feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)

app/routes/attachments.py

@@ -9,9 +9,8 @@ from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile, s
 from fastapi.responses import FileResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.auth import check_permission
 from app.core.db import get_db
-from app.deps import get_current_user
+from app.deps import require_permission
 from app.services import attachment_service
 
 router = APIRouter(prefix="/api/v1/attachments", tags=["attachments"])
@@ -23,18 +22,12 @@ async def upload_attachment(
     entity_type: str = Form(...),
     entity_id: str = Form(...),
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("attachments:write")),
 ):
     """Upload a file attachment. Multipart form data."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    role = current_user.get("role", "viewer")
 
-    if not check_permission(role, "companies", "update"):
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail={"detail": "Insufficient permissions", "code": "forbidden"},
-        )
 
     try:
         eid = uuid.UUID(entity_id)
@@ -55,7 +48,7 @@ async def list_attachments(
     entity_type: str,
     entity_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("attachments:read")),
 ):
     """List attachments for a specific entity."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -72,7 +65,7 @@ async def list_attachments(
 async def download_attachment(
     attachment_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("attachments:read")),
 ):
     """Download an attachment file."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -101,18 +94,12 @@ async def download_attachment(
 async def delete_attachment(
     attachment_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("attachments:write")),
 ):
     """Delete an attachment."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    role = current_user.get("role", "viewer")
 
-    if not check_permission(role, "companies", "delete"):
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail={"detail": "Insufficient permissions", "code": "forbidden"},
-        )
 
     try:
         aid = uuid.UUID(attachment_id)