feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)

app/routes/plugins.py

@@ -7,7 +7,7 @@ from pydantic import BaseModel
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.deps import require_admin
+from app.deps import require_permission
 from app.plugins.migration_runner import MigrationValidationError
 from app.services.plugin_service import get_plugin_service
 
@@ -22,7 +22,7 @@ class PluginConfigUpdate(BaseModel):
 @router.get("")
 async def list_plugins(
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("plugins:read")),
 ):
     """List all plugins with their current status (discovered, installed, active, inactive)."""
     service = get_plugin_service()
@@ -32,7 +32,7 @@ async def list_plugins(
 
 @router.get("/manifest")
 async def get_manifest_schema(
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("plugins:read")),
 ):
     """Get the plugin manifest schema documentation."""
     service = get_plugin_service()
@@ -43,7 +43,7 @@ async def get_manifest_schema(
 async def get_plugin_config(
     name: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("plugins:read")),
 ):
     """Get the configuration for a specific plugin.
 
@@ -64,7 +64,7 @@ async def update_plugin_config(
     name: str,
     body: PluginConfigUpdate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("plugins:configure")),
 ):
     """Update the configuration for a specific plugin.
 
@@ -92,7 +92,7 @@ async def update_plugin_config(
 async def install_plugin(
     name: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("plugins:configure")),
 ):
     """Install a plugin by name. Runs migrations and creates DB record.
 
@@ -125,7 +125,7 @@ async def install_plugin(
 async def activate_plugin(
     name: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("plugins:configure")),
 ):
     """Activate a plugin by name. Registers event listeners and routes.
 
@@ -158,7 +158,7 @@ async def activate_plugin(
 async def deactivate_plugin(
     name: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("plugins:configure")),
 ):
     """Deactivate a plugin by name. Unregisters event listeners and routes.
 
@@ -188,7 +188,7 @@ async def uninstall_plugin(
     name: str,
     remove_data: bool = Query(False),
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("plugins:configure")),
 ):
     """Uninstall a plugin. Optionally drop plugin-created tables with remove_data=true.