chihlasm b3dba57bc5 feat: tenant isolation Phase 0 — app-layer filters, UUID audit, CI gate (#132)
* docs: add tenant data isolation design spec

Complete architecture plan for multi-tenant data isolation across
all layers (PostgreSQL RLS, application-layer filtering, schema
migration, testing strategy, and phased rollout checklist).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: add background job isolation policy to tenant isolation spec

Documents policy for all 5 existing background jobs:
- Knowledge Flywheel and PSA Retry flagged for account_id threading
- Chat Retention already follows correct pattern (model for others)
- Maintenance Schedule Firing needs account_id in queries + Session creation
- AI Conversation Expiry approved as cross-tenant with justification

Adds approved cross-tenant query registry and Phase 2 checklist items.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: add tenant isolation Phase 0 implementation plan

8 tasks covering: CRITICAL copilot hotfix, tenant_filter() helper,
get_tenant_context dependency, analytics/category/AI session gap fixes,
full UUID endpoint audit, TargetList dead code audit, teams orphan
check, and CI grep check for missing tenant filters.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat: add tenant_filter() helper and get_tenant_context dependency

tenant_filter(model, account_id) is the canonical app-layer tenant
scoping expression. Every query on a tenant table must use it.
build_tree_access_filter and build_step_visibility_filter updated
to call tenant_filter() internally for the account_id match.

get_tenant_context is a FastAPI dependency that returns account_id
or raises 403 if the user has no account — prevents raw access to
current_user.account_id and centralises the null check.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: scope analytics/flows/{tree_id} to requesting account

Any authenticated user could read flow analytics (session counts,
completion rates, CSAT) for any tree UUID. Now returns 404 if the
tree doesn't belong to the requesting account.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: scope category tree_count to requesting account

tree_count on GET /categories/{id} was including trees from all
accounts, leaking cross-tenant row counts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: restrict AI session search to current user only

Search endpoint used OR(user_id, account_id), exposing other users'
problem_summary and problem_domain within the same account. Sessions
are user-scoped only — cross-user access requires explicit escalation
or sharing. List and search endpoints now behave consistently.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: add ownership check and 404 responses to ai-sessions endpoints

Cross-tenant isolation audit found:
- retry-psa-push had NO ownership check (CRITICAL) — any user could retry any session's PSA push
- save_task_lane used db.get() without ownership filter, returned 403 revealing existence
- get_session returned 403 instead of 404 for unauthorized access
- stream_documentation returned 403 instead of 404

All now use query-level user_id filtering and return 404 to avoid revealing existence.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: return 404 instead of 403 for cross-tenant session access

All session endpoints (get, update, complete, scratchpad, variables, export,
ticket-link) now return 404 instead of 403 when a user tries to access
another user's session. This prevents confirming existence of resources
across tenant boundaries.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: return 404 instead of 403 for cross-tenant tree access

get_tree and update_tree now return 404 when a user cannot access a tree
(private tree from another account). Prevents confirming resource existence
across tenant boundaries.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: return 404 instead of 403 for cross-tenant step access

get_step_or_404 now returns 404 when can_view_step or can_edit_step fails,
preventing confirmation of step existence across tenant boundaries.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: return 404 instead of 403 for cross-tenant upload access

get_upload_url and delete_upload now return 404 when the upload belongs to
a different account/user, preventing resource existence confirmation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: return 404 instead of 403 for cross-tenant share access

revoke_share and create_share now return 404 when the caller is not the
owner, preventing resource existence confirmation across users.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: return 404 instead of 403 for cross-team tree access in maintenance schedules

_get_tree_or_403 now returns 404 when the user's team does not match,
preventing confirmation of tree existence across teams.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: return 404 instead of 403 for cross-account tag access

get_tag now returns 404 for account-specific tags that belong to another
account, preventing resource existence confirmation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: return 404 instead of 403 for cross-account step category access

get_step_category now returns 404 for account-specific categories that
belong to another account, preventing resource existence confirmation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test: add cross-tenant isolation tests for Task 6 UUID audit

Tests cover:
- Tree GET/PUT returns 404 for cross-account access
- Session GET returns 404 for cross-user access
- AI session GET returns 404 for cross-user access
- AI session retry-psa-push requires ownership
- Upload URL returns 404 for cross-account access
- Share revoke returns 404 for cross-user access

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: return 404 (not 403) for get_documentation cross-user access; add missing Task 6 tests

get_documentation was revealing session existence via 403. Added pre-check
query filtering by session_id AND user_id before calling the engine.

Also add cross-tenant isolation tests for steps, tags, step_categories,
and maintenance_schedules endpoints fixed in Task 6 (TDD was skipped).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: address Task 6 quality review — rename helper, restore 403 for intra-account, add docs test

- Rename _get_tree_or_403 → _get_tree_or_404 in maintenance_schedules.py
  (function now raises 404, old name was misleading)
- Restore HTTP 403 for intra-account permission failures in update_tree:
  same-account users who can see a tree but can't edit it got 404 (wrong);
  only cross-account lookups should return 404 to avoid confirming existence
- Apply same 403/404 distinction to update_tree_visibility
- Add test: get_documentation must return 404 for cross-user session access
- Add comment documenting owner-only design for documentation endpoints

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: Task 7+8 — TargetList audit, CI tenant-filter grep check

Task 7: TargetList dead code audit
- Found active code references in 12+ files across backend and frontend
  (full CRUD API + frontend page + MaintenanceScheduleSection + BatchLaunchModal)
- Decision: migrate to account_id in Phase 1 (cannot drop)
- DB row count not available from code-server — must verify from VPS SSH
  before Phase 1 migration
- Teams orphan check query documented; must run from VPS SSH before Phase 1
- Results documented in spec Section 9

Task 8: CI tenant-filter enforcement check (warn mode)
- Create backend/scripts/check_tenant_filters.py
  Scans endpoint and service files for select() on tenant tables without
  tenant_filter/account_id/user_id in surrounding context. Currently
  reports 109 warnings (Phase 1 backlog). Exits 0 (warn mode).
- Add Check tenant filter enforcement step to backend CI job
  Add --fail flag after Phase 1 backlog clears to make it blocking.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: record Phase 0 audit results — 0 orphaned teams, 0 target_list rows

Both checks confirmed 2026-04-09 from production DB.
Phase 1 migration is safe to proceed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-09 00:42:19 -04:00

ResolutionFlow

Stop writing ticket notes. Start generating them.

ResolutionFlow is an AI-powered troubleshooting platform for MSP professionals. Engineers follow guided flows while an AI copilot assists — and documentation writes itself as a byproduct of the work.

Production: resolutionflow.com


Quick Start

# Prerequisites: Docker, Python 3.11+, Node.js 20+

# Start PostgreSQL
docker start patherly_postgres

# Backend
cd backend
source venv/bin/activate
pip install -r requirements.txt
alembic upgrade head
uvicorn app.main:app --reload

# Frontend (separate terminal)
cd frontend
npm install
npm run dev

See DEV-ENV.md for full environment setup (devserver, Docker, CORS).


Features

FlowPilot AI Copilot

Like having a senior engineer on every call. FlowPilot guides troubleshooting decisions, suggests next steps with context-aware intelligence, and automatically captures documentation as a byproduct of the session.

  • Confidence-tiered model routing (fast responses for simple steps, deeper reasoning for complex decisions)
  • AI-generated ticket summaries and session documentation
  • Standalone assistant chat with RAG for open-ended troubleshooting
  • Knowledge Flywheel: AI analyzes completed sessions and proposes new flows automatically

Guided Flows

  • Troubleshooting Flows — Decision trees with branching paths for diagnosing issues
  • Procedural Flows (Projects) — Step-by-step checklists for onboarding, migrations, deployments
  • Maintenance Flows — Scheduled recurring tasks with batch execution across multiple targets
  • Visual Flow Editor with drag-and-drop canvas, undo/redo, markdown support
  • AI Flow Builder — describe what you need, get a complete flow generated

Auto-Documentation

Every session generates timestamped, detailed notes formatted for your PSA. Engineers never write another ticket note.

  • Export to Markdown, plain text, or HTML
  • Sensitive data redaction
  • One-click push to ConnectWise PSA tickets

ConnectWise PSA Integration

  • Post session documentation directly to ConnectWise tickets as internal notes
  • Pull ticket details and client context into FlowPilot sessions
  • Member mapping between ResolutionFlow and ConnectWise users
  • Credentials encrypted at rest (Fernet), stored per-team

Team & Knowledge Management

  • Role-based access (super_admin, team_admin, engineer, viewer)
  • Shared flow library with categories, tags, folders, full-text search
  • Step Library — reusable troubleshooting steps with ratings and reviews
  • Session sharing via link (authenticated and public views)
  • Escalation workflow with AI-enhanced briefing packages
  • Flow proposals from AI analysis (review queue for team leads)

Tech Stack

Layer Technology
Frontend React 19, TypeScript, Vite, Tailwind CSS v4
State Zustand (immer + zundo for undo/redo)
Routing React Router v7
Canvas @xyflow/react (React Flow) + dagre
Backend Python FastAPI, async SQLAlchemy 2.0 + asyncpg
Database PostgreSQL 16
Migrations Alembic (75+ migrations)
Auth JWT (python-jose) + bcrypt, refresh token rotation
AI Anthropic Claude API (tiered model routing)
Embeddings Voyage AI (semantic search)
Scheduling APScheduler 3.x (async)
Analytics PostHog
Hosting Railway (auto-deploy on push to main)

Project Structure

patherly/
├── backend/
│   ├── app/
│   │   ├── main.py                 # FastAPI entry point
│   │   ├── api/endpoints/          # Route handlers (35+ endpoints)
│   │   ├── core/                   # Config, database, permissions, security
│   │   ├── models/                 # SQLAlchemy models
│   │   ├── schemas/                # Pydantic schemas
│   │   └── services/psa/           # PSA provider abstraction layer
│   ├── alembic/                    # Database migrations
│   └── tests/                      # Integration tests (100+)
├── frontend/
│   ├── src/
│   │   ├── components/             # UI components by domain
│   │   ├── pages/                  # Page components
│   │   ├── store/                  # Zustand stores
│   │   └── types/                  # TypeScript interfaces
├── docs/                           # Design docs, plans, ConnectWise reference
├── brand-assets/                   # SVGs, brand guide
├── CLAUDE.md                       # AI assistant project context
├── CURRENT-STATE.md                # Detailed feature status
└── CHANGELOG.md                    # Release history

Running Tests

# Backend integration tests
cd backend
pytest --override-ini="addopts="

# Frontend build (stricter than tsc --noEmit)
cd frontend
npm run build

Documentation

Document Purpose
CLAUDE.md Full project context for AI-assisted development
CURRENT-STATE.md Detailed feature status
03-DEVELOPMENT-ROADMAP.md Development roadmap
UI-DESIGN-SYSTEM.md Design system (Slate & Ice)
DEV-ENV.md Development environment setup
CHANGELOG.md Release history

License

Proprietary. All rights reserved.

Description
Troubleshooting decision tree application for MSP engineers - automatically generates professional documentation from guided diagnostic workflows
Readme 16 MiB
Languages
Python 54.7%
TypeScript 43.5%
HTML 1.1%
CSS 0.6%