Agent Zero 47432651f1 fix(security): F03 (Astra P1) — Sitzungswiderruf in beiden Session-Stores durchsetzen ...

Vorher (Astra-Finding): Widerruf war inkonsistent ueber vier Pfade:
- Deaktivierung invalidierte nur den Berechtigungscache — Sessions
  liefen bis TTL (8h) weiter
- Loeschung invalidierte GAR NICHTS
- Passwortwechsel loeschte nur Redis-Sessions — PostgreSQL-Fallback-
  Sessions ueberlebten jeden Redis-Ausfall
- Fehlende UserTenant-Mitgliedschaft wurde durchgewinkt statt
  abgewiesen

Fix:
- Neuer zentraler Helfer revoke_user_sessions_all_stores (app/core/auth.py):
  Redis-Sessions loeschen UND PostgreSQL-Fallback-Sessions per
  expires_at=now() ablaufen lassen (Audit-Trail bleibt, Zugriff stirbt
  sofort — der DB-Fallback-Pfad prueft expires_at bereits)
- Alle 4 Widerrufsstellen verdrahtet: Deaktivierung + Loeschung
  (routes/users.py), Passwortwechsel (user_service.py), Passwort-Reset
  (auth_service.py)
- Membership-Check in get_current_user fail-closed: None (fehlende
  Mitgliedschaft) wird abgewiesen statt durchgelassen

Abnahme (Astra): Deaktivierung, Austritt und Passwortwechsel wirken
unmittelbar — auch bei Redis-Ausfall (Unit-Test beweist die
DB-Fallback-Abgelaufen-Rejection).

Tests: test_s1_security_guards.py 10/10 (3 neue F03-Tests) +
test_auth.py 11/11 + ruff clean.

2026-09-18 07:59:31 +02:00

..

__init__.py

fix: remove broken service re-exports from __init__.py — fixes ImportError on startup

2026-07-04 18:14:30 +02:00

address_service.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

attachment_service.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

auth_service.py

fix(security): F03 (Astra P1) — Sitzungswiderruf in beiden Session-Stores durchsetzen

2026-09-18 07:59:31 +02:00

backup_service.py

fix(d2): datetime.now(UTC) everywhere + SQLITE-001 automation tests on ephemeral postgres

2026-08-24 01:22:42 +02:00

bank_account_service.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

bulk_permission_service.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

contact_folder_permission_service.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

contact_folder_service.py

fix: BUG-073 (broken imports), BUG-009 (contact folders id=None), BUG-014 (tags assign 500), BUG-016 (search performance use_ai), BUG-030 (user delete GRANT DELETE), BUG-052 (miniapps response), BUG-047 (approval_requests columns), BUG-037 (compliance refresh), prestart.sh GRANT DELETE

2026-08-22 07:10:25 +02:00

contact_service.py

feat(N3): Backend respektiert X-Workspace-ID bei Listen — contacts/dms/mail/calendar (#367)

2026-09-01 10:27:23 +02:00

currency_service.py

feat(core): add currency service

2026-07-04 00:21:42 +00:00

custom_field_service.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

dedup_service.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

delegation_service.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

entity_history_service.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

entity_permission_service.py

fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)

2026-09-13 02:25:01 +02:00

group_service.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

import_export_helpers.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

import_export_jobs.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

import_export_service.py

feat(#359): W4a Phase 1 — Import/Export Contribution-Architektur Kern

2026-08-27 21:11:14 +02:00

owner_transfer_service.py

feat(UI-Overhaul-Phase2): AI Assistent in Kommunikation integriert

2026-08-21 13:34:54 +02:00

permission_audit.py

fix(permissions): fix 10 high-priority permission system issues

2026-08-06 12:05:09 +02:00

permission_cache.py

feat(permissions): ABAC integration, principals caching, cache version validation

2026-08-06 22:05:15 +02:00

permission_resolver.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

permission_template_service.py

sprint14-19: ABAC UI rule editor + permission templates + bulk share + analytics + delegation + resolution strategies + migrations 0056-0058

2026-07-29 02:47:03 +02:00

plugin_service.py

fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)

2026-09-13 02:25:01 +02:00

policy_service.py

fix(tests): backend test suite - app version, DB roles, admin RBAC, companies route, field names, DeletionLog, ABAC, imports

2026-08-08 08:09:23 +02:00

role_service.py

Fix Bug 3+4+6: permission_version bump, denied_permissions, soft-delete

2026-07-20 23:13:45 +00:00

saved_filter_service.py

sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

2026-07-29 01:52:47 +02:00

sequence_service.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

system_settings_service.py

feat: punkt 6 (backup) — ARQ cron job, backup config in settings, backup-now trigger, backup history, migration 0130

2026-08-20 13:47:35 +02:00

tax_service.py

feat(core): add tax rate service

2026-07-04 00:23:14 +00:00

tenant_service.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

user_service.py

fix(security): F03 (Astra P1) — Sitzungswiderruf in beiden Session-Stores durchsetzen

2026-09-18 07:59:31 +02:00

webhook_service.py

fix(webhooks): JSONB-Containment statt .any() auf JSON-Spalte — behebt 158 fehlgeschlagene Outbox-Events

2026-09-14 07:55:07 +02:00

workflow_service.py

fix(i-c): BUG-036 behoben — Workflow-Instances GET lieferte 500 auf jeden Aufruf (Route übergab user_id/is_system_admin die die Service-Signatur nicht akzeptierte → TypeError); Service um optionale User-Filterung erweitert (Nicht-Admins sehen nur eigene Instanzen via initiated_by, Admins alle); Beweistest test_bug036_instances.py 2/2 grün

2026-08-24 21:16:08 +02:00

workspace_scope_service.py

feat(N4): Restliche Module — Tasks/Kommunikation/Wiki/Reports/Agents/Tags/Search + Navigation + Dashboard-Schnittstelle (#368)

2026-09-01 23:23:15 +02:00

workspace_service.py

fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)

2026-09-13 02:25:01 +02:00