Leopoldadmin/leocrm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)

Browse Source
This commit is contained in:
Agent Zero
2026-07-15 22:35:50 +02:00
parent 8ca6dfee88
commit 08fd3ab72c
18 changed files with 132 additions and 265 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/routes/roles.py
+40 -10
View File
@@ -13,7 +13,7 @@ from app.core.audit import log_audit
from app.core.auth import get_redis
from app.core.db import get_db
from app.core.permissions import invalidate_all_user_permissions
from app.deps import get_current_user, require_admin
from app.deps import require_permission
from app.models.plugin import Plugin as PluginModel
from app.plugins.registry import get_registry
from app.schemas.role import RoleCreate, RoleUpdate
@@ -25,23 +25,53 @@ router = APIRouter(prefix="/api/v1/roles", tags=["roles"])
SYSTEM_PERMISSIONS: list[dict[str, str]] = [
{"key": "companies:read", "label": "Companies: Read", "category": "system"},
{"key": "companies:write", "label": "Companies: Write", "category": "system"},
{"key": "companies:delete", "label": "Companies: Delete", "category": "system"},
{"key": "contacts:read", "label": "Contacts: Read", "category": "system"},
{"key": "contacts:write", "label": "Contacts: Write", "category": "system"},
{"key": "contacts:delete", "label": "Contacts: Delete", "category": "system"},
{"key": "users:read", "label": "Users: Read", "category": "system"},
{"key": "users:write", "label": "Users: Write", "category": "system"},
{"key": "audit:read", "label": "Audit Log: Read", "category": "system"},
{"key": "settings:write", "label": "Settings: Write", "category": "system"},
{"key": "plugins:install", "label": "Plugins: Install", "category": "system"},
{"key": "plugins:configure", "label": "Plugins: Configure", "category": "system"},
{"key": "users:delete", "label": "Users: Delete", "category": "system"},
{"key": "roles:read", "label": "Roles: Read", "category": "system"},
{"key": "roles:write", "label": "Roles: Write", "category": "system"},
{"key": "roles:delete", "label": "Roles: Delete", "category": "system"},
{"key": "groups:read", "label": "Groups: Read", "category": "system"},
{"key": "groups:write", "label": "Groups: Write", "category": "system"},
{"key": "groups:delete", "label": "Groups: Delete", "category": "system"},
{"key": "audit:read", "label": "Audit Log: Read", "category": "system"},
{"key": "settings:read", "label": "Settings: Read", "category": "system"},
{"key": "settings:write", "label": "Settings: Write", "category": "system"},
{"key": "plugins:read", "label": "Plugins: Read", "category": "system"},
{"key": "plugins:install", "label": "Plugins: Install", "category": "system"},
{"key": "plugins:configure", "label": "Plugins: Configure", "category": "system"},
{"key": "tenants:read", "label": "Tenants: Read", "category": "system"},
{"key": "tenants:write", "label": "Tenants: Write", "category": "system"},
{"key": "tenants:delete", "label": "Tenants: Delete", "category": "system"},
{"key": "notifications:read", "label": "Notifications: Read", "category": "system"},
{"key": "notifications:write", "label": "Notifications: Write", "category": "system"},
{"key": "attachments:read", "label": "Attachments: Read", "category": "system"},
{"key": "attachments:write", "label": "Attachments: Write", "category": "system"},
{"key": "attachments:delete", "label": "Attachments: Delete", "category": "system"},
{"key": "workflows:read", "label": "Workflows: Read", "category": "system"},
{"key": "workflows:write", "label": "Workflows: Write", "category": "system"},
{"key": "sequences:read", "label": "Sequences: Read", "category": "system"},
{"key": "sequences:write", "label": "Sequences: Write", "category": "system"},
{"key": "addresses:read", "label": "Addresses: Read", "category": "system"},
{"key": "addresses:write", "label": "Addresses: Write", "category": "system"},
{"key": "addresses:delete", "label": "Addresses: Delete", "category": "system"},
{"key": "taxes:read", "label": "Taxes: Read", "category": "system"},
{"key": "taxes:write", "label": "Taxes: Write", "category": "system"},
{"key": "currencies:read", "label": "Currencies: Read", "category": "system"},
{"key": "currencies:write", "label": "Currencies: Write", "category": "system"},
{"key": "import_export:read", "label": "Import/Export: Read", "category": "system"},
{"key": "import_export:write", "label": "Import/Export: Write", "category": "system"},
]
@router.get("/permissions")
async def list_permissions(
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("roles:read")),
):
"""List all available permissions (system + active plugin permissions).
@@ -84,7 +114,7 @@ async def list_permissions(
@router.get("")
async def list_roles(
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(get_current_user),
current_user: dict = Depends(require_permission("roles:read")),
):
"""List roles for the current tenant."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -96,7 +126,7 @@ async def list_roles(
async def create_role(
body: RoleCreate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("roles:write")),
):
"""Create a custom role (admin only)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -123,7 +153,7 @@ async def update_role(
role_id: str,
body: RoleUpdate,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("roles:write")),
):
"""Update a role (admin only)."""
tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -168,7 +198,7 @@ async def update_role(
async def delete_role(
role_id: str,
db: AsyncSession = Depends(get_db),
current_user: dict = Depends(require_admin),
current_user: dict = Depends(require_permission("roles:write")),
):
"""Delete a role (admin only)."""
tenant_id = uuid.UUID(current_user["tenant_id"])