leocrm/ENTERPRISE_RBAC_PLAN.md

# Enterprise RBAC Plan — LeoCRM

## Gesamt: 23 Sprints, 74 Features, 230h

### Sprint 1 — Fundament (14h)
- [ ] entity_permissions Tabelle + expires_at + Migration 0049
- [ ] OwnedMixin + owner_id auf allen Models + Migration 0050
- [ ] Universeller Permission Service (CRUD + get_effective_access + get_visible_ids)
- [ ] Universelle Permission API (5 Endpoints)
- [ ] Redis-Cache für Entity-Permissions (Bitmap)
- [ ] PostgreSQL RLS Policies + set_user_context()
- [ ] Rate Limiting auf Permission-Änderungen
- [ ] Folder ACLs in entity_permissions migrieren (Migration 0051)

### Sprint 2 — Row-Level Security (16h)
- [ ] apply_visibility_filter() Helper
- [ ] Query-Filter in alle 28 Routes
- [ ] Child-Entity-Vererbung
- [ ] Batch-Resolution
- [ ] BaseSearchProvider mit Visibility-Filter
- [ ] ContactDetail/ContactsList Permission-Checks
- [ ] Copy/Duplicate Permission
- [ ] EXISTS-Optimization für RLS

### Sprint 3 — Search/Dashboard/Export (13h)
- [ ] GlobalSearch Visibility-Filter
- [ ] Two-Phase Search
- [ ] Search-Index Pre-Filter
- [ ] Dashboard-Counts pro User
- [ ] Export-Filter
- [ ] Reports-Filter
- [ ] Frontend-Filter für alle 4

### Sprint 4 — Field-Level komplett (10h)
- [ ] Custom Field Sensitivity
- [ ] Field Definitions für alle Entities + Plugin-Registration
- [ ] filter_fields_by_permission() in alle Responses
- [ ] Field-Level Permission Editor UI
- [ ] Frontend: readonly/hidden in ContactDetail + ContactsList + DMS + Mail + AI

### Sprint 5 — Sharing UI (8h)
- [ ] Universeller ShareDialog Komponente
- [ ] Share-Button in 8 Detail-Ansichten
- [ ] Owner-Spalte in 8 Listen
- [ ] Permission-UI (Buttons ausblenden)
- [ ] Permission-Expiration UI

### Sprint 6 — Notifications + Audit + Real-time (10h)
- [ ] Permission-Change-Notifications
- [ ] Audit-Trail für Permission-Änderungen
- [ ] Notification-Entity-Filter
- [ ] Real-time WebSocket Sync
- [ ] Redis Pub/Sub für WebSocket Fan-Out

### Sprint 7 — E-Mail Postfächer (8h)
- [ ] Mailbox owner_id + Migration
- [ ] Mailbox Permissions (entity_permissions)
- [ ] Mail Permission Migration
- [ ] Mail-Query-Filter
- [ ] Mail-Field-Level
- [ ] Frontend: Mailbox-Liste + Mail-Liste + Mail-Detail

### Sprint 8 — Plugin Entities (14h)
- [ ] DMS owner_id + Permissions + Migration
- [ ] Calendar owner_id + Permissions + Migration
- [ ] Tasks owner_id + Permissions + Migration
- [ ] Kommunikation RBAC Migration
- [ ] Entity Links Permission
- [ ] Tags Permission
- [ ] 15 Plugin Entity Registration
- [ ] DMS Permission Migration
- [ ] Folder-Path-Materialization
- [ ] Frontend Permission-Checks für DMS + Calendar + Tasks

### Sprint 9 — App-Sichtbarkeit (7h)
- [ ] Plugin Manifest permission Feld
- [ ] tenant_plugin_activation Tabelle + API
- [ ] Sidebar Permission-Filter
- [ ] TopBar Permission-Filter
- [ ] Settings-Navigation Permission-Filter
- [ ] Route-Guards (ProtectedRoute)

### Sprint 10 — Advanced Security + AI + WebSocket (18h)
- [ ] API-Token Scopes
- [ ] Webhook Scope Filter
- [ ] Workflow Scope Filter
- [ ] Contact Merge Permission-Check
- [ ] AI Copilot Permission-Aware (process_query + execute_action)
- [ ] AI Tool Registry
- [ ] AI System Prompt mit Permission-Context
- [ ] AI Proactive Permission-Aware
- [ ] AI UI Control Permission-Checks
- [ ] MCP Permission-Scopes
- [ ] Automation Permission-Checks
- [ ] WebSocket Permission-Checks
- [ ] Event Bus Permission-Filter
- [ ] Frontend: AI + Notifications + Workflows + DedupMerge

### Sprint 11 — Owner Management (5h)
- [ ] Owner-Transfer (Bulk) API
- [ ] Auto-Transfer bei User-Deaktivierung
- [ ] Backup/Restore Permissions
- [ ] Frontend Owner-Transfer-UI

### Sprint 12 — Zentrale Einstellungsseite (9h)
- [ ] Rechte-Settings-Page mit Tabs
- [ ] Freigaben-Übersicht (Admin-Dashboard)
- [ ] Audit-View für Permission-Changes
- [ ] CustomFields Sensitivity UI
- [ ] App-Sichtbarkeit-Tab

### Sprint 13 — ABAC Engine (18h)
- [ ] entity_policies Tabelle + Migration
- [ ] Policy-Engine: JSONB → SQLAlchemy Übersetzer
- [ ] apply_policy_filter() + Integration mit RBAC-Filter
- [ ] Policy-Cache (Redis) + Invalidation
- [ ] Policy Service (CRUD)
- [ ] Policy API (5 Endpoints)
- [ ] GIN-Indexes für ABAC
- [ ] Pre-compiled SQL Fragments
- [ ] Policy-Intersection-Optimization
- [ ] Materialized Policy Result

### Sprint 14 — ABAC UI (10h)
- [ ] ABAC Rule-Editor mit AND/OR Gruppen
- [ ] Feld-Auswahl (Core + Custom Fields)
- [ ] Vorschau + Test-Tool
- [ ] Custom Field ABAC Support (JSONB-Path)

### Sprint 15 — Templates & Automation (5h)
- [ ] permission_templates Tabelle + Migration
- [ ] Default-Policies für neue Entities
- [ ] Auto-Share bei Erstellung
- [ ] Frontend Template-Editor UI

### Sprint 16 — Mass & Bulk (4h)
- [ ] Bulk-Share API
- [ ] Mass-Operations
- [ ] Frontend Bulk-Share-UI

### Sprint 17 — Analytics & Konflikte (5h)
- [ ] Permission-Analytics API
- [ ] Konflikt-Erkennung
- [ ] Orphaned-Permissions-Cleanup
- [ ] Frontend Analytics-Dashboard

### Sprint 18 — Delegation (4h)
- [ ] permission_delegations Tabelle + Migration
- [ ] Delegation Service + API
- [ ] Abwesenheits-UI
- [ ] Auto-Expiry

### Sprint 19 — Resolution-Strategien (3h)
- [ ] Konfigurierbare Override-Regeln
- [ ] Tenant-Einstellung
- [ ] Frontend UI

### Sprint 20 — Tests (12h)
- [ ] Backend: Entity Permissions Tests
- [ ] Backend: ABAC Tests
- [ ] Backend: Performance Tests (100K Datensätze)
- [ ] Backend: Search Permission Tests
- [ ] Backend: WebSocket Permission Tests
- [ ] Frontend: ProtectedRoute Tests
- [ ] Frontend: Permission-UI Tests
- [ ] Frontend: ShareDialog Tests

### Sprint 21 — Dokumentation (3h)
- [ ] docs/permissions.md
- [ ] docs/permissions_plugin_dev.md
- [ ] Plugin Template mit Permission-Beispielen
- [ ] API-Docs

### Sprint 22 — Guest Access (28h)
- [ ] guest_users Tabelle + Migration
- [ ] Guest Auth (Login, Session, Logout)
- [ ] Guest Permission Resolution (Service + RLS)
- [ ] Guest Invitation Flow (Backend + E-Mail)
- [ ] Guest API (limited endpoints)
- [ ] Guest Frontend (vereinfachtes Layout + Views)
- [ ] Guest Permission Management UI (Settings)
- [ ] Guest Expiration & Auto-Cleanup
- [ ] Guest Audit Trail
- [ ] Guest Security (IP-Whitelist, Rate Limit, Watermarking)
- [ ] Guest Tests

### Sprint 23 — Infrastructure (4h)
- [ ] PgBouncer Setup
- [ ] Audit Log Partitioning
- [ ] Connection Pool Config

## Permission Levels
| Level | Sichtbar? | Bearbeiten? | Löschen? | Teilen? |
|-------|:---:|:---:|:---:|:---:|
| Owner | ✅ | ✅ | ✅ | ✅ |
| Admin | ✅ | ✅ | ✅ | ✅ |
| Write | ✅ | ✅ | ❌ | ❌ |
| Read | ✅ | ❌ | ❌ | ❌ |
| None | ❌ | ❌ | ❌ | ❌ |

## Architecture
- PostgreSQL RLS (Safety Net)
- Materialized View (user_entity_visibility)
- Redis Bitmap Cache
- Batch-Resolution
- GIN-Indexes (ABAC + JSONB)
- Folder-Path-Materialization (GiST)
- PgBouncer Connection Pool
- Redis Pub/Sub WebSocket Fan-Out
- Audit Log Partitioning