leocrm/ENTERPRISE_RBAC_PLAN.md

Enterprise RBAC Plan — LeoCRM

Gesamt: 23 Sprints, 74 Features, 230h

Sprint 1 — Fundament (14h)

• entity_permissions Tabelle + expires_at + Migration 0049
• OwnedMixin + owner_id auf allen Models + Migration 0050
• Universeller Permission Service (CRUD + get_effective_access + get_visible_ids)
• Universelle Permission API (5 Endpoints)
• Redis-Cache für Entity-Permissions (Bitmap)
• PostgreSQL RLS Policies + set_user_context()
• Rate Limiting auf Permission-Änderungen
• Folder ACLs in entity_permissions migrieren (Migration 0051)

Sprint 2 — Row-Level Security (16h)

• apply_visibility_filter() Helper
• Query-Filter in alle 28 Routes
• Child-Entity-Vererbung
• Batch-Resolution
• BaseSearchProvider mit Visibility-Filter
• ContactDetail/ContactsList Permission-Checks
• Copy/Duplicate Permission
• EXISTS-Optimization für RLS

Sprint 3 — Search/Dashboard/Export (13h)

• GlobalSearch Visibility-Filter
• Two-Phase Search
• Search-Index Pre-Filter
• Dashboard-Counts pro User
• Export-Filter
• Reports-Filter
• Frontend-Filter für alle 4

Sprint 4 — Field-Level komplett (10h)

• Custom Field Sensitivity
• Field Definitions für alle Entities + Plugin-Registration
• filter_fields_by_permission() in alle Responses
• Field-Level Permission Editor UI
• Frontend: readonly/hidden in ContactDetail + ContactsList + DMS + Mail + AI

Sprint 5 — Sharing UI (8h)

• Universeller ShareDialog Komponente
• Share-Button in 8 Detail-Ansichten
• Owner-Spalte in 8 Listen
• Permission-UI (Buttons ausblenden)
• Permission-Expiration UI

Sprint 6 — Notifications + Audit + Real-time (10h)

• Permission-Change-Notifications
• Audit-Trail für Permission-Änderungen
• Notification-Entity-Filter
• Real-time WebSocket Sync
• Redis Pub/Sub für WebSocket Fan-Out

Sprint 7 — E-Mail Postfächer (8h)

• Mailbox owner_id + Migration
• Mailbox Permissions (entity_permissions)
• Mail Permission Migration
• Mail-Query-Filter
• Mail-Field-Level
• Frontend: Mailbox-Liste + Mail-Liste + Mail-Detail

Sprint 8 — Plugin Entities (14h)

• DMS owner_id + Permissions + Migration
• Calendar owner_id + Permissions + Migration
• Tasks owner_id + Permissions + Migration
• Kommunikation RBAC Migration
• Entity Links Permission
• Tags Permission
• 15 Plugin Entity Registration
• DMS Permission Migration
• Folder-Path-Materialization
• Frontend Permission-Checks für DMS + Calendar + Tasks

Sprint 9 — App-Sichtbarkeit (7h)

• Plugin Manifest permission Feld
• tenant_plugin_activation Tabelle + API
• Sidebar Permission-Filter
• TopBar Permission-Filter
• Settings-Navigation Permission-Filter
• Route-Guards (ProtectedRoute)

Sprint 10 — Advanced Security + AI + WebSocket (18h)

• API-Token Scopes
• Webhook Scope Filter
• Workflow Scope Filter
• Contact Merge Permission-Check
• AI Copilot Permission-Aware (process_query + execute_action)
• AI Tool Registry
• AI System Prompt mit Permission-Context
• AI Proactive Permission-Aware
• AI UI Control Permission-Checks
• MCP Permission-Scopes
• Automation Permission-Checks
• WebSocket Permission-Checks
• Event Bus Permission-Filter
• Frontend: AI + Notifications + Workflows + DedupMerge

Sprint 11 — Owner Management (5h)

• Owner-Transfer (Bulk) API
• Auto-Transfer bei User-Deaktivierung
• Backup/Restore Permissions
• Frontend Owner-Transfer-UI

Sprint 12 — Zentrale Einstellungsseite (9h)

• Rechte-Settings-Page mit Tabs
• Freigaben-Übersicht (Admin-Dashboard)
• Audit-View für Permission-Changes
• CustomFields Sensitivity UI
• App-Sichtbarkeit-Tab

Sprint 13 — ABAC Engine (18h)

• entity_policies Tabelle + Migration
• Policy-Engine: JSONB → SQLAlchemy Übersetzer
• apply_policy_filter() + Integration mit RBAC-Filter
• Policy-Cache (Redis) + Invalidation
• Policy Service (CRUD)
• Policy API (5 Endpoints)
• GIN-Indexes für ABAC
• Pre-compiled SQL Fragments
• Policy-Intersection-Optimization
• Materialized Policy Result

Sprint 14 — ABAC UI (10h)

• ABAC Rule-Editor mit AND/OR Gruppen
• Feld-Auswahl (Core + Custom Fields)
• Vorschau + Test-Tool
• Custom Field ABAC Support (JSONB-Path)

Sprint 15 — Templates & Automation (5h)

• permission_templates Tabelle + Migration
• Default-Policies für neue Entities
• Auto-Share bei Erstellung
• Frontend Template-Editor UI

Sprint 16 — Mass & Bulk (4h)

• Bulk-Share API
• Mass-Operations
• Frontend Bulk-Share-UI

Sprint 17 — Analytics & Konflikte (5h)

• Permission-Analytics API
• Konflikt-Erkennung
• Orphaned-Permissions-Cleanup
• Frontend Analytics-Dashboard

Sprint 18 — Delegation (4h)

• permission_delegations Tabelle + Migration
• Delegation Service + API
• Abwesenheits-UI
• Auto-Expiry

Sprint 19 — Resolution-Strategien (3h)

• Konfigurierbare Override-Regeln
• Tenant-Einstellung
• Frontend UI

Sprint 20 — Tests (12h)

• Backend: Entity Permissions Tests
• Backend: ABAC Tests
• Backend: Performance Tests (100K Datensätze)
• Backend: Search Permission Tests
• Backend: WebSocket Permission Tests
• Frontend: ProtectedRoute Tests
• Frontend: Permission-UI Tests
• Frontend: ShareDialog Tests

Sprint 21 — Dokumentation (3h)

• docs/permissions.md
• docs/permissions_plugin_dev.md
• Plugin Template mit Permission-Beispielen
• API-Docs

Sprint 22 — Guest Access (28h)

• guest_users Tabelle + Migration
• Guest Auth (Login, Session, Logout)
• Guest Permission Resolution (Service + RLS)
• Guest Invitation Flow (Backend + E-Mail)
• Guest API (limited endpoints)
• Guest Frontend (vereinfachtes Layout + Views)
• Guest Permission Management UI (Settings)
• Guest Expiration & Auto-Cleanup
• Guest Audit Trail
• Guest Security (IP-Whitelist, Rate Limit, Watermarking)
• Guest Tests

Sprint 23 — Infrastructure (4h)

• PgBouncer Setup
• Audit Log Partitioning
• Connection Pool Config

Permission Levels

Level	Sichtbar?	Bearbeiten?	Löschen?	Teilen?
Owner	✅	✅	✅	✅
Admin	✅	✅	✅	✅
Write	✅	✅	❌	❌
Read	✅	❌	❌	❌
None	❌	❌	❌	❌

Architecture

• PostgreSQL RLS (Safety Net)
• Materialized View (user_entity_visibility)
• Redis Bitmap Cache
• Batch-Resolution
• GIN-Indexes (ABAC + JSONB)
• Folder-Path-Materialization (GiST)
• PgBouncer Connection Pool
• Redis Pub/Sub WebSocket Fan-Out
• Audit Log Partitioning