# LeoCRM — Current Status
**Phase**: Fix Branch — 20/22 FIX-PLAN Items erledigt
**Last update**: 2026-07-26 16:25
**Branch**: main (leocrm-fix)

## FIX-PLAN Überprüfung (2026-07-26)
Alle 22 Items gegen Codebasis verifiziert. 20 erledigt, 2 offen.

### Erledigt (20)
- P0-1: Auth-Bypass entfernt ✅
- P0-2: Migrationen repariert ✅
- P0-3: Plugin-Upload deaktiviert ✅
- P0-4: RLS FORCE + WITH CHECK ✅
- P0-5: Plugin-Doppelregistrierung behoben ✅
- P0-6: Persistent Volume ✅
- P1-1: User/Tenant-Modell bereinigt ✅
- P1-2: Redis zentralisiert ✅
- P1-3: Worker ausgelagert ✅
- P1-4: Transactional Outbox ✅
- P1-5: XSS-Stellen geschlossen ✅
- P1-6: DMS lastfest ✅
- P1-7: Permission-System vereinheitlicht ✅
- P1-8: Password Reset funktionsfähig ✅
- P1-9: Metrics abgesichert ✅
- P1-10: Coolify-Doku & Config korrigiert ✅
- P1-11: Cross-Tenant FK ✅
- P2-1: Contact Model normalisiert ✅
- P2-3: Commands & Statusmaschinen ✅
- P2-4: SPA Path-Traversal ✅

### Offen (2)
- P0-7: App von öffentlicher Domain nehmen (operational — 30 Min)
- P2-2: Plugin-Cross-Imports reduzieren (228 Imports — 1-2 Wochen)

## Previous: P1-4: Transactional Outbox — COMPLETE
- Migration 0040_outbox.py created (down_revision=0039_contact_normalize)
- event_outbox table: id, tenant_id, event_name, payload JSONB, status, attempts, max_attempts, next_retry_at, timestamps
- app/core/outbox.py: enqueue_outbox_event() + process_outbox_batch() with FOR UPDATE SKIP LOCKED, exponential backoff retry
- app/core/event_bus.py: added publish_with_results() for error-aware publishing; docstring note about outbox
- app/core/worker.py: process_outbox_job cron (every 5s, Redis distributed lock)
- app/services/contact_service.py: contact.created, lead.created, contact.updated → enqueue_outbox_event
- app/models/outbox.py: SQLAlchemy ORM model for event_outbox
- tests/test_outbox.py: 6 tests, all passing
- py_compile: OK, alembic heads: single head 0040_outbox

## Previous: P2-1: Unified Contact Model normalisieren — COMPLETE
- Migration 0039_contact_normalize.py (down_revision=0038_dms_content_hash)