# RBAC Build Progress — LeoCRM

## Letztes Update: 2026-07-29 02:00 CEST

## Sprint 1 — Fundament (14h) ✅ VOLLSTÄNDIG

Alle Items erledigt und in Produktion. Siehe vorherige Commits.

## Sprint 2 — Row-Level Security (16h) ✅ GRÖSSTEILS FERTIG

### Erledigt ✅
- [x] apply_visibility_filter() Helper (`app/core/visibility.py`, 237 Zeilen)
- [x] Query-Filter in contact_service (list, get, create, update, delete, export)
- [x] Query-Filter in 8 weiteren Services (address, attachment, bank_account, workflow, sequence, saved_filter, saved_view, webhook)
- [x] 8 Routes angepasst (user_id + is_system_admin + PermissionError handling)
- [x] BaseSearchProvider mit Visibility-Filter (`app/plugins/builtins/unified_search/base_provider.py`)
- [x] Frontend Permission-Checks: ContactDetailPage + ContactDetail + ContactsList
- [x] Field-Level UI: hidden fields nicht gerendert, readonly disabled
- [x] OwnedMixin auf 8 Models korrigiert (Klassendefinition)
- [x] Alles deployed und committed (52a5c34)

### Noch offen ⬜
- [ ] Child-Entity-Vererbung (ContactPerson erbt von Contact)
- [ ] Copy/Duplicate Permission
- [ ] EXISTS-Optimization für RLS (bereits in visibility.py verwendet)
- [ ] Weitere 12 Routes (notifications, entity_history, custom_fields, etc.)

## Sprint 3-23 ⬜

---

## Migrationen
| # | Beschreibung | Status |
|---|-------------|:---:|
| 0048 | contact_folder_permissions Tabelle | ✅ |
| 0049 | entity_permissions Tabelle | ✅ |
| 0050 | owner_id auf 15 Tabellen | ✅ |
| 0051 | Folder ACLs → entity_permissions | ✅ |
| 0052 | RLS Policies auf contacts | ✅ |

## Git Commits
| Hash | Beschreibung |
|------|-------------|
| cc021cd | feat: folder permissions (ACLs) |
| 5afa1fa | sprint1: entity_permissions + owned_mixin + service + API + migrations 0049+0050 |
| 48647a5 | sprint1: set_user_context + RLS policies + folder ACL migration 0051+0052 |
| ea1c1d5 | sprint1 complete: rate limiting on permission changes |
| 479ee04 | sprint2: visibility filter + contact service access checks |
| 9fc84b7 | sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider |
| 52a5c34 | sprint2: frontend permission checks for ContactDetail + ContactsList |

## Was in Produktion läuft
- entity_permissions Tabelle (universelle ACLs)
- owner_id auf 15 Tabellen
- PostgreSQL RLS auf contacts (4 Policies)
- set_user_context() bei jedem Request
- Universelle Permission API unter /api/v1/permissions/*
- Rate Limiting auf Permission-Änderungen
- Visibility Filter in 9 Services (contacts + 8 weitere)
- Frontend Permission-Checks in ContactDetail + ContactsList
- BaseSearchProvider für Permission-aware Search