feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)

app/routes/companies.py

@@ -7,9 +7,8 @@ import uuid
 from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.auth import check_permission
 from app.core.db import get_db
-from app.deps import get_current_user
+from app.deps import require_permission
 from app.schemas.company import CompanyCreate, CompanyUpdate
 from app.services import company_service
 
@@ -25,7 +24,7 @@ async def list_companies(
     sort_by: str = Query("name"),
     sort_order: str = Query("asc", pattern="^(asc|desc)$"),
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("companies:read")),
 ):
     """List companies with pagination, FTS search, industry filter, and sorting."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -46,18 +45,12 @@ async def list_companies(
 async def create_company(
     body: CompanyCreate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("companies:write")),
 ):
     """Create a company. Requires write permission."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    role = current_user.get("role", "viewer")
 
-    if not check_permission(role, "companies", "create"):
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail={"detail": "Insufficient permissions", "code": "forbidden"},
-        )
 
     data = body.model_dump()
     return await company_service.create_company(db, tenant_id, user_id, data)
@@ -69,7 +62,7 @@ async def export_companies(
     industry: str | None = Query(None),
     search: str | None = Query(None),
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("companies:read")),
 ):
     """Export companies as CSV (streaming) or XLSX (buffered)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -155,7 +148,7 @@ async def export_companies(
 async def get_company(
     company_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("companies:read")),
 ):
     """Get a single company with contacts array. Cross-tenant returns 404."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -177,15 +170,12 @@ async def update_company(
     company_id: str,
     body: CompanyUpdate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("companies:write")),
 ):
     """Update a company (full PUT)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    role = current_user.get("role", "viewer")
 
-    if not check_permission(role, "companies", "update"):
-        raise HTTPException(403, detail={"detail": "Insufficient permissions", "code": "forbidden"})
 
     try:
         cid = uuid.UUID(company_id)
@@ -206,15 +196,12 @@ async def delete_company(
     company_id: str,
     cascade: bool = Query(False),
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("companies:write")),
 ):
     """Soft-delete a company. Use cascade=true to also delete N:M links."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    role = current_user.get("role", "viewer")
 
-    if not check_permission(role, "companies", "delete"):
-        raise HTTPException(403, detail={"detail": "Insufficient permissions", "code": "forbidden"})
 
     try:
         cid = uuid.UUID(company_id)
@@ -237,15 +224,12 @@ async def link_company_contact(
     company_id: str,
     contact_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("companies:write")),
 ):
     """Link a contact to a company (N:M)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    role = current_user.get("role", "viewer")
 
-    if not check_permission(role, "companies", "update"):
-        raise HTTPException(403, detail={"detail": "Insufficient permissions", "code": "forbidden"})
 
     try:
         comp_id = uuid.UUID(company_id)
@@ -266,15 +250,12 @@ async def unlink_company_contact(
     company_id: str,
     contact_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("companies:write")),
 ):
     """Unlink a contact from a company (N:M)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    role = current_user.get("role", "viewer")
 
-    if not check_permission(role, "companies", "update"):
-        raise HTTPException(403, detail={"detail": "Insufficient permissions", "code": "forbidden"})
 
     try:
         comp_id = uuid.UUID(company_id)
@@ -293,7 +274,7 @@ async def unlink_company_contact(
 async def get_company_emails(
     company_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("companies:read")),
 ):
     """Get emails for a company (mail plugin inactive — returns empty array)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])