feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)

app/routes/import_export.py

@@ -14,9 +14,8 @@ from fastapi import (
 )
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.auth import check_permission
 from app.core.db import get_db
-from app.deps import get_current_user
+from app.deps import require_permission
 from app.services import import_export_service
 
 router = APIRouter(prefix="/api/v1", tags=["import_export"])
@@ -27,17 +26,14 @@ async def import_csv(
     file: UploadFile = File(...),
     entity_type: str = Form("companies"),
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("import_export:write")),
 ):
     """Import companies or contacts from CSV file.
     entity_type: 'companies' or 'contacts'.
     """
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    role = current_user.get("role", "viewer")
 
-    if not check_permission(role, "companies", "create"):
-        raise HTTPException(403, detail={"detail": "Insufficient permissions", "code": "forbidden"})
 
     content = await file.read()
     csv_content = content.decode("utf-8")
@@ -58,15 +54,12 @@ async def import_csv_preview(
     file: UploadFile = File(...),
     entity_type: str = Form("companies"),
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("import_export:read")),
 ):
     """Preview CSV import (dry-run — no DB changes)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    role = current_user.get("role", "viewer")
 
-    if not check_permission(role, "companies", "read"):
-        raise HTTPException(403, detail={"detail": "Insufficient permissions", "code": "forbidden"})
 
     content = await file.read()
     csv_content = content.decode("utf-8")