Agent Zero
04d6562f5b
Problem 1: Remove legacy role bypass - Remove role="admin" string bypass in permissions.py resolve_permissions() - Remove role="admin"/"editor" bypass in auth.py check_permission() - Remove legacy role string fallback in deps.py require_admin/require_write - Add migration 0112: Create Role records for built-in roles and link role_id - KI-Kommentar: Legacy Role Bypass entfernt — alle Admins müssen echte role_id haben Problem 2: Enforce API token scopes - Add _token_scopes check in require_permission() in deps.py - When _token_scopes is set (API token auth), required permission must be in scopes - When _token_scopes not set (session auth), normal permission check applies Problem 3: Migration chain verification - Chain is already linear: 0027→0028_rls_force→0028_user_preferences→0029 - user_preferences table confirmed exists in DB - No duplicate revision IDs found Problem 4: RLS for remaining tenant tables - Add migration 0111: Dynamic RLS activation for any remaining tables with tenant_id - Login tables and global tables explicitly excluded - DB check shows 0 tables currently missing RLS (safety net migration) Problem 5: Permission cache invalidation on tenant switch - Add invalidate_permission_cache() call in switch_tenant() for old tenant - Stale cached permissions from old tenant no longer leak Problem 6+7: Guest system removal - Remove get_current_guest() from deps.py - Remove guest_auth.py router from main.py and routes/__init__.py - Rewrite guests.py to use regular User/UserTenant with role=guest - Remove GuestUser/GuestInvitation from models/__init__.py - Add migration 0113: Migrate guest_users to regular users, drop guest tables - Update frontend GuestLogin/GuestContacts to redirect to normal pages - KI-Kommentar: Guest-System umgebaut — Guests sind jetzt reguläre User mit role=guest
88 lines
3.0 KiB
Python
88 lines
3.0 KiB
Python
"""SQLAlchemy models for LeoCRM."""
|
|
|
|
from app.models.address import Address
|
|
from app.models.bank_account import BankAccount
|
|
from app.models.ai_conversation import AIConversation, AIMessage
|
|
from app.models.attachment import Attachment
|
|
from app.models.audit import AuditLog, DeletionLog
|
|
from app.models.auth import ApiToken, PasswordResetToken
|
|
from app.models.contact import Contact, ContactPerson
|
|
from app.models.contact_folder import ContactFolder
|
|
from app.models.contact_folder_permission import ContactFolderPermission
|
|
from app.models.contact_merge import ContactMergeHistory
|
|
from app.models.entity_permission import EntityPermission
|
|
from app.models.consumer_inbox import ConsumerInbox
|
|
from app.models.outbox_delivery import OutboxDelivery
|
|
# ⚠️ Guest-System umgebaut — Guests sind jetzt reguläre User mit role=guest
|
|
# GuestUser and GuestInvitation models removed — guests are now regular users
|
|
from app.models.entity_policy import EntityPolicy
|
|
from app.models.permission_template import PermissionTemplate
|
|
from app.models.permission_delegation import PermissionDelegation
|
|
from app.models.owned_mixin import OwnedMixin
|
|
from app.models.entity_history import EntityHistory
|
|
from app.models.currency import Currency
|
|
from app.models.group import Group, UserGroup
|
|
from app.models.notification import Notification, NotificationPreference, NotificationType
|
|
from app.models.plugin import Plugin, PluginMigration
|
|
from app.models.role import Role
|
|
from app.models.sequence import Sequence
|
|
from app.models.session import Session
|
|
from app.models.system_settings import SystemSettings
|
|
from app.models.tax import TaxRate
|
|
from app.models.tenant import Tenant
|
|
from app.models.user import User, UserTenant
|
|
from app.models.backup import Backup
|
|
from app.models.custom_field_definition import CustomFieldDefinition
|
|
from app.models.webhook import Webhook
|
|
from app.models.workflow import Workflow, WorkflowInstance, WorkflowStepHistory
|
|
from app.models.saved_view import SavedView
|
|
|
|
__all__ = [
|
|
"Tenant",
|
|
"User",
|
|
"UserTenant",
|
|
"Role",
|
|
"Group",
|
|
"UserGroup",
|
|
"Session",
|
|
"AuditLog",
|
|
"DeletionLog",
|
|
"Notification",
|
|
"NotificationType",
|
|
"NotificationPreference",
|
|
"PasswordResetToken",
|
|
"ApiToken",
|
|
"Contact",
|
|
"ContactPerson",
|
|
"ContactFolder",
|
|
"ContactFolderPermission",
|
|
"ContactMergeHistory",
|
|
"EntityPermission",
|
|
"ConsumerInbox",
|
|
"PermissionDelegation",
|
|
"PermissionTemplate",
|
|
"EntityPolicy",
|
|
"OwnedMixin",
|
|
"EntityHistory",
|
|
"Currency",
|
|
"TaxRate",
|
|
"Sequence",
|
|
"SystemSettings",
|
|
"Attachment",
|
|
"Address",
|
|
"BankAccount",
|
|
"Plugin",
|
|
"PluginMigration",
|
|
"AIConversation",
|
|
"AIMessage",
|
|
"Backup",
|
|
"CustomFieldDefinition",
|
|
"Webhook",
|
|
"Workflow",
|
|
"WorkflowInstance",
|
|
"WorkflowStepHistory",
|
|
"SavedView",
|
|
]
|
|
from app.models.entity_attachment import EntityAttachment # noqa: F401
|
|
from app.models.workspace import Workspace, WorkspaceModule, WorkspaceUser, WorkspaceWidget # noqa: F401
|