Agent Zero 47432651f1 fix(security): F03 (Astra P1) — Sitzungswiderruf in beiden Session-Stores durchsetzen ...

Vorher (Astra-Finding): Widerruf war inkonsistent ueber vier Pfade:
- Deaktivierung invalidierte nur den Berechtigungscache — Sessions
  liefen bis TTL (8h) weiter
- Loeschung invalidierte GAR NICHTS
- Passwortwechsel loeschte nur Redis-Sessions — PostgreSQL-Fallback-
  Sessions ueberlebten jeden Redis-Ausfall
- Fehlende UserTenant-Mitgliedschaft wurde durchgewinkt statt
  abgewiesen

Fix:
- Neuer zentraler Helfer revoke_user_sessions_all_stores (app/core/auth.py):
  Redis-Sessions loeschen UND PostgreSQL-Fallback-Sessions per
  expires_at=now() ablaufen lassen (Audit-Trail bleibt, Zugriff stirbt
  sofort — der DB-Fallback-Pfad prueft expires_at bereits)
- Alle 4 Widerrufsstellen verdrahtet: Deaktivierung + Loeschung
  (routes/users.py), Passwortwechsel (user_service.py), Passwort-Reset
  (auth_service.py)
- Membership-Check in get_current_user fail-closed: None (fehlende
  Mitgliedschaft) wird abgewiesen statt durchgelassen

Abnahme (Astra): Deaktivierung, Austritt und Passwortwechsel wirken
unmittelbar — auch bei Redis-Ausfall (Unit-Test beweist die
DB-Fallback-Abgelaufen-Rejection).

Tests: test_s1_security_guards.py 10/10 (3 neue F03-Tests) +
test_auth.py 11/11 + ruff clean.

2026-09-18 07:59:31 +02:00

..

db

fix(arch-043,arch-052): deterministic system tenant lookup; async-safe file metadata

2026-08-23 16:39:09 +02:00

__init__.py

T01: core infrastructure + auth + multi-tenant + RLS

2026-06-29 08:02:14 +02:00

api_token.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

approval.py

feat(F): F-TEST + F-DOC + F-UI-TRIG — Phase F complete!

2026-08-17 19:36:42 +02:00

audit.py

feat(B-SENS): Sensitive Data Boundary + AI/Data Exposure Policy + AIProvider Compliance

2026-08-13 20:39:32 +02:00

auth.py

fix(security): F03 (Astra P1) — Sitzungswiderruf in beiden Session-Stores durchsetzen

2026-09-18 07:59:31 +02:00

backup_job.py

feat: punkt 6 (backup) — ARQ cron job, backup config in settings, backup-now trigger, backup history, migration 0130

2026-08-20 13:47:35 +02:00

cache.py

feat(B-RED): Zentraler Redis Pool — cache.py, monitoring.py, worker.py auf get_redis() umgestellt

2026-08-13 16:25:17 +02:00

delegation_token.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

error_codes.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

event_bus.py

fix(arch-014,arch-020): no contract lazy-resurrect after unregister; event bus dedupes handlers

2026-08-23 15:30:12 +02:00

history_hooks.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

hooks.py

fix(audit): P2 frontend any→concrete types (181→61), heroicons→lucide-react, missing type exports, toast API, Select options, TaskStatus types; P2-9 hooks.py type annotations

2026-08-17 22:24:24 +02:00

importexport_registry.py

feat(#359): W4a Phase 1 — Import/Export Contribution-Architektur Kern

2026-08-27 21:11:14 +02:00

job_registry.py

refactor(block-h): knowledge retention job lives with plugin; compliance via contract

2026-08-23 12:18:02 +02:00

jobs.py

refactor(#356): DSAR-Fachlogik vollstaendig aus dem Core extrahiert — dsar_collect/dsar_erase in die 5 beteiligten Contracts (contacts, mail, tasks, calendar, kommunikation); core/jobs.py sammelt/loescht nur Core-eigene Daten und iteriert generisch ueber die Plugin-Registry; neue Plugins liefern DSAR-Kategorien ohne Core-Aenderung; Counts-/Category-Keys unveraendert; tasks/contracts.py von Patch-Artefakt bereinigt

2026-08-27 18:09:15 +02:00

middleware.py

fix(security): Bearer-Requests von CSRF-Middleware ausnehmen

2026-09-16 00:49:37 +02:00

monitoring.py

feat(B.13-B.17+B.16): Error-Handling-Infra, Observability, Graceful Shutdown, Cost-Cap, API Versioning

2026-08-13 21:33:14 +02:00

notifications.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

outbox.py

fix(outbox): qualname nur fuer bound methods — plain functions behalten __name__ (test_outbox_phase5 17/17 gruen)

2026-09-14 08:31:50 +02:00

pagination.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

permission_registry.py

fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)

2026-09-13 02:25:01 +02:00

permissions.py

fix(security): F01 (Astra P0) — KI-Tool-Ausführung ohne Freigabe verhindern

2026-09-17 22:48:59 +02:00

plugin_error_handler.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

principals.py

feat(permissions): ABAC integration, principals caching, cache version validation

2026-08-06 22:05:15 +02:00

rate_limit.py

feat(B-RL): Rate-Limiting Konsistenz — zentrale Policies für Auth/AI/Upload/Webhook

2026-08-13 17:51:04 +02:00

redis.py

fix: add app/core/redis.py shim re-exporting get_redis from auth

2026-07-30 02:01:28 +02:00

resilience.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

restore_registry.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

seeds.py

C1: Add seeds.py — EUR currency, 19% and 7% tax rates, idempotent

2026-07-04 01:30:06 +00:00

sensitive_data.py

fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)

2026-09-13 02:25:01 +02:00

service_container.py

fix(arch-a2): deactivation cleanup - container services, search provider, hook deregistration, notification sync, task state, activation order

2026-08-23 19:24:12 +02:00

state_machine.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

storage.py

fix(arch-043,arch-052): deterministic system tenant lookup; async-safe file metadata

2026-08-23 16:39:09 +02:00

system_miniapps.py

feat(M4): System-Rueckbau — Dashboard-Inhalte als MiniApps, Core = reiner Host (#362)

2026-08-30 22:22:20 +02:00

tenant.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00

trigger_dispatcher.py

fix(arch-014,arch-020): no contract lazy-resurrect after unregister; event bus dedupes handlers

2026-08-23 15:30:12 +02:00

visibility.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

webhook_dispatcher.py

fix(webhooks): JSONB-Containment statt .any() auf JSON-Spalte — behebt 158 fehlgeschlagene Outbox-Events

2026-09-14 07:55:07 +02:00

worker.py

fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)

2026-09-13 02:25:01 +02:00

ws_helpers.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

ws_pubsub.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00