Agent Zero
7fbbe420bd
Check Cross-Plugin Imports / check (push) Has been cancelled
CRITICAL: - Fix SQL injection in prestart.sh (parameterized query) - Fix secret key validation (always validate, not just production) - Fix workspace model partial index bug (func.text -> text) - Fix HealthResponse schema (add checks field) - Fix Tenant import in permissions.py (NameError on every auth request) - Fix README tech stack (React instead of Alpine.js) - Delete broken test_cross_tenant_security_v2.py - Add fail-closed RLS migration 0084 (48 tenant tables) HIGH: - Add GeneralRateLimitMiddleware for all API routes - Add file type blocklist for DMS and attachment uploads - Fix guest auth: Pydantic schema, tenant_slug required, CSRF bypass - Fix CSRF bypass path matching (in -> endswith) - Add worker healthcheck in docker-compose.yml - Add ARQ max_tries=3 for job retries - Fix 28 bare pass in mail services (-> logger.debug) - Fix print() -> logger in main.py and ai_assistant - Fix duplicate email handling (catch IntegrityError -> 409) - Add session revocation (invalidate_all_user_sessions) - Add resource limits to all containers - Fix CORS default (localhost -> production domain) - Fix SameSite=Lax -> Strict - Fix Redis password visibility in healthcheck - Fix npm vulnerabilities (19 -> 9) - Fix Sidebar OOM (wildcard lucide import -> curated ICON_MAP) MEDIUM: - Localize ErrorBoundary to German - Wire Mail.tsx save/delete filter to API - Document system_notif plugin (no routes needed) - Fix datetime.utcnow() -> datetime.now(UTC) - Pin litellm version (>=1.0,<2.0) - Move CSRF token from sessionStorage to in-memory - Fix restore_backup error handling and transaction - Fix Dms.tsx useEffect cleanup - Add skip-to-content link for accessibility - Add selectinload imports to 3 services - Add .env.example missing variables - Fix AppShell/TopBar/Sidebar test mocks NEW TESTS: - test_guest_auth.py (6 tests) - test_user_service.py (8 tests) - test_backup_service.py (5 tests) NEW SCHEMAS: - saved_filter, saved_view, user_preference, workspace, entity_policy Tests: 22/22 PASSED
66 lines
2.4 KiB
Bash
66 lines
2.4 KiB
Bash
#!/bin/sh
|
|
# =============================================================================
|
|
# prestart.sh — Container entrypoint for CRM API container
|
|
#
|
|
# Responsibilities:
|
|
# 1. Run Alembic DB migrations (alembic upgrade head) using the owner user.
|
|
# 2. Set the crm_runtime password (for RLS-enforced app access).
|
|
# 3. Start uvicorn as PID 1 (so signals like SIGTERM are forwarded correctly).
|
|
#
|
|
# Notes:
|
|
# - `set -e` ensures the container crashes loudly if migrations fail.
|
|
# - The ARQ worker runs in a separate container (see worker.sh / docker-compose).
|
|
# - Migrations use MIGRATION_DATABASE_URL (crm_user, owner, can bypass RLS).
|
|
# - The app uses DATABASE_URL (crm_runtime, NOSUPERUSER, NOBYPASSRLS).
|
|
# =============================================================================
|
|
|
|
set -e
|
|
|
|
# Use MIGRATION_DATABASE_URL for alembic (falls back to DATABASE_URL for backwards compat)
|
|
export ALEMBIC_DATABASE_URL="${MIGRATION_DATABASE_URL:-$DATABASE_URL}"
|
|
|
|
# Configure alembic to use the migration database URL
|
|
export ALEMBIC_DATABASE_URL
|
|
|
|
echo "[prestart] $(date -u +%Y-%m-%dT%H:%M:%SZ) - Running alembic upgrade head (owner user)..."
|
|
# Temporarily override DATABASE_URL for alembic
|
|
DATABASE_URL="$ALEMBIC_DATABASE_URL" alembic upgrade head
|
|
echo "[prestart] DB migrations completed successfully."
|
|
|
|
# Set crm_runtime password if RUNTIME_DB_PASSWORD is set
|
|
if [ -n "$RUNTIME_DB_PASSWORD" ]; then
|
|
echo "[prestart] Setting crm_runtime password..."
|
|
python3 -c "
|
|
import asyncio
|
|
import os
|
|
from sqlalchemy.ext.asyncio import create_async_engine
|
|
from sqlalchemy import text
|
|
|
|
async def set_password():
|
|
db_url = os.environ.get('MIGRATION_DATABASE_URL', os.environ.get('DATABASE_URL', ''))
|
|
if not db_url:
|
|
print('[prestart] WARNING: No DB URL for password setup')
|
|
return
|
|
engine = create_async_engine(db_url)
|
|
pwd = os.environ.get('RUNTIME_DB_PASSWORD', '')
|
|
try:
|
|
async with engine.begin() as conn:
|
|
await conn.execute(text(
|
|
"ALTER ROLE crm_runtime WITH LOGIN PASSWORD :pwd NOSUPERUSER NOBYPASSRLS"
|
|
), {"pwd": pwd})
|
|
print('[prestart] crm_runtime password set.')
|
|
except Exception as e:
|
|
print(f'[prestart] WARNING: Could not set crm_runtime password: {e}')
|
|
finally:
|
|
await engine.dispose()
|
|
|
|
asyncio.run(set_password())
|
|
"
|
|
fi
|
|
|
|
echo "[prestart] Starting uvicorn on 0.0.0.0:8000 (workers=1)..."
|
|
exec uvicorn app.main:app \
|
|
--host 0.0.0.0 \
|
|
--port 8000 \
|
|
--workers 1
|