Agent Zero
824686c673
fix(security): F02 (Astra P0) — globale Login-Identitaet von Mandantenverwaltung trennen
...
Vorher: Ein Mandanten-Admin (users:write) konnte die globale User.email
und das Passwort JEDES Mitglieds seines Mandanten aendern. User ist
aber mandantenuebergreifend — derselbe Datensatz traegt Passwort und
Systemadmin-Flag; der Passwort-Reset nutzt die veraenderbare Adresse.
Ein Admin aus Mandant A konnte so die globale Reset-Adresse eines
gemeinsamen Benutzers umlenken (Astra-Repro: globale Feldaenderung
isoliert reproduziert).
Fix (routes/users.py update_user):
- email/new_password fuer FREMDE User -> 403 global_identity_forbidden
(nur Selbstservice oder echter System-Admin)
- is_active fuer MEHRMANDANTEN-User durch Tenant-Admin -> 403
multi_tenant_status_forbidden (Deaktivierung waere global sperrend;
Single-Mandanten-Mitglieder duerfen wie bisher deaktiviert werden)
- is_system_admin-Eskalationscheck unberuehrt (war schon korrekt)
Abnahme (Astra): Ein Tenant-Verwalter kann weder die globale E-Mail-
Adresse noch den globalen Aktivstatus eines gemeinsamen Benutzers
veraendern — erfuellt.
Tests: test_user_service.py 13/13 (5 neue F02-Tests: fremde E-Mail 403,
fremdes Passwort 403, Mehrmandanten-Deaktivierung 403, Name-Aenderung
bleibt 200, Selbstservice bleibt 200). ruff clean.
2026-09-17 22:58:38 +02:00
..
2026-06-29 08:02:14 +02:00
2026-09-13 02:25:01 +02:00
2026-08-06 22:05:15 +02:00
2026-07-29 12:28:08 +02:00
2026-09-17 22:48:59 +02:00
2026-08-16 01:17:18 +02:00
2026-08-16 01:30:02 +02:00
2026-08-17 16:40:55 +02:00
2026-08-16 01:30:02 +02:00
2026-08-16 01:30:02 +02:00
2026-08-24 07:57:27 +02:00
2026-07-23 20:41:45 +02:00
2026-08-16 01:30:02 +02:00
2026-08-16 01:17:18 +02:00
2026-08-23 21:44:01 +02:00
2026-09-13 02:35:52 +02:00
fix: connect 10 unconnected backend modules to real code paths (context_builder→agent_runner, agent_permissions→agent_runner, agent_tools→agent_runner, data_policy→agent_runner, oversight→agent_runner+migration 0128, transparency→agent_runner, agent_stream→agent_routes SSE endpoint, agent_memory AI-module deleted, decision_guard→engine, require_approval→agent_runner), 11 integration tests passing
2026-08-19 16:25:20 +02:00
2026-08-24 13:55:25 +02:00
2026-08-27 11:03:24 +02:00
2026-07-24 01:32:08 +02:00
2026-08-16 01:30:02 +02:00
2026-08-16 01:17:18 +02:00
2026-08-24 21:16:08 +02:00
2026-08-16 01:30:02 +02:00
2026-07-25 21:03:46 +02:00
2026-08-16 01:30:02 +02:00
2026-09-13 02:25:01 +02:00
2026-09-13 02:25:01 +02:00
2026-08-29 02:48:31 +02:00
2026-08-16 01:30:02 +02:00
2026-08-13 21:33:14 +02:00
2026-08-25 17:06:24 +02:00
2026-08-20 13:34:27 +02:00
2026-08-16 01:17:18 +02:00
2026-08-29 01:27:24 +02:00
2026-08-16 01:30:02 +02:00
2026-08-16 01:30:02 +02:00
2026-08-30 22:22:20 +02:00
2026-08-12 20:47:43 +02:00
2026-08-27 00:40:36 +02:00
2026-06-29 20:48:58 +02:00
2026-08-16 01:30:02 +02:00
2026-08-29 09:49:16 +02:00
2026-08-29 18:05:55 +02:00
2026-08-16 01:30:02 +02:00
2026-08-12 20:47:43 +02:00
2026-08-13 21:33:14 +02:00
2026-08-16 01:17:18 +02:00
2026-08-25 23:48:22 +02:00
2026-08-26 01:06:23 +02:00
2026-08-23 14:17:02 +02:00
2026-08-13 21:33:14 +02:00
2026-08-16 01:17:18 +02:00
2026-07-01 23:15:35 +02:00
2026-07-26 23:15:34 +02:00
2026-08-13 22:43:33 +02:00
2026-08-13 20:54:15 +02:00
2026-08-13 16:22:05 +02:00
2026-08-30 22:22:20 +02:00
2026-08-31 00:15:44 +02:00
2026-08-31 01:07:56 +02:00
2026-08-25 20:13:40 +02:00
2026-08-26 14:33:30 +02:00
2026-07-26 23:15:34 +02:00
2026-08-16 01:17:18 +02:00
2026-07-23 23:02:07 +02:00
2026-08-16 01:17:18 +02:00
2026-08-30 13:00:33 +02:00
2026-07-01 23:15:35 +02:00
2026-09-01 10:27:23 +02:00
2026-09-01 23:23:15 +02:00
2026-09-01 23:23:15 +02:00
2026-08-16 01:17:18 +02:00
2026-08-13 21:19:41 +02:00
2026-08-16 01:30:02 +02:00
2026-08-13 21:33:14 +02:00
2026-08-02 23:47:29 +02:00
2026-08-03 15:20:06 +02:00
2026-08-26 23:17:38 +02:00
2026-07-25 21:03:46 +02:00
2026-08-12 20:47:43 +02:00
2026-08-20 13:56:52 +02:00
2026-08-22 07:56:50 +02:00
2026-08-12 20:47:43 +02:00
2026-08-25 22:02:59 +02:00
2026-08-25 22:02:59 +02:00
2026-08-20 23:33:29 +02:00
2026-08-18 23:17:33 +02:00
2026-08-21 01:34:48 +02:00
2026-08-21 01:58:46 +02:00
2026-08-24 21:12:58 +02:00
2026-08-27 13:32:51 +02:00
2026-08-01 23:29:20 +02:00
2026-08-27 09:58:21 +02:00
2026-08-12 20:47:43 +02:00
2026-08-13 17:51:04 +02:00
2026-09-13 02:25:01 +02:00
2026-06-30 01:12:33 +02:00
2026-08-13 16:25:17 +02:00
2026-08-12 20:47:43 +02:00
2026-08-04 14:34:06 +02:00
2026-08-16 01:17:18 +02:00
2026-08-25 22:48:12 +02:00
2026-08-16 01:30:02 +02:00
2026-07-26 23:15:34 +02:00
2026-08-13 20:39:32 +02:00
2026-08-17 16:40:55 +02:00
2026-08-19 00:05:42 +02:00
2026-08-25 22:02:59 +02:00
2026-08-13 16:32:24 +02:00
2026-08-16 01:30:02 +02:00
2026-08-16 01:30:02 +02:00
2026-08-16 01:30:02 +02:00
2026-08-13 21:04:46 +02:00
2026-08-14 01:34:58 +02:00
2026-08-12 20:47:43 +02:00
2026-08-17 18:51:22 +02:00
2026-08-12 20:47:43 +02:00
2026-09-17 22:58:38 +02:00
2026-08-17 16:02:17 +02:00
2026-07-26 23:15:34 +02:00
2026-09-14 07:55:07 +02:00
2026-08-16 01:30:02 +02:00
2026-08-31 23:17:54 +02:00
2026-08-16 01:17:18 +02:00
2026-08-13 16:43:54 +02:00