Agent Zero
64 lines
2.4 KiB
Markdown
64 lines
2.4 KiB
Markdown
# RBAC Build Progress — LeoCRM
|
|
|
|
## Letztes Update: 2026-07-29 01:31 CEST
|
|
|
|
## Sprint 1 — Fundament (14h) ✅ VOLLSTÄNDIG
|
|
|
|
### Alle Items erledigt:
|
|
- [x] EntityPermission Model (`app/models/entity_permission.py`)
|
|
- [x] OwnedMixin (`app/models/owned_mixin.py`)
|
|
- [x] Migration 0049: entity_permissions Tabelle — ✅ Produktion
|
|
- [x] Migration 0050: owner_id auf 15 Tabellen — ✅ Produktion
|
|
- [x] Migration 0051: Folder ACLs → entity_permissions — ✅ Produktion
|
|
- [x] Migration 0052: RLS Policies auf contacts — ✅ Produktion
|
|
- [x] OwnedMixin auf 13 Models angewendet
|
|
- [x] Universeller Permission Service (648 Zeilen)
|
|
- [x] Universelle Permission API (6 Endpoints + Rate Limiting)
|
|
- [x] set_user_context() für RLS in db/__init__.py
|
|
- [x] deps.py: set_user_context() wird bei jedem Request aufgerufen
|
|
- [x] Rate Limiting auf Permission-Änderungen (50/min/User)
|
|
- [x] Container neu gestartet, alles deployed
|
|
- [x] Git committed und gepusht (ea1c1d5)
|
|
|
|
## Sprint 2 — Row-Level Security (16h) 🔄 NÄCHSTER
|
|
|
|
### Geplante Items:
|
|
- [ ] apply_visibility_filter() Helper
|
|
- [ ] Query-Filter in alle 28 Routes
|
|
- [ ] Child-Entity-Vererbung
|
|
- [ ] Batch-Resolution in Listen-Queries
|
|
- [ ] BaseSearchProvider mit Visibility-Filter
|
|
- [ ] ContactDetail/ContactsList Permission-Checks (Frontend)
|
|
- [ ] Copy/Duplicate Permission
|
|
- [ ] EXISTS-Optimization für RLS
|
|
|
|
## Sprint 3-23 ⬜
|
|
|
|
---
|
|
|
|
## Migrationen
|
|
| # | Beschreibung | Status |
|
|
|---|-------------|:---:|
|
|
| 0048 | contact_folder_permissions Tabelle | ✅ |
|
|
| 0049 | entity_permissions Tabelle | ✅ |
|
|
| 0050 | owner_id auf 15 Tabellen | ✅ |
|
|
| 0051 | Folder ACLs → entity_permissions | ✅ |
|
|
| 0052 | RLS Policies auf contacts | ✅ |
|
|
|
|
## Git Commits
|
|
| Hash | Beschreibung |
|
|
|------|-------------|
|
|
| cc021cd | feat: folder permissions (ACLs) |
|
|
| 5afa1fa | sprint1: entity_permissions + owned_mixin + service + API + migrations 0049+0050 |
|
|
| 48647a5 | sprint1: set_user_context + RLS policies + folder ACL migration 0051+0052 |
|
|
| ea1c1d5 | sprint1 complete: rate limiting on permission changes |
|
|
|
|
## Was in Produktion läuft
|
|
- entity_permissions Tabelle (universelle ACLs)
|
|
- owner_id auf 15 Tabellen (contacts, addresses, attachments, etc.)
|
|
- PostgreSQL RLS auf contacts (4 Policies: admin, owner, tenant-owned, shared)
|
|
- set_user_context() wird bei jedem Request gesetzt
|
|
- Universelle Permission API unter /api/v1/permissions/*
|
|
- Rate Limiting auf Permission-Änderungen
|
|
- Folder ACLs in entity_permissions migriert
|