Files

T

Check Cross-Plugin Imports / check (push) Has been cancelled

Details

fix: close remaining security gaps, test fixes, frontend integration, event bus

- RCE: move _check_dangerous_imports() BEFORE exec_module() in plugins.py
- verify_ws_origin: reject empty Origin header when CORS configured
- Test: ai_app fixture with permission_registry init for ai_assistant
- Test: login_client sets CSRF token + Origin as client default headers
- Test: SESSION_COOKIE_SECURE=false override + get_settings.cache_clear()
- Test: asyncio_default_test_loop_scope=session fixes event loop closed
- Test: fix 15 assertions (paths, variables, auth expectations)
- Frontend: integrate SavedFilterBar in ContactsList, Mail, Calendar
- Frontend: integrate TagSelector in ContactsList, Mail, Calendar
- Event Bus: add 4 subscribers in system_notif (conversation/participant/reaction)
- Docs: update all analysis reports and FIX-PLAN-V2 to current state

2026-07-27 12:45:45 +02:00

4.4 KiB

Raw Blame History

Test Report — LeoCRM Fix Branch

Date: 2026-07-27 Branch: main (leocrm-fix)

Test Results

Backend: AI Copilot Tests (tests/test_ai_copilot.py)

76 passed, 2 warnings in 63.31s

AC Tests (all pass):

AC1: test_ac1_copilot_query_returns_proposed_actions ✅
AC2: test_ac2_copilot_execute_action_success ✅
AC3: test_ac3_copilot_execute_blocked_by_rbac ✅
AC4: test_ac4_copilot_history_paginated ✅
AC5: test_ac5_copilot_action_logged_in_audit ✅
AC6: test_ac6_copilot_tenant_isolation ✅
AC7: test_ac7_copilot_field_level_permissions ✅

Other tests fixed:

test_copilot_unauthenticated: Fixed 401→403 for POST (CSRF middleware returns 403)
test_route_copilot_history_unauthenticated: GET returns 401 (no CSRF needed)
test_route_copilot_execute_unauthenticated: Fixed 401→403 for POST
action_mapper tests: Updated /api/v1/companies → /api/v1/contacts (unified contact model)
llm_client tests: Fixed ai_client → client variable, api_base default ''
service tests: Updated /api/v1/companies → /api/v1/contacts, PATCH/DELETE return 400 (unsupported)

Frontend: TypeScript Type Check

cd frontend && npx tsc --noEmit
# Exit code 0 — no errors

Event Loop Fix

Added asyncio_default_fixture_loop_scope = "session" and asyncio_default_test_loop_scope = "session" to pyproject.toml to fix 'Event loop is closed' error when running multiple AI copilot tests in sequence.

Changes Summary

1. Backend Security Fixes

RCE Dead Code repariert (app/routes/plugins.py): Security-Check (_check_dangerous_imports) wurde VOR exec_module() verschoben. Zuvor war exec_module vor dem Security-Check, was eine RCE-Lücke war (auch wenn alle Upload-Endpoints deaktiviert waren).
verify_ws_origin verschärft (app/core/auth.py): Leerer Origin-Header wird jetzt abgelehnt (return False) wenn CORS konfiguriert ist, statt automatisch akzeptiert zu werden.

2. Test Infrastructure Fixes (conftest.py)

Neuer ai_app und ai_client Fixture mit init_permission_registry(active_plugin_names={'ai_assistant'})
login_client setzt jetzt CSRF-Token und Origin als Client-Default-Header
SESSION_COOKIE_SECURE=false und SESSION_COOKIE_SAMESITE=lax werden vor allen Imports gesetzt
get_settings.cache_clear() nach env-Override
pyproject.toml: asyncio_default_fixture_loop_scope = "session" und asyncio_default_test_loop_scope = "session" hinzugefügt
tests/test_ai_copilot.py: /api/v1/companies → /api/v1/contacts (Companies sind Contacts mit type='company'). 15 weitere Test-Fixes (action_mapper paths, llm_client variables, service test paths, unauthenticated test assertions).

3. Event Bus Lücken geschlossen

system_notif/plugin.py: Added conversation.created, participant.joined, participant.left, reaction.added to manifest events list
Added handler methods: on_conversation_created, on_participant_joined, on_participant_left, on_reaction_added
Added event titles for new events in _create_system_notification

4. Frontend Integration: SavedFilterBar

ContactsList.tsx: Added SavedFilterBar with entityType="contacts" in middle pane
Mail.tsx: Added SavedFilterBar with entityType="mail" in mail list pane
Calendar.tsx: Added SavedFilterBar with entityType="calendar" in calendar view pane

5. Frontend Integration: TagSelector

ContactsList.tsx: Added TagSelector with entityType="contact" in middle pane
Mail.tsx: Added TagSelector with entityType="file" in mail list pane
Calendar.tsx: Added TagSelector with entityType="calendar_entry" in calendar view pane

6. Event Loop Fix

pyproject.toml: Added asyncio_default_fixture_loop_scope and asyncio_default_test_loop_scope = "session"
Fixed 15 pre-existing test failures (action_mapper, llm_client, service tests) caused by unified contact model migration

Smoke Test

Backend: All 76 AI copilot tests pass including AC1-AC7
Frontend: TypeScript compilation passes with 0 errors
Event bus: system_notif plugin now subscribes to conversation.created, participant.joined/left, reaction.added
RCE Dead Code: Security-Check (_check_dangerous_imports) wird VOR exec_module() ausgeführt
verify_ws_origin: Leerer Origin-Header wird abgelehnt bei konfiguriertem CORS
conftest.py: ai_app/ai_client Fixtures mit ai_assistant Plugin-Aktivierung, CSRF-Token, Origin-Header
Frontend-Integration: SavedFilterBar und TagSelector in ContactsList, Mail, Calendar integriert

4.4 KiB Raw Blame History