feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)

app/routes/notifications.py

@@ -14,7 +14,7 @@ from app.core.notifications import (
     list_notifications,
     mark_notification_read,
 )
-from app.deps import get_current_user
+from app.deps import require_permission
 from app.models.notification import (
     NotificationPreference,
     NotificationType,
@@ -29,7 +29,7 @@ async def list_notifications_endpoint(
     page: int = Query(1, ge=1),
     page_size: int = Query(25, ge=1, le=100),
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("notifications:read")),
 ):
     """List notifications (unread first)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -41,7 +41,7 @@ async def list_notifications_endpoint(
 async def mark_notification_read_endpoint(
     notification_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("notifications:write")),
 ):
     """Mark a notification as read."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -70,7 +70,7 @@ async def mark_notification_read_endpoint(
 @router.get("/unread-count")
 async def unread_count_endpoint(
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("notifications:read")),
 ):
     """Get unread notification count."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -82,7 +82,7 @@ async def unread_count_endpoint(
 @router.get("/types")
 async def list_notification_types(
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("notifications:read")),
 ):
     """List all registered notification types with the user's preference."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -125,7 +125,7 @@ async def list_notification_types(
 @router.get("/preferences")
 async def list_preferences(
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("notifications:read")),
 ):
     """List user's notification preferences."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -154,7 +154,7 @@ async def update_preference(
     type_key: str,
     data: NotificationPreferenceUpdate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("notifications:write")),
 ):
     """Update user's preference for a notification type (upsert)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])