Agent Zero
627360113f
P8: Invalidate all Redis sessions when is_system_admin changes - Added is_system_admin to UserUpdate schema and UserResponse - Added invalidate_all_user_sessions call in users.py route - Added is_system_admin param to user_service.update_user P9: Remove no-op permission resolution strategies - Only highest_wins supported, others removed as no-ops - Updated tenant.py CheckConstraint to only allow highest_wins - Added KI-Kommentar in permissions.py P10: Remove legacy check_permission from auth.py - Removed duplicate check_permission and filter_fields_by_permission - Fixed ai_copilot_service.py to use permissions.check_permission - Updated ai_copilot route to pass resolved permissions dict P11: Verified — no guest_users remnants found P12: Migrate ContactFolderPermission to EntityPermission - contact_folder_permission_service now delegates to entity_permission_service - contact_folder_service uses EntityPermission queries - Removed ContactFolderPermission from models/__init__.py - Created migration 0114 to migrate data and drop table P13: Added RLS migration history comment in alembic/env.py P14: Verified — services already apply visibility_filter - saved_filters/views filter by user_id (personal data) - workspaces are UI context only - notifications already filter by entity access P15: Split entity_permission_service.py (932 lines) into 4 modules - permission_resolver.py: get_effective_access, get_visible_ids, etc. - permission_cache.py: Redis caching functions - permission_audit.py: Audit logging helpers - entity_permission_service.py: CRUD operations + re-exports P16: Centralize PERM_RANK in permissions.py - Single source: app.core.permissions.PERM_RANK - Updated all services to import from permissions.py P17: Fix MIGRATION_DATABASE_URL to use crm_migration - docker-compose.yaml defaults changed from crm_user to crm_migration - .env.docker.example updated - prestart.sh comment updated
98 lines
3.1 KiB
Python
98 lines
3.1 KiB
Python
"""Audit logging helpers for entity permission changes.
|
|
|
|
Extracted from entity_permission_service.py for modularity.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import uuid
|
|
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.core.audit import log_audit
|
|
from app.core.notifications import create_notification
|
|
from app.models.entity_permission import EntityPermission
|
|
|
|
|
|
async def _log_permission_grant(
|
|
db: AsyncSession,
|
|
tenant_id: uuid.UUID,
|
|
created_by: uuid.UUID | None,
|
|
perm: EntityPermission,
|
|
permission_level: str,
|
|
principal_type: str,
|
|
principal_id: str,
|
|
) -> None:
|
|
"""Log audit entry for a new permission grant and notify the user."""
|
|
await log_audit(
|
|
db, tenant_id, created_by,
|
|
action='permission_grant',
|
|
entity_type='entity_permission',
|
|
entity_id=perm.id,
|
|
changes={'permission_level': permission_level, 'principal_type': principal_type, 'principal_id': principal_id}
|
|
)
|
|
# Notify user if direct permission
|
|
if principal_type == 'user':
|
|
await create_notification(
|
|
db, tenant_id, uuid.UUID(principal_id),
|
|
type='permission_granted',
|
|
title='Neue Berechtigung',
|
|
body=f'{perm.entity_type} wurde mit dir geteilt',
|
|
entity_type=perm.entity_type,
|
|
entity_id=perm.entity_id,
|
|
)
|
|
|
|
|
|
async def _log_permission_update(
|
|
db: AsyncSession,
|
|
tenant_id: uuid.UUID,
|
|
created_by: uuid.UUID | None,
|
|
perm: EntityPermission,
|
|
permission_level: str,
|
|
principal_type: str,
|
|
principal_id: str,
|
|
) -> None:
|
|
"""Log audit entry for a permission update and notify the user."""
|
|
await log_audit(
|
|
db, tenant_id, created_by,
|
|
action='permission_update',
|
|
entity_type='entity_permission',
|
|
entity_id=perm.id,
|
|
changes={'permission_level': permission_level, 'principal_type': principal_type, 'principal_id': principal_id}
|
|
)
|
|
# Notify user if direct permission
|
|
if principal_type == 'user':
|
|
await create_notification(
|
|
db, tenant_id, uuid.UUID(principal_id),
|
|
type='permission_granted',
|
|
title='Neue Berechtigung',
|
|
body=f'{perm.entity_type} wurde mit dir geteilt',
|
|
entity_type=perm.entity_type,
|
|
entity_id=perm.entity_id,
|
|
)
|
|
|
|
|
|
async def _log_permission_revoke(
|
|
db: AsyncSession,
|
|
tenant_id: uuid.UUID,
|
|
perm: EntityPermission,
|
|
) -> None:
|
|
"""Log audit entry for a permission revoke and notify the user."""
|
|
await log_audit(
|
|
db, tenant_id, None,
|
|
action='permission_revoke',
|
|
entity_type='entity_permission',
|
|
entity_id=perm.id,
|
|
changes={'permission_level': perm.permission_level, 'principal_type': perm.principal_type, 'principal_id': str(perm.principal_id)}
|
|
)
|
|
# Notify user if direct permission
|
|
if perm.principal_type == 'user':
|
|
await create_notification(
|
|
db, tenant_id, perm.principal_id,
|
|
type='permission_revoked',
|
|
title='Berechtigung entfernt',
|
|
body=f'{perm.entity_type} wurde nicht mehr mit dir geteilt',
|
|
entity_type=perm.entity_type,
|
|
entity_id=perm.entity_id,
|
|
)
|