Agent Zero 8ad0a19f25 Phase 5: AI/MCP Bearer-Auth + Delegationstoken + Audit ...

5.1 Delegationstoken (app/core/delegation_token.py):
- HMAC-SHA256 signiert mit SECRET_KEY, max 60s Lifetime
- Payload: user_id, tenant_id, agent_id, audience, expires_at, token_id
- Statelose Verifikation, Audience-Check, Expiry-Check

5.2 MCP Bearer-Auth:
- app/core/api_token.py: Token Service (create, verify, revoke, list)
- app/deps.py: get_current_user_bearer + get_current_user_or_bearer
- app/routes/api_tokens.py: Token CRUD Routes (create, list, revoke)
- MCP Server Routes: get_current_user_or_bearer akzeptiert Session + Bearer

5.3 Methodenrechte:
- MCP nutzt bereits mcp:read/mcp:write basierend auf tool_def.required_permission

5.5 Audit:
- MCP Tool-Ausfuehrung wird protokolliert (log_audit mit correlation_id)

Tests: 13/13 bestanden (7 API Token + 6 Delegation Token)

2026-08-03 14:06:55 +02:00

..

__init__.py

sprint20-23: tests + documentation + guest access + infrastructure + migrations 0059

2026-07-29 02:53:37 +02:00

addresses.py

sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

2026-07-29 01:52:47 +02:00

ai_copilot.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00

api_tokens.py

Phase 5: AI/MCP Bearer-Auth + Delegationstoken + Audit

2026-08-03 14:06:55 +02:00

attachments.py

fix: storage.load() → storage.read() for attachment download

2026-07-29 17:55:33 +02:00

audit.py

feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)

2026-07-15 22:35:50 +02:00

auth.py

phase1: separate DB roles, RLS restoration, login on crm_auth

2026-07-31 02:05:16 +02:00

backups.py

Phase 4: Webhooks, Backup/Restore UI, Onboarding/Tutorial

2026-07-26 03:17:40 +02:00

bank_accounts.py

sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

2026-07-29 01:52:47 +02:00

contact_folder_permissions.py

feat: folder permissions (ACLs) - share folders with users/groups, inherit to subfolders, permission dialog UI

2026-07-28 23:58:19 +02:00

contact_folders.py

perf: Fix all 7 code analysis issues

2026-07-25 09:19:32 +02:00

contacts.py

sprint10+11: AI permission filter + API token scopes + merge check + owner transfer service + auto-transfer on deactivation

2026-07-29 02:37:51 +02:00

currencies.py

feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)

2026-07-15 22:35:50 +02:00

custom_field_definitions.py

Phase 2: Tags UI, Custom Fields UI, Notifications Bell

2026-07-26 03:02:25 +02:00

custom_fields.py

Phase 2: Tags UI, Custom Fields UI, Notifications Bell

2026-07-26 03:02:25 +02:00

dashboard.py

sprint3: dashboard counts per user + import owner_id + export visibility filter

2026-07-29 02:11:29 +02:00

delegations.py

fix: comprehensive system audit fixes (55+ issues)

2026-07-31 00:58:05 +02:00

entity_history.py

Phase 0 Complete: Tasks 0.7-0.20

2026-07-23 08:42:26 +02:00

entity_permissions.py

fix: redis cache invalidation in permission service + permission check in entity_permissions route + upsert cache invalidation + remove TopBar quick-create

2026-07-29 10:45:45 +02:00

errors.py

Phase 2: Fix high-priority security and stability issues (H1-H7)

2026-07-26 20:49:15 +02:00

groups.py

Fix Bug 5: require groups:read permission for list_groups

2026-07-20 23:13:47 +00:00

guest_auth.py

fix: comprehensive system audit fixes (55+ issues)

2026-07-31 00:58:05 +02:00

guests.py

P1.6: secure guest invitation tokens (secrets.token_urlsafe + SHA-256 hash + one-time use + session revocation)

2026-07-29 12:30:00 +02:00

health.py

fix: /health/ready status mapping (up/down → ok/fail)

2026-07-29 23:25:56 +02:00

import_export.py

sprint3: dashboard counts per user + import owner_id + export visibility filter

2026-07-29 02:11:29 +02:00

metrics.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

notifications.py

sprint6+7: permission notifications + audit trail + notification entity filter + mail account permissions + migration 0053

2026-07-29 02:18:17 +02:00

outbox.py

Phase 5 (v2): Processing-Recovery, Retention-Cleanup, Replay-Delivery-Reset

2026-08-02 23:47:29 +02:00

owner_transfer.py

sprint10+11: AI permission filter + API token scopes + merge check + owner transfer service + auto-transfer on deactivation

2026-07-29 02:37:51 +02:00

permission_templates.py

sprint14-19: ABAC UI rule editor + permission templates + bulk share + analytics + delegation + resolution strategies + migrations 0056-0058

2026-07-29 02:47:03 +02:00

plugins.py

P1 fixes: outbox no_handlers, HTML sanitization, WebSocket plugin check, fail-closed plugin gate, plugin admin-only

2026-07-29 12:33:46 +02:00

policies.py

sprint12+13: zentrale rechte settings page + ABAC engine backend (model, migration 0055, service, routes)

2026-07-29 02:42:16 +02:00

roles.py

Phase 1C: Frontend unified contact UI

2026-07-23 17:17:32 +02:00

saved_filters.py

sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

2026-07-29 01:52:47 +02:00

saved_views.py

sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

2026-07-29 01:52:47 +02:00

sequences.py

sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

2026-07-29 01:52:47 +02:00

system_settings.py

fix: add missing deleted_at columns to all plugin tables, fix system-settings response schema, fix transaction rollback in permissions

2026-07-24 10:34:38 +02:00

taxes.py

feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)

2026-07-15 22:35:50 +02:00

tenants.py

feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)

2026-07-15 22:35:50 +02:00

user_preferences.py

feat(5.2): add User Preferences API with full-stack implementation

2026-07-23 20:39:42 +02:00

users.py

fix: comprehensive system audit fixes (55+ issues)

2026-07-31 00:58:05 +02:00

webhooks.py

sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

2026-07-29 01:52:47 +02:00

workflows.py

fix: workflow route remove is_system_admin param not accepted by service

2026-07-30 11:16:56 +02:00

workspaces.py

Reparaturplan Fixes: Widget workspace_id check, total bug, context is_visible, permissions, fallbacks

2026-08-03 12:44:02 +02:00