Agent Zero b91ee5bf1b fix(security): Bearer-Requests von CSRF-Middleware ausnehmen ...

Die CSRF-Middleware verlangte Origin+X-CSRF-Token auf allen unsafe
Requests — auch auf Bearer-authentifizierten API-Calls (External-Agent-
API, MCP, Integrationen). Externe Systeme senden nie Origin/CSRF,
dadurch war /api/v1/external/agent/* faktisch unbrauchbar (403).

Fix: Authorization: Bearer-Header-Requests skippen die CSRF-Pruefung.
Bearer ist CSRF-immun per Design: Browser haengen den Authorization-
Header niemals automatisch an, Cross-Site-Requests koennen ihn nicht
schmuggeln. Session-Cookie-Requests (SPA) laufen unverändert durch die
volle Origin+Double-Submit-Pruefung.

Regression: pytest test_auth.py 11/11, ruff clean

2026-09-16 00:49:37 +02:00

..

db

fix(arch-043,arch-052): deterministic system tenant lookup; async-safe file metadata

2026-08-23 16:39:09 +02:00

__init__.py

T01: core infrastructure + auth + multi-tenant + RLS

2026-06-29 08:02:14 +02:00

api_token.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

approval.py

feat(F): F-TEST + F-DOC + F-UI-TRIG — Phase F complete!

2026-08-17 19:36:42 +02:00

audit.py

feat(B-SENS): Sensitive Data Boundary + AI/Data Exposure Policy + AIProvider Compliance

2026-08-13 20:39:32 +02:00

auth.py

fix(g2): Session-Revocation bei Passwortaenderung auf beiden Pfaden

2026-08-26 00:00:19 +02:00

backup_job.py

feat: punkt 6 (backup) — ARQ cron job, backup config in settings, backup-now trigger, backup history, migration 0130

2026-08-20 13:47:35 +02:00

cache.py

feat(B-RED): Zentraler Redis Pool — cache.py, monitoring.py, worker.py auf get_redis() umgestellt

2026-08-13 16:25:17 +02:00

delegation_token.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

error_codes.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

event_bus.py

fix(arch-014,arch-020): no contract lazy-resurrect after unregister; event bus dedupes handlers

2026-08-23 15:30:12 +02:00

history_hooks.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

hooks.py

fix(audit): P2 frontend any→concrete types (181→61), heroicons→lucide-react, missing type exports, toast API, Select options, TaskStatus types; P2-9 hooks.py type annotations

2026-08-17 22:24:24 +02:00

importexport_registry.py

feat(#359): W4a Phase 1 — Import/Export Contribution-Architektur Kern

2026-08-27 21:11:14 +02:00

job_registry.py

refactor(block-h): knowledge retention job lives with plugin; compliance via contract

2026-08-23 12:18:02 +02:00

jobs.py

refactor(#356): DSAR-Fachlogik vollstaendig aus dem Core extrahiert — dsar_collect/dsar_erase in die 5 beteiligten Contracts (contacts, mail, tasks, calendar, kommunikation); core/jobs.py sammelt/loescht nur Core-eigene Daten und iteriert generisch ueber die Plugin-Registry; neue Plugins liefern DSAR-Kategorien ohne Core-Aenderung; Counts-/Category-Keys unveraendert; tasks/contracts.py von Patch-Artefakt bereinigt

2026-08-27 18:09:15 +02:00

middleware.py

fix(security): Bearer-Requests von CSRF-Middleware ausnehmen

2026-09-16 00:49:37 +02:00

monitoring.py

feat(B.13-B.17+B.16): Error-Handling-Infra, Observability, Graceful Shutdown, Cost-Cap, API Versioning

2026-08-13 21:33:14 +02:00

notifications.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

outbox.py

fix(outbox): qualname nur fuer bound methods — plain functions behalten __name__ (test_outbox_phase5 17/17 gruen)

2026-09-14 08:31:50 +02:00

pagination.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

permission_registry.py

fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)

2026-09-13 02:25:01 +02:00

permissions.py

fix(critical): permission cache returns None causing 500 on every authenticated API call

2026-08-21 02:16:24 +02:00

plugin_error_handler.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

principals.py

feat(permissions): ABAC integration, principals caching, cache version validation

2026-08-06 22:05:15 +02:00

rate_limit.py

feat(B-RL): Rate-Limiting Konsistenz — zentrale Policies für Auth/AI/Upload/Webhook

2026-08-13 17:51:04 +02:00

redis.py

fix: add app/core/redis.py shim re-exporting get_redis from auth

2026-07-30 02:01:28 +02:00

resilience.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

restore_registry.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

seeds.py

C1: Add seeds.py — EUR currency, 19% and 7% tax rates, idempotent

2026-07-04 01:30:06 +00:00

sensitive_data.py

fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)

2026-09-13 02:25:01 +02:00

service_container.py

fix(arch-a2): deactivation cleanup - container services, search provider, hook deregistration, notification sync, task state, activation order

2026-08-23 19:24:12 +02:00

state_machine.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

storage.py

fix(arch-043,arch-052): deterministic system tenant lookup; async-safe file metadata

2026-08-23 16:39:09 +02:00

system_miniapps.py

feat(M4): System-Rueckbau — Dashboard-Inhalte als MiniApps, Core = reiner Host (#362)

2026-08-30 22:22:20 +02:00

tenant.py

chore: fix all ruff lint errors + format — 0 errors, 306 tests pass

2026-06-29 17:43:56 +02:00

trigger_dispatcher.py

fix(arch-014,arch-020): no contract lazy-resurrect after unregister; event bus dedupes handlers

2026-08-23 15:30:12 +02:00

visibility.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

webhook_dispatcher.py

fix(webhooks): JSONB-Containment statt .any() auf JSON-Spalte — behebt 158 fehlgeschlagene Outbox-Events

2026-09-14 07:55:07 +02:00

worker.py

fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)

2026-09-13 02:25:01 +02:00

ws_helpers.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00

ws_pubsub.py

fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

2026-08-16 01:17:18 +02:00