feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)

app/routes/audit.py

@@ -10,7 +10,7 @@ from sqlalchemy import select, func
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.deps import get_current_user
+from app.deps import require_permission
 from app.models.audit import AuditLog
 
 router = APIRouter(prefix="/api/v1/audit-log", tags=["audit"])
@@ -40,14 +40,9 @@ async def list_audit_logs(
     page: int = Query(1, ge=1, description="Page number"),
     page_size: int = Query(50, ge=1, le=200, description="Items per page"),
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("audit:read")),
 ):
     """List audit log entries with filtering and pagination. Admin only."""
-    if current_user.get("role") != "admin":
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail={"detail": "Admin access required", "code": "forbidden"},
-        )
 
     tenant_id = uuid.UUID(current_user["tenant_id"])