Agent Zero 627360113f fix(permissions): fix 10 high-priority permission system issues ...

P8: Invalidate all Redis sessions when is_system_admin changes
- Added is_system_admin to UserUpdate schema and UserResponse
- Added invalidate_all_user_sessions call in users.py route
- Added is_system_admin param to user_service.update_user

P9: Remove no-op permission resolution strategies
- Only highest_wins supported, others removed as no-ops
- Updated tenant.py CheckConstraint to only allow highest_wins
- Added KI-Kommentar in permissions.py

P10: Remove legacy check_permission from auth.py
- Removed duplicate check_permission and filter_fields_by_permission
- Fixed ai_copilot_service.py to use permissions.check_permission
- Updated ai_copilot route to pass resolved permissions dict

P11: Verified — no guest_users remnants found

P12: Migrate ContactFolderPermission to EntityPermission
- contact_folder_permission_service now delegates to entity_permission_service
- contact_folder_service uses EntityPermission queries
- Removed ContactFolderPermission from models/__init__.py
- Created migration 0114 to migrate data and drop table

P13: Added RLS migration history comment in alembic/env.py

P14: Verified — services already apply visibility_filter
- saved_filters/views filter by user_id (personal data)
- workspaces are UI context only
- notifications already filter by entity access

P15: Split entity_permission_service.py (932 lines) into 4 modules
- permission_resolver.py: get_effective_access, get_visible_ids, etc.
- permission_cache.py: Redis caching functions
- permission_audit.py: Audit logging helpers
- entity_permission_service.py: CRUD operations + re-exports

P16: Centralize PERM_RANK in permissions.py
- Single source: app.core.permissions.PERM_RANK
- Updated all services to import from permissions.py

P17: Fix MIGRATION_DATABASE_URL to use crm_migration
- docker-compose.yaml defaults changed from crm_user to crm_migration
- .env.docker.example updated
- prestart.sh comment updated

2026-08-06 12:05:09 +02:00

..

__init__.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00

address.py

Phase 1C: Frontend unified contact UI

2026-07-23 17:17:32 +02:00

ai_copilot.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00

attachment.py

Phase 1: Critical security fixes - 59 permissions, grants, RLS, mass-assignment, ownership, leaks, MIME

2026-08-03 22:32:03 +02:00

auth.py

Phase 3: Fix medium-priority issues (M1-M4, M6)

2026-07-26 20:51:40 +02:00

backup.py

Phase 4: Webhooks, Backup/Restore UI, Onboarding/Tutorial

2026-07-26 03:17:40 +02:00

bank_account.py

feat: Mini-Apps registry, Stammdaten backend persistence, bank accounts

2026-07-25 02:11:29 +02:00

common.py

fix: comprehensive system audit fixes (55+ issues)

2026-07-31 00:58:05 +02:00

contact_folder_permission.py

feat: folder permissions (ACLs) - share folders with users/groups, inherit to subfolders, permission dialog UI

2026-07-28 23:58:19 +02:00

contact_folder.py

feat: Kontakt-Ordner mit Drag&Drop Baum (wie KI-Chat Sidebar)

2026-07-20 01:33:44 +02:00

contact.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

currency.py

feat(core): add currency schemas

2026-07-04 00:21:42 +00:00

custom_field_definition.py

Phase 2: Tags UI, Custom Fields UI, Notifications Bell

2026-07-26 03:02:25 +02:00

delegation.py

sprint14-19: ABAC UI rule editor + permission templates + bulk share + analytics + delegation + resolution strategies + migrations 0056-0058

2026-07-29 02:47:03 +02:00

entity_history.py

Phase 0 Complete: Tasks 0.7-0.20

2026-07-23 08:42:26 +02:00

entity_permission.py

sprint1: entity_permissions table + owned_mixin + universal permission service + API + migrations 0049+0050

2026-07-29 01:28:13 +02:00

entity_policy.py

fix: comprehensive system audit fixes (55+ issues)

2026-07-31 00:58:05 +02:00

group.py

feat: granular RBAC system with user groups, deny-list, permission registry, system-admin, self-mod prevention

2026-07-15 21:59:45 +02:00

permission_template.py

sprint14-19: ABAC UI rule editor + permission templates + bulk share + analytics + delegation + resolution strategies + migrations 0056-0058

2026-07-29 02:47:03 +02:00

plugin.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00

policy.py

sprint12+13: zentrale rechte settings page + ABAC engine backend (model, migration 0055, service, routes)

2026-07-29 02:42:16 +02:00

role.py

Add denied_permissions and permission_version to Role schemas

2026-07-20 23:13:46 +00:00

saved_filter.py

fix: comprehensive system audit fixes (55+ issues)

2026-07-31 00:58:05 +02:00

saved_view.py

fix: comprehensive system audit fixes (55+ issues)

2026-07-31 00:58:05 +02:00

sequence.py

feat(core): add sequence schemas

2026-07-04 00:24:16 +00:00

system_settings.py

Phase 1: Critical security fixes - 59 permissions, grants, RLS, mass-assignment, ownership, leaks, MIME

2026-08-03 22:32:03 +02:00

tax.py

feat(core): add tax rate schemas

2026-07-04 00:23:14 +00:00

tenant.py

T01: core infrastructure + auth + multi-tenant + RLS

2026-06-29 08:02:14 +02:00

user_preference.py

fix: comprehensive system audit fixes (55+ issues)

2026-07-31 00:58:05 +02:00

user.py

fix(permissions): fix 10 high-priority permission system issues

2026-08-06 12:05:09 +02:00

webhook.py

Phase 1: Fix all critical release blockers (B1-B10)

2026-07-26 20:45:42 +02:00

workflow.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00

workspace.py

fix: comprehensive system audit fixes (55+ issues)

2026-07-31 00:58:05 +02:00