Agent Zero 1a980ba9d8 gate: migration 0086, crm_migration BYPASSRLS, audit_log fix, CI test for app.tenant_id ...

- Migration 0086: Remove FORCE RLS from 5 global tables
- Migration 0085: crm_migration keeps BYPASSRLS for data migrations
- Migration 0085: Remove audit_log from crm_auth grants
- auth_service.py: Audit log via separate API session (crm_api with tenant context)
- tests/test_no_legacy_tenant_var.py: CI test for app.tenant_id in policies

2026-07-31 09:02:40 +02:00

..

0001_initial.py

T01: core infrastructure + auth + multi-tenant + RLS

2026-06-29 08:02:14 +02:00

0002_contacts_fts.py

T02: companies + contacts + import/export + N:M + soft-delete + GDPR + FTS

2026-06-29 08:02:15 +02:00

0003_plugin_system.py

T03: plugin system framework + lifecycle + migrations + event bus + DI

2026-06-29 08:02:15 +02:00

0004_ai_workflows.py

T09: KI-Copilot API + Hybrid Workflow Engine + LLM client + event-triggered workflows

2026-06-29 08:02:15 +02:00

0005_user_role_fk.py

Problem 1: Alembic migration 0005 — add role_id FK column to users table

2026-07-03 19:50:08 +00:00

0006_add_addresses.py

feat(core): add alembic migration for address fields

2026-07-04 00:15:24 +00:00

0007_currencies.py

feat(core): add alembic migration for currencies table

2026-07-04 00:21:43 +00:00

0008_tax_rates.py

feat(core): add alembic migration for tax_rates table

2026-07-04 00:23:15 +00:00

0009_sequences.py

feat(core): add alembic migration for sequences table

2026-07-04 00:24:18 +00:00

0010_system_settings.py

feat(core): add alembic migration for system_settings table

2026-07-04 00:25:39 +00:00

0011_attachments.py

feat(core): add alembic migration for attachments table

2026-07-04 00:29:12 +00:00

0012_soft_delete.py

feat(core): add alembic migration for soft-delete columns on core tables

2026-07-04 00:31:47 +00:00

0013_addresses.py

A: Migration 0013 — create addresses table, migrate data, drop old address columns

2026-07-04 01:32:12 +00:00

0014_currency_unique_fix.py

B2: Migration 0014 — drop global unique on currency.code, add tenant-scoped unique constraint

2026-07-04 01:32:13 +00:00

0015_rls_policies.py

Fix: 0015 RLS migration idempotent — DROP POLICY IF EXISTS before CREATE POLICY

2026-07-04 08:12:39 +00:00

0016_plugin_is_core.py

feat: Core Plugin system — is_core flag, topological sort dependency resolution, deactivation protection

2026-07-07 07:44:02 +02:00

0017_notification_preferences.py

feat: notification preferences system with plugin registry

2026-07-15 21:00:32 +02:00

0018_fix_notification_preferences_columns.py

fix: correct migration 0018 revision id

2026-07-15 21:19:08 +02:00

0019_rbac_groups.py

fix: migration 0019 - add missing updated_at and deleted_at columns to roles table

2026-07-15 22:18:48 +02:00

0020_notifications_updated_at.py

fix: make migration 0020 idempotent (check column exists)

2026-07-17 00:59:41 +02:00

0021_unified_contacts.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

0022_contact_folders.py

feat: Kontakt-Ordner mit Drag&Drop Baum (wie KI-Chat Sidebar)

2026-07-20 01:33:44 +02:00

0023_theme_customization.py

Phase 0 Complete: Tasks 0.7-0.20

2026-07-23 08:42:26 +02:00

0024_heartbeat_config.py

Phase 0 Complete: Tasks 0.7-0.20

2026-07-23 08:42:26 +02:00

0025_entity_history.py

Phase 0 Complete: Tasks 0.7-0.20

2026-07-23 08:42:26 +02:00

0026_mail_salt_security.py

Phase 0 Complete: Tasks 0.7-0.20

2026-07-23 08:42:26 +02:00

0027_unify_company_to_contact.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

0028_rls_force.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

0028_user_preferences.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

0029_saved_filters.py

feat(5.22): Saved Searches / Smart Lists — reusable filters for list views

2026-07-23 23:44:50 +02:00

0030_contact_merge_history.py

Task 5.23: Deduplication / Merge — ContactMergeHistory model, dedup service, API routes (duplicates/merge/merge-history), DedupDialog frontend, i18n, 5 tests

2026-07-23 23:58:45 +02:00

0031_permissions_soft_delete.py

fix: resolve menu duplicates, route prefix conflicts, API path bugs, permissions.deleted_at, remove test plugin from production

2026-07-24 08:19:45 +02:00

0032_user_profile_fields.py

fix: correct alembic revision ID in migration 0032

2026-07-24 17:24:47 +02:00

0033_bank_accounts.py

feat: Mini-Apps registry, Stammdaten backend persistence, bank accounts

2026-07-25 02:11:29 +02:00

0034_automation_config.py

fix: Replace automation stubs with real execution engine

2026-07-25 02:52:07 +02:00

0035_comm_search_index.py

fix: Chat search index, DMS group-share user_id, verify workflows and mail salt

2026-07-25 03:02:41 +02:00

0036_cross_tenant_fk.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

0037_user_tenant_model.py

Fix: register plugin routes in create_app() not lifespan(); add status column to contacts migration 0039; add updated_at to user_tenants migration 0037

2026-07-26 00:42:31 +02:00

0038_dms_content_hash.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

0039_contact_normalize.py

Fix: register plugin routes in create_app() not lifespan(); add status column to contacts migration 0039; add updated_at to user_tenants migration 0037

2026-07-26 00:42:31 +02:00

0040_outbox.py

Security fixes: P0-P2 complete (22 fixes)

2026-07-25 21:03:46 +02:00

0041_custom_field_definitions.py

Phase 2: Tags UI, Custom Fields UI, Notifications Bell

2026-07-26 03:02:25 +02:00

0042_webhooks.py

Phase 4: Webhooks, Backup/Restore UI, Onboarding/Tutorial

2026-07-26 03:17:40 +02:00

0043_backups.py

Fix: Add updated_at and deleted_at columns to backups migration (TenantMixin)

2026-07-26 03:22:40 +02:00

0044_rls_repair_and_db_roles.py

Fix: Migration 0044 down_revision must be 0043_backups not 0043

2026-07-26 21:41:23 +02:00

0045_repair_contact_migration.py

Phase 2: Fix high-priority security and stability issues (H1-H7)

2026-07-26 20:49:15 +02:00

0046_plugin_allowlist.py

feat: Plugin-System Umbau — 6 Phasen komplett abgeschlossen

2026-07-26 23:15:34 +02:00

0047_saved_views.py

fix: alembic down_revision 0046 not 0046_plugin_allowlist

2026-07-28 14:41:04 +02:00

0048_contact_folder_permissions.py

feat: folder permissions (ACLs) - share folders with users/groups, inherit to subfolders, permission dialog UI

2026-07-28 23:58:19 +02:00

0049_entity_permissions.py

sprint1: entity_permissions table + owned_mixin + universal permission service + API + migrations 0049+0050

2026-07-29 01:28:13 +02:00

0050_owner_id_all_tables.py

sprint1: entity_permissions table + owned_mixin + universal permission service + API + migrations 0049+0050

2026-07-29 01:28:13 +02:00

0051_migrate_folder_acls.py

sprint1: set_user_context + RLS policies on contacts + folder ACL migration 0051+0052

2026-07-29 01:30:25 +02:00

0052_rls_contacts.py

sprint1: set_user_context + RLS policies on contacts + folder ACL migration 0051+0052

2026-07-29 01:30:25 +02:00

0053_mail_owner_id.py

sprint6+7: permission notifications + audit trail + notification entity filter + mail account permissions + migration 0053

2026-07-29 02:18:17 +02:00

0054_plugin_owner_id.py

sprint8: fix migration 0054 — skip existing owner_id columns

2026-07-29 02:35:32 +02:00

0055_entity_policies.py

sprint12+13: zentrale rechte settings page + ABAC engine backend (model, migration 0055, service, routes)

2026-07-29 02:42:16 +02:00

0056_permission_templates.py

sprint14-19: ABAC UI rule editor + permission templates + bulk share + analytics + delegation + resolution strategies + migrations 0056-0058

2026-07-29 02:47:03 +02:00

0057_permission_delegations.py

sprint14-19: ABAC UI rule editor + permission templates + bulk share + analytics + delegation + resolution strategies + migrations 0056-0058

2026-07-29 02:47:03 +02:00

0058_resolution_strategy.py

fix: migration 0058 checkconstraint + all sprint 20-23 deployed

2026-07-29 03:10:26 +02:00

0059_guest_users.py

sprint20-23: tests + documentation + guest access + infrastructure + migrations 0059

2026-07-29 02:53:37 +02:00

0060_rls_contacts_secure.py

P0+P1 fixes: RCE sandbox, SQL injection, RLS tenant isolation, DB roles, test syntax, attachment, permission registry, membership check

2026-07-29 12:28:08 +02:00

0061_db_roles_secure.py

fix: migration 0061 — remove non-existent tables from RLS list

2026-07-29 12:40:15 +02:00

0062_guest_invitations_secure.py

P1.6: secure guest invitation tokens (secrets.token_urlsafe + SHA-256 hash + one-time use + session revocation)

2026-07-29 12:30:00 +02:00

0063_notification_entity_fields.py

fix: missing notification entity_type/entity_id migration (0063)

2026-07-29 12:35:44 +02:00

0064_rls_all_tenant_tables.py

fix: guest_sessions Redis index for revocation + RLS on all tenant tables (migration 0064)

2026-07-29 12:46:50 +02:00

0065_consumer_inbox.py

fix: consumer_inbox table for outbox idempotency + tenant_plugin_activation table

2026-07-29 12:49:15 +02:00

0066_tenant_plugin_activation.py

fix: consumer_inbox table for outbox idempotency + tenant_plugin_activation table

2026-07-29 12:49:15 +02:00

0067_disable_rls_system_tables.py

fix: WeasyPrint URL fetcher + attachment improvements + webhook error propagation + WebSocket conversation check + RLS disabled on system tables (bootstrap fix)

2026-07-29 13:19:21 +02:00

0068_entity_permissions_deleted_at.py

fix: visibility.py Defense-in-Depth tenant_id filter + entity_permissions deleted_at migration + cross-tenant tests

2026-07-29 16:12:04 +02:00

0069_rls_tenant_isolation_only.py

phase1: RLS simplified to tenant isolation only + canAccess fallback removed + useUserPermissions hook + security kernel docs

2026-07-29 16:36:51 +02:00

0070_db_roles_separation.py

phase2: 4 DB roles (crm_migration/api/worker/auth) + docker-compose updated + GRANT USAGE + RLS verified with unprivileged role

2026-07-29 16:49:09 +02:00

0071_entity_attachments.py

phase4: entity_attachments table + DMS unified storage + attachment service rewritten + download via DMS

2026-07-29 17:52:55 +02:00

0072_workspaces.py

phase5: workspace backend — models, service, routes, migration 0072

2026-07-29 18:32:35 +02:00

0073_workspace_deleted_at.py

fix: add deleted_at to workspace tables (TenantMixin includes SoftDeleteMixin)

2026-07-29 18:38:06 +02:00

0074_workspace_users_timestamps.py

fix: add created_at/updated_at to workspace_users (TenantMixin inherits TimestampMixin)

2026-07-29 18:40:09 +02:00

0075_outbox_envelope.py

phase6: standardized event envelope (aggregate_type, aggregate_id, occurred_at, correlation_id, schema_version) + outbox_deliveries table

2026-07-29 22:50:27 +02:00

0076_disable_rls_startup_tables.py

phase12: disable RLS on startup tables (system_settings, currencies, taxes, sequences, saved_filters, saved_views, webhooks)

2026-07-29 23:33:56 +02:00

0077_disable_rls_tax_rates.py

phase12: disable RLS on tax_rates (startup table)

2026-07-29 23:42:25 +02:00

0078_disable_rls_automation.py

phase12: disable RLS on automation tables (written at startup)

2026-07-30 00:06:43 +02:00

0079_disable_rls_system_tables.py

phase12: disable RLS on all system/auth/config tables for crm_api startup

2026-07-30 00:15:58 +02:00

0080_disable_rls_audit_sessions.py

phase12: disable RLS on audit_log and sessions (written during login)

2026-07-30 00:20:20 +02:00

0081_disable_rls_all_system_tables.py

phase12: disable RLS on all system/auth/config/plugin tables (final migration)

2026-07-30 00:47:43 +02:00

0082_add_sensitivity_to_custom_field_definitions.py

migration: add sensitivity column to custom_field_definitions (0082)

2026-07-30 09:27:04 +02:00

0083_add_missing_deleted_at_columns.py

migration: add missing deleted_at columns to 9 TenantMixin tables (0083)

2026-07-30 10:16:26 +02:00

0084_rls_fail_closed_reactivate.py

fix: RLS fail-closed migration + per-tenant startup code

2026-07-31 01:31:41 +02:00

0085_restore_tenant_rls.py

gate: migration 0086, crm_migration BYPASSRLS, audit_log fix, CI test for app.tenant_id

2026-07-31 09:02:40 +02:00

0086_fix_global_tables_force_rls.py

gate: migration 0086, crm_migration BYPASSRLS, audit_log fix, CI test for app.tenant_id

2026-07-31 09:02:40 +02:00