Agent Zero 727d86614e Security fixes: P0-P2 complete (22 fixes) ...

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

2026-07-25 21:03:46 +02:00

..

__init__.py

feat: Mini-Apps registry, Stammdaten backend persistence, bank accounts

2026-07-25 02:11:29 +02:00

address.py

Phase 1C: Frontend unified contact UI

2026-07-23 17:17:32 +02:00

ai_conversation.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00

attachment.py

feat(core): remove duplicate deleted_at from Attachment (inherited from SoftDeleteMixin)

2026-07-04 00:31:47 +00:00

audit.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00

auth.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00

bank_account.py

feat: Mini-Apps registry, Stammdaten backend persistence, bank accounts

2026-07-25 02:11:29 +02:00

contact_folder.py

feat: Kontakt-Ordner mit Drag&Drop Baum (wie KI-Chat Sidebar)

2026-07-20 01:33:44 +02:00

contact_merge.py

Task 5.23: Deduplication / Merge — ContactMergeHistory model, dedup service, API routes (duplicates/merge/merge-history), DedupDialog frontend, i18n, 5 tests

2026-07-23 23:58:45 +02:00

contact.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

currency.py

B2: Currency.code — remove unique=True, add tenant-scoped UniqueConstraint

2026-07-04 01:30:03 +00:00

entity_history.py

Phase 0 Complete: Tasks 0.7-0.20

2026-07-23 08:42:26 +02:00

group.py

feat: granular RBAC system with user groups, deny-list, permission registry, system-admin, self-mod prevention

2026-07-15 21:59:45 +02:00

notification.py

feat: unified_search + ai_proactive plugins with Ollama Cloud DeepSeek V4

2026-07-18 11:21:51 +02:00

outbox.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

plugin.py

feat: Core Plugin system — is_core flag, topological sort dependency resolution, deactivation protection

2026-07-07 07:44:02 +02:00

role.py

Add deleted_at field to Role model for soft-delete

2026-07-20 23:13:46 +00:00

saved_filter.py

feat(5.22): Saved Searches / Smart Lists — reusable filters for list views

2026-07-23 23:44:50 +02:00

sequence.py

feat(core): remove duplicate deleted_at from Sequence (inherited from SoftDeleteMixin)

2026-07-04 00:31:46 +00:00

session.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00

system_settings.py

fix: Replace automation stubs with real execution engine

2026-07-25 02:52:07 +02:00

tax.py

feat(core): remove duplicate deleted_at from TaxRate (inherited from SoftDeleteMixin)

2026-07-04 00:31:45 +00:00

tenant.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00

user_preference.py

feat(5.2): add User Preferences API with full-stack implementation

2026-07-23 20:39:42 +02:00

user.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

workflow.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00