Agent Zero 100b9f705c phase1: separate DB roles, RLS restoration, login on crm_auth ...

- config.py: add auth_database_url, worker_database_url, migration_database_url
- db/__init__.py: separate engines for auth/worker/migration + get_auth_db/get_worker_db
- auth.py: all auth endpoints use get_auth_db (crm_auth role)
- auth_service.py: remove login fallback, require active membership, check status
- auth_service.py: switch_tenant checks active membership status
- alembic/env.py: use migration_database_url for Alembic
- docker-compose.yml: add AUTH_DATABASE_URL, WORKER_DATABASE_URL
- .env.example: add all 4 DB URLs with separate roles
- migration 0085: transfer ownership to crm_migration, fix BYPASSRLS,
  enable RLS+FORCE on all tenant tables, drop old policies, create new
  fail-closed policies scoped to crm_api+crm_worker, revoke excessive grants,
  grant minimal crm_auth access, drop crm_runtime, set default privileges
- tests/test_rls_coverage.py: automated RLS coverage check (13 tests)
- tests/test_cross_tenant_security_v2.py: RLS tests with unprivileged role

2026-07-31 02:05:16 +02:00

..

db

phase1: separate DB roles, RLS restoration, login on crm_auth

2026-07-31 02:05:16 +02:00

__init__.py

T01: core infrastructure + auth + multi-tenant + RLS

2026-06-29 08:02:14 +02:00

audit.py

T01: core infrastructure + auth + multi-tenant + RLS

2026-06-29 08:02:14 +02:00

auth.py

fix: comprehensive system audit fixes (55+ issues)

2026-07-31 00:58:05 +02:00

cache.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00

commands.py

phase7: command pattern infrastructure (CommandHandler, UnitOfWork, RequestContext) + example CreateContactCommand

2026-07-29 23:00:38 +02:00

error_codes.py

feat: add forgejo_error_reporter plugin for automatic error reporting to Forgejo issues

2026-07-26 12:49:39 +02:00

event_bus.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

hooks.py

feat: Plugin-System Umbau — 6 Phasen komplett abgeschlossen

2026-07-26 23:15:34 +02:00

job_registry.py

perf: Fix all 7 code analysis issues

2026-07-25 09:19:32 +02:00

jobs.py

Phase 1: Fix all critical release blockers (B1-B10)

2026-07-26 20:45:42 +02:00

middleware.py

fix: comprehensive system audit fixes (55+ issues)

2026-07-31 00:58:05 +02:00

monitoring.py

fix: health check worker uses zcard instead of llen for arq sorted set queue

2026-07-19 02:25:42 +02:00

notifications.py

sprint6+7: permission notifications + audit trail + notification entity filter + mail account permissions + migration 0053

2026-07-29 02:18:17 +02:00

outbox.py

phase6: standardized event envelope (aggregate_type, aggregate_id, occurred_at, correlation_id, schema_version) + outbox_deliveries table

2026-07-29 22:50:27 +02:00

permission_registry.py

P0+P1 fixes: RCE sandbox, SQL injection, RLS tenant isolation, DB roles, test syntax, attachment, permission registry, membership check

2026-07-29 12:28:08 +02:00

permissions.py

fix: comprehensive system audit fixes (55+ issues)

2026-07-31 00:58:05 +02:00

plugin_error_handler.py

fix: keep __annotations__ in wrap_plugin_route — body params need ForwardRef resolution

2026-07-27 02:39:16 +02:00

rate_limit.py

fix: comprehensive system audit fixes (55+ issues)

2026-07-31 00:58:05 +02:00

redis.py

fix: add app/core/redis.py shim re-exporting get_redis from auth

2026-07-30 02:01:28 +02:00

seeds.py

C1: Add seeds.py — EUR currency, 19% and 7% tax rates, idempotent

2026-07-04 01:30:06 +00:00

service_container.py

T01: core infrastructure + auth + multi-tenant + RLS

2026-06-29 08:02:14 +02:00

state_machine.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

storage.py

Phase 2: Fix high-priority security and stability issues (H1-H7)

2026-07-26 20:49:15 +02:00

tenant.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00

visibility.py

fix: visibility.py Defense-in-Depth tenant_id filter + entity_permissions deleted_at migration + cross-tenant tests

2026-07-29 16:12:04 +02:00

webhook_dispatcher.py

fix: WeasyPrint URL fetcher + attachment improvements + webhook error propagation + WebSocket conversation check + RLS disabled on system tables (bootstrap fix)

2026-07-29 13:19:21 +02:00

worker.py

fix: comprehensive system audit fixes (55+ issues)

2026-07-31 00:58:05 +02:00