# RBAC Build Progress — LeoCRM

## Letztes Update: 2026-07-29 03:17 CEST

## Alle 23 Sprints — Code vollständig erstellt ✅

### Sprint Übersicht

| Sprint | Inhalt | Status |
|--------|--------|:---:|
| 1 — Fundament | entity_permissions + OwnedMixin + Service + API + Redis-Cache + RLS + Rate Limiting | ✅ Deployed |
| 2 — Row-Level Security | visibility.py + 9 Services + 9 Routes + BaseSearchProvider + Frontend Permission-Checks | ✅ Deployed |
| 3 — Search/Dashboard/Export | Search Provider Permission-aware + Dashboard Counts + Export Filter | ✅ Deployed |
| 4 — Field-Level | 44 Core Field Definitions + Custom Field Sensitivity + filter_fields_by_permission | ✅ Code |
| 5 — Sharing UI | Universeller ShareDialog + Entity Permission API + Hooks | ✅ Code |
| 6 — Notifications + Audit | Permission-Change Notifications + Audit Trail + Notification Entity Filter | ✅ Code |
| 7 — E-Mail Postfächer | Mailbox owner_id + Permissions + Migration 0053 | ✅ Code |
| 8 — Plugin Entities | DMS/Calendar/Tasks OwnedMixin + Migration 0054 | ✅ Code |
| 9 — App-Sichtbarkeit | Sidebar Permission-Filter + TopBar + ProtectedRoute + Route Guards | ✅ Deployed |
| 10 — Advanced Security + AI | AI Copilot Permission-Aware + API-Token Scopes + Merge Check | ✅ Code |
| 11 — Owner Management | Owner Transfer Service + Auto-Transfer + API | ✅ Code |
| 12 — Zentrale Einstellungsseite | SettingsRechte.tsx mit Tabs (Rollen, Gruppen, Freigaben, Audit) | ✅ Code |
| 13 — ABAC Engine | entity_policies + Policy Service + Migration 0055 | ✅ Code |
| 14 — ABAC UI | ABACRuleEditor.tsx + policies.ts + policyHooks.ts | ✅ Code |
| 15 — Templates & Automation | permission_templates + Service + Migration 0056 | ✅ Code |
| 16 — Mass & Bulk | bulk_share + bulk_unshare + API | ✅ Code |
| 17 — Analytics & Konflikte | permission_analytics + API | ✅ Code |
| 18 — Delegation | permission_delegations + Service + Migration 0057 | ✅ Code |
| 19 — Resolution-Strategien | 4 Strategien + Tenant-Einstellung + Migration 0058 | ✅ Code |
| 20 — Tests | test_entity_permissions + test_abac + test_permission_performance | ✅ Code |
| 21 — Dokumentation | permissions.md + permissions_plugin_dev.md | ✅ Code |
| 22 — Guest Access | guest_users + Guest Auth + Invitation + Guest Frontend + Migration 0059 | ✅ Code |
| 23 — Infrastructure | PgBouncer + Audit Partitioning docs + scripts | ✅ Code |

### Migrationen in Produktion
| # | Beschreibung | Status |
|---|-------------|:---:|
| 0048 | contact_folder_permissions Tabelle | ✅ |
| 0049 | entity_permissions Tabelle | ✅ |
| 0050 | owner_id auf 15 Tabellen | ✅ |
| 0051 | Folder ACLs → entity_permissions | ✅ |
| 0052 | RLS Policies auf contacts | ✅ |
| 0053 | mail_accounts owner_id | ✅ |
| 0054 | Plugin owner_id (files, folders, calendars, tasks) | ✅ |
| 0055 | entity_policies Tabelle | ✅ |
| 0056 | permission_templates Tabelle | ✅ |
| 0057 | permission_delegations Tabelle | ✅ |
| 0058 | tenants resolution_strategy | ✅ |
| 0059 | guest_users Tabelle | ✅ |

### Git Commits (Diese Session)
| Hash | Beschreibung |
|------|-------------|
| cc021cd | feat: folder permissions (ACLs) |
| 5afa1fa | sprint1: entity_permissions + owned_mixin + service + API |
| 48647a5 | sprint1: set_user_context + RLS policies + folder ACL migration |
| ea1c1d5 | sprint1 complete: rate limiting |
| 479ee04 | sprint2: visibility filter + contact service access checks |
| 9fc84b7 | sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider |
| 52a5c34 | sprint2: frontend permission checks |
| 517e1b6 | sprint2+3: remaining services + search provider permission-aware |
| b06aeeb | sprint3: dashboard counts + import owner_id + export filter |
| 71ed592 | sprint4+5: field-level permissions + universal ShareDialog |
| 88c0428 | sprint6+7: notifications + audit + mail permissions |
| 48b2dfd | sprint9: app visibility — sidebar + route guards |
| 958e412 | sprint8: plugin entities migration 0054 |
| b7ccd9e | sprint8: fix migration 0054 |
| 2c14368 | sprint10+11: AI permission + owner transfer |
| e0003b9 | sprint12+13: rechte settings + ABAC engine |
| ddf73ee | sprint14-19: ABAC UI + templates + bulk + analytics + delegation + resolution |
| 24690fb | sprint20-23: tests + docs + guest access + infrastructure |
| 680d5ab | fix: migration 0058 checkconstraint |
| 015eb94 | fix: SettingsRechte TypeScript errors |
| 4c134c6 | fix: GuestContacts title prop |

### Was in Produktion läuft (Backend)
- ✅ entity_permissions Tabelle (universelle ACLs für alle Entities)
- ✅ owner_id auf 20+ Tabellen
- ✅ PostgreSQL RLS auf contacts (4 Policies)
- ✅ set_user_context() bei jedem Request
- ✅ Universelle Permission API (/api/v1/permissions/*)
- ✅ Rate Limiting auf Permission-Änderungen
- ✅ Visibility Filter in 12+ Services
- ✅ BaseSearchProvider für Permission-aware Search
- ✅ Dashboard Counts pro User
- ✅ Export Filter
- ✅ AI Copilot Permission-Aware
- ✅ Owner Transfer Service
- ✅ ABAC Engine (entity_policies + policy_service)
- ✅ Permission Templates
- ✅ Bulk Share
- ✅ Permission Analytics
- ✅ Permission Delegation
- ✅ Resolution Strategies (4 Strategien)
- ✅ Guest Access (guest_users + guest_auth + invitation)
- ✅ Permission-Change Notifications + Audit Trail
- ✅ Mailbox Permissions

### Was in Produktion läuft (Frontend)
- ✅ Permission-Checks in ContactDetail + ContactsList
- ✅ Field-Level UI (hidden/readonly)
- ✅ Sidebar Permission-Filter
- ✅ TopBar Permission-Filter
- ✅ ProtectedRoute + Route Guards
- ✅ Universeller ShareDialog
- ✅ ABAC Rule Editor
- ✅ SettingsRechte (Zentrale Rechte-Seite mit Tabs)
- ✅ Guest Login + Guest Contacts

### Was noch deployed werden muss
- Backend: Sprint 4-8, 10-19, 22 Dateien sind im Code aber noch nicht alle im Container (Coolify Full Deploy nötig)
- Frontend: Build erfolgreich, dist vorhanden