Leopoldadmin/leocrm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)

Browse Source
This commit is contained in:
Agent Zero
2026-07-15 22:35:50 +02:00
parent 8ca6dfee88
commit 08fd3ab72c
18 changed files with 132 additions and 265 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/routes/addresses.py
+5 -24
View File
@@ -7,9 +7,8 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, Query, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.auth import check_permission
from app.core.db import get_db
from app.deps import get_current_user
from app.deps import require_permission
from app.schemas.address import AddressCreate, AddressUpdate
from app.services import address_service
@@ -21,7 +20,7 @@ async def list_addresses(
entity_type: str = Query(..., pattern="^(company|contact)$"),
entity_id: str = Query(...),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("addresses:read")),
):
"""List all addresses for a given entity (company or contact)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -37,18 +36,12 @@ async def list_addresses(
async def create_address(
body: AddressCreate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("addresses:write")),
):
"""Create a new address for a company or contact."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "companies", "create") and not check_permission(role, "contacts", "create"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
data = body.model_dump()
try:
@@ -62,18 +55,12 @@ async def update_address(
address_id: str,
body: AddressUpdate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("addresses:write")),
):
"""Update an address."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "companies", "update") and not check_permission(role, "contacts", "update"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
try:
aid = uuid.UUID(address_id)
@@ -91,18 +78,12 @@ async def update_address(
async def delete_address(
address_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("addresses:write")),
):
"""Soft-delete an address."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "companies", "delete") and not check_permission(role, "contacts", "delete"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
try:
aid = uuid.UUID(address_id)
app/routes/attachments.py
+5 -18
View File
@@ -9,9 +9,8 @@ from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile, s
from fastapi.responses import FileResponse
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.auth import check_permission
from app.core.db import get_db
from app.deps import get_current_user
from app.deps import require_permission
from app.services import attachment_service
router = APIRouter(prefix="/api/v1/attachments", tags=["attachments"])
@@ -23,18 +22,12 @@ async def upload_attachment(
entity_type: str = Form(...),
entity_id: str = Form(...),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("attachments:write")),
):
"""Upload a file attachment. Multipart form data."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "companies", "update"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
try:
eid = uuid.UUID(entity_id)
@@ -55,7 +48,7 @@ async def list_attachments(
entity_type: str,
entity_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("attachments:read")),
):
"""List attachments for a specific entity."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -72,7 +65,7 @@ async def list_attachments(
async def download_attachment(
attachment_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("attachments:read")),
):
"""Download an attachment file."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -101,18 +94,12 @@ async def download_attachment(
async def delete_attachment(
attachment_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("attachments:write")),
):
"""Delete an attachment."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "companies", "delete"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
try:
aid = uuid.UUID(attachment_id)
app/routes/audit.py
+2 -7
View File
@@ -10,7 +10,7 @@ from sqlalchemy import select, func
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.db import get_db
from app.deps import get_current_user
from app.deps import require_permission
from app.models.audit import AuditLog
router = APIRouter(prefix="/api/v1/audit-log", tags=["audit"])
@@ -40,14 +40,9 @@ async def list_audit_logs(
page: int = Query(1, ge=1, description="Page number"),
page_size: int = Query(50, ge=1, le=200, description="Items per page"),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("audit:read")),
):
"""List audit log entries with filtering and pagination. Admin only."""
if current_user.get("role") != "admin":
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Admin access required", "code": "forbidden"},
)
tenant_id = uuid.UUID(current_user["tenant_id"])
app/routes/companies.py
+10 -29
View File
@@ -7,9 +7,8 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.auth import check_permission
from app.core.db import get_db
from app.deps import get_current_user
from app.deps import require_permission
from app.schemas.company import CompanyCreate, CompanyUpdate
from app.services import company_service
@@ -25,7 +24,7 @@ async def list_companies(
sort_by: str = Query("name"),
sort_order: str = Query("asc", pattern="^(asc|desc)$"),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("companies:read")),
):
"""List companies with pagination, FTS search, industry filter, and sorting."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -46,18 +45,12 @@ async def list_companies(
async def create_company(
body: CompanyCreate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("companies:write")),
):
"""Create a company. Requires write permission."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "companies", "create"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
data = body.model_dump()
return await company_service.create_company(db, tenant_id, user_id, data)
@@ -69,7 +62,7 @@ async def export_companies(
industry: str | None = Query(None),
search: str | None = Query(None),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("companies:read")),
):
"""Export companies as CSV (streaming) or XLSX (buffered)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -155,7 +148,7 @@ async def export_companies(
async def get_company(
company_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("companies:read")),
):
"""Get a single company with contacts array. Cross-tenant returns 404."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -177,15 +170,12 @@ async def update_company(
company_id: str,
body: CompanyUpdate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("companies:write")),
):
"""Update a company (full PUT)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "companies", "update"):
raise HTTPException(403, detail={"detail": "Insufficient permissions", "code": "forbidden"})
try:
cid = uuid.UUID(company_id)
@@ -206,15 +196,12 @@ async def delete_company(
company_id: str,
cascade: bool = Query(False),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("companies:write")),
):
"""Soft-delete a company. Use cascade=true to also delete N:M links."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "companies", "delete"):
raise HTTPException(403, detail={"detail": "Insufficient permissions", "code": "forbidden"})
try:
cid = uuid.UUID(company_id)
@@ -237,15 +224,12 @@ async def link_company_contact(
company_id: str,
contact_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("companies:write")),
):
"""Link a contact to a company (N:M)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "companies", "update"):
raise HTTPException(403, detail={"detail": "Insufficient permissions", "code": "forbidden"})
try:
comp_id = uuid.UUID(company_id)
@@ -266,15 +250,12 @@ async def unlink_company_contact(
company_id: str,
contact_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("companies:write")),
):
"""Unlink a contact from a company (N:M)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "companies", "update"):
raise HTTPException(403, detail={"detail": "Insufficient permissions", "code": "forbidden"})
try:
comp_id = uuid.UUID(company_id)
@@ -293,7 +274,7 @@ async def unlink_company_contact(
async def get_company_emails(
company_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("companies:read")),
):
"""Get emails for a company (mail plugin inactive — returns empty array)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
app/routes/contacts.py
+7 -20
View File
@@ -11,9 +11,8 @@ from fastapi.responses import StreamingResponse
from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.auth import check_permission
from app.core.db import get_db
from app.deps import get_current_user
from app.deps import require_permission
from app.models.contact import Contact
from app.schemas.contact import ContactCreate, ContactUpdate
from app.services import contact_service
@@ -29,7 +28,7 @@ async def list_contacts(
sort_by: str = Query("last_name"),
sort_order: str = Query("asc", pattern="^(asc|desc)$"),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("contacts:read")),
):
"""List contacts with pagination and optional search.
@@ -53,7 +52,7 @@ async def export_contacts(
format: str = Query("csv", pattern="^(csv)$"),
search: str | None = Query(None),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("contacts:read")),
):
"""Stream contacts as CSV (not buffered — uses StreamingResponse).
@@ -148,18 +147,12 @@ async def export_contacts(
async def create_contact(
body: ContactCreate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("contacts:write")),
):
"""Create a contact. Optionally link to companies via company_ids array."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "contacts", "create"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
data = body.model_dump()
return await contact_service.create_contact(db, tenant_id, user_id, data)
@@ -169,7 +162,7 @@ async def create_contact(
async def get_contact(
contact_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("contacts:read")),
):
"""Get a single contact with companies array. Cross-tenant returns 404."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -191,15 +184,12 @@ async def update_contact(
contact_id: str,
body: ContactUpdate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("contacts:write")),
):
"""Update a contact."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "contacts", "update"):
raise HTTPException(403, detail={"detail": "Insufficient permissions", "code": "forbidden"})
try:
cid = uuid.UUID(contact_id)
@@ -220,15 +210,12 @@ async def delete_contact(
contact_id: str,
gdpr: bool = Query(False),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("contacts:write")),
):
"""Delete a contact. Default: soft-delete. Use gdpr=true for hard-delete with deletion_log."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "contacts", "delete"):
raise HTTPException(403, detail={"detail": "Insufficient permissions", "code": "forbidden"})
try:
cid = uuid.UUID(contact_id)
app/routes/currencies.py
+5 -24
View File
@@ -7,9 +7,8 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.auth import check_permission
from app.core.db import get_db
from app.deps import get_current_user
from app.deps import require_permission
from app.schemas.currency import CurrencyCreate, CurrencyUpdate
from app.services import currency_service
@@ -19,7 +18,7 @@ router = APIRouter(prefix="/api/v1/currencies", tags=["currencies"])
@router.get("")
async def list_currencies(
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("currencies:read")),
):
"""List all currencies for the current tenant."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -30,18 +29,12 @@ async def list_currencies(
async def create_currency(
body: CurrencyCreate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("currencies:write")),
):
"""Create a currency. Requires admin permission."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "settings", "create"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
data = body.model_dump()
return await currency_service.create_currency(db, tenant_id, user_id, data)
@@ -52,18 +45,12 @@ async def update_currency(
currency_id: str,
body: CurrencyUpdate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("currencies:write")),
):
"""Update a currency. Requires admin permission."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "settings", "update"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
try:
cid = uuid.UUID(currency_id)
@@ -81,18 +68,12 @@ async def update_currency(
async def delete_currency(
currency_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("currencies:write")),
):
"""Delete a currency. Requires admin permission."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "settings", "delete"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
try:
cid = uuid.UUID(currency_id)
app/routes/import_export.py
+3 -10
View File
@@ -14,9 +14,8 @@ from fastapi import (
)
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.auth import check_permission
from app.core.db import get_db
from app.deps import get_current_user
from app.deps import require_permission
from app.services import import_export_service
router = APIRouter(prefix="/api/v1", tags=["import_export"])
@@ -27,17 +26,14 @@ async def import_csv(
file: UploadFile = File(...),
entity_type: str = Form("companies"),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("import_export:write")),
):
"""Import companies or contacts from CSV file.
entity_type: 'companies' or 'contacts'.
"""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "companies", "create"):
raise HTTPException(403, detail={"detail": "Insufficient permissions", "code": "forbidden"})
content = await file.read()
csv_content = content.decode("utf-8")
@@ -58,15 +54,12 @@ async def import_csv_preview(
file: UploadFile = File(...),
entity_type: str = Form("companies"),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("import_export:read")),
):
"""Preview CSV import (dry-run — no DB changes)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "companies", "read"):
raise HTTPException(403, detail={"detail": "Insufficient permissions", "code": "forbidden"})
content = await file.read()
csv_content = content.decode("utf-8")
app/routes/metrics.py
+2 -2
View File
@@ -6,7 +6,7 @@ from fastapi import APIRouter, Depends
from fastapi.responses import PlainTextResponse
from app.core.monitoring import generate_metrics
from app.deps import require_admin
from app.deps import get_current_user
router = APIRouter(tags=["metrics"])
@@ -14,7 +14,7 @@ router = APIRouter(tags=["metrics"])
@router.get(
"/api/v1/metrics",
response_class=PlainTextResponse,
dependencies=[Depends(require_admin)],
dependencies=[Depends(get_current_user)],
)
async def metrics():
"""Prometheus metrics endpoint.
app/routes/notifications.py
+7 -7
View File
@@ -14,7 +14,7 @@ from app.core.notifications import (
list_notifications,
mark_notification_read,
)
from app.deps import get_current_user
from app.deps import require_permission
from app.models.notification import (
NotificationPreference,
NotificationType,
@@ -29,7 +29,7 @@ async def list_notifications_endpoint(
page: int = Query(1, ge=1),
page_size: int = Query(25, ge=1, le=100),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("notifications:read")),
):
"""List notifications (unread first)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -41,7 +41,7 @@ async def list_notifications_endpoint(
async def mark_notification_read_endpoint(
notification_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("notifications:write")),
):
"""Mark a notification as read."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -70,7 +70,7 @@ async def mark_notification_read_endpoint(
@router.get("/unread-count")
async def unread_count_endpoint(
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("notifications:read")),
):
"""Get unread notification count."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -82,7 +82,7 @@ async def unread_count_endpoint(
@router.get("/types")
async def list_notification_types(
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("notifications:read")),
):
"""List all registered notification types with the user's preference."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -125,7 +125,7 @@ async def list_notification_types(
@router.get("/preferences")
async def list_preferences(
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("notifications:read")),
):
"""List user's notification preferences."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -154,7 +154,7 @@ async def update_preference(
type_key: str,
data: NotificationPreferenceUpdate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("notifications:write")),
):
"""Update user's preference for a notification type (upsert)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
app/routes/plugins.py
+9 -9
View File
@@ -7,7 +7,7 @@ from pydantic import BaseModel
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.db import get_db
from app.deps import require_admin
from app.deps import require_permission
from app.plugins.migration_runner import MigrationValidationError
from app.services.plugin_service import get_plugin_service
@@ -22,7 +22,7 @@ class PluginConfigUpdate(BaseModel):
@router.get("")
async def list_plugins(
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("plugins:read")),
):
"""List all plugins with their current status (discovered, installed, active, inactive)."""
service = get_plugin_service()
@@ -32,7 +32,7 @@ async def list_plugins(
@router.get("/manifest")
async def get_manifest_schema(
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("plugins:read")),
):
"""Get the plugin manifest schema documentation."""
service = get_plugin_service()
@@ -43,7 +43,7 @@ async def get_manifest_schema(
async def get_plugin_config(
name: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("plugins:read")),
):
"""Get the configuration for a specific plugin.
@@ -64,7 +64,7 @@ async def update_plugin_config(
name: str,
body: PluginConfigUpdate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("plugins:configure")),
):
"""Update the configuration for a specific plugin.
@@ -92,7 +92,7 @@ async def update_plugin_config(
async def install_plugin(
name: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("plugins:configure")),
):
"""Install a plugin by name. Runs migrations and creates DB record.
@@ -125,7 +125,7 @@ async def install_plugin(
async def activate_plugin(
name: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("plugins:configure")),
):
"""Activate a plugin by name. Registers event listeners and routes.
@@ -158,7 +158,7 @@ async def activate_plugin(
async def deactivate_plugin(
name: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("plugins:configure")),
):
"""Deactivate a plugin by name. Unregisters event listeners and routes.
@@ -188,7 +188,7 @@ async def uninstall_plugin(
name: str,
remove_data: bool = Query(False),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("plugins:configure")),
):
"""Uninstall a plugin. Optionally drop plugin-created tables with remove_data=true.
app/routes/roles.py
+40 -10
View File
@@ -13,7 +13,7 @@ from app.core.audit import log_audit
from app.core.auth import get_redis
from app.core.db import get_db
from app.core.permissions import invalidate_all_user_permissions
from app.deps import get_current_user, require_admin
from app.deps import require_permission
from app.models.plugin import Plugin as PluginModel
from app.plugins.registry import get_registry
from app.schemas.role import RoleCreate, RoleUpdate
@@ -25,23 +25,53 @@ router = APIRouter(prefix="/api/v1/roles", tags=["roles"])
SYSTEM_PERMISSIONS: list[dict[str, str]] = [
{"key": "companies:read", "label": "Companies: Read", "category": "system"},
{"key": "companies:write", "label": "Companies: Write", "category": "system"},
{"key": "companies:delete", "label": "Companies: Delete", "category": "system"},
{"key": "contacts:read", "label": "Contacts: Read", "category": "system"},
{"key": "contacts:write", "label": "Contacts: Write", "category": "system"},
{"key": "contacts:delete", "label": "Contacts: Delete", "category": "system"},
{"key": "users:read", "label": "Users: Read", "category": "system"},
{"key": "users:write", "label": "Users: Write", "category": "system"},
{"key": "audit:read", "label": "Audit Log: Read", "category": "system"},
{"key": "settings:write", "label": "Settings: Write", "category": "system"},
{"key": "plugins:install", "label": "Plugins: Install", "category": "system"},
{"key": "plugins:configure", "label": "Plugins: Configure", "category": "system"},
{"key": "users:delete", "label": "Users: Delete", "category": "system"},
{"key": "roles:read", "label": "Roles: Read", "category": "system"},
{"key": "roles:write", "label": "Roles: Write", "category": "system"},
{"key": "roles:delete", "label": "Roles: Delete", "category": "system"},
{"key": "groups:read", "label": "Groups: Read", "category": "system"},
{"key": "groups:write", "label": "Groups: Write", "category": "system"},
{"key": "groups:delete", "label": "Groups: Delete", "category": "system"},
{"key": "audit:read", "label": "Audit Log: Read", "category": "system"},
{"key": "settings:read", "label": "Settings: Read", "category": "system"},
{"key": "settings:write", "label": "Settings: Write", "category": "system"},
{"key": "plugins:read", "label": "Plugins: Read", "category": "system"},
{"key": "plugins:install", "label": "Plugins: Install", "category": "system"},
{"key": "plugins:configure", "label": "Plugins: Configure", "category": "system"},
{"key": "tenants:read", "label": "Tenants: Read", "category": "system"},
{"key": "tenants:write", "label": "Tenants: Write", "category": "system"},
{"key": "tenants:delete", "label": "Tenants: Delete", "category": "system"},
{"key": "notifications:read", "label": "Notifications: Read", "category": "system"},
{"key": "notifications:write", "label": "Notifications: Write", "category": "system"},
{"key": "attachments:read", "label": "Attachments: Read", "category": "system"},
{"key": "attachments:write", "label": "Attachments: Write", "category": "system"},
{"key": "attachments:delete", "label": "Attachments: Delete", "category": "system"},
{"key": "workflows:read", "label": "Workflows: Read", "category": "system"},
{"key": "workflows:write", "label": "Workflows: Write", "category": "system"},
{"key": "sequences:read", "label": "Sequences: Read", "category": "system"},
{"key": "sequences:write", "label": "Sequences: Write", "category": "system"},
{"key": "addresses:read", "label": "Addresses: Read", "category": "system"},
{"key": "addresses:write", "label": "Addresses: Write", "category": "system"},
{"key": "addresses:delete", "label": "Addresses: Delete", "category": "system"},
{"key": "taxes:read", "label": "Taxes: Read", "category": "system"},
{"key": "taxes:write", "label": "Taxes: Write", "category": "system"},
{"key": "currencies:read", "label": "Currencies: Read", "category": "system"},
{"key": "currencies:write", "label": "Currencies: Write", "category": "system"},
{"key": "import_export:read", "label": "Import/Export: Read", "category": "system"},
{"key": "import_export:write", "label": "Import/Export: Write", "category": "system"},
]
@router.get("/permissions")
async def list_permissions(
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("roles:read")),
):
"""List all available permissions (system + active plugin permissions).
@@ -84,7 +114,7 @@ async def list_permissions(
@router.get("")
async def list_roles(
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("roles:read")),
):
"""List roles for the current tenant."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -96,7 +126,7 @@ async def list_roles(
async def create_role(
body: RoleCreate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("roles:write")),
):
"""Create a custom role (admin only)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -123,7 +153,7 @@ async def update_role(
role_id: str,
body: RoleUpdate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("roles:write")),
):
"""Update a role (admin only)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -168,7 +198,7 @@ async def update_role(
async def delete_role(
role_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("roles:write")),
):
"""Delete a role (admin only)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
app/routes/sequences.py
+5 -30
View File
@@ -7,9 +7,8 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.auth import check_permission
from app.core.db import get_db
from app.deps import get_current_user
from app.deps import require_permission
from app.schemas.sequence import SequenceCreate, SequenceUpdate
from app.services import sequence_service
@@ -19,17 +18,11 @@ router = APIRouter(prefix="/api/v1/sequences", tags=["sequences"])
@router.get("")
async def list_sequences(
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("sequences:read")),
):
"""List all sequences for the current tenant. Admin only."""
tenant_id = uuid.UUID(current_user["tenant_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "settings", "read"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
return await sequence_service.list_sequences(db, tenant_id)
@@ -38,18 +31,12 @@ async def list_sequences(
async def create_sequence(
body: SequenceCreate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("sequences:write")),
):
"""Create a new sequence. Admin only."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "settings", "create"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
data = body.model_dump()
return await sequence_service.create_sequence(db, tenant_id, user_id, data)
@@ -60,18 +47,12 @@ async def update_sequence(
sequence_id: str,
body: SequenceUpdate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("sequences:write")),
):
"""Update a sequence (name, prefix, padding only). Admin only."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "settings", "update"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
try:
sid = uuid.UUID(sequence_id)
@@ -89,18 +70,12 @@ async def update_sequence(
async def delete_sequence(
sequence_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("sequences:write")),
):
"""Delete a sequence (soft-delete). Admin only."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "settings", "delete"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
try:
sid = uuid.UUID(sequence_id)
app/routes/system_settings.py
+3 -10
View File
@@ -7,9 +7,8 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.auth import check_permission
from app.core.db import get_db
from app.deps import get_current_user
from app.deps import require_permission
from app.schemas.system_settings import SystemSettingsUpsert
from app.services import system_settings_service
@@ -19,7 +18,7 @@ router = APIRouter(prefix="/api/v1/system-settings", tags=["system-settings"])
@router.get("")
async def get_system_settings(
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("settings:read")),
):
"""Get system settings for the current tenant."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -33,18 +32,12 @@ async def get_system_settings(
async def upsert_system_settings(
body: SystemSettingsUpsert,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("settings:write")),
):
"""Upsert system settings. Requires admin permission."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "settings", "update"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
data = body.model_dump()
return await system_settings_service.upsert_system_settings(db, tenant_id, user_id, data)
app/routes/taxes.py
+5 -24
View File
@@ -7,9 +7,8 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.auth import check_permission
from app.core.db import get_db
from app.deps import get_current_user
from app.deps import require_permission
from app.schemas.tax import TaxRateCreate, TaxRateUpdate
from app.services import tax_service
@@ -19,7 +18,7 @@ router = APIRouter(prefix="/api/v1/taxes", tags=["taxes"])
@router.get("")
async def list_tax_rates(
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("taxes:read")),
):
"""List all tax rates for the current tenant."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -30,18 +29,12 @@ async def list_tax_rates(
async def create_tax_rate(
body: TaxRateCreate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("taxes:write")),
):
"""Create a tax rate. Requires admin permission."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "settings", "create"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
data = body.model_dump()
return await tax_service.create_tax_rate(db, tenant_id, user_id, data)
@@ -52,18 +45,12 @@ async def update_tax_rate(
tax_id: str,
body: TaxRateUpdate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("taxes:write")),
):
"""Update a tax rate. Requires admin permission."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "settings", "update"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
try:
tid = uuid.UUID(tax_id)
@@ -81,18 +68,12 @@ async def update_tax_rate(
async def delete_tax_rate(
tax_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("taxes:write")),
):
"""Delete a tax rate. Requires admin permission."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "settings", "delete"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
try:
tid = uuid.UUID(tax_id)
app/routes/tenants.py
+5 -5
View File
@@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, HTTPException
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.db import get_db
from app.deps import get_current_user, require_admin
from app.deps import require_permission
from app.schemas.tenant import TenantCreate, TenantUserAssign
from app.services.tenant_service import tenant_service
@@ -18,7 +18,7 @@ router = APIRouter(prefix="/api/v1/tenants", tags=["tenants"])
@router.get("")
async def list_tenants(
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("tenants:read")),
):
"""List tenants for the current user."""
user_id = uuid.UUID(current_user["user_id"])
@@ -30,7 +30,7 @@ async def list_tenants(
async def create_tenant(
body: TenantCreate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("tenants:write")),
):
"""Create a new tenant (admin only)."""
tenant = await tenant_service.create_tenant(db, body.name, body.slug)
@@ -45,7 +45,7 @@ async def create_tenant(
async def list_tenant_users(
tenant_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("tenants:write")),
):
"""List users in a tenant (admin only)."""
try:
@@ -64,7 +64,7 @@ async def assign_user_to_tenant(
tenant_id: str,
body: TenantUserAssign,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("tenants:write")),
):
"""Assign a user to a tenant (admin only)."""
try:
app/routes/users.py
+6 -6
View File
@@ -13,7 +13,7 @@ from app.core.auth import get_redis
from app.core.db import get_db
from app.core.notifications import create_notification
from app.core.permissions import invalidate_permission_cache
from app.deps import get_current_user, require_admin
from app.deps import require_permission
from app.schemas.user import UserCreate, UserUpdate
from app.services.user_service import user_service, _UNSET
@@ -42,7 +42,7 @@ async def list_users(
page_size: int = Query(25, ge=1, le=100),
search: str | None = Query(None),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("users:read")),
):
"""List users (admin only, paginated)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -53,7 +53,7 @@ async def list_users(
async def create_user(
body: UserCreate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("users:write")),
):
"""Create a new user (admin only)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -107,7 +107,7 @@ async def create_user(
async def get_user(
user_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("users:read")),
):
"""Get a single user."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -138,7 +138,7 @@ async def update_user(
user_id: str,
body: UserUpdate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("users:write")),
):
"""Update a user (admin only).
@@ -220,7 +220,7 @@ async def update_user(
async def delete_user(
user_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("users:write")),
):
"""Delete a user (admin only)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
app/routes/workflows.py
+11 -30
View File
@@ -7,9 +7,8 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.auth import check_permission
from app.core.db import get_db
from app.deps import get_current_user
from app.deps import require_permission
from app.schemas.workflow import AdvanceRequest, InstanceCreate, WorkflowCreate, WorkflowUpdate
from app.services import workflow_service
@@ -25,7 +24,7 @@ async def list_workflows(
page_size: int = Query(20, ge=1, le=100),
is_active: bool | None = Query(None),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("workflows:read")),
):
"""List workflows with pagination."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -42,18 +41,12 @@ async def list_workflows(
async def create_workflow(
body: WorkflowCreate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("workflows:write")),
):
"""Create a new workflow definition. Requires write permission."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "workflows", "create"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
data = body.model_dump()
return await workflow_service.create_workflow(db, tenant_id, user_id, data)
@@ -65,7 +58,7 @@ async def list_instances(
page_size: int = Query(20, ge=1, le=100),
status: str | None = Query(None),
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("workflows:read")),
):
"""List workflow instances with optional status filter."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -82,7 +75,7 @@ async def list_instances(
async def get_workflow(
workflow_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("workflows:read")),
):
"""Get a single workflow by ID."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -100,18 +93,12 @@ async def update_workflow(
workflow_id: str,
body: WorkflowUpdate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("workflows:write")),
):
"""Update a workflow definition."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "workflows", "update"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
data = body.model_dump(exclude_unset=True)
result = await workflow_service.update_workflow(db, tenant_id, user_id, workflow_id, data)
@@ -127,18 +114,12 @@ async def update_workflow(
async def delete_workflow(
workflow_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("workflows:write")),
):
"""Delete a workflow definition."""
tenant_id = uuid.UUID(current_user["tenant_id"])
user_id = uuid.UUID(current_user["user_id"])
role = current_user.get("role", "viewer")
if not check_permission(role, "workflows", "delete"):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={"detail": "Insufficient permissions", "code": "forbidden"},
)
deleted = await workflow_service.delete_workflow(db, tenant_id, user_id, workflow_id)
if not deleted:
@@ -157,7 +138,7 @@ async def create_instance(
workflow_id: str,
body: InstanceCreate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("workflows:write")),
):
"""Create a new workflow instance."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -183,7 +164,7 @@ async def create_instance(
async def get_instance(
instance_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("workflows:read")),
):
"""Get a workflow instance with step history."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -201,7 +182,7 @@ async def advance_instance(
instance_id: str,
body: AdvanceRequest,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("workflows:write")),
):
"""Advance or reject a workflow instance step.
@@ -236,7 +217,7 @@ async def advance_instance(
async def cancel_instance(
instance_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("workflows:write")),
):
"""Cancel a workflow instance. Returns 200 with cancelled instance."""
tenant_id = uuid.UUID(current_user["tenant_id"])