leocrm/codebase-vs-requirements.md

# LeoCRM — Codebase vs Requirements (IST-Stand Juli 2026)

**Datum:** 2026-07-23
**Prüfer:** Agent Zero
**Methode:** Vollständige Code-Inspektion gegen requirements.md und architecture.md

---

## 1. Aktueller Stack

| Komponente | Code-Realität | Requirements | Status |
|------------|-------------|-------------|--------|
| Backend | FastAPI 0.115+ | FastAPI | ✅ kompatibel |
| Python | 3.12 (Dockerfile) | 3.12 | ✅ kompatibel |
| Datenbank | PostgreSQL 16 + asyncpg | PostgreSQL 16 | ✅ erfüllt |
| ORM | SQLAlchemy 2.0 async | SQLAlchemy 2.0 | ✅ erfüllt |
| Frontend | React 18 SPA (Vite) | React SPA | ✅ erfüllt |
| Auth | Session-based (Redis + HttpOnly Cookie) | Session-based | ✅ erfüllt |
| Deployment | Docker Multi-Stage + Coolify | Docker + Coolify | ✅ erfüllt |
| Testing | pytest + httpx (Backend), Vitest (Frontend) | pytest + Vitest + Playwright | ⚠️ Playwright fehlt |
| KI | LiteLLM + PydanticAI | KI-Copilot | ✅ erfüllt + erweitert |
| Search | pgvector + FTS Hybrid (RRF Fusion) | FTS | ✅ übertroffen |

## 2. Projekt-Struktur (IST)

```
app/
├── main.py                 — FastAPI app, lifespan, middleware, router wiring
├── config.py               — Pydantic Settings (env: LEOCRM_*)
├── deps.py                 — Auth dependencies, require_permission
├── core/
│   ├── auth.py             — Session auth, bcrypt, Redis session store
│   ├── tenant.py           — Tenant-scoping ORM filter
│   ├── permissions.py      — RBAC resolver with Redis cache
│   ├── permission_registry.py — Central permission catalog
│   ├── event_bus.py        — In-process async event bus
│   ├── service_container.py — DI container
│   ├── cache.py            — Redis cache wrapper
│   ├── jobs.py             — ARQ job queue integration
│   ├── worker.py           — ARQ worker configuration
│   ├── audit.py            — Audit log + deletion log
│   ├── notifications.py    — Notification service
│   ├── monitoring.py       — Prometheus metrics + structlog
│   ├── rate_limit.py       — Redis-based rate limiting
│   ├── middleware.py       — CSRF, CORS, request logging
│   └── seeds.py            — Seed data
├── models/                 — 20 SQLAlchemy models (all with TenantMixin)
├── schemas/                — 19 Pydantic schema modules
├── services/               — 18 service modules
├── routes/                 — 22 FastAPI routers
├── plugins/
│   ├── base.py             — BasePlugin class
│   ├── manifest.py         — PluginManifest, PluginRouteDef
│   ├── registry.py         — PluginRegistry (698 lines)
│   ├── migration_runner.py — Plugin DB migration runner
│   └── builtins/           — 12 built-in plugins
├── workflows/
│   ├── engine.py           — Workflow execution engine (306 lines)
│   └── code/onboarding.py  — Onboarding workflow
├── ai/
│   ├── llm_client.py       — LLM client (LiteLLM migration pending)
│   └── action_mapper.py    — NL→API action mapping
└── utils/

frontend/
├── src/
│   ├── pages/              — 27 pages (~7.826 lines)
│   ├── components/         — 70 components (~13.893 lines)
│   ├── api/                — 12 API modules (~3.456 lines)
│   ├── store/ + stores/    — 5 Zustand stores (~461 lines)
│   ├── hooks/              — 5 custom hooks (~247 lines)
│   ├── i18n/               — DE + EN (750 keys each)
│   └── routes/             — Router + ProtectedRoute
├── package.json            — 26 deps, 15 devDeps
├── vite.config.ts          — React + Vitest + proxy
└── tailwind.config.js      — Design tokens, dark mode
```

## 3. Requirements-Erfüllung

### Core Features (v1)

| Feature | Status | Anmerkung |
|---------|--------|-----------|
| F-AUTH-01: Login/Logout | ✅ | Session + Redis + bcrypt |
| F-AUTH-03: User Management | ✅ | CRUD + RBAC |
| F-AUTH-04: RBAC | ✅ | Role + Groups + Field-Level |
| F-AUTH-05: Password Reset | ✅ | Token-based, 1h expiry |
| F-AUTH-06: Custom Roles | ✅ | Role editor in frontend |
| F-AUTH-07: Multi-Tenant | ✅ | ORM filter + RLS (Migration 0015) |
| F-COMP-01-08: Company CRUD | ⚠️ | Unified Contact Model — Company = Contact type='company'. Company-Routes werden entfernt (Phase 1) |
| F-CONT-01-08: Contact CRUD | ✅ | Unified Contact mit type='company'\|'person' + ContactPerson 1:N |
| F-CORE-01: Event Bus | ✅ | In-process async, 53 Zeilen |
| F-CORE-02: Multi-Tenant | ✅ | TenantMixin + RLS |
| F-CORE-03: Plugin System | ✅ | 12 Plugins, Registry, Manifest, Lifecycle |
| F-CORE-07: ARQ Job Queue | ✅ | Redis-based, worker.py |
| F-CORE-08: Caching | ✅ | Redis cache wrapper |
| F-CORE-10: Storage | ❌ | Architecture beschreibt StorageBackend, aber NICHT implementiert. Hardcoded Pfade. (Phase 0.16) |
| F-DATA-03: Validation | ✅ | Pydantic auf allen Inputs |
| F-DATA-04: PostgreSQL | ✅ | PostgreSQL 16 + asyncpg |
| F-PLUGIN-01-02: Plugin System | ✅ | Registry, Manifest, Lifecycle, Migration Runner |
| F-SEC-01: CSRF | ✅ | SameSite=Strict + Origin validation |
| F-SEC-02: CSP | ✅ | In architecture definiert (Nginx fehlt — Phase 0) |
| F-SEARCH-01: Global Search | ✅ | Hybrid FTS + Vector + RRF + KI Query Understanding |
| F-AI-01: KI-Copilot | ✅ | LiteLLM + PydanticAI + tool_registry |
| F-WF-01: Workflow Engine | ✅ | 306 Zeilen, 4 Step-Types (action/approval/notification/condition) |
| F-INFRA-01: Health Check | ✅ | /api/v1/health |
| F-INFRA-04: Monitoring | ✅ | Prometheus + structlog |
| F-PERF-01: Performance | ⚠️ | Indizes vorhanden, aber kein Virtual Scrolling (Phase 2) |
| F-TEST-01: Testing | ⚠️ | Backend + Frontend Tests da, E2E fehlt (Phase 5) |

### Plugin Features (v2)

| Plugin | Status | Anmerkung |
|--------|--------|-----------|
| Calendar | ✅ | 12 Komponenten, ICS, Kanban, Resources, Subtasks |
| DMS | ✅ | 9 Komponenten, OnlyOffice (→Collabora Phase 0.20), Share, Bulk |
| Mail | ✅ | 13 Komponenten, PGP, Vacation, Rules, Templates, IMAP/SMTP |
| Tags | ✅ | TagPicker, TagCloud, BulkTagDialog |
| Permissions | ✅ | File/folder permissions, share links |
| Entity Links | ✅ | File↔Entity links |
| Unified Search | ✅ | Hybrid FTS+Vector, 5 Provider, KI Query Understanding |
| AI Assistant | ✅ | Multi-provider LLM, Agents, Tools, Streaming |
| AI Proactive | ✅ | Context-aware suggestions, SSE, Heartbeat, Deep Analysis |
| Kommunikation | ✅ | WebSocket messaging, MiniApps, Rich Content Blocks |
| Report Generator | ⚠️ | Backend da (CSV/Excel/JSON), Frontend fehlt, PDF fehlt (Phase 5.18-5.19) |
| System Notifications | ✅ | Participant handler, notification types |

## 4. Bekannte Lücken (im MASTER-PLAN.md eingeplant)

| Lücke | Phase | Task |
|-------|-------|------|
| Storage Backend (S3) | 0 | 0.16 |
| Company-Routes entfernen | 1 | 1.1-1.20 |
| Plugin-UI-System (PluginRegistry) | 3 | 3.1-3.10 |
| Automation & Agents Plugin | 3.5 | 3.11-3.32 |
| KI-UI-Steuerung | 4 | 4.1-4.12 |
| E2E Tests (Playwright) | 5 | 5.4-5.11 |
| Backup-System | 5 | 5.15 |
| MCP Integration | 5 | 5.16-5.17 |
| Report Frontend + PDF | 5 | 5.18-5.19 |
| Custom Fields UI | 5 | 5.20 |
| Tasks-Plugin | 5 | 5.21 |
| Saved Searches | 5 | 5.22 |
| Deduplication | 5 | 5.23 |
| PWA | 5 | 5.24 |
| Dashboard-System | 5 | 5.25 |
| Code-Splitting | 2 | 2.1-2.7 |
| Virtual Scrolling | 2 | 2.2-2.6 |
| RHF + Zod überall | 6 | 6.1-6.6 |
| AGPL-Lizenzen (PyMuPDF, OnlyOffice) | 0 | 0.20 |
| RBAC in 4 Plugins | 0 | 0.10 |
| Undo/History | 0 | 0.15 |
| .env in Git | 0 | 0.18 |
| Mail-Salt hardcoded | 0 | 0.19 |

## 5. Statistik

| Metrik | Wert |
|--------|------|
| Backend Python-Zeilen | ~35.800 |
| Frontend TS/TSX-Zeilen | ~30.000 |
| Test-Zeilen (Backend) | ~17.300 |
| Test-Zeilen (Frontend) | ~3.045 |
| Plugins | 12 |
| API-Endpoints | ~120+ |
| DB-Migrationen | 22 |
| UI-Komponenten | 12 (+2 zusätzliche) |
| Frontend Pages | 27 |
| i18n Keys (pro Sprache) | 750 |

## 6. Fazit

Die Codebase hat den ursprünglichen Requirements-Review (der SQLite, Jinja2, keine Plugins beschrieb) **weit übertroffen**. Das unified Contact Model, das Plugin-System, die KI-Integration und die Vector Search sind implementiert und funktionieren.

Die verbleibenden Lücken sind im `MASTER-PLAN.md` detailliert eingeplant (~590h Gesamt-Aufwand über 8 Phasen + Phase 3.5).