leocrm/codebase-vs-requirements.md

LeoCRM — Codebase vs Requirements (IST-Stand Juli 2026)

Datum: 2026-07-23 Prüfer: Agent Zero Methode: Vollständige Code-Inspektion gegen requirements.md und architecture.md

---

1. Aktueller Stack

Komponente	Code-Realität	Requirements	Status
Backend	FastAPI 0.115+	FastAPI	✅ kompatibel
Python	3.12 (Dockerfile)	3.12	✅ kompatibel
Datenbank	PostgreSQL 16 + asyncpg	PostgreSQL 16	✅ erfüllt
ORM	SQLAlchemy 2.0 async	SQLAlchemy 2.0	✅ erfüllt
Frontend	React 18 SPA (Vite)	React SPA	✅ erfüllt
Auth	Session-based (Redis + HttpOnly Cookie)	Session-based	✅ erfüllt
Deployment	Docker Multi-Stage + Coolify	Docker + Coolify	✅ erfüllt
Testing	pytest + httpx (Backend), Vitest (Frontend)	pytest + Vitest + Playwright	⚠️ Playwright fehlt
KI	LiteLLM + PydanticAI	KI-Copilot	✅ erfüllt + erweitert
Search	pgvector + FTS Hybrid (RRF Fusion)	FTS	✅ übertroffen

2. Projekt-Struktur (IST)

app/
├── main.py                 — FastAPI app, lifespan, middleware, router wiring
├── config.py               — Pydantic Settings (env: LEOCRM_*)
├── deps.py                 — Auth dependencies, require_permission
├── core/
│   ├── auth.py             — Session auth, bcrypt, Redis session store
│   ├── tenant.py           — Tenant-scoping ORM filter
│   ├── permissions.py      — RBAC resolver with Redis cache
│   ├── permission_registry.py — Central permission catalog
│   ├── event_bus.py        — In-process async event bus
│   ├── service_container.py — DI container
│   ├── cache.py            — Redis cache wrapper
│   ├── jobs.py             — ARQ job queue integration
│   ├── worker.py           — ARQ worker configuration
│   ├── audit.py            — Audit log + deletion log
│   ├── notifications.py    — Notification service
│   ├── monitoring.py       — Prometheus metrics + structlog
│   ├── rate_limit.py       — Redis-based rate limiting
│   ├── middleware.py       — CSRF, CORS, request logging
│   └── seeds.py            — Seed data
├── models/                 — 20 SQLAlchemy models (all with TenantMixin)
├── schemas/                — 19 Pydantic schema modules
├── services/               — 18 service modules
├── routes/                 — 22 FastAPI routers
├── plugins/
│   ├── base.py             — BasePlugin class
│   ├── manifest.py         — PluginManifest, PluginRouteDef
│   ├── registry.py         — PluginRegistry (698 lines)
│   ├── migration_runner.py — Plugin DB migration runner
│   └── builtins/           — 12 built-in plugins
├── workflows/
│   ├── engine.py           — Workflow execution engine (306 lines)
│   └── code/onboarding.py  — Onboarding workflow
├── ai/
│   ├── llm_client.py       — LLM client (LiteLLM migration pending)
│   └── action_mapper.py    — NL→API action mapping
└── utils/

frontend/
├── src/
│   ├── pages/              — 27 pages (~7.826 lines)
│   ├── components/         — 70 components (~13.893 lines)
│   ├── api/                — 12 API modules (~3.456 lines)
│   ├── store/ + stores/    — 5 Zustand stores (~461 lines)
│   ├── hooks/              — 5 custom hooks (~247 lines)
│   ├── i18n/               — DE + EN (750 keys each)
│   └── routes/             — Router + ProtectedRoute
├── package.json            — 26 deps, 15 devDeps
├── vite.config.ts          — React + Vitest + proxy
└── tailwind.config.js      — Design tokens, dark mode

3. Requirements-Erfüllung

Core Features (v1)

Feature	Status	Anmerkung
F-AUTH-01: Login/Logout	✅	Session + Redis + bcrypt
F-AUTH-03: User Management	✅	CRUD + RBAC
F-AUTH-04: RBAC	✅	Role + Groups + Field-Level
F-AUTH-05: Password Reset	✅	Token-based, 1h expiry
F-AUTH-06: Custom Roles	✅	Role editor in frontend
F-AUTH-07: Multi-Tenant	✅	ORM filter + RLS (Migration 0015)
F-COMP-01-08: Company CRUD	⚠️	Unified Contact Model — Company = Contact type='company'. Company-Routes werden entfernt (Phase 1)
F-CONT-01-08: Contact CRUD	✅	Unified Contact mit type='company'|'person' + ContactPerson 1:N
F-CORE-01: Event Bus	✅	In-process async, 53 Zeilen
F-CORE-02: Multi-Tenant	✅	TenantMixin + RLS
F-CORE-03: Plugin System	✅	12 Plugins, Registry, Manifest, Lifecycle
F-CORE-07: ARQ Job Queue	✅	Redis-based, worker.py
F-CORE-08: Caching	✅	Redis cache wrapper
F-CORE-10: Storage	❌	Architecture beschreibt StorageBackend, aber NICHT implementiert. Hardcoded Pfade. (Phase 0.16)
F-DATA-03: Validation	✅	Pydantic auf allen Inputs
F-DATA-04: PostgreSQL	✅	PostgreSQL 16 + asyncpg
F-PLUGIN-01-02: Plugin System	✅	Registry, Manifest, Lifecycle, Migration Runner
F-SEC-01: CSRF	✅	SameSite=Strict + Origin validation
F-SEC-02: CSP	✅	In architecture definiert (Nginx fehlt — Phase 0)
F-SEARCH-01: Global Search	✅	Hybrid FTS + Vector + RRF + KI Query Understanding
F-AI-01: KI-Copilot	✅	LiteLLM + PydanticAI + tool_registry
F-WF-01: Workflow Engine	✅	306 Zeilen, 4 Step-Types (action/approval/notification/condition)
F-INFRA-01: Health Check	✅	/api/v1/health
F-INFRA-04: Monitoring	✅	Prometheus + structlog
F-PERF-01: Performance	⚠️	Indizes vorhanden, aber kein Virtual Scrolling (Phase 2)
F-TEST-01: Testing	⚠️	Backend + Frontend Tests da, E2E fehlt (Phase 5)

Plugin Features (v2)

Plugin	Status	Anmerkung
Calendar	✅	12 Komponenten, ICS, Kanban, Resources, Subtasks
DMS	✅	9 Komponenten, OnlyOffice (→Collabora Phase 0.20), Share, Bulk
Mail	✅	13 Komponenten, PGP, Vacation, Rules, Templates, IMAP/SMTP
Tags	✅	TagPicker, TagCloud, BulkTagDialog
Permissions	✅	File/folder permissions, share links
Entity Links	✅	File↔Entity links
Unified Search	✅	Hybrid FTS+Vector, 5 Provider, KI Query Understanding
AI Assistant	✅	Multi-provider LLM, Agents, Tools, Streaming
AI Proactive	✅	Context-aware suggestions, SSE, Heartbeat, Deep Analysis
Kommunikation	✅	WebSocket messaging, MiniApps, Rich Content Blocks
Report Generator	⚠️	Backend da (CSV/Excel/JSON), Frontend fehlt, PDF fehlt (Phase 5.18-5.19)
System Notifications	✅	Participant handler, notification types

4. Bekannte Lücken (im MASTER-PLAN.md eingeplant)

Lücke	Phase	Task
Storage Backend (S3)	0	0.16
Company-Routes entfernen	1	1.1-1.20
Plugin-UI-System (PluginRegistry)	3	3.1-3.10
Automation & Agents Plugin	3.5	3.11-3.32
KI-UI-Steuerung	4	4.1-4.12
E2E Tests (Playwright)	5	5.4-5.11
Backup-System	5	5.15
MCP Integration	5	5.16-5.17
Report Frontend + PDF	5	5.18-5.19
Custom Fields UI	5	5.20
Tasks-Plugin	5	5.21
Saved Searches	5	5.22
Deduplication	5	5.23
PWA	5	5.24
Dashboard-System	5	5.25
Code-Splitting	2	2.1-2.7
Virtual Scrolling	2	2.2-2.6
RHF + Zod überall	6	6.1-6.6
AGPL-Lizenzen (PyMuPDF, OnlyOffice)	0	0.20
RBAC in 4 Plugins	0	0.10
Undo/History	0	0.15
.env in Git	0	0.18
Mail-Salt hardcoded	0	0.19

5. Statistik

Metrik	Wert
Backend Python-Zeilen	~35.800
Frontend TS/TSX-Zeilen	~30.000
Test-Zeilen (Backend)	~17.300
Test-Zeilen (Frontend)	~3.045
Plugins	12
API-Endpoints	~120+
DB-Migrationen	22
UI-Komponenten	12 (+2 zusätzliche)
Frontend Pages	27
i18n Keys (pro Sprache)	750

6. Fazit

Die Codebase hat den ursprünglichen Requirements-Review (der SQLite, Jinja2, keine Plugins beschrieb) weit übertroffen. Das unified Contact Model, das Plugin-System, die KI-Integration und die Vector Search sind implementiert und funktionieren.

Die verbleibenden Lücken sind im MASTER-PLAN.md detailliert eingeplant (~590h Gesamt-Aufwand über 8 Phasen + Phase 3.5).