Agent Zero
62 lines
2.6 KiB
Markdown
62 lines
2.6 KiB
Markdown
# RBAC Build Progress — LeoCRM
|
|
|
|
## Letztes Update: 2026-07-29 02:00 CEST
|
|
|
|
## Sprint 1 — Fundament (14h) ✅ VOLLSTÄNDIG
|
|
|
|
Alle Items erledigt und in Produktion. Siehe vorherige Commits.
|
|
|
|
## Sprint 2 — Row-Level Security (16h) ✅ GRÖSSTEILS FERTIG
|
|
|
|
### Erledigt ✅
|
|
- [x] apply_visibility_filter() Helper (`app/core/visibility.py`, 237 Zeilen)
|
|
- [x] Query-Filter in contact_service (list, get, create, update, delete, export)
|
|
- [x] Query-Filter in 8 weiteren Services (address, attachment, bank_account, workflow, sequence, saved_filter, saved_view, webhook)
|
|
- [x] 8 Routes angepasst (user_id + is_system_admin + PermissionError handling)
|
|
- [x] BaseSearchProvider mit Visibility-Filter (`app/plugins/builtins/unified_search/base_provider.py`)
|
|
- [x] Frontend Permission-Checks: ContactDetailPage + ContactDetail + ContactsList
|
|
- [x] Field-Level UI: hidden fields nicht gerendert, readonly disabled
|
|
- [x] OwnedMixin auf 8 Models korrigiert (Klassendefinition)
|
|
- [x] Alles deployed und committed (52a5c34)
|
|
|
|
### Noch offen ⬜
|
|
- [ ] Child-Entity-Vererbung (ContactPerson erbt von Contact)
|
|
- [ ] Copy/Duplicate Permission
|
|
- [ ] EXISTS-Optimization für RLS (bereits in visibility.py verwendet)
|
|
- [ ] Weitere 12 Routes (notifications, entity_history, custom_fields, etc.)
|
|
|
|
## Sprint 3-23 ⬜
|
|
|
|
---
|
|
|
|
## Migrationen
|
|
| # | Beschreibung | Status |
|
|
|---|-------------|:---:|
|
|
| 0048 | contact_folder_permissions Tabelle | ✅ |
|
|
| 0049 | entity_permissions Tabelle | ✅ |
|
|
| 0050 | owner_id auf 15 Tabellen | ✅ |
|
|
| 0051 | Folder ACLs → entity_permissions | ✅ |
|
|
| 0052 | RLS Policies auf contacts | ✅ |
|
|
|
|
## Git Commits
|
|
| Hash | Beschreibung |
|
|
|------|-------------|
|
|
| cc021cd | feat: folder permissions (ACLs) |
|
|
| 5afa1fa | sprint1: entity_permissions + owned_mixin + service + API + migrations 0049+0050 |
|
|
| 48647a5 | sprint1: set_user_context + RLS policies + folder ACL migration 0051+0052 |
|
|
| ea1c1d5 | sprint1 complete: rate limiting on permission changes |
|
|
| 479ee04 | sprint2: visibility filter + contact service access checks |
|
|
| 9fc84b7 | sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider |
|
|
| 52a5c34 | sprint2: frontend permission checks for ContactDetail + ContactsList |
|
|
|
|
## Was in Produktion läuft
|
|
- entity_permissions Tabelle (universelle ACLs)
|
|
- owner_id auf 15 Tabellen
|
|
- PostgreSQL RLS auf contacts (4 Policies)
|
|
- set_user_context() bei jedem Request
|
|
- Universelle Permission API unter /api/v1/permissions/*
|
|
- Rate Limiting auf Permission-Änderungen
|
|
- Visibility Filter in 9 Services (contacts + 8 weitere)
|
|
- Frontend Permission-Checks in ContactDetail + ContactsList
|
|
- BaseSearchProvider für Permission-aware Search
|