feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)

app/routes/tenants.py

@@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.deps import get_current_user, require_admin
+from app.deps import require_permission
 from app.schemas.tenant import TenantCreate, TenantUserAssign
 from app.services.tenant_service import tenant_service
 
@@ -18,7 +18,7 @@ router = APIRouter(prefix="/api/v1/tenants", tags=["tenants"])
 @router.get("")
 async def list_tenants(
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("tenants:read")),
 ):
     """List tenants for the current user."""
     user_id = uuid.UUID(current_user["user_id"])
@@ -30,7 +30,7 @@ async def list_tenants(
 async def create_tenant(
     body: TenantCreate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("tenants:write")),
 ):
     """Create a new tenant (admin only)."""
     tenant = await tenant_service.create_tenant(db, body.name, body.slug)
@@ -45,7 +45,7 @@ async def create_tenant(
 async def list_tenant_users(
     tenant_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("tenants:write")),
 ):
     """List users in a tenant (admin only)."""
     try:
@@ -64,7 +64,7 @@ async def assign_user_to_tenant(
     tenant_id: str,
     body: TenantUserAssign,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("tenants:write")),
 ):
     """Assign a user to a tenant (admin only)."""
     try: