release: corte da v1.1.0 — develop para main (24 commits)

.env.example

@@ -34,7 +34,8 @@ REDIS_PASSWORD=evoai_redis_pass
 SECRET_KEY_BASE=a]i9F#k2$$Lm7Nq0R!sT4uW6xZ8bD1eG3hJ5oP7rV9yAcE2fH4jM6pS8vX0zB3dK5nQ7tU9wY1
 JWT_SECRET_KEY=a]i9F#k2$$Lm7Nq0R!sT4uW6xZ8bD1eG3hJ5oP7rV9yAcE2fH4jM6pS8vX0zB3dK5nQ7tU9wY1
 
-# Used by: core-service, processor (API key encryption)
+# Used by: core-service, processor (API key encryption); compose feeds it to the
+# CRM as EVO_AI_ENCRYPTION_KEY (AI credentials)
 ENCRYPTION_KEY=XoQPOBw2FrzjQS11utERG9qO2MsAnXFxlhIns_uUxRk=
 
 # Used by: auth, crm, processor (service-to-service authentication)
@@ -220,7 +221,9 @@ APP_URL=http://localhost:8011
 LISTEN_ADDR=0.0.0.0:8080
 BOT_RUNTIME_SECRET=evo-bot-runtime-dev-secret
 AI_PROCESSOR_API_KEY=evo-processor-dev-api-key
-AI_CALL_TIMEOUT_SECONDS=30
+# CRM-236: um turno com tool faz duas chamadas ao modelo e a cauda do
+# provedor mede ~20s cada. Valor explicito aqui anula o default do codigo.
+AI_CALL_TIMEOUT_SECONDS=90
 
 # Bot Runtime integration (used by CRM service to connect to bot-runtime)
 BOT_RUNTIME_URL=http://evo-bot-runtime:8080
@@ -309,3 +312,8 @@ VITE_TINYMCE_API_KEY=no-api-key
 
 # # OpenAI (for AI-powered features)
 # OPENAI_API_KEY=
+
+# Host(s) allowed to serve incoming media to the AI agent, comma-separated,
+# no scheme or port. Must match the host of BACKEND_URL above (that is what
+# signs the attachment URLs); without it the agent receives no media.
+MEDIA_HOST_ALLOWLIST=localhost

.env.swarm.example

@@ -10,7 +10,8 @@
 #      placeholders: SUBDOMAIN_API / SUBDOMAIN_FRONTEND (your domains),
 #      every empty secret (SECRET_KEY_BASE, JWT_SECRET_KEY, EVOAI_CRM_API_TOKEN,
 #      DOORKEEPER_JWT_SECRET_KEY, ENCRYPTION_KEY, BOT_RUNTIME_SECRET — same
-#      value everywhere it appears), the Postgres password, and SMTP/S3 if used.
+#      value everywhere it appears; ENCRYPTION_KEY also fills the CRM's
+#      EVO_AI_ENCRYPTION_KEY), the Postgres password, and SMTP/S3 if used.
 #   2. Create the external network/volumes and a pgvector Postgres (see the
 #      header of docker-compose.swarm.yaml for the full dependency list).
 #   3. Deploy:
@@ -39,6 +40,7 @@ EVOAI_CRM_API_TOKEN=CHANGE_ME
 BOT_RUNTIME_SECRET=CHANGE_ME
 
 # Generate with: python3 -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+# Also goes into crm/crm_sidekiq as EVO_AI_ENCRYPTION_KEY (AI credentials).
 ENCRYPTION_KEY=CHANGE_ME
 
 # =============================================================================
@@ -85,3 +87,8 @@ MFA_ISSUER=EvoCRM
 SIDEKIQ_CONCURRENCY=10
 ACTIVE_STORAGE_SERVICE=local
 ORGANIZATION_NAME=Evo CRM
+
+# Host(s) que servem a midia recebida ao agente, separados por virgula, sem
+# esquema nem porta. Deve casar com o host do BACKEND_URL (quem assina a URL
+# do anexo); sem isso o agente nao recebe midia. Ex.: crm.seudominio.com
+MEDIA_HOST_ALLOWLIST=

README.md

@@ -86,11 +86,28 @@ The Evo CRM Community platform is composed of 6 independent services:
 ### Design principles (Community Edition)
 
 - **Single-tenant** — one account, no multi-tenancy overhead
-- **No super-admin** — all configuration via seed data and environment variables
 - **No billing / plans** — all limits removed, features unlocked by default
-- **Role hierarchy**: `account_owner` and `agent` — no intermediate roles
+- **Configuration via seed data and environment variables** — with one exception: installation-level settings (SMTP, Storage, Social Login, OpenAI, Channels, Inbound Email, Frontend Runtime) live in the database, behind `installation_configs.manage`
+- **Role hierarchy** — three seeded roles (`agent`, `account_owner`, `super_admin`), plus any custom role created at runtime — see [Roles](#roles)
 - **Account resolution** via token — no `account-id` header required between services
 
+#### Roles
+
+`db/seeds/rbac.rb` in [`evo-auth-service-community`](./evo-auth-service-community) is the authoritative role model. It seeds three roles:
+
+| Role | Scope | Permissions |
+|---|---|---|
+| `agent` | account | Attendance only — conversations, contacts, pipeline cards. Sees only the inboxes it is a member of |
+| `account_owner` | account | The whole catalog except `accounts.stats` and `installation_configs.manage` |
+| `super_admin` | installation | The whole catalog, including `installation_configs.manage` — the only role that renders Admin Settings and reaches `/api/v1/installation_configs/**` |
+
+Two facts a security review needs, because neither is enforced by the code:
+
+- **`super_admin` has no single-holder guarantee.** The setup wizard grants it to the user it creates, and the `PromoteFirstUserToSuperAdmin` migration grants it to the oldest user of an already-bootstrapped installation. Nothing prevents it being assigned to more — audit `user_roles` for the `super_admin` role key instead of assuming one installation owner.
+- **The seeded three are not the whole set.** `account_owner` holds `roles.create` and `roles.bulk_update_permissions`, so custom roles with arbitrary permission sets can be created at runtime via `POST /api/v1/roles`.
+
+`Role::ADMIN_ROLE_KEYS` (defined in `evo-ai-crm-community`, mirrored in auth and the frontend) is an admin-bypass allowlist, not the role model: it also names legacy `administrator`/`admin` keys the seed never creates, and the three copies disagree.
+
 ### Companion services (independent versioning)
 
 The following services are part of the Evolution Foundation ecosystem but are not pinned to the Evo CRM release tag:

docker-compose.swarm.yaml

@@ -15,7 +15,7 @@
 ##        - JWT_SECRET_KEY .......... auth, auth_sidekiq, crm, crm_sidekiq, core
 ##        - EVOAI_CRM_API_TOKEN ..... auth, auth_sidekiq, crm, crm_sidekiq, processor
 ##        - DOORKEEPER_JWT_SECRET_KEY  auth, auth_sidekiq
-##        - ENCRYPTION_KEY .......... core, processor
+##        - ENCRYPTION_KEY .......... core, processor; crm + crm_sidekiq (como EVO_AI_ENCRYPTION_KEY)
 ##        - BOT_RUNTIME_SECRET ...... crm, crm_sidekiq, bot_runtime
 ##        - AUTH_APIKEY_INTEGRATION_LOCAL  crm, crm_sidekiq, evoflow
 ##        - CLICKHOUSE_PASSWORD ..... clickhouse, evoflow
@@ -238,6 +238,7 @@ services:
       - SECRET_KEY_BASE=        # Mesmo valor de SECRET_KEY_BASE usado nos demais serviços
       - JWT_SECRET_KEY=         # Mesmo valor de JWT_SECRET_KEY usado nos demais serviços
       - EVOAI_CRM_API_TOKEN=    # Mesmo valor de EVOAI_CRM_API_TOKEN usado nos demais serviços
+      - EVO_AI_ENCRYPTION_KEY=  # Mesma chave Fernet do ENCRYPTION_KEY (core/processor) — cifra credenciais de IA
 
     ## 🗄️ PostgreSQL
       - POSTGRES_HOST=pgvector
@@ -316,6 +317,7 @@ services:
       - SECRET_KEY_BASE=        # Mesmo valor de SECRET_KEY_BASE usado nos demais serviços
       - JWT_SECRET_KEY=         # Mesmo valor de JWT_SECRET_KEY usado nos demais serviços
       - EVOAI_CRM_API_TOKEN=    # Mesmo valor de EVOAI_CRM_API_TOKEN usado nos demais serviços
+      - EVO_AI_ENCRYPTION_KEY=  # Mesma chave Fernet do ENCRYPTION_KEY (core/processor) — cifra credenciais de IA
 
     ## 🗄️ PostgreSQL
       - POSTGRES_HOST=pgvector
@@ -487,7 +489,12 @@ services:
     ## 🤖 Processor e segurança
       - AI_PROCESSOR_URL=http://evocrm_processor:8000
       - BOT_RUNTIME_SECRET=     # Mesmo valor de BOT_RUNTIME_SECRET usado no evocrm_crm e evocrm_crm_sidekiq
-      - AI_CALL_TIMEOUT_SECONDS=30
+      # CRM-236: um turno com tool faz duas chamadas ao modelo e a cauda do
+      # provedor mede ~20s cada. Valor explicito aqui anula o default do codigo.
+      - AI_CALL_TIMEOUT_SECONDS=90
+      - MEDIA_HOST_ALLOWLIST=   # Host(s) que servem a midia recebida, separados por virgula, sem esquema nem porta.
+                                # Use o host do BACKEND_URL do CRM (o que assina a URL do anexo); sem isso o agente nao recebe midia.
+                                # Ex.: "crm.seudominio.com".
 
     deploy:
       placement:
@@ -604,7 +611,7 @@ services:
   ## e roda as migrations. O banco do CRM (evocrm) não é tocado.
   ## O swarm ignora depends_on → o boot espera o ClickHouse por conta própria.
   evocrm_evoflow:
-    image: evoapicloud/evo-flow-community:develop
+    image: evoapicloud/evo-flow-community:latest
     command:
       - sh
       - -c

docker-compose.yml

@@ -132,6 +132,8 @@ services:
       POSTGRES_HOST: postgres
       EVO_AUTH_SERVICE_URL: http://evo-auth:3001
       EVO_AI_CORE_SERVICE_URL: http://evo-core:5555
+      # Same Fernet key core/processor read as ENCRYPTION_KEY; the CRM encrypts AI credentials with it.
+      EVO_AI_ENCRYPTION_KEY: ${ENCRYPTION_KEY:-XoQPOBw2FrzjQS11utERG9qO2MsAnXFxlhIns_uUxRk=}
       BOT_RUNTIME_URL: http://evo-bot-runtime:8080
       BOT_RUNTIME_SECRET: ${BOT_RUNTIME_SECRET:-evo-bot-runtime-dev-secret}
       BOT_RUNTIME_POSTBACK_BASE_URL: http://evo-crm:3000
@@ -175,6 +177,8 @@ services:
       POSTGRES_HOST: postgres
       EVO_AUTH_SERVICE_URL: http://evo-auth:3001
       EVO_AI_CORE_SERVICE_URL: http://evo-core:5555
+      # Same Fernet key core/processor read as ENCRYPTION_KEY; the CRM encrypts AI credentials with it.
+      EVO_AI_ENCRYPTION_KEY: ${ENCRYPTION_KEY:-XoQPOBw2FrzjQS11utERG9qO2MsAnXFxlhIns_uUxRk=}
       BOT_RUNTIME_URL: http://evo-bot-runtime:8080
       BOT_RUNTIME_SECRET: ${BOT_RUNTIME_SECRET:-evo-bot-runtime-dev-secret}
       BOT_RUNTIME_POSTBACK_BASE_URL: http://evo-crm:3000
@@ -288,6 +292,10 @@ services:
       REDIS_URL: redis://:${REDIS_PASSWORD:-evoai_redis_pass}@redis:6379
       AI_PROCESSOR_URL: http://evo-processor:8000
       BOT_RUNTIME_SECRET: ${BOT_RUNTIME_SECRET:-evo-bot-runtime-dev-secret}
+      # Hosts allowed to serve incoming media. Must cover the host the CRM signs
+      # attachment URLs with (ACTIVE_STORAGE_URL, or BACKEND_URL when unset), or
+      # the agent receives no media at all.
+      MEDIA_HOST_ALLOWLIST: ${MEDIA_HOST_ALLOWLIST:-localhost}
     depends_on:
       redis:
         condition: service_healthy