Agent Zero
ecc7a24c1c
Backend: - Phantom-Permission-Bug gefixt: approvals:read/write/approve fehlten in CORE_PERMISSIONS (Rollen konnten sie nie zugewiesen bekommen — gleiche Fehlerklasse wie dashboard:read in M2) Frontend: - api/approvals.ts: TanStack Hooks (list/detail/approve/reject/expire/create) - pages/Approvals.tsx: Review-Queue — Status-Tabs (Offen/Alle/Genehmigt/ Abgelehnt/Abgelaufen), Karten mit Aktion/Entity/Requester/Metadata, Approve/Reject mit Kommentar-Modal, Permission-Gating (approvals:approve) - Route /approvals (PermissionRoute approvals:read), Sidebar-Eintrag - i18n approvals.* + nav.approvals (de/en) Verifikation: Vitest 10/10 (Rendering, Tabs, Approve/Reject-Flow, Kommentar, Permission-Gating, Resolved-Zustände), RBAC-Regression 102/102, tsc clean, Build OK
294 lines
17 KiB
Python
294 lines
17 KiB
Python
"""Permission Registry — central catalog of all valid permissions.
|
|
|
|
Built at startup from core SYSTEM_PERMISSIONS and active plugin manifests.
|
|
Validates permission assignments and provides metadata for UI.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import logging
|
|
from typing import Any
|
|
|
|
from sqlalchemy import select
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.models.custom_field_definition import CustomFieldDefinition
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
# ── Core system permissions ──
|
|
CORE_PERMISSIONS: list[dict[str, str]] = [
|
|
{"key": "users:read", "label": "Users: Read", "category": "core", "module": "users"},
|
|
{"key": "users:write", "label": "Users: Write", "category": "core", "module": "users"},
|
|
{"key": "users:delete", "label": "Users: Delete", "category": "core", "module": "users"},
|
|
{"key": "roles:read", "label": "Roles: Read", "category": "core", "module": "roles"},
|
|
{"key": "roles:write", "label": "Roles: Write", "category": "core", "module": "roles"},
|
|
{"key": "roles:delete", "label": "Roles: Delete", "category": "core", "module": "roles"},
|
|
{"key": "groups:read", "label": "Groups: Read", "category": "core", "module": "groups"},
|
|
{"key": "groups:write", "label": "Groups: Write", "category": "core", "module": "groups"},
|
|
{"key": "groups:delete", "label": "Groups: Delete", "category": "core", "module": "groups"},
|
|
{"key": "audit:read", "label": "Audit Log: Read", "category": "core", "module": "audit"},
|
|
{"key": "settings:read", "label": "Settings: Read", "category": "core", "module": "settings"},
|
|
{"key": "settings:write", "label": "Settings: Write", "category": "core", "module": "settings"},
|
|
{"key": "plugins:read", "label": "Plugins: Read", "category": "core", "module": "plugins"},
|
|
{"key": "plugins:install", "label": "Plugins: Install", "category": "core", "module": "plugins"},
|
|
{"key": "plugins:configure", "label": "Plugins: Configure", "category": "core", "module": "plugins"},
|
|
{"key": "tenants:read", "label": "Tenants: Read", "category": "core", "module": "tenants"},
|
|
{"key": "tenants:write", "label": "Tenants: Write", "category": "core", "module": "tenants"},
|
|
{"key": "tenants:delete", "label": "Tenants: Delete", "category": "core", "module": "tenants"},
|
|
{"key": "notifications:read", "label": "Notifications: Read", "category": "core", "module": "notifications"},
|
|
{"key": "notifications:write", "label": "Notifications: Write", "category": "core", "module": "notifications"},
|
|
{"key": "attachments:read", "label": "Attachments: Read", "category": "core", "module": "attachments"},
|
|
{"key": "attachments:write", "label": "Attachments: Write", "category": "core", "module": "attachments"},
|
|
{"key": "attachments:delete", "label": "Attachments: Delete", "category": "core", "module": "attachments"},
|
|
{"key": "workflows:read", "label": "Workflows: Read", "category": "core", "module": "workflows"},
|
|
{"key": "workflows:write", "label": "Workflows: Write", "category": "core", "module": "workflows"},
|
|
{"key": "user_preferences:read", "label": "User Preferences: Read", "category": "core", "module": "user_preferences"},
|
|
{"key": "user_preferences:write", "label": "User Preferences: Write", "category": "core", "module": "user_preferences"},
|
|
{"key": "sequences:read", "label": "Sequences: Read", "category": "core", "module": "sequences"},
|
|
{"key": "sequences:write", "label": "Sequences: Write", "category": "core", "module": "sequences"},
|
|
{"key": "addresses:read", "label": "Addresses: Read", "category": "core", "module": "addresses"},
|
|
{"key": "addresses:write", "label": "Addresses: Write", "category": "core", "module": "addresses"},
|
|
{"key": "addresses:delete", "label": "Addresses: Delete", "category": "core", "module": "addresses"},
|
|
{"key": "taxes:read", "label": "Taxes: Read", "category": "core", "module": "taxes"},
|
|
{"key": "taxes:write", "label": "Taxes: Write", "category": "core", "module": "taxes"},
|
|
{"key": "currencies:read", "label": "Currencies: Read", "category": "core", "module": "currencies"},
|
|
{"key": "currencies:write", "label": "Currencies: Write", "category": "core", "module": "currencies"},
|
|
{"key": "custom_fields:read", "label": "Custom Fields: Read", "category": "core", "module": "custom_fields"},
|
|
{"key": "custom_fields:write", "label": "Custom Fields: Write", "category": "core", "module": "custom_fields"},
|
|
{"key": "import_export:read", "label": "Import/Export: Read", "category": "core", "module": "import_export"},
|
|
{"key": "import_export:write", "label": "Import/Export: Write", "category": "core", "module": "import_export"},
|
|
{"key": "workspaces:read", "label": "Workspaces: Read", "category": "core", "module": "workspaces"},
|
|
{"key": "workspaces:create", "label": "Workspaces: Create", "category": "core", "module": "workspaces"},
|
|
{"key": "workspaces:update", "label": "Workspaces: Update", "category": "core", "module": "workspaces"},
|
|
{"key": "workspaces:delete", "label": "Workspaces: Delete", "category": "core", "module": "workspaces"},
|
|
{"key": "workspaces:assign_users", "label": "Workspaces: Assign Users", "category": "core", "module": "workspaces"},
|
|
{"key": "workspaces:configure_modules", "label": "Workspaces: Configure Modules", "category": "core", "module": "workspaces"},
|
|
{"key": "approvals:read", "label": "Approvals: Read", "category": "core", "module": "approvals"},
|
|
{"key": "approvals:write", "label": "Approvals: Write", "category": "core", "module": "approvals"},
|
|
{"key": "approvals:approve", "label": "Approvals: Approve/Reject", "category": "core", "module": "approvals"},
|
|
{"key": "dashboard:read", "label": "Dashboard: Read", "category": "core", "module": "dashboard"},
|
|
{"key": "dashboard:write", "label": "Dashboard: Write", "category": "core", "module": "dashboard"},
|
|
{"key": "system:admin", "label": "System: Admin (cross-tenant)", "category": "system", "module": "system"},
|
|
# NOTE: Plugin permissions (calendar, dms, mail, tasks, comm, automation, ai,
|
|
# tags, entity_links, reports, search, mcp, permissions, agents)
|
|
# are registered dynamically via register_plugin_permissions() from plugin
|
|
# manifests at activation time. They are NOT hardcoded here (P0-4 fix).
|
|
]
|
|
|
|
|
|
# ── Core field definitions for field-level permissions ──
|
|
CORE_FIELD_DEFINITIONS: list[dict[str, str]] = [
|
|
# ── Contact fields ──
|
|
{"module": "contacts", "field": "firstname", "label": "First Name", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "surname", "label": "Last Name", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "displayname", "label": "Display Name", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "name", "label": "Name", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "email_1", "label": "Email 1", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "email_2", "label": "Email 2", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "phone_1", "label": "Phone 1", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "phone_2", "label": "Phone 2", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "mobilephone", "label": "Mobile", "sensitivity": "sensitive"},
|
|
{"module": "contacts", "field": "function", "label": "Position", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "website", "label": "Website", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "status", "label": "Status", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "type", "label": "Type", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "gender", "label": "Gender", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "suffix", "label": "Suffix", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "ext_name_line", "label": "Extra Name Line", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "country", "label": "Country", "sensitivity": "normal"},
|
|
# ── Financial / sensitive fields ──
|
|
{"module": "contacts", "field": "code", "label": "Code", "sensitivity": "sensitive"},
|
|
{"module": "contacts", "field": "accounting_code", "label": "Accounting Code", "sensitivity": "sensitive"},
|
|
{"module": "contacts", "field": "vendor_accounting_code", "label": "Vendor Accounting Code", "sensitivity": "sensitive"},
|
|
{"module": "contacts", "field": "vat_code", "label": "VAT Code", "sensitivity": "sensitive"},
|
|
{"module": "contacts", "field": "fiscal_code", "label": "Fiscal Code", "sensitivity": "sensitive"},
|
|
{"module": "contacts", "field": "commerce_code", "label": "Commerce Code", "sensitivity": "sensitive"},
|
|
{"module": "contacts", "field": "purchase_number", "label": "Purchase Number", "sensitivity": "sensitive"},
|
|
{"module": "contacts", "field": "bic", "label": "BIC", "sensitivity": "sensitive"},
|
|
# ── Addresses ──
|
|
{"module": "contacts", "field": "mailing_street", "label": "Mailing Street", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "mailing_city", "label": "Mailing City", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "mailing_postalcode", "label": "Mailing Postal Code", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "mailing_country", "label": "Mailing Country", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "visit_street", "label": "Visit Street", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "visit_city", "label": "Visit City", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "visit_postalcode", "label": "Visit Postal Code", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "visit_country", "label": "Visit Country", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "invoice_street", "label": "Invoice Street", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "invoice_city", "label": "Invoice City", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "invoice_postalcode", "label": "Invoice Postal Code", "sensitivity": "normal"},
|
|
{"module": "contacts", "field": "invoice_country", "label": "Invoice Country", "sensitivity": "normal"},
|
|
# ── Notes & Tags ──
|
|
{"module": "contacts", "field": "notes", "label": "Notes", "sensitivity": "sensitive"},
|
|
{"module": "contacts", "field": "tags", "label": "Tags", "sensitivity": "sensitive"},
|
|
# ── User fields ──
|
|
{"module": "users", "field": "email", "label": "Email", "sensitivity": "normal"},
|
|
{"module": "users", "field": "name", "label": "Name", "sensitivity": "normal"},
|
|
{"module": "users", "field": "role", "label": "Role", "sensitivity": "normal"},
|
|
{"module": "users", "field": "is_active", "label": "Active", "sensitivity": "normal"},
|
|
]
|
|
|
|
|
|
class PermissionRegistry:
|
|
"""Central registry of all valid permissions (core + active plugins)."""
|
|
|
|
def __init__(self) -> None:
|
|
self._permissions: dict[str, dict[str, str]] = {}
|
|
self._plugin_permissions: dict[str, list[dict[str, str]]] = {} # plugin_name → perms
|
|
self._active_plugins: set[str] = set()
|
|
self._initialized = False
|
|
self._field_definitions: dict[str, list[dict[str, str]]] = {} # plugin_name → field_defs
|
|
self._core_field_definitions: list[dict[str, str]] = list(CORE_FIELD_DEFINITIONS)
|
|
|
|
def initialize(self, active_plugin_names: set[str] | None = None) -> None:
|
|
"""Build the registry from core permissions and active plugin manifests.
|
|
|
|
Preserves already-registered plugin permissions (fixes P1.3 bug where
|
|
initialize() would wipe plugin permissions registered before startup).
|
|
"""
|
|
# Preserve existing plugin permissions
|
|
existing_plugin_perms = self._plugin_permissions.copy()
|
|
|
|
# Reset only core permissions, keep plugin permissions
|
|
self._permissions = {}
|
|
self._active_plugins = active_plugin_names or set()
|
|
|
|
# Register core permissions
|
|
for perm in CORE_PERMISSIONS:
|
|
self._permissions[perm["key"]] = perm
|
|
|
|
# Re-apply plugin permissions that were registered before initialize()
|
|
for plugin_name, perms in existing_plugin_perms.items():
|
|
self._plugin_permissions[plugin_name] = perms
|
|
for entry in perms:
|
|
self._permissions[entry["key"]] = entry
|
|
|
|
self._initialized = True
|
|
logger.info("Permission registry initialized with %d core permissions, %d plugin permissions",
|
|
len(CORE_PERMISSIONS), len(existing_plugin_perms))
|
|
|
|
def register_plugin_permissions(self, plugin_name: str, permissions: list[str]) -> None:
|
|
"""Register permissions from a plugin manifest."""
|
|
plugin_perms: list[dict[str, str]] = []
|
|
for perm in permissions:
|
|
# Normalize: replace dots with colons
|
|
normalized = perm.replace(".", ":")
|
|
entry = {
|
|
"key": normalized,
|
|
"label": normalized.replace(":", ": ").title(),
|
|
"category": "plugins",
|
|
"plugin_name": plugin_name,
|
|
"module": normalized.split(":")[0] if ":" in normalized else normalized,
|
|
}
|
|
plugin_perms.append(entry)
|
|
self._permissions[normalized] = entry
|
|
|
|
self._plugin_permissions[plugin_name] = plugin_perms
|
|
logger.info("Registered %d permissions for plugin '%s'", len(plugin_perms), plugin_name)
|
|
|
|
def unregister_plugin_permissions(self, plugin_name: str) -> None:
|
|
"""Remove permissions for a deactivated/uninstalled plugin."""
|
|
perms = self._plugin_permissions.pop(plugin_name, [])
|
|
for p in perms:
|
|
self._permissions.pop(p["key"], None)
|
|
logger.info("Unregistered permissions for plugin '%s'", plugin_name)
|
|
|
|
def is_valid(self, permission: str) -> bool:
|
|
"""Check if a permission key is known to the registry."""
|
|
return permission in self._permissions
|
|
|
|
def is_plugin_active(self, plugin_name: str) -> bool:
|
|
"""Check if a plugin is currently active."""
|
|
return plugin_name in self._active_plugins
|
|
|
|
def get_all(self) -> list[dict[str, str]]:
|
|
"""Return all registered permissions."""
|
|
return list(self._permissions.values())
|
|
|
|
def get_core(self) -> list[dict[str, str]]:
|
|
"""Return only core permissions."""
|
|
return [p for p in self._permissions.values() if p.get("category") == "core"]
|
|
|
|
def get_plugin_permissions(self) -> list[dict[str, str]]:
|
|
"""Return only plugin permissions."""
|
|
return [p for p in self._permissions.values() if p.get("category") == "plugins"]
|
|
|
|
def get_grouped(self) -> dict[str, list[dict[str, str]]]:
|
|
"""Return permissions grouped by category."""
|
|
groups: dict[str, list[dict[str, str]]] = {}
|
|
for perm in self._permissions.values():
|
|
cat = perm.get("category", "core")
|
|
if cat not in groups:
|
|
groups[cat] = []
|
|
groups[cat].append(perm)
|
|
return groups
|
|
|
|
def register_field_definitions(self, plugin_name: str, field_defs: list[dict[str, str]]) -> None:
|
|
"""Register field definitions from a plugin."""
|
|
self._field_definitions[plugin_name] = field_defs
|
|
logger.info("Registered %d field definitions for plugin '%s'", len(field_defs), plugin_name)
|
|
|
|
def get_all_field_definitions(self) -> list[dict[str, str]]:
|
|
"""Return all registered field definitions."""
|
|
result = list(self._core_field_definitions)
|
|
for defs in self._field_definitions.values():
|
|
result.extend(defs)
|
|
return result
|
|
|
|
async def get_all_field_definitions_with_custom(
|
|
self,
|
|
db: AsyncSession,
|
|
tenant_id: Any,
|
|
) -> list[dict[str, str]]:
|
|
"""Return all field definitions including custom fields from DB.
|
|
|
|
Merges core field definitions with plugin-provided definitions
|
|
and active custom field definitions from the database.
|
|
"""
|
|
result = list(self._core_field_definitions)
|
|
|
|
# Add plugin field definitions
|
|
for defs in self._field_definitions.values():
|
|
result.extend(defs)
|
|
|
|
# Load custom field definitions from DB
|
|
q = select(CustomFieldDefinition).where(
|
|
CustomFieldDefinition.tenant_id == tenant_id,
|
|
CustomFieldDefinition.is_active.is_(True),
|
|
)
|
|
custom_defs = await db.execute(q)
|
|
for cfd in custom_defs.scalars().all():
|
|
result.append({
|
|
"module": cfd.entity,
|
|
"field": cfd.name,
|
|
"label": cfd.label,
|
|
"sensitivity": cfd.sensitivity,
|
|
"custom": "true",
|
|
})
|
|
|
|
return result
|
|
|
|
|
|
# Global instance
|
|
_registry = PermissionRegistry()
|
|
|
|
|
|
def get_permission_registry() -> PermissionRegistry:
|
|
return _registry
|
|
|
|
|
|
def init_permission_registry(active_plugin_names: set[str] | None = None) -> None:
|
|
"""Initialize the global permission registry."""
|
|
_registry.initialize(active_plugin_names)
|
|
|
|
|
|
def register_plugin_permissions(plugin_name: str, permissions: list[str]) -> None:
|
|
"""Convenience: register plugin permissions on the global registry."""
|
|
_registry.register_plugin_permissions(plugin_name, permissions)
|
|
|
|
|
|
def unregister_plugin_permissions(plugin_name: str) -> None:
|
|
"""Convenience: unregister plugin permissions on the global registry."""
|
|
_registry.unregister_plugin_permissions(plugin_name)
|