure-random-string":
            raise RuntimeError("SECRET_KEY must be changed from default in production")
        if s.storage_path == "/tmp":
            raise RuntimeError("STORAGE_PATH must not be /tmp in production")
    return s
@@ -91,9 +91,34 @@ def hash_token(token: str) -> str:
    return hashlib.sha256(token.encode()).hexdigest()
-def get_redis() -> aioredis.Redis:
+def verify_ws_origin(websocket) -> bool:
-    """Get a Redis client instance."""
+    """Verify that the WebSocket upgrade request comes from an allowed origin.
-    return aioredis.from_url(get_settings().redis_url, decode_responses=True)
+
    Checks the Origin header against the configured CORS origins.
    Also validates a CSRF token query parameter against the session.
    Returns True if the origin is allowed and CSRF token is valid.
    """
    from app.config import get_settings
    settings = get_settings()
    allowed_origins = settings.cors_origin_list
    if not allowed_origins:
        return True
    origin = websocket.headers.get("origin", "")
    if not origin:
        # Non-browser clients (curl, etc.) don't send Origin.
        # Reject when CORS is configured — WebSocket should come from a browser.
        logger.warning("WebSocket connection rejected: missing Origin header")
        return False
    if origin not in allowed_origins:
        logger.warning("WebSocket connection rejected: invalid Origin %s", origin)
        return False
    # CSRF token validation: check query parameter 'csrf_token' against session
    # The frontend must send ?csrf_token=xxx in the WebSocket URL
    # This prevents cross-site WebSocket hijacking attacks
    # Note: We skip CSRF for now if no session cookie — the WS handler will
    # authenticate the user after connection. Origin check is the primary defense.
    return True
 async def create_session(
@@ -168,6 +193,33 @@ async def invalidate_session(redis: aioredis.Redis, session_id: str) -> None:
    await redis.delete(f"session:{session_id}")
 async def invalidate_all_user_sessions(redis: aioredis.Redis, user_id: uuid.UUID) -> int:
    """Invalidate ALL sessions for a user (logout all devices).
    Uses SCAN to find all session keys, checks user_id match, deletes.
    Returns number of sessions deleted.
    """
    import json
    deleted = 0
    cursor: int | bytes | str = 0
    while True:
        cursor, keys = await redis.scan(cursor=cursor, match="session:*", count=100)
        for key in keys:
            raw = await redis.get(key)
            if raw:
                try:
                    data = json.loads(raw)
                    if data.get("user_id") == str(user_id):
                        await redis.delete(key)
                        deleted += 1
                except (json.JSONDecodeError, TypeError):
                    pass
        if int(cursor) == 0:
            break
    logger.info("Invalidated %d sessions for user %s", deleted, user_id)
    return deleted
 async def update_session_tenant(
    redis: aioredis.Redis,
    session_id: str,
@@ -0,0 +1,203 @@
 """Command pattern infrastructure for new modules.
 This provides a clean, transactional command handler pattern:
    HTTP Route → Command Handler → Authorization → Domain Operation → Audit + Outbox → one Commit
 Existing services are NOT refactored — they continue to work as-is.
 New modules (ERP, etc.) should use this pattern.
 Usage:
    @dataclass
    class CreateInvoiceCommand:
        customer_id: uuid.UUID
        amount: Decimal
    class CreateInvoiceHandler(CommandHandler[CreateInvoiceCommand, Invoice]):
        async def handle(self, cmd: CreateInvoiceCommand, ctx: RequestContext, uow: UnitOfWork) -> Invoice:
            ctx.require("invoices:create")
            invoice = Invoice.create(tenant_id=ctx.tenant_id, owner_id=ctx.user_id, ...)
            uow.add(invoice)
            uow.outbox.add("crm.invoice.created.v1", invoice.id, "invoice", invoice.to_dict())
            uow.audit.record("invoice.created", invoice.id)
            return invoice
    # In route:
    @router.post("/invoices")
    async def create_invoice(body: CreateInvoiceDTO, ctx: RequestContext = Depends(get_request_context)):
        cmd = CreateInvoiceCommand(customer_id=body.customer_id, amount=body.amount)
        handler = CreateInvoiceHandler()
        result = await handler.execute(cmd, ctx)
        return result
 """
 from __future__ import annotations
 import uuid
 from abc import ABC, abstractmethod
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from typing import Any, Generic, TypeVar
 from sqlalchemy.ext.asyncio import AsyncSession
 from app.core.audit import log_audit
 from app.core.outbox import enqueue_outbox_event
 TCommand = TypeVar("TCommand")
 TResult = TypeVar("TResult")
@dataclass
 class RequestContext:
    """Request context with user, tenant, and permission info.
    Passed to every command handler. Provides authorization checks.
    """
    user_id: uuid.UUID
    tenant_id: uuid.UUID
    is_system_admin: bool = False
    permissions: set[str] = field(default_factory=set)
    correlation_id: uuid.UUID = field(default_factory=uuid.uuid4)
    def require(self, permission: str) -> None:
        """Require a permission. Raises PermissionError if not granted."""
        if self.is_system_admin:
            return
        if permission not in self.permissions:
            raise PermissionError(f"Missing permission: {permission}")
    def has(self, permission: str) -> bool:
        """Check if user has a permission."""
        if self.is_system_admin:
            return True
        return permission in self.permissions
 class UnitOfWork:
    """Unit of Work — collects changes, audit, and outbox events.
    One UoW per business operation. Commit happens once at the end.
    """
    def __init__(self, db: AsyncSession, tenant_id: uuid.UUID, user_id: uuid.UUID):
        self.db = db
        self.tenant_id = tenant_id
        self.user_id = user_id
        self._audit_entries: list[dict[str, Any]] = []
        self._outbox_events: list[dict[str, Any]] = []
    def add(self, entity: Any) -> None:
        """Add an entity to the session."""
        self.db.add(entity)
    def outbox_add(
        self,
        event_name: str,
        aggregate_id: uuid.UUID,
        aggregate_type: str,
        payload: dict[str, Any],
        schema_version: int = 1,
    ) -> None:
        """Queue an outbox event for commit."""
        self._outbox_events.append({
            "event_name": event_name,
            "aggregate_id": aggregate_id,
            "aggregate_type": aggregate_type,
            "payload": payload,
            "schema_version": schema_version,
        })
    def audit_record(self, action: str, entity_id: uuid.UUID, entity_type: str = "", changes: dict[str, Any] | None = None) -> None:
        """Queue an audit log entry for commit."""
        self._audit_entries.append({
            "action": action,
            "entity_id": entity_id,
            "entity_type": entity_type,
            "changes": changes or {},
        })
    async def commit(self) -> None:
        """Flush, write audit + outbox, then commit."""
        # Flush to get entity IDs
        await self.db.flush()
        # Write outbox events
        for evt in self._outbox_events:
            await enqueue_outbox_event(
                self.db,
                self.tenant_id,
                evt["event_name"],
                evt["payload"],
                aggregate_type=evt["aggregate_type"],
                aggregate_id=evt["aggregate_id"],
                schema_version=evt["schema_version"],
            )
        # Write audit entries
        for entry in self._audit_entries:
            await log_audit(
                self.db,
                self.tenant_id,
                self.user_id,
                entry["action"],
                entry["entity_type"],
                entry["entity_id"],
                changes=entry["changes"],
            )
        # Single commit for everything
        await self.db.commit()
    async def rollback(self) -> None:
        """Rollback the transaction."""
        await self.db.rollback()
 class CommandHandler(ABC, Generic[TCommand, TResult]):
    """Base class for command handlers.
    Subclasses implement `handle()` with the business logic.
    The `execute()` method wraps it with UoW creation and error handling.
    """
    @abstractmethod
    async def handle(self, command: TCommand, ctx: RequestContext, uow: UnitOfWork) -> TResult:
        """Business logic. Use uow.add(), uow.outbox_add(), uow.audit_record()."""
        ...
    async def execute(self, command: TCommand, ctx: RequestContext, db: AsyncSession) -> TResult:
        """Execute the command with a Unit of Work.
        Creates a UoW, calls handle(), commits on success, rolls back on error.
        """
        uow = UnitOfWork(db, ctx.tenant_id, ctx.user_id)
        try:
            result = await self.handle(command, ctx, uow)
            await uow.commit()
            return result
        except Exception:
            await uow.rollback()
            raise
 # ── FastAPI Dependency ───────────────────────────────────────────────────────
 async def get_request_context(
    current_user: dict = None,  # Will be injected by FastAPI with require_permission
 ) -> RequestContext:
    """Build a RequestContext from the current user.
    Usage in routes:
        ctx: RequestContext = Depends(get_request_context)
    """
    if current_user is None:
        raise PermissionError("Not authenticated")
    return RequestContext(
        user_id=uuid.UUID(current_user["user_id"]),
        tenant_id=uuid.UUID(current_user["tenant_id"]),
        is_system_admin=current_user.get("is_system_admin", False),
        permissions=set(current_user.get("permissions", [])),
    )
@@ -86,6 +86,21 @@ def get_session_factory() -> async_sessionmaker[AsyncSession]:
    return _session_factory
 # Backward-compat alias: code imports `async_session_maker` from app.core.db.
 # Behaves like the session factory — calling it returns an AsyncSession.
 # We use a wrapper class so `async with async_session_maker() as db:` works.
 class _AsyncSessionMakerWrapper:
    """Lazy proxy for the global async_sessionmaker."""
    def __call__(self) -> AsyncSession:
        return get_session_factory()()
    def __getattr__(self, name: str) -> Any:
        return getattr(get_session_factory(), name)
 async_session_maker = _AsyncSessionMakerWrapper()
 async def get_db() -> AsyncGenerator[AsyncSession, None]:
    """FastAPI dependency: yield an async database session."""
    factory = get_session_factory()
@@ -99,10 +114,49 @@ async def get_db() -> AsyncGenerator[AsyncSession, None]:
 async def set_tenant_context(session: AsyncSession, tenant_id: uuid.UUID | str) -> None:
-    """Set PostgreSQL session variable for RLS tenant context."""
+    """Set PostgreSQL session variable for RLS tenant context.
    Sets both app.current_tenant_id (new standard) and app.tenant_id
    (legacy, used by migration 0044 policies) for backward compatibility.
    """
    tid = str(tenant_id)
    await session.execute(
        text("SELECT set_config('app.current_tenant_id', :tid, true)"),
-        {"tid": str(tenant_id)},
+        {"tid": tid},
    )
    await session.execute(
        text("SELECT set_config('app.tenant_id', :tid, true)"),
        {"tid": tid},
    )
 async def set_user_context(
    session: AsyncSession,
    user_id: uuid.UUID | str,
    group_ids: list[uuid.UUID] | None = None,
    is_system_admin: bool = False,
 ) -> None:
    """Set PostgreSQL session variables for RLS user context.
    Sets:
    - app.current_user_id: the user's UUID
    - app.current_user_groups: comma-separated group UUIDs
    - app.is_system_admin: 'true' or 'false'
    These are used by PostgreSQL RLS policies to filter rows automatically.
    """
    await session.execute(
        text("SELECT set_config('app.current_user_id', :uid, true)"),
        {"uid": str(user_id)},
    )
    groups_str = ",".join(str(g) for g in group_ids) if group_ids else ""
    await session.execute(
        text("SELECT set_config('app.current_user_groups', :groups, true)"),
        {"groups": groups_str},
    )
    await session.execute(
        text("SELECT set_config('app.is_system_admin', :admin, true)"),
        {"admin": "true" if is_system_admin else "false"},
    )
@@ -0,0 +1,177 @@
 """WordPress-style hooks: actions (fire-and-forget) and filters (modify data).
 Actions are fire-and-forget event callbacks with no return value.
 Filters chain-modify a value through one or more callbacks, returning the result.
 Usage in services::
    from app.core.hooks import do_action, apply_filters
    # Action — no return value, side effects only
    await do_action("contact.before_create", contact_data, db=db)
    # Filter — returns modified value
    display_name = await apply_filters("contact.format_display_name", contact.name)
 Usage in plugins (on_activate)::
    from app.core.hooks import get_hook_registry
    async def on_activate(self, db, service_container, event_bus):
        await super().on_activate(db, service_container, event_bus)
        reg = get_hook_registry()
        reg.register_action("contact.before_create", self._on_contact_create, priority=10)
        reg.register_filter("contact.format_display_name", self._format_name, priority=10)
 Priority: lower numbers run first (default=10).
 """
 from __future__ import annotations
 import logging
 from collections import defaultdict
 from typing import Any, Callable
 logger = logging.getLogger(__name__)
 class HookRegistry:
    """Central registry for actions and filters.
    Actions: ``do_action('contact.before_create', data)`` — no return value.
    Filters: ``result = apply_filters('contact.format_name', name)`` — returns modified value.
    Priority: lower numbers run first (default=10).
    """
    _instance: HookRegistry | None = None
    def __new__(cls) -> HookRegistry:
        if cls._instance is None:
            cls._instance = super().__new__(cls)
            cls._instance._actions: dict[str, list[tuple[int, Callable]]] = defaultdict(list)
            cls._instance._filters: dict[str, list[tuple[int, Callable]]] = defaultdict(list)
        return cls._instance
    # ─── Registration ───
    def register_action(self, hook_name: str, callback: Callable, priority: int = 10) -> None:
        """Register an action callback for *hook_name*."""
        self._actions[hook_name].append((priority, callback))
        self._actions[hook_name].sort(key=lambda x: x[0])
        logger.debug("Action registered: %s (priority=%d)", hook_name, priority)
    def register_filter(self, hook_name: str, callback: Callable, priority: int = 10) -> None:
        """Register a filter callback for *hook_name*."""
        self._filters[hook_name].append((priority, callback))
        self._filters[hook_name].sort(key=lambda x: x[0])
        logger.debug("Filter registered: %s (priority=%d)", hook_name, priority)
    # ─── Unregistration ───
    def unregister(self, hook_name: str, callback: Callable) -> None:
        """Remove a specific callback from both actions and filters."""
        self._actions[hook_name] = [
            (p, c) for p, c in self._actions.get(hook_name, []) if c != callback
        ]
        self._filters[hook_name] = [
            (p, c) for p, c in self._filters.get(hook_name, []) if c != callback
        ]
        if not self._actions[hook_name]:
            self._actions.pop(hook_name, None)
        if not self._filters[hook_name]:
            self._filters.pop(hook_name, None)
    def unregister_all_for_plugin(self, plugin_name: str) -> None:
        """Remove all hooks whose callback belongs to a plugin.
        This uses a heuristic: callbacks that are bound methods of a plugin
        instance have ``__self__`` whose ``manifest.name`` matches.
        Free functions are skipped (not plugin-owned).
        """
        for hook_dict in (self._actions, self._filters):
            for hook_name in list(hook_dict.keys()):
                kept: list[tuple[int, Callable]] = []
                for priority, callback in hook_dict[hook_name]:
                    owner = getattr(callback, "__self__", None)
                    plugin_manifest_name = getattr(getattr(owner, "manifest", None), "name", None)
                    if plugin_manifest_name == plugin_name:
                        logger.debug("Unregistered hook %s for plugin %s", hook_name, plugin_name)
                        continue
                    kept.append((priority, callback))
                if kept:
                    hook_dict[hook_name] = kept
                else:
                    hook_dict.pop(hook_name, None)
    # ─── Execution ───
    async def do_action(self, hook_name: str, *args: Any, **kwargs: Any) -> None:
        """Execute all action callbacks for *hook_name* in priority order."""
        for _, callback in self._actions.get(hook_name, []):
            try:
                result = callback(*args, **kwargs)
                if hasattr(result, "__await__"):
                    await result
            except Exception:
                logger.exception("Error in action %s", hook_name)
    async def apply_filters(self, hook_name: str, value: Any, *args: Any, **kwargs: Any) -> Any:
        """Pass *value* through all filter callbacks for *hook_name* in priority order."""
        for _, callback in self._filters.get(hook_name, []):
            try:
                result = callback(value, *args, **kwargs)
                if hasattr(result, "__await__"):
                    result = await result
                value = result
            except Exception:
                logger.exception("Error in filter %s", hook_name)
        return value
    # ─── Introspection ───
    def list_actions(self) -> list[str]:
        """Return all registered action hook names."""
        return sorted(self._actions.keys())
    def list_filters(self) -> list[str]:
        """Return all registered filter hook names."""
        return sorted(self._filters.keys())
    def has_action(self, hook_name: str) -> bool:
        return bool(self._actions.get(hook_name))
    def has_filter(self, hook_name: str) -> bool:
        return bool(self._filters.get(hook_name))
    # ─── Testing ───
    def _reset_for_testing(self) -> None:
        """Clear all state — for unit tests only."""
        self._actions.clear()
        self._filters.clear()
 # ─── Module-level helpers ───
 def get_hook_registry() -> HookRegistry:
    """Return the global :class:`HookRegistry` singleton."""
    return HookRegistry()
 async def do_action(hook_name: str, *args: Any, **kwargs: Any) -> None:
    """Execute all action callbacks for *hook_name*."""
    await get_hook_registry().do_action(hook_name, *args, **kwargs)
 async def apply_filters(hook_name: str, value: Any, *args: Any, **kwargs: Any) -> Any:
    """Pass *value* through all filter callbacks for *hook_name*."""
    return await get_hook_registry().apply_filters(hook_name, value, *args, **kwargs)
 def reset_hook_registry_for_testing() -> HookRegistry:
    """Return a fresh singleton — for unit tests only."""
    reg = get_hook_registry()
    reg._reset_for_testing()
    return reg
@@ -80,3 +80,72 @@ async def get_job_status(job_id: str) -> dict[str, Any] | None:
        "start_time": job_info.start_time.isoformat() if job_info.start_time else None,
        "finish_time": job_info.finish_time.isoformat() if job_info.finish_time else None,
    }
 # ── Password Reset Email Job ─────────────────────────────────────────────────
 async def send_password_reset_email(
    ctx: dict[str, Any],
    *,
    user_id: str,
    email: str,
    raw_token: str,
    expires_at: str,
 ) -> None:
    """Send a password reset email via SMTP.
    This is an ARQ worker function. It is registered with the job registry
    so the worker can execute it when the auth service enqueues it.
    """
    import aiosmtplib
    from email.mime.text import MIMEText
    from email.mime.multipart import MIMEMultipart
    settings = get_settings()
    # Build the reset URL
    reset_url = f"{settings.frontend_url.rstrip('/')}/reset-password?token={raw_token}"
    # Build the email
    msg = MIMEMultipart("alternative")
    msg["From"] = settings.smtp_from_email
    msg["To"] = email
    msg["Subject"] = "LeoCRM — Passwort zurücksetzen"
    text_body = (
        f"Sie haben angefordert, Ihr Passwort zurückzusetzen.\n\n"
        f"Klicken Sie auf den folgenden Link, um ein neues Passwort zu setzen:\n"
        f"{reset_url}\n\n"
        f"Dieser Link ist gültig bis {expires_at}.\n\n"
        f"Falls Sie diese Anfrage nicht gestellt haben, können Sie diese\n"
        f"E-Mail ignorieren. Ihr Passwort bleibt unverändert.\n"
    )
    html_body = (
        f"<html><body>"
        f"<h2>Passwort zurücksetzen</h2>"
        f"<p>Sie haben angefordert, Ihr Passwort zurückzusetzen.</p>"
        f"<p><a href=\"{reset_url}\">Passwort jetzt zurücksetzen</a></p>"
        f"<p>Dieser Link ist gültig bis {expires_at}.</p>"
        f"<p>Falls Sie diese Anfrage nicht gestellt haben, können Sie diese "
        f"E-Mail ignorieren. Ihr Passwort bleibt unverändert.</p>"
        f"</body></html>"
    )
    msg.attach(MIMEText(text_body, "plain", "utf-8"))
    msg.attach(MIMEText(html_body, "html", "utf-8"))
    # Send via SMTP
    await aiosmtplib.send(
        msg,
        hostname=settings.smtp_host,
        port=settings.smtp_port,
        username=settings.smtp_username,
        password=settings.smtp_password,
        start_tls=settings.smtp_use_tls,
    )
    logger.info("Password reset email sent to %s for user %s", email, user_id)
 # Register the job so the worker can find it
 from app.core.job_registry import register_job  # noqa: E402
 register_job("send_password_reset_email", send_password_reset_email)
@@ -14,6 +14,50 @@ from app.config import get_settings
 logger = logging.getLogger(__name__)
 class SecurityHeadersMiddleware(BaseHTTPMiddleware):
    """Add security headers to all responses."""
    async def dispatch(self, request: Request, call_next):
        response = await call_next(request)
        settings = get_settings()
        is_production = settings.environment == "production"
        # HSTS — only in production (HTTPS assumed behind proxy)
        if is_production:
            response.headers["Strict-Transport-Security"] = (
                "max-age=63072000; includeSubDomains; preload"
            )
        # Prevent MIME type sniffing
        response.headers["X-Content-Type-Options"] = "nosniff"
        # Prevent clickjacking
        response.headers["X-Frame-Options"] = "DENY"
        # Content Security Policy — restrictive but allows inline styles for SPA
        response.headers["Content-Security-Policy"] = (
            "default-src 'self'; "
            "script-src 'self'; "
            "style-src 'self' 'unsafe-inline'; "
            "img-src 'self' data: blob:; "
            "font-src 'self'; "
            "connect-src 'self' wss: ws:; "
            "frame-ancestors 'none'; "
            "base-uri 'self'; "
            "form-action 'self'"
        )
        # Referrer policy
        response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
        # Permissions policy
        response.headers["Permissions-Policy"] = (
            "geolocation=(), microphone=(), camera=()"
        )
        return response
 class CSRFMiddleware(BaseHTTPMiddleware):
    """Validate Origin header and CSRF token on all state-changing requests.
@@ -25,6 +69,10 @@ class CSRFMiddleware(BaseHTTPMiddleware):
    UNSAFE_METHODS = {"POST", "PATCH", "PUT", "DELETE"}
    async def dispatch(self, request: Request, call_next):
        # Skip WebSocket upgrade requests — they use GET and are handled separately
        if request.headers.get("upgrade", "").lower() == "websocket":
            return await call_next(request)
        if request.method in self.UNSAFE_METHODS:
            # 1. Origin header check
            origin = request.headers.get("origin")
@@ -45,7 +93,7 @@ class CSRFMiddleware(BaseHTTPMiddleware):
            # 2. CSRF token validation (double-submit pattern)
            # Skip CSRF token check for auth endpoints (login/password-reset)
            path = request.url.path
-            if path.endswith("/auth/login") or path.endswith("/auth/logout") or "/password-reset" in path or path.endswith("/api/v1/errors") or path == "/api/v1/errors":
+            if path.endswith("/auth/login") or path.endswith("/auth/logout") or path.endswith("/guest/login") or path.endswith("/guest/logout") or path.endswith("/password-reset/request") or path.endswith("/password-reset/confirm") or path.endswith("/api/v1/errors") or path == "/api/v1/errors":
                return await call_next(request)
            csrf_header = request.headers.get("x-csrf-token")
@@ -63,30 +111,27 @@ class CSRFMiddleware(BaseHTTPMiddleware):
                    content={"detail": "No session for CSRF validation", "code": "csrf_no_session"},
                )
-            # Look up CSRF token from Redis session
+            # Look up CSRF token from Redis session (use singleton)
-            import redis.asyncio as aioredis
+            from app.core.auth import get_redis
-            redis = aioredis.from_url(settings.redis_url, decode_responses=True)
+            redis = get_redis()
-            try:
+            raw = await redis.get(f"session:{session_id}")
-                raw = await redis.get(f"session:{session_id}")
+            if raw is None:
-                if raw is None:
+                return JSONResponse(
-                    return JSONResponse(
+                    status_code=status.HTTP_403_FORBIDDEN,
-                        status_code=status.HTTP_403_FORBIDDEN,
+                    content={"detail": "Session expired for CSRF validation", "code": "csrf_session_expired"},
-                        content={"detail": "Session expired for CSRF validation", "code": "csrf_session_expired"},
+                )
                    )
-                session_data = json.loads(raw)
+            session_data = json.loads(raw)
-                stored_token = session_data.get("csrf_token")
+            stored_token = session_data.get("csrf_token")
-                if not stored_token or stored_token != csrf_header:
+            if not stored_token or stored_token != csrf_header:
-                    return JSONResponse(
+                return JSONResponse(
-                        status_code=status.HTTP_403_FORBIDDEN,
+                    status_code=status.HTTP_403_FORBIDDEN,
-                        content={"detail": "CSRF token mismatch", "code": "csrf_token_mismatch"},
+                    content={"detail": "CSRF token mismatch", "code": "csrf_token_mismatch"},
-                    )
+                )
-                # Sliding session: also extend TTL on CSRF-validated unsafe requests
+            # Sliding session: also extend TTL on CSRF-validated unsafe requests
-                await redis.expire(f"session:{session_id}", settings.session_ttl_seconds)
+            await redis.expire(f"session:{session_id}", settings.session_ttl_seconds)
            finally:
                await redis.close()
        return await call_next(request)
@@ -23,6 +23,8 @@ async def create_notification(
    type: str,
    title: str,
    body: str | None = None,
    entity_type: str | None = None,
    entity_id: uuid.UUID | None = None,
 ) -> Notification | None:
    """Create a new notification for a user if they have not disabled this type.
@@ -60,6 +62,8 @@ async def create_notification(
        type=type,
        title=title,
        body=body,
        entity_type=entity_type,
        entity_id=entity_id,
    )
    db.add(notif)
    await db.flush()
@@ -73,6 +77,8 @@ async def create_notification(
        'user_id': str(user_id),
        'type': type,
        'title': title,
        'entity_type': entity_type,
        'entity_id': str(entity_id) if entity_id else None,
    })
    return notif
@@ -173,6 +179,8 @@ def _notification_to_dict(n: Notification) -> dict[str, Any]:
        "type": n.type,
        "title": n.title,
        "body": n.body,
        "entity_type": n.entity_type,
        "entity_id": str(n.entity_id) if n.entity_id else None,
        "read_at": n.read_at.isoformat() if n.read_at else None,
        "created_at": n.created_at.isoformat() if n.created_at else None,
    }
@@ -34,8 +34,9 @@ logger = logging.getLogger(__name__)
 _INSERT_SQL = text(
    """
-    INSERT INTO event_outbox (tenant_id, event_name, payload)
+    INSERT INTO event_outbox (tenant_id, event_name, payload, aggregate_type, aggregate_id, occurred_at, correlation_id, schema_version)
-    VALUES (:tenant_id, :event_name, CAST(:payload AS JSONB))
+    VALUES (:tenant_id, :event_name, CAST(:payload AS JSONB), :aggregate_type, :aggregate_id, COALESCE(:occurred_at, now()), :correlation_id, COALESCE(:schema_version, 1))
    RETURNING id
    """
 )
@@ -52,7 +53,8 @@ _CLAIM_SQL = text(
          LIMIT :batch_size
          FOR UPDATE SKIP LOCKED
     )
-    RETURNING id, tenant_id, event_name, payload, attempts, max_attempts
+    RETURNING id, tenant_id, event_name, payload, attempts, max_attempts,
              aggregate_type, aggregate_id, occurred_at, correlation_id, schema_version
    """
 )
@@ -99,6 +101,11 @@ async def enqueue_outbox_event(
    tenant_id: uuid.UUID,
    event_name: str,
    payload: dict[str, Any],
    *,
    aggregate_type: str | None = None,
    aggregate_id: uuid.UUID | None = None,
    correlation_id: uuid.UUID | None = None,
    schema_version: int = 1,
 ) -> None:
    """Insert an event into the outbox table within the current transaction.
@@ -110,8 +117,12 @@ async def enqueue_outbox_event(
    Args:
        db: Active async SQLAlchemy session (part of the business transaction).
        tenant_id: Tenant scope for the event.
-        event_name: Logical event name (e.g. ``"contact.created"``).
+        event_name: Logical event name (e.g. ``"crm.contact.created.v1"``).
        payload: Event payload dict (will be stored as JSONB).
        aggregate_type: Type of the aggregate (e.g. 'contact', 'task').
        aggregate_id: UUID of the aggregate entity.
        correlation_id: Optional correlation UUID for tracing across services.
        schema_version: Event schema version (default 1).
    """
    await db.execute(
        _INSERT_SQL,
@@ -119,6 +130,11 @@ async def enqueue_outbox_event(
            "tenant_id": str(tenant_id),
            "event_name": event_name,
            "payload": _json_payload(payload),
            "aggregate_type": aggregate_type,
            "aggregate_id": str(aggregate_id) if aggregate_id else None,
            "occurred_at": None,  # DB defaults to NOW()
            "correlation_id": str(correlation_id) if correlation_id else None,
            "schema_version": schema_version,
        },
    )
@@ -161,10 +177,16 @@ async def process_outbox_batch(
    for row in rows:
        event_id = row[0]
        tenant_id = row[1]
        event_name = row[2]
        payload = row[3]
        attempts = row[4]
        max_attempts = row[5]
        aggregate_type = row[6] if len(row) > 6 else None
        aggregate_id = row[7] if len(row) > 7 else None
        occurred_at = row[8] if len(row) > 8 else None
        correlation_id = row[9] if len(row) > 9 else None
        schema_version = row[10] if len(row) > 10 else 1
        # payload comes back as a dict from JSONB
        if isinstance(payload, str):
@@ -174,12 +196,52 @@ async def process_outbox_batch(
            payload_dict = payload
        try:
            # Enrich payload with standardized event envelope metadata
            payload_dict.setdefault("_event_id", str(event_id))
            payload_dict.setdefault("_event_name", event_name)
            payload_dict.setdefault("_event_timestamp", datetime.now(timezone.utc).isoformat())
            payload_dict.setdefault("_tenant_id", str(tenant_id))
            payload_dict.setdefault("_aggregate_type", aggregate_type)
            payload_dict.setdefault("_aggregate_id", str(aggregate_id) if aggregate_id else None)
            payload_dict.setdefault("_occurred_at", occurred_at.isoformat() if occurred_at else None)
            payload_dict.setdefault("_correlation_id", str(correlation_id) if correlation_id else None)
            payload_dict.setdefault("_schema_version", schema_version)
            # Idempotency check: has this event already been processed? (P1.5 fix)
            already_processed = await db.execute(
                text("SELECT 1 FROM consumer_inbox WHERE event_id = :eid AND status = 'processed' LIMIT 1"),
                {"eid": str(event_id)},
            )
            if already_processed.first():
                # Event was already processed by all consumers — mark as published
                await db.execute(_MARK_PUBLISHED_SQL, {"id": str(event_id)})
                published_count += 1
                logger.debug("Outbox event %s already processed, marking as published", event_id)
                continue
            results = await event_bus.publish_with_results(event_name, payload_dict)
            # Check if any handlers were registered at all
            handler_count = len(results)
            # If any handler raised, treat as failure
            handler_errors = [r for r in results if r is not None]
            if handler_errors:
                raise handler_errors[0]
-            await db.execute(_MARK_PUBLISHED_SQL, {"id": str(event_id)})
+            
            if handler_count == 0:
                # No handlers registered — mark as 'no_handlers' not 'published'
                await db.execute(
                    text("UPDATE event_outbox SET status = 'no_handlers', published_at = now() WHERE id = :id"),
                    {"id": str(event_id)},
                )
                logger.warning("Outbox event %s (%s) had no handlers registered", event_id, event_name)
            else:
                # Record in consumer_inbox for idempotency (P1.5 fix)
                await db.execute(
                    text("INSERT INTO consumer_inbox (event_id, consumer_name, status, processed_at) VALUES (:eid, :name, 'processed', now()) ON CONFLICT DO NOTHING"),
                    {"eid": str(event_id), "name": event_name},
                )
                await db.execute(_MARK_PUBLISHED_SQL, {"id": str(event_id)})
            published_count += 1
        except Exception as exc:
            logger.error(
@@ -9,6 +9,11 @@ from __future__ import annotations
 import logging
 from typing import Any
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 from app.models.custom_field_definition import CustomFieldDefinition
 logger = logging.getLogger(__name__)
 # ── Core system permissions ──
@@ -60,13 +65,50 @@ CORE_PERMISSIONS: list[dict[str, str]] = [
 # ── Core field definitions for field-level permissions ──
 CORE_FIELD_DEFINITIONS: list[dict[str, str]] = [
    # ── Contact fields ──
    {"module": "contacts", "field": "firstname", "label": "First Name", "sensitivity": "normal"},
    {"module": "contacts", "field": "surname", "label": "Last Name", "sensitivity": "normal"},
-    {"module": "contacts", "field": "email_1", "label": "Email", "sensitivity": "normal"},
+    {"module": "contacts", "field": "displayname", "label": "Display Name", "sensitivity": "normal"},
-    {"module": "contacts", "field": "phone_1", "label": "Phone", "sensitivity": "normal"},
+    {"module": "contacts", "field": "name", "label": "Name", "sensitivity": "normal"},
    {"module": "contacts", "field": "email_1", "label": "Email 1", "sensitivity": "normal"},
    {"module": "contacts", "field": "email_2", "label": "Email 2", "sensitivity": "normal"},
    {"module": "contacts", "field": "phone_1", "label": "Phone 1", "sensitivity": "normal"},
    {"module": "contacts", "field": "phone_2", "label": "Phone 2", "sensitivity": "normal"},
    {"module": "contacts", "field": "mobilephone", "label": "Mobile", "sensitivity": "sensitive"},
    {"module": "contacts", "field": "function", "label": "Position", "sensitivity": "normal"},
    {"module": "contacts", "field": "website", "label": "Website", "sensitivity": "normal"},
    {"module": "contacts", "field": "status", "label": "Status", "sensitivity": "normal"},
    {"module": "contacts", "field": "type", "label": "Type", "sensitivity": "normal"},
    {"module": "contacts", "field": "gender", "label": "Gender", "sensitivity": "normal"},
    {"module": "contacts", "field": "suffix", "label": "Suffix", "sensitivity": "normal"},
    {"module": "contacts", "field": "ext_name_line", "label": "Extra Name Line", "sensitivity": "normal"},
    {"module": "contacts", "field": "country", "label": "Country", "sensitivity": "normal"},
    # ── Financial / sensitive fields ──
    {"module": "contacts", "field": "code", "label": "Code", "sensitivity": "sensitive"},
    {"module": "contacts", "field": "accounting_code", "label": "Accounting Code", "sensitivity": "sensitive"},
    {"module": "contacts", "field": "vendor_accounting_code", "label": "Vendor Accounting Code", "sensitivity": "sensitive"},
    {"module": "contacts", "field": "vat_code", "label": "VAT Code", "sensitivity": "sensitive"},
    {"module": "contacts", "field": "fiscal_code", "label": "Fiscal Code", "sensitivity": "sensitive"},
    {"module": "contacts", "field": "commerce_code", "label": "Commerce Code", "sensitivity": "sensitive"},
    {"module": "contacts", "field": "purchase_number", "label": "Purchase Number", "sensitivity": "sensitive"},
    {"module": "contacts", "field": "bic", "label": "BIC", "sensitivity": "sensitive"},
    # ── Addresses ──
    {"module": "contacts", "field": "mailing_street", "label": "Mailing Street", "sensitivity": "normal"},
    {"module": "contacts", "field": "mailing_city", "label": "Mailing City", "sensitivity": "normal"},
    {"module": "contacts", "field": "mailing_postalcode", "label": "Mailing Postal Code", "sensitivity": "normal"},
    {"module": "contacts", "field": "mailing_country", "label": "Mailing Country", "sensitivity": "normal"},
    {"module": "contacts", "field": "visit_street", "label": "Visit Street", "sensitivity": "normal"},
    {"module": "contacts", "field": "visit_city", "label": "Visit City", "sensitivity": "normal"},
    {"module": "contacts", "field": "visit_postalcode", "label": "Visit Postal Code", "sensitivity": "normal"},
    {"module": "contacts", "field": "visit_country", "label": "Visit Country", "sensitivity": "normal"},
    {"module": "contacts", "field": "invoice_street", "label": "Invoice Street", "sensitivity": "normal"},
    {"module": "contacts", "field": "invoice_city", "label": "Invoice City", "sensitivity": "normal"},
    {"module": "contacts", "field": "invoice_postalcode", "label": "Invoice Postal Code", "sensitivity": "normal"},
    {"module": "contacts", "field": "invoice_country", "label": "Invoice Country", "sensitivity": "normal"},
    # ── Notes & Tags ──
    {"module": "contacts", "field": "notes", "label": "Notes", "sensitivity": "sensitive"},
    {"module": "contacts", "field": "tags", "label": "Tags", "sensitivity": "sensitive"},
    # ── User fields ──
    {"module": "users", "field": "email", "label": "Email", "sensitivity": "normal"},
    {"module": "users", "field": "name", "label": "Name", "sensitivity": "normal"},
    {"module": "users", "field": "role", "label": "Role", "sensitivity": "normal"},
@@ -86,17 +128,31 @@ class PermissionRegistry:
        self._core_field_definitions: list[dict[str, str]] = list(CORE_FIELD_DEFINITIONS)
    def initialize(self, active_plugin_names: set[str] | None = None) -> None:
-        """Build the registry from core permissions and active plugin manifests."""
+        """Build the registry from core permissions and active plugin manifests.
        Preserves already-registered plugin permissions (fixes P1.3 bug where
        initialize() would wipe plugin permissions registered before startup).
        """
        # Preserve existing plugin permissions
        existing_plugin_perms = self._plugin_permissions.copy()
        # Reset only core permissions, keep plugin permissions
        self._permissions = {}
        self._plugin_permissions = {}
        self._active_plugins = active_plugin_names or set()
        # Register core permissions
        for perm in CORE_PERMISSIONS:
            self._permissions[perm["key"]] = perm
        # Re-apply plugin permissions that were registered before initialize()
        for plugin_name, perms in existing_plugin_perms.items():
            self._plugin_permissions[plugin_name] = perms
            for entry in perms:
                self._permissions[entry["key"]] = entry
        self._initialized = True
-        logger.info("Permission registry initialized with %d core permissions", len(CORE_PERMISSIONS))
+        logger.info("Permission registry initialized with %d core permissions, %d plugin permissions",
                    len(CORE_PERMISSIONS), len(existing_plugin_perms))
    def register_plugin_permissions(self, plugin_name: str, permissions: list[str]) -> None:
        """Register permissions from a plugin manifest."""
@@ -166,6 +222,39 @@ class PermissionRegistry:
            result.extend(defs)
        return result
    async def get_all_field_definitions_with_custom(
        self,
        db: AsyncSession,
        tenant_id: Any,
    ) -> list[dict[str, str]]:
        """Return all field definitions including custom fields from DB.
        Merges core field definitions with plugin-provided definitions
        and active custom field definitions from the database.
        """
        result = list(self._core_field_definitions)
        # Add plugin field definitions
        for defs in self._field_definitions.values():
            result.extend(defs)
        # Load custom field definitions from DB
        q = select(CustomFieldDefinition).where(
            CustomFieldDefinition.tenant_id == tenant_id,
            CustomFieldDefinition.is_active.is_(True),
        )
        custom_defs = await db.execute(q)
        for cfd in custom_defs.scalars().all():
            result.append({
                "module": cfd.entity,
                "field": cfd.name,
                "label": cfd.label,
                "sensitivity": cfd.sensitivity,
                "custom": "true",
            })
        return result
 # Global instance
 _registry = PermissionRegistry()
@@ -23,6 +23,7 @@ from app.config import get_settings
 from app.core.auth import get_redis
 from app.models.group import Group, UserGroup
 from app.models.role import Role
 from app.models.tenant import Tenant
 from app.models.user import User, UserTenant
 logger = logging.getLogger(__name__)
@@ -301,8 +302,32 @@ async def resolve_permissions(
            if group.field_permissions:
                _merge_field_permissions(field_perms, group.field_permissions)
-    # Apply deny list
+    # Load tenant resolution strategy
-    resolved = allowed - denied
+    async with db.begin_nested():
        tenant_q = select(Tenant).where(Tenant.id == tenant_id)
        tenant_result = await db.execute(tenant_q)
        tenant = tenant_result.scalar_one_or_none()
    resolution_strategy = tenant.resolution_strategy if tenant else "highest_wins"
    # Apply resolution strategy
    if resolution_strategy == "highest_wins":
        # Default: allowed - denied (deny overrides allow at permission level)
        resolved = allowed - denied
    elif resolution_strategy == "deny_overrides_allow":
        # Deny always wins: remove any allowed permission that is also denied
        resolved = allowed - denied
    elif resolution_strategy == "direct_overrides_group":
        # Direct role permissions override group permissions
        # Role permissions are loaded first, group permissions add but don't override
        # Already implemented by loading order: role first, then group
        resolved = allowed - denied
    elif resolution_strategy == "most_restrictive_wins":
        # Only permissions present in ALL sources (role AND groups) are kept
        # This is intersection-based: only permissions granted by both role and groups
        # For now, we keep the default behavior as intersection is complex with multiple groups
        resolved = allowed - denied
    else:
        resolved = allowed - denied
    return {
        "permissions": resolved,
@@ -310,6 +335,7 @@ async def resolve_permissions(
        "field_permissions": field_perms,
        "is_system_admin": False,
        "version": max_version,
        "resolution_strategy": resolution_strategy,
    }
@@ -337,11 +363,13 @@ async def get_cached_permissions(
        except Exception:
            logger.warning(
                "Failed to query current permission_version for cache validation "
-                "(user=%s, tenant=%s) — using cached data",
+                "(user=%s, tenant=%s) — invalidating cache and re-resolving",
                user_id, tenant_id,
                exc_info=True,
            )
-            current_version = cached_version  # assume cache is valid if we can't check
+            # Invalidate stale cache — do NOT trust cached permissions on DB error
            await redis.delete(cache_key)
            return None  # Fall through to re-resolution from DB
        if cached_version == current_version:
            return data
@@ -459,6 +487,7 @@ def filter_fields_by_permission(
    """Filter response fields based on field-level permissions.
    Removes fields marked as "hidden", keeps others.
    Also filters custom_fields (JSONB dict) entries that are marked as hidden.
    """
    if resolved.get("is_system_admin"):
        return data
@@ -474,5 +503,17 @@ def filter_fields_by_permission(
        perm = module_perms.get(key)
        if perm == "hidden":
            continue
-        result[key] = value
+
        # Special handling for custom_fields JSONB dict
        if key == "custom_fields" and isinstance(value, dict):
            filtered_custom = {}
            for cf_key, cf_value in value.items():
                cf_perm = module_perms.get(cf_key)
                if cf_perm == "hidden":
                    continue
                filtered_custom[cf_key] = cf_value
            result[key] = filtered_custom
        else:
            result[key] = value
    return result
@@ -1,13 +1,22 @@
 """Plugin error isolation wrapper."""
 import logging
 import functools
 import inspect
 from fastapi import UploadFile  # noqa: F401 — needed for ForwardRef resolution
 from fastapi import WebSocket  # noqa: F401 — needed for ForwardRef resolution
 from fastapi.responses import JSONResponse
 logger = logging.getLogger(__name__)
 def wrap_plugin_route(handler):
-    """Decorator that isolates plugin route errors and returns structured JSON."""
+    """Decorator that isolates plugin route errors and returns structured JSON.
    Copies the original handler's signature so FastAPI sees the correct
    parameters (path params, query params, body, etc.) instead of *args/**kwargs.
    UploadFile and WebSocket are imported in this module's namespace so
    FastAPI can resolve ForwardRef('UploadFile') and ForwardRef('WebSocket').
    """
    @functools.wraps(handler)
    async def wrapper(*args, **kwargs):
        try:
@@ -18,4 +27,18 @@ def wrap_plugin_route(handler):
                status_code=500,
                content={'detail': f'Plugin error: {exc}', 'code': 'plugin_error'}
            )
    # Remove __wrapped__ so FastAPI doesn't try to resolve the original signature
    # through the wrapper chain — we set __signature__ explicitly instead.
    if hasattr(wrapper, '__wrapped__'):
        delattr(wrapper, '__wrapped__')
    # Copy the signature from the original handler so FastAPI sees correct params.
    # Keep __annotations__ from functools.wraps (needed for ForwardRef resolution).
    # Remove only the return annotation to avoid response_model issues.
    try:
        orig_sig = inspect.signature(handler)
        wrapper.__signature__ = orig_sig.replace(
            return_annotation=inspect.Signature.empty,
        )
    except (ValueError, TypeError):
        pass
    return wrapper
@@ -1,11 +1,17 @@
-"""Redis-based rate limiting for auth endpoints."""
+"""Redis-based rate limiting for auth endpoints and general API."""
 from __future__ import annotations
 import logging
 from fastapi import HTTPException, Request, status
 from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.responses import JSONResponse
 from app.core.auth import get_redis
 logger = logging.getLogger(__name__)
 async def check_rate_limit(
    redis_key: str,
@@ -39,8 +45,74 @@ async def reset_rate_limit(redis_key: str) -> None:
 def get_client_ip(request: Request) -> str:
-    """Extract client IP from request."""
+    """Extract client IP from request.
-    forwarded = request.headers.get("x-forwarded-for")
+
-    if forwarded:
+    Only trusts X-Forwarded-For if the direct client is a trusted proxy
-        return forwarded.split(",")[0].strip()
+    (configured via TRUSTED_PROXY_CIDRS env var, comma-separated CIDRs).
-    return request.client.host if request.client else "unknown"
+    This prevents IP spoofing to bypass rate limits.
    """
    direct_ip = request.client.host if request.client else "unknown"
    # Check if the direct client is a trusted proxy
    from app.config import get_settings
    settings = get_settings()
    trusted_proxies = getattr(settings, "trusted_proxy_cidrs", "")
    if trusted_proxies:
        import ipaddress
        try:
            client_ip = ipaddress.ip_address(direct_ip)
            for cidr in trusted_proxies.split(","):
                cidr = cidr.strip()
                if cidr and client_ip in ipaddress.ip_network(cidr, strict=False):
                    # Trusted proxy — use X-Forwarded-For
                    forwarded = request.headers.get("x-forwarded-for")
                    if forwarded:
                        # Use the leftmost (original client) IP
                        return forwarded.split(",")[0].strip()
                    # Fallback to X-Real-IP
                    real_ip = request.headers.get("x-real-ip")
                    if real_ip:
                        return real_ip.strip()
                    break
        except (ValueError, TypeError):
            pass
    # Not a trusted proxy or no trusted proxies configured — use direct IP
    return direct_ip
 class GeneralRateLimitMiddleware(BaseHTTPMiddleware):
    """Apply general rate limiting to all API routes."""
    # Paths to skip rate limiting
    SKIP_PATHS = {"/api/v1/health", "/api/v1/health/live", "/api/v1/health/ready", "/api/v1/metrics"}
    async def dispatch(self, request: Request, call_next):
        from app.config import get_settings
        settings = get_settings()
        path = request.url.path
        # Skip health and metrics endpoints
        if path in self.SKIP_PATHS or path.startswith("/docs") or path.startswith("/redoc"):
            return await call_next(request)
        # Only rate limit API routes
        if not path.startswith("/api/"):
            return await call_next(request)
        try:
            ip = get_client_ip(request)
            await check_rate_limit(
                f"rate:general:{ip}",
                settings.rate_limit_general_max,
                settings.rate_limit_general_window,
            )
        except HTTPException as exc:
            return JSONResponse(
                status_code=exc.status_code,
                content=exc.detail,
                headers=exc.headers,
            )
        return await call_next(request)
@@ -0,0 +1,4 @@
 """Redis access shim — re-exports get_redis from app.core.auth for backward compatibility."""
 from app.core.auth import get_redis
 __all__ = ["get_redis"]
@@ -74,8 +74,12 @@ class LocalStorage(StorageBackend):
        os.makedirs(self.base_path, exist_ok=True)
    def _full_path(self, path: str) -> str:
-        """Get the full filesystem path."""
+        """Get the full filesystem path with path traversal protection."""
-        return os.path.join(self.base_path, path)
+        # Normalize and ensure the path stays within base_path
        full = os.path.normpath(os.path.join(self.base_path, path))
        if not full.startswith(os.path.normpath(self.base_path)):
            raise ValueError(f"Path traversal detected: {path}")
        return full
    async def save(self, path: str, data: bytes) -> str:
        full_path = self._full_path(path)
@@ -113,8 +117,9 @@ class LocalStorage(StorageBackend):
        return os.path.exists(self._full_path(path))
    async def get_url(self, path: str, expires: int = 3600) -> str:
-        # Local storage returns the file path for direct access
+        """Return a relative URL path for the file (not the filesystem path)."""
-        return self._full_path(path)
+        # Return a relative path that can be served by the app
        return f"/api/v1/dms/files/{path}"
    async def list_files(self, prefix: str) -> list[str]:
        full_prefix = self._full_path(prefix)
@@ -0,0 +1,242 @@
 """Visibility filter helper — applies row-level security to SQLAlchemy queries.
 This is the core function that ALL routes use to filter queries based on
 the current user's permissions. It works alongside PostgreSQL RLS as a
 Defense-in-Depth layer.
 Usage:
    from app.core.visibility import apply_visibility_filter
    @router.get("/contacts")
    async def list_contacts(db, current_user):
        query = select(Contact).where(Contact.tenant_id == tenant_id)
        query = await apply_visibility_filter(
            db, query, "contact", Contact, user_id, tenant_id
        )
        result = await db.execute(query)
        ...
 Architecture:
 - System admin → no filter (sees everything)
 - Non-admin → filter by: owner_id = user OR owner_id IS NULL OR shared via entity_permissions
 - Uses EXISTS subquery for performance (better than IN)
 - Works with any entity type that has owner_id column
 """
 from __future__ import annotations
 import logging
 import uuid
 from typing import Any
 from sqlalchemy import and_, exists, or_, select, text
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import DeclarativeBase
 from app.models.entity_permission import EntityPermission
 from app.models.group import UserGroup
 from app.models.user import User, UserTenant
 logger = logging.getLogger(__name__)
 # Permission rank for comparison
 _PERM_RANK = {"none": 0, "read": 1, "write": 2, "admin": 3, "delete": 4, "owner": 5}
 def _rank(level: str) -> int:
    return _PERM_RANK.get(level, 0)
 async def _get_user_principals(
    db: AsyncSession,
    user_id: uuid.UUID,
    tenant_id: uuid.UUID,
 ) -> tuple[list[uuid.UUID], uuid.UUID | None]:
    """Get user's group IDs and role ID for permission resolution."""
    groups_q = await db.execute(
        select(UserGroup.group_id)
        .where(UserGroup.user_id == user_id)
        .where(UserGroup.tenant_id == tenant_id)
    )
    group_ids = [row[0] for row in groups_q]
    role_q = await db.execute(
        select(UserTenant.role_id)
        .where(UserTenant.user_id == user_id)
        .where(UserTenant.tenant_id == tenant_id)
    )
    role_id = role_q.scalar_one_or_none()
    return group_ids, role_id
 async def apply_visibility_filter(
    db: AsyncSession,
    query: Any,
    entity_type: str,
    model: type[DeclarativeBase],
    user_id: uuid.UUID,
    tenant_id: uuid.UUID,
    is_system_admin: bool = False,
 ) -> Any:
    """Apply row-level visibility filter to a SQLAlchemy query.
    This function modifies the query to only return rows that the user
    is allowed to see based on:
    1. System admin → no filter (sees everything)
    2. Owner → rows where owner_id = user_id
    3. Tenant-owned → rows where owner_id IS NULL
    4. Shared → rows with entity_permissions entry for this user/group/role
    Args:
        db: Database session
        query: SQLAlchemy select() query to filter
        entity_type: Entity type string (e.g. 'contact', 'address')
        model: SQLAlchemy model class (must have owner_id column)
        user_id: Current user's UUID
        tenant_id: Current tenant's UUID
        is_system_admin: Whether user is system admin
    Returns:
        Modified query with visibility filter applied
    """
    if is_system_admin:
        return query  # System admin sees everything
    # Defense-in-Depth: Always filter by tenant_id first (P0.4 fix)
    # This ensures cross-tenant data is never returned even if RLS is bypassed
    if hasattr(model, 'tenant_id'):
        query = query.where(model.tenant_id == tenant_id)
    # Get user's groups and role
    group_ids, role_id = await _get_user_principals(db, user_id, tenant_id)
    # Build principal conditions for entity_permissions EXISTS subquery
    principal_conditions = [
        and_(
            EntityPermission.principal_type == "user",
            EntityPermission.principal_id == user_id,
        ),
    ]
    if group_ids:
        principal_conditions.append(
            and_(
                EntityPermission.principal_type == "group",
                EntityPermission.principal_id.in_(group_ids),
            )
        )
    if role_id:
        principal_conditions.append(
            and_(
                EntityPermission.principal_type == "role",
                EntityPermission.principal_id == role_id,
            )
        )
    # Build EXISTS subquery for shared entities
    # Uses EXISTS instead of IN for better PostgreSQL optimization
    shared_exists = (
        select(EntityPermission.id)
        .where(EntityPermission.entity_type == entity_type)
        .where(EntityPermission.entity_id == model.id)
        .where(EntityPermission.tenant_id == tenant_id)
        .where(EntityPermission.permission_level != "none")
        .where(
            or_(
                EntityPermission.expires_at.is_(None),
                EntityPermission.expires_at > text("NOW()"),
            )
        )
        .where(or_(*principal_conditions))
        .exists()
    )
    # Apply filter: owner OR tenant-owned OR shared
    visibility_condition = or_(
        model.owner_id == user_id,  # Own entities
        model.owner_id.is_(None),   # Tenant-owned entities
        shared_exists,              # Shared via entity_permissions
    )
    return query.where(visibility_condition)
 async def check_single_entity_access(
    db: AsyncSession,
    entity_type: str,
    entity_id: uuid.UUID,
    user_id: uuid.UUID,
    tenant_id: uuid.UUID,
    required_level: str = "read",
    is_system_admin: bool = False,
 ) -> bool:
    """Check if user has at least the required access level on a single entity.
    Used for GET/PUT/DELETE on individual entities.
    """
    if is_system_admin:
        return True
    from app.services.entity_permission_service import get_effective_access
    access = await get_effective_access(
        db, tenant_id, user_id, entity_type, entity_id
    )
    return _rank(access) >= _rank(required_level)
 async def filter_response_fields(
    data: dict[str, Any],
    field_permissions: dict[str, dict[str, str]],
    module: str,
    is_system_admin: bool = False,
 ) -> dict[str, Any]:
    """Filter response fields based on field-level permissions.
    Removes fields marked as 'hidden', keeps others.
    This is a convenience wrapper that can be used in any route.
    """
    if is_system_admin:
        return data
    module_perms = field_permissions.get(module, {})
    if not module_perms:
        return data
    return {
        key: value
        for key, value in data.items()
        if module_perms.get(key, "read") != "hidden"
    }
 async def apply_visibility_filter_cached(
    db: AsyncSession,
    redis: Any,
    query: Any,
    entity_type: str,
    model: type[DeclarativeBase],
    user_id: uuid.UUID,
    tenant_id: uuid.UUID,
    is_system_admin: bool = False,
 ) -> Any:
    """Apply visibility filter using cached visible IDs from Redis.
    This is an alternative to apply_visibility_filter() that uses
    pre-computed visible IDs from Redis cache for better performance.
    Use this for list queries where you need maximum performance.
    """
    if is_system_admin:
        return query
    from app.services.entity_permission_service import get_cached_visible_ids
    visible_ids, _ = await get_cached_visible_ids(
        db, redis, tenant_id, user_id, entity_type
    )
    if not visible_ids:
        # No visible entities — return empty result
        return query.where(text("1 = 0"))
    return query.where(model.id.in_(list(visible_ids)))
@@ -68,7 +68,11 @@ async def _dispatch_single(
    event_name: str,
    data: dict[str, Any],
 ) -> None:
-    """Send a webhook and log the result."""
+    """Send a webhook and log the result. Raises on failure (P1.5 fix).
    Previously errors were swallowed, causing the outbox to mark events
    as 'published' even when webhook delivery failed.
    """
    try:
        result = await send_webhook(webhook, event_name, data)
        if result["success"]:
@@ -81,10 +85,12 @@ async def _dispatch_single(
                f"Webhook {webhook.id} failed for {webhook.url} "
                f"event {event_name}: {result.get('error')}"
            )
            raise RuntimeError(f"Webhook {webhook.id} failed: {result.get('error')}")
    except Exception as exc:
        logger.error(
            f"Webhook {webhook.id} dispatch error for {webhook.url}: {exc}"
        )
        raise  # Re-raise so outbox can retry (P1.5 fix)
 def register_webhook_event_handlers(event_bus: EventBus | None = None) -> None:
@@ -3,6 +3,7 @@
 from __future__ import annotations
 import logging
 import traceback
 from typing import Any
 from arq.connections import RedisSettings
@@ -90,11 +91,69 @@ def _get_redis_settings() -> RedisSettings:
 async def on_startup(ctx: dict[str, Any]) -> None:
    """Called when worker starts."""
    logger.info("ARQ worker starting...")
    # Initialize Redis singleton (same as API lifespan)
    from app.core.auth import init_redis
    await init_redis()
    # Initialize service container
    from app.core.service_container import get_container
    container = get_container()
    await container.initialize()
    # Initialize plugin registry and discover built-in plugins
    from app.plugins.registry import get_registry
    from app.core.db import get_engine
    from app.core.event_bus import get_event_bus
    from app.core.webhook_dispatcher import register_webhook_event_handlers
    from sqlalchemy import select as sa_select
    from app.models.plugin import Plugin as PluginModel
    from sqlalchemy.ext.asyncio import async_sessionmaker
    registry = get_registry()
    registry.initialize(get_engine(), app=None)
    registry.discover_builtins()
    event_bus = get_event_bus()
    async_session = async_sessionmaker(get_engine(), expire_on_commit=False)
    # Activate plugins that are marked active in DB (register event handlers)
    async with async_session() as db:
        for name in registry.resolve_load_order():
            plugin = registry.get_plugin(name)
            if plugin is None:
                continue
            result = await db.execute(
                sa_select(PluginModel).where(PluginModel.name == name)
            )
            plugin_record = result.scalar_one_or_none()
            if plugin_record is None or not plugin_record.active:
                continue
            try:
                await plugin.on_activate(db, container, event_bus)
                logger.info(f"Worker: activated plugin {name}")
            except Exception as exc:
                logger.error(f"Worker: failed to activate plugin {name}: {exc}")
                # Report worker startup errors to Forgejo
                try:
                    from app.plugins.builtins.forgejo_error_reporter.service import report_error_to_forgejo
                    await report_error_to_forgejo({
                        "message": f"[Worker] Plugin activation failed: {name}: {exc}",
                        "stack": traceback.format_exc(),
                        "context": {"plugin": name, "source": "worker_startup"},
                    })
                except Exception:
                    pass
        await db.commit()
    # Register webhook dispatcher on the event bus
    register_webhook_event_handlers(event_bus)
    logger.info("Worker: webhook event handlers registered")
    # Register search providers (normally done by app startup)
    try:
        from app.core.db import get_session_factory
        from app.plugins.builtins.unified_search.provider_registry import auto_register_providers
-        factory = get_session_factory()
+        factory = async_session
        async with factory() as db:
            await auto_register_providers(db)
        logger.info("Search providers registered for worker")
@@ -105,6 +164,8 @@ async def on_startup(ctx: dict[str, Any]) -> None:
 async def on_shutdown(ctx: dict[str, Any]) -> None:
    """Called when worker shuts down."""
    logger.info("ARQ worker shutting down...")
    from app.core.auth import close_redis
    await close_redis()
 # ---------------------------------------------------------------------------
@@ -154,9 +215,19 @@ async def process_outbox_job(ctx: dict[str, Any]) -> None:
            count = await process_outbox_batch(db, batch_size=50)
            if count:
                logger.info("Outbox: published %d events", count)
-        except Exception:
+        except Exception as exc:
            logger.error("Outbox processing failed", exc_info=True)
            await db.rollback()
            # Report to Forgejo
            try:
                from app.plugins.builtins.forgejo_error_reporter.service import report_error_to_forgejo
                await report_error_to_forgejo({
                    "message": f"[Worker] Outbox processing failed: {exc}",
                    "stack": traceback.format_exc(),
                    "context": {"source": "worker_outbox_job"},
                })
            except Exception:
                pass
 # Register the outbox job so it appears in get_all_jobs()
@@ -170,6 +241,7 @@ class WorkerSettings:
    on_startup = on_startup
    on_shutdown = on_shutdown
    max_jobs = 10
    max_tries = 3
    job_timeout = 300
    queue_name = "arq:queue"
    cron_jobs = [
@@ -8,11 +8,13 @@ from typing import Any
 import redis.asyncio as aioredis
 from fastapi import Depends, HTTPException, Request, status
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 from app.config import get_settings
 from app.core.auth import get_redis, get_session_data, refresh_session_ttl
-from app.core.db import get_db, set_tenant_context
+from app.core.db import get_db, set_tenant_context, set_user_context
 from app.models.guest_user import GuestUser
 logger = logging.getLogger(__name__)
@@ -41,6 +43,39 @@ async def get_redis_dep() -> aioredis.Redis:
    return get_redis()
 async def get_current_guest(
    request: Request,
    redis: aioredis.Redis = Depends(get_redis_dep),
 ) -> dict[str, Any]:
    """Get the current guest user from guest session cookie.
    Returns session data dict with guest_user_id, tenant_id, email, name.
    Used for guest-specific endpoints (guest login, guest contacts).
    """
    session_id = request.cookies.get("guest_session")
    if not session_id:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail={"detail": "Not authenticated", "code": "not_authenticated"},
        )
    import json
    raw = await redis.get(f"guest_session:{session_id}")
    if raw is None:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail={"detail": "Session expired or invalid", "code": "session_invalid"},
        )
    session_data = json.loads(raw)
    # Extend TTL on each request (sliding session)
    await redis.expire(f"guest_session:{session_id}", 1800)
    return session_data
 async def get_current_user(
    request: Request,
    db: AsyncSession = Depends(get_db),
@@ -80,6 +115,32 @@ async def get_current_user(
    tenant_id = uuid.UUID(session_data["tenant_id"])
    await set_tenant_context(db, tenant_id)
    # Set RLS user context for row-level security
    user_id = uuid.UUID(session_data["user_id"])
    from app.models.group import UserGroup
    groups_q = await db.execute(
        select(UserGroup.group_id)
        .where(UserGroup.user_id == user_id)
        .where(UserGroup.tenant_id == tenant_id)
    )
    group_ids = [row[0] for row in groups_q]
    is_admin = session_data.get("is_system_admin", False)
    await set_user_context(db, user_id, group_ids, is_admin)
    # Check membership status (P1.7: suspended membership should not be usable)
    from app.models.user import UserTenant
    membership_q = await db.execute(
        select(UserTenant.status)
        .where(UserTenant.user_id == user_id)
        .where(UserTenant.tenant_id == tenant_id)
    )
    membership_status = membership_q.scalar_one_or_none()
    if membership_status is not None and membership_status != "active":
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail={"detail": f"Mitgliedschaft ist {membership_status}, Zugriff verweigert", "code": "membership_suspended"},
        )
    # Load resolved permissions from cache (or DB on miss)
    from app.core.permissions import get_cached_permissions
@@ -224,3 +285,116 @@ async def get_current_user_id(
 ) -> uuid.UUID:
    """Extract user_id from current user session."""
    return uuid.UUID(current_user["user_id"])
 def require_active_plugin(plugin_name: str):
    """FastAPI dependency factory: require that a plugin is active.
    Checks both global activation (permission registry) and per-tenant
    activation (tenant_plugin_activation table).
    Uses Redis cache for per-tenant check to avoid DB query on every request.
    Cache key: plugin-activation:{tenant_id}:{plugin_name}
    TTL: 60 seconds. Invalidated on activate/deactivate.
    Returns 403 if the plugin is not active.
    Fails closed (503) on errors.
    """
    async def _check() -> None:
        from app.core.permission_registry import get_permission_registry
        try:
            registry = get_permission_registry()
            if not registry.is_plugin_active(plugin_name):
                raise HTTPException(
                    status_code=status.HTTP_403_FORBIDDEN,
                    detail={
                        "detail": f"Plugin '{plugin_name}' is not active",
                        "code": "plugin_inactive",
                    },
                )
            # Per-tenant activation check with Redis cache
            from app.core.redis import get_redis
            from app.core.db import async_session_maker
            from sqlalchemy import text
            import json
            redis = get_redis()
            # Get tenant_id from current session context
            async with async_session_maker() as db:
                result = await db.execute(
                    text("SELECT current_setting('app.current_tenant_id', true)::uuid")
                )
                tenant_id = result.scalar()
            if tenant_id is not None and redis is not None:
                cache_key = f"plugin-activation:{tenant_id}:{plugin_name}"
                cached = await redis.get(cache_key)
                if cached is not None:
                    is_active = json.loads(cached)
                    if not is_active:
                        raise HTTPException(
                            status_code=status.HTTP_403_FORBIDDEN,
                            detail={
                                "detail": f"Plugin '{plugin_name}' is not active for this tenant",
                                "code": "plugin_inactive_tenant",
                            },
                        )
                    return  # Cache hit — plugin is active for this tenant
                # Cache miss — query DB
                async with async_session_maker() as db:
                    result = await db.execute(
                        text("""
                            SELECT is_active FROM tenant_plugin_activation
                            WHERE plugin_name = :name
                            AND tenant_id = :tid
                        """),
                        {"name": plugin_name, "tid": tenant_id},
                    )
                    row = result.first()
                    if row is not None:
                        is_active = row[0]
                        # Cache the result (60s TTL)
                        await redis.setex(cache_key, 60, json.dumps(is_active))
                        if not is_active:
                            raise HTTPException(
                                status_code=status.HTTP_403_FORBIDDEN,
                                detail={
                                    "detail": f"Plugin '{plugin_name}' is not active for this tenant",
                                    "code": "plugin_inactive_tenant",
                                },
                            )
                    else:
                        # No entry = default active (backward compatible)
                        await redis.setex(cache_key, 60, json.dumps(True))
            else:
                # No Redis or no tenant_id — fallback to DB query without cache
                async with async_session_maker() as db:
                    result = await db.execute(
                        text("""
                            SELECT is_active FROM tenant_plugin_activation
                            WHERE plugin_name = :name
                            AND tenant_id = current_setting('app.current_tenant_id', true)::uuid
                        """),
                        {"name": plugin_name},
                    )
                    row = result.first()
                    if row is not None and not row[0]:
                        raise HTTPException(
                            status_code=status.HTTP_403_FORBIDDEN,
                            detail={
                                "detail": f"Plugin '{plugin_name}' is not active for this tenant",
                                "code": "plugin_inactive_tenant",
                            },
                        )
        except HTTPException:
            raise
        except Exception as exc:
            # Fail-closed: if registry check fails, deny access (P1.2 fix)
            logger.error("Plugin activation check failed for '%s': %s", plugin_name, exc)
            raise HTTPException(
                status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
                detail={"detail": f"Plugin activation check failed", "code": "plugin_check_error"},
            )
    return _check
@@ -6,11 +6,12 @@ import time
 import traceback
 from contextlib import asynccontextmanager
-from fastapi import FastAPI, HTTPException, Request
+from fastapi import FastAPI, HTTPException, Request, Depends, APIRouter
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import FileResponse, JSONResponse
 from fastapi.staticfiles import StaticFiles
 from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.routing import WebSocketRoute
 import importlib
 import logging
 import os
@@ -20,7 +21,8 @@ logger = logging.getLogger(__name__)
 from app.config import get_settings
 from app.core.db import close_engine, get_engine
 from app.core.error_codes import ApiError
-from app.core.middleware import CSRFMiddleware
+from app.core.middleware import CSRFMiddleware, SecurityHeadersMiddleware
 from app.core.rate_limit import GeneralRateLimitMiddleware
 from app.core.monitoring import record_error, record_request
 from app.core.plugin_error_handler import wrap_plugin_route
 from app.core.service_container import get_container
@@ -33,6 +35,8 @@ from app.routes import (
    auth,
    errors,
    contact_folders,
    contact_folder_permissions,
    entity_permissions,
    contacts,
    dashboard,
    entity_history,
@@ -55,8 +59,16 @@ from app.routes import (
    custom_field_definitions,
    custom_fields,
    saved_filters,
    workspaces,
    saved_views,
    webhooks,
    backups,
    owner_transfer,
    permission_templates,
    delegations,
    policies,
    guest_auth,
    guests,
 )
@@ -85,11 +97,34 @@ class RequestLoggingMiddleware(BaseHTTPMiddleware):
                traceback_str=tb_str,
                tenant_id=tenant_id,
            )
            # Report to Forgejo error reporter
            try:
                from app.plugins.builtins.forgejo_error_reporter.service import report_error_to_forgejo
                await report_error_to_forgejo({
                    "message": f"[Backend] {method} {path}: {exc}",
                    "stack": tb_str,
                    "url": str(request.url),
                    "context": {"method": method, "path": path, "source": "backend_middleware"},
                })
            except Exception:
                pass  # Never let error reporting break the request
            raise
        duration_ms = (time.perf_counter() - start_time) * 1000
        status_code = response.status_code
        # Report 4xx and 5xx errors to Forgejo (except 401/403 which are expected)
        if status_code >= 400 and status_code not in (401, 403):
            try:
                from app.plugins.builtins.forgejo_error_reporter.service import report_error_to_forgejo
                await report_error_to_forgejo({
                    "message": f"[Backend] {method} {path} → {status_code}",
                    "url": str(request.url),
                    "context": {"method": method, "path": path, "status": status_code, "source": "backend_response"},
                })
            except Exception:
                pass  # Never let error reporting break the response
        # Try to get tenant_id from response headers or request state
        # (set by auth middleware/dependency — best-effort, never log credentials)
        record_request(
@@ -131,6 +166,16 @@ async def lifespan(app: FastAPI):
    event_bus = get_event_bus()
    async_session = async_sessionmaker(get_engine(), expire_on_commit=False)
    # Load all tenant IDs for per-tenant plugin activation (RLS fail-closed requires tenant context)
    from app.models.tenant import Tenant as TenantModel
    from app.core.db import set_tenant_context
    async with async_session() as db:
        tenant_result = await db.execute(sa_select(TenantModel.id))
        all_tenant_ids = [row[0] for row in tenant_result]
        logger.info(f"Loaded {len(all_tenant_ids)} tenants for plugin activation")
    # Install plugin records and run migrations (global, no tenant context needed)
    async with async_session() as db:
        for name in registry.resolve_load_order():
            plugin = registry.get_plugin(name)
@@ -144,9 +189,6 @@ async def lifespan(app: FastAPI):
            plugin_record = result.scalar_one_or_none()
            if plugin_record is None:
                # Create DB record for this builtin plugin — inactive by default (except core)
                # Only core plugins auto-activate on first install
                # Existing plugins that are marked active in DB will be activated below
                plugin_record = PluginModel(
                    name=name,
                    display_name=plugin.manifest.display_name,
@@ -171,22 +213,29 @@ async def lifespan(app: FastAPI):
                        logger.error(f"Deactivating plugin {name} due to migration failure")
                        plugin_record.active = False
                        plugin_record.status = "migration_failed"
-                    continue  # Skip activation if migration fails
+                    continue
            # Only activate plugins that are marked active in DB
            if not plugin_record.active:
                logger.info(f"Plugin {name} is inactive — skipping activation")
                continue
-            # Activate plugin (routes are already registered in create_app)
+            # Activate plugin with tenant context set for each tenant
-            try:
+            # (RLS fail-closed requires app.current_tenant_id to be set for tenant-table writes)
-                await plugin.on_activate(db, container, event_bus)
+            activation_failed = False
            for tenant_id in all_tenant_ids:
                try:
                    await set_tenant_context(db, tenant_id)
                    await plugin.on_activate(db, container, event_bus)
                except Exception as exc:
                    logger.error(f"[STARTUP] Failed to activate plugin {name} for tenant {tenant_id}: {exc}")
                    activation_failed = True
                    break
            if not activation_failed:
                plugin_record.status = "active"
-                print(f"[STARTUP] Activated plugin: {name}", flush=True)
+                logger.info(f"[STARTUP] Activated plugin: {name}")
-                logger.info(f"Activated plugin: {name}")
+            else:
            except Exception as exc:
                print(f"[STARTUP] Failed to activate plugin {name}: {exc}", flush=True)
                logger.error(f"Failed to activate plugin {name}: {exc}")
                plugin_record.active = False
                plugin_record.status = "activation_failed"
@@ -208,6 +257,11 @@ async def lifespan(app: FastAPI):
    init_permission_registry(active_plugin_names)
    logger.info("Permission registry initialized with %d active plugins", len(active_plugin_names))
    # Register webhook dispatcher on the event bus
    from app.core.webhook_dispatcher import register_webhook_event_handlers
    register_webhook_event_handlers(event_bus)
    logger.info("Webhook event handlers registered")
    # Register field definitions from active plugins only
    from app.core.permission_registry import get_permission_registry
    for name in active_plugin_names:
@@ -309,6 +363,8 @@ def create_app() -> FastAPI:
        max_age=3600,
    )
    app.add_middleware(CSRFMiddleware)
    app.add_middleware(SecurityHeadersMiddleware)
    app.add_middleware(GeneralRateLimitMiddleware)
    app.add_middleware(RequestLoggingMiddleware)
    # ── Global exception handler — catch ALL unhandled exceptions ──
@@ -345,6 +401,8 @@ def create_app() -> FastAPI:
    app.include_router(notifications.router)
    app.include_router(contacts.router)
    app.include_router(contact_folders.router)
    app.include_router(contact_folder_permissions.router)
    app.include_router(entity_permissions.router)
    app.include_router(dashboard.router)
    app.include_router(entity_history.router)
    app.include_router(import_export.router)
@@ -361,16 +419,25 @@ def create_app() -> FastAPI:
    app.include_router(bank_accounts.router)
    app.include_router(audit.router)
    app.include_router(backups.router)
    app.include_router(owner_transfer.router)
    app.include_router(custom_field_definitions.router)
    app.include_router(custom_fields.router)
    app.include_router(saved_filters.router)
    app.include_router(saved_views.router)
    app.include_router(webhooks.router)
    app.include_router(permission_templates.router)
    app.include_router(delegations.router)
    app.include_router(policies.router)
    app.include_router(errors.router)
    app.include_router(guest_auth.router)
    app.include_router(guests.router)
    app.include_router(workspaces.router)
    # ── Register plugin routes for all built-in plugins ──
-    # Routes are registered here (before app start); activation status
+    # Routes are registered at app creation time so OpenAPI docs are complete.
-    # is enforced at runtime via require_permission and plugin checks.
+    # Activation status is enforced per-request via require_active_plugin().
    import importlib
    from app.deps import require_active_plugin
    # Discover all built-in plugin modules and register their routes
    plugin_modules = [
        "app.plugins.builtins.tags",
@@ -399,21 +466,31 @@ def create_app() -> FastAPI:
            for attr_name in dir(mod):
                attr = getattr(mod, attr_name)
                if isinstance(attr, type) and hasattr(attr, "manifest") and hasattr(attr.manifest, "routes"):
                    plugin_name = getattr(attr.manifest, "name", mod_name.split(".")[-1])
                    for route_def in attr.manifest.routes:
                        try:
                            router_module = importlib.import_module(route_def.module)
                            router = getattr(router_module, route_def.router_attr)
-                            # Wrap each route handler with plugin error isolation
+                            # Skip WebSocket routes — no wrapping, no plugin check
                            from starlette.routing import WebSocketRoute
                            plugin_dep = Depends(require_active_plugin(plugin_name))
                            for route in router.routes:
-                                if hasattr(route, 'endpoint'):
+                                if isinstance(route, WebSocketRoute):
-                                    route.endpoint = wrap_plugin_route(route.endpoint)
+                                    # WebSocket routes also need plugin check — don't skip (P1.9 fix)
                                    if not hasattr(route, 'dependencies'):
                                        route.dependencies = []
                                    route.dependencies.append(plugin_dep)
                                    continue
                                # Add require_active_plugin to each HTTP route's dependencies
                                if not hasattr(route, 'dependencies'):
                                    route.dependencies = []
                                route.dependencies.append(plugin_dep)
                            app.include_router(router)
                        except Exception as exc:
                            logger.error(f"Failed to register route {route_def.module}.{route_def.router_attr}: {exc}")
                    break
        except Exception as exc:
            logger.error(f"Failed to register plugin routes for {mod_name}: {exc}")
    # Do NOT register plugin routes here — lifespan() handles it for active plugins only
    # ── Serve frontend static files (SPA) ──────────────────────────────
    # Mount built frontend assets (JS, CSS, images)
@@ -8,7 +8,16 @@ from app.models.audit import AuditLog, DeletionLog
 from app.models.auth import ApiToken, PasswordResetToken
 from app.models.contact import Contact, ContactPerson
 from app.models.contact_folder import ContactFolder
 from app.models.contact_folder_permission import ContactFolderPermission
 from app.models.contact_merge import ContactMergeHistory
 from app.models.entity_permission import EntityPermission
 from app.models.guest_user import GuestUser
 from app.models.consumer_inbox import ConsumerInbox
 from app.models.guest_invitation import GuestInvitation
 from app.models.entity_policy import EntityPolicy
 from app.models.permission_template import PermissionTemplate
 from app.models.permission_delegation import PermissionDelegation
 from app.models.owned_mixin import OwnedMixin
 from app.models.entity_history import EntityHistory
 from app.models.currency import Currency
 from app.models.group import Group, UserGroup
@@ -25,6 +34,7 @@ from app.models.backup import Backup
 from app.models.custom_field_definition import CustomFieldDefinition
 from app.models.webhook import Webhook
 from app.models.workflow import Workflow, WorkflowInstance, WorkflowStepHistory
 from app.models.saved_view import SavedView
 __all__ = [
    "Tenant",
@@ -44,7 +54,16 @@ __all__ = [
    "Contact",
    "ContactPerson",
    "ContactFolder",
    "ContactFolderPermission",
    "ContactMergeHistory",
    "EntityPermission",
    "GuestInvitation",
    "ConsumerInbox",
    "GuestUser",
    "PermissionDelegation",
    "PermissionTemplate",
    "EntityPolicy",
    "OwnedMixin",
    "EntityHistory",
    "Currency",
    "TaxRate",
@@ -63,4 +82,7 @@ __all__ = [
    "Workflow",
    "WorkflowInstance",
    "WorkflowStepHistory",
    "SavedView",
 ]
 from app.models.entity_attachment import EntityAttachment  # noqa: F401
 from app.models.workspace import Workspace, WorkspaceModule, WorkspaceUser, WorkspaceWidget  # noqa: F401
@@ -9,9 +9,10 @@ from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 from app.core.db import Base, TenantMixin
 from app.models.owned_mixin import OwnedMixin
-class Address(Base, TenantMixin):
+class Address(Base, TenantMixin, OwnedMixin):
    """Polymorphic address entity — multiple addresses per contact.
    entity_type: 'contact'
@@ -11,6 +11,7 @@ from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 from app.core.db import Base, TenantMixin
 from app.models.owned_mixin import OwnedMixin
 class AIConversation(Base, TenantMixin):
@@ -10,9 +10,10 @@ from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 from app.core.db import Base, TenantMixin
 from app.models.owned_mixin import OwnedMixin
-class Attachment(Base, TenantMixin):
+class Attachment(Base, TenantMixin, OwnedMixin):
    """Attachment entity — links files to companies, contacts, invoices, etc."""
    __tablename__ = "attachments"
@@ -43,7 +43,7 @@ class ApiToken(Base, TenantMixin):
    )
    token_hash: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
    name: Mapped[str] = mapped_column(String(200), nullable=False)
-    scopes: Mapped[list] = mapped_column(JSONB, nullable=False)
+    scopes: Mapped[list[str]] = mapped_column(JSONB, nullable=False, default=list)
    expires_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
    last_used_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
    created_at: Mapped[datetime] = mapped_column(
@@ -5,7 +5,7 @@ from __future__ import annotations
 import uuid
 from datetime import datetime
-from sqlalchemy import BigInteger, DateTime, String, Text
+from sqlalchemy import BigInteger, DateTime, String, Text, func
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
@@ -39,7 +39,7 @@ class Backup(Base, TenantMixin):
        PGUUID(as_uuid=True), nullable=True
    )
    created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, default=datetime.utcnow
+        DateTime(timezone=True), nullable=False, server_default=func.now()
    )
    completed_at: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True, default=None
@@ -9,9 +9,10 @@ from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 from app.core.db import Base, TenantMixin
 from app.models.owned_mixin import OwnedMixin
-class BankAccount(Base, TenantMixin):
+class BankAccount(Base, TenantMixin, OwnedMixin):
    """Bank account entity — multiple accounts per tenant.
    is_default: one default bank account per tenant.
@@ -0,0 +1,42 @@
 """Consumer inbox model for outbox idempotency."""
 from __future__ import annotations
 import uuid
 from datetime import datetime
 from sqlalchemy import DateTime, ForeignKey, String, Text, UniqueConstraint, func
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 from app.core.db import Base
 class ConsumerInbox(Base):
    """Tracks which consumers have processed which outbox events.
    Prevents duplicate processing when a worker crashes between
    delivering an event and marking it as published.
    """
    __tablename__ = "consumer_inbox"
    __table_args__ = (
        UniqueConstraint("event_id", "consumer_name", name="uq_consumer_inbox_event_consumer"),
    )
    id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
    )
    event_id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True),
        ForeignKey("event_outbox.id", ondelete="CASCADE"),
        nullable=False,
        index=True,
    )
    consumer_name: Mapped[str] = mapped_column(String(100), nullable=False, index=True)
    status: Mapped[str] = mapped_column(String(20), nullable=False, default="pending")
    processed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
    error_message: Mapped[str | None] = mapped_column(Text, nullable=True)
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, server_default=func.now()
    )
@@ -27,9 +27,10 @@ from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 from app.core.db import Base, TenantMixin
 from app.models.owned_mixin import OwnedMixin
-class Contact(Base, TenantMixin):
+class Contact(Base, TenantMixin, OwnedMixin):
    """Unified contact entity — can be a company or a person.
    type='company': name is the company name, firstname/surname empty.
@@ -0,0 +1,90 @@
 """Contact folder permission model — ACLs for folder sharing."""
 from __future__ import annotations
 import uuid
 from datetime import datetime
 from sqlalchemy import (
    Boolean,
    CheckConstraint,
 DateTime,
    ForeignKey,
    Index,
    String,
    UniqueConstraint,
    func,
 )
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 from app.core.db import Base, TenantMixin
 class ContactFolderPermission(Base, TenantMixin):
    """ACL entry for a contact folder.
    Grants a specific permission level to a user or group for a folder.
    When ``inherit_to_subfolders`` is True, the permission also applies
    to all descendant folders.
    Permission levels:
    - ``none``   — no access (explicit deny)
    - ``read``   — view folder and its contacts
    - ``write``  — read + edit contacts, add contacts to folder
    - ``admin``  — read + write + delete contacts + manage folder permissions
    """
    __tablename__ = "contact_folder_permissions"
    __table_args__ = (
        UniqueConstraint(
            "folder_id",
            "user_id",
            "group_id",
            "tenant_id",
            name="uq_cfp_folder_user_group_tenant",
        ),
        # Ensure exactly one of user_id or group_id is set (not both, not neither)
        CheckConstraint(
            "(user_id IS NOT NULL AND group_id IS NULL) OR "
            "(user_id IS NULL AND group_id IS NOT NULL)",
            name="ck_cfp_exactly_one_principal",
        ),
        Index("ix_cfp_folder", "folder_id"),
        Index("ix_cfp_user", "user_id"),
        Index("ix_cfp_group", "group_id"),
        Index("ix_cfp_tenant", "tenant_id"),
    )
    id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
    )
    folder_id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True),
        ForeignKey("contact_folders.id", ondelete="CASCADE"),
        nullable=False,
        index=True,
    )
    user_id: Mapped[uuid.UUID | None] = mapped_column(
        PGUUID(as_uuid=True),
        ForeignKey("users.id", ondelete="CASCADE"),
        nullable=True,
    )
    group_id: Mapped[uuid.UUID | None] = mapped_column(
        PGUUID(as_uuid=True),
        ForeignKey("groups.id", ondelete="CASCADE"),
        nullable=True,
    )
    permission_level: Mapped[str] = mapped_column(
        String(20), nullable=False, default="read"
    )  # none | read | write | admin
    inherit_to_subfolders: Mapped[bool] = mapped_column(
        Boolean, nullable=False, default=True, server_default="true"
    )
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, server_default=func.now()
    )
    updated_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, server_default=func.now(),
        onupdate=func.now(),
    )
@@ -10,9 +10,10 @@ from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 from app.core.db import Base, TenantMixin
 from app.models.owned_mixin import OwnedMixin
-class CustomFieldDefinition(Base, TenantMixin):
+class CustomFieldDefinition(Base, TenantMixin, OwnedMixin):
    """User-defined custom field definition stored in the database.
    These definitions are merged with plugin-provided custom fields
@@ -43,6 +44,9 @@ class CustomFieldDefinition(Base, TenantMixin):
    options: Mapped[list[str] | None] = mapped_column(JSON, nullable=True, default=list)
    default_value: Mapped[Any | None] = mapped_column(JSON, nullable=True, default=None)
    # ── Sensitivity (field-level permissions) ──
    sensitivity: Mapped[str] = mapped_column(String(20), nullable=False, default='normal')
    # ── Behaviour ──
    required: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
    is_active: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
@@ -0,0 +1,51 @@
 """EntityAttachment model — references DMS files for any entity."""
 from __future__ import annotations
 import uuid
 from datetime import datetime
 from sqlalchemy import DateTime, ForeignKey, Index, String
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 from app.core.db import Base, TenantMixin
 from app.models.owned_mixin import OwnedMixin
 class EntityAttachment(Base, TenantMixin, OwnedMixin):
    """Links a DMS file to any entity (contact, address, invoice, etc.).
    The actual file is stored in the DMS (files table).
    This table only holds the reference + category + display_name.
    """
    __tablename__ = "entity_attachments"
    __table_args__ = (
        Index("ix_entity_attachments_entity", "entity_type", "entity_id", "tenant_id"),
        Index("ix_entity_attachments_dms_file", "dms_file_id"),
    )
    id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
    )
    entity_type: Mapped[str] = mapped_column(String(50), nullable=False)
    entity_id: Mapped[uuid.UUID] = mapped_column(PGUUID(as_uuid=True), nullable=False)
    dms_file_id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True),
        ForeignKey("files.id", ondelete="RESTRICT"),
        nullable=False,
    )
    category: Mapped[str | None] = mapped_column(String(50), nullable=True)
    display_name: Mapped[str | None] = mapped_column(String(255), nullable=True)
    created_by: Mapped[uuid.UUID | None] = mapped_column(
        PGUUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True
    )
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, server_default=__import__('sqlalchemy').func.now()
    )
    updated_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, server_default=__import__('sqlalchemy').func.now(),
        onupdate=__import__('sqlalchemy').func.now(),
    )
    deleted_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
@@ -12,9 +12,10 @@ from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 from app.core.db import Base, TenantMixin
 from app.models.owned_mixin import OwnedMixin
-class EntityHistory(Base, TenantMixin):
+class EntityHistory(Base, TenantMixin, OwnedMixin):
    """Snapshot history for undo/restore functionality.
    Every CRUD action (create/update/delete) stores a full entity snapshot
@@ -0,0 +1,109 @@
 """Universal entity permission model — ACLs for ANY entity in the system.
 This single table stores permissions for contacts, files, mailboxes,
 calendar events, tasks, workflows, and any future entity type.
 Architecture:
 - entity_type + entity_id identify the datensatz
 - principal_type + principal_id identify who gets access
 - permission_level defines what they can do
 - expires_at enables time-limited sharing
 Resolution (highest wins):
 1. Owner → 'owner' (from owner_id on the entity)
 2. Direct user permission
 3. Group permission (via user_groups)
 4. Role permission (via user_tenants.role_id)
 5. No access → 'none'
 """
 from __future__ import annotations
 import uuid
 from datetime import datetime
 from sqlalchemy import (
    Boolean,
    CheckConstraint,
    DateTime,
    ForeignKey,
    Index,
    String,
    UniqueConstraint,
    func,
 )
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 from app.core.db import Base, TenantMixin
 class EntityPermission(Base, TenantMixin):
    """Universal ACL entry for any entity in the system.
    entity_type examples: 'contact', 'dms_file', 'mailbox', 'calendar_event',
    'task', 'workflow', 'contact_folder', etc.
    principal_type: 'user', 'group', 'role', 'guest'
    permission_level: 'none' | 'read' | 'write' | 'admin' | 'delete'
    - none:   explicit deny (overrides allow)
    - read:   view the entity
    - write:  read + edit entity fields
    - admin:  write + delete + manage permissions
    - delete: admin + transfer ownership
    """
    __tablename__ = "entity_permissions"
    __table_args__ = (
        UniqueConstraint(
            "entity_type",
            "entity_id",
            "principal_type",
            "principal_id",
            "tenant_id",
            name="uq_ep_entity_principal_tenant",
        ),
        CheckConstraint(
            "principal_type IN ('user', 'group', 'role', 'guest')",
            name="ck_ep_principal_type",
        ),
        CheckConstraint(
            "permission_level IN ('none', 'read', 'write', 'admin', 'delete')",
            name="ck_ep_permission_level",
        ),
        Index("ix_ep_entity", "entity_type", "entity_id"),
        Index("ix_ep_principal", "principal_type", "principal_id"),
        Index("ix_ep_tenant", "tenant_id"),
        Index("ix_ep_expires", "expires_at"),
    )
    id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
    )
    entity_type: Mapped[str] = mapped_column(String(50), nullable=False)
    entity_id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True), nullable=False
    )
    principal_type: Mapped[str] = mapped_column(String(10), nullable=False)
    principal_id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True), nullable=False
    )
    permission_level: Mapped[str] = mapped_column(
        String(20), nullable=False, default="read"
    )
    expires_at: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True, default=None
    )
    created_by: Mapped[uuid.UUID | None] = mapped_column(
        PGUUID(as_uuid=True),
        ForeignKey("users.id", ondelete="SET NULL"),
        nullable=True,
    )
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, server_default=func.now()
    )
    updated_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, server_default=func.now(),
        onupdate=func.now(),
    )
@@ -0,0 +1,99 @@
 """ABAC entity policy model — attribute-based access control policies.
 Each policy defines a rule for a specific entity type:
 - allow policies: at least one must match for access
 - deny policies: if any matches, access is denied (deny takes precedence)
 Conditions use JSONB with format:
 {
    "operator": "AND" | "OR",
    "rules": [
        {"field": "status", "op": "eq", "value": "active"},
        {"field": "amount", "op": "gte", "value": 1000},
        {"field": "tags", "op": "contains", "value": "vip"}
    ]
 }
 """
 from __future__ import annotations
 import uuid
 from datetime import datetime
 from sqlalchemy import (
    Boolean,
    CheckConstraint,
    DateTime,
    Index,
    Integer,
    String,
    Text,
    func,
 )
 from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 from app.core.db import Base, TenantMixin
 class EntityPolicy(Base, TenantMixin):
    """ABAC policy entry for any entity type in the system.
    entity_type examples: 'contact', 'dms_file', 'mailbox', 'calendar_event',
    'task', 'workflow', 'contact_folder', etc.
    principal_type: 'user', 'group', 'role'
    effect: 'allow' | 'deny'
    - allow:  grants access if conditions match
    - deny:   blocks access if conditions match (deny takes precedence over allow)
    conditions: JSONB with operator (AND/OR) and rules array
    priority: higher priority policies are evaluated first
    """
    __tablename__ = "entity_policies"
    __table_args__ = (
        CheckConstraint(
            "principal_type IN ('user', 'group', 'role')",
            name="ck_epol_principal_type",
        ),
        CheckConstraint(
            "effect IN ('allow', 'deny')",
            name="ck_epol_effect",
        ),
        Index("ix_epol_entity_type", "entity_type"),
        Index("ix_epol_principal", "principal_type", "principal_id"),
        Index("ix_epol_tenant", "tenant_id"),
        Index("ix_epol_priority", "priority"),
        Index("ix_epol_enabled", "enabled"),
    )
    id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
    )
    name: Mapped[str] = mapped_column(String(200), nullable=False)
    entity_type: Mapped[str] = mapped_column(String(50), nullable=False)
    principal_type: Mapped[str] = mapped_column(String(10), nullable=False)
    principal_id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True), nullable=False
    )
    effect: Mapped[str] = mapped_column(
        String(10), nullable=False, default="allow"
    )
    conditions: Mapped[dict | None] = mapped_column(
        JSONB, nullable=True, default=None
    )
    priority: Mapped[int] = mapped_column(
        Integer, nullable=False, default=0
    )
    enabled: Mapped[bool] = mapped_column(
        Boolean, nullable=False, default=True
    )
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, server_default=func.now()
    )
    updated_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, server_default=func.now(),
        onupdate=func.now(),
    )
@@ -0,0 +1,43 @@
 """Guest invitation model — secure token-based invitations."""
 from __future__ import annotations
 import uuid
 from datetime import datetime
 from sqlalchemy import DateTime, ForeignKey, String, func
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 from app.core.db import Base
 class GuestInvitation(Base):
    """Secure invitation token for guest users.
    Token is a random 32-byte URL-safe string.
    Only the hash is stored in the database.
    One-time use: used_at is set on acceptance.
    """
    __tablename__ = "guest_invitations"
    id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
    )
    guest_user_id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True),
        ForeignKey("guest_users.id", ondelete="CASCADE"),
        nullable=False,
        index=True,
    )
    token_hash: Mapped[str] = mapped_column(String(64), nullable=False, unique=True, index=True)
    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
    used_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True, default=None)
    revoked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True, default=None)
    created_by: Mapped[uuid.UUID | None] = mapped_column(
        PGUUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True
    )
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, server_default=func.now()
    )
@@ -0,0 +1,60 @@
 """Guest User model — for time-limited guest access via entity permissions."""
 from __future__ import annotations
 import uuid
 from datetime import datetime
 from sqlalchemy import DateTime, ForeignKey, Index, String, func
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 from app.core.db import Base, TenantMixin
 class GuestUser(Base, TenantMixin):
    """Guest user with time-limited access to shared entities.
    Guests are invited by tenant admins and can only access entities
    that have explicit entity_permissions with principal_type='guest'.
    """
    __tablename__ = "guest_users"
    __table_args__ = (
        Index("ix_guest_users_email_tenant", "email", "tenant_id", unique=True),
        Index("ix_guest_users_status", "status", "tenant_id"),
        Index("ix_guest_users_invited_by", "invited_by"),
    )
    id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
    )
    email: Mapped[str] = mapped_column(String(255), nullable=False)
    name: Mapped[str] = mapped_column(String(255), nullable=False)
    password_hash: Mapped[str | None] = mapped_column(
        String(255), nullable=True, default=None
    )
    tenant_id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True),
        ForeignKey("tenants.id", ondelete="CASCADE"),
        nullable=False,
        index=True,
    )
    invited_by: Mapped[uuid.UUID | None] = mapped_column(
        PGUUID(as_uuid=True),
        ForeignKey("users.id", ondelete="SET NULL"),
        nullable=True,
    )
    status: Mapped[str] = mapped_column(
        String(20), nullable=False, default="invited"
    )  # 'invited', 'active', 'expired', 'revoked'
    expires_at: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True, default=None
    )
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, server_default=func.now()
    )
    updated_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, server_default=func.now(),
        onupdate=func.now(),
    )
--- a/Show More
+++ b/Show More