feat: phase 2 - migrate all route guards to require_permission (75 guards, 21 files)

app/routes/users.py

@@ -13,7 +13,7 @@ from app.core.auth import get_redis
 from app.core.db import get_db
 from app.core.notifications import create_notification
 from app.core.permissions import invalidate_permission_cache
-from app.deps import get_current_user, require_admin
+from app.deps import require_permission
 from app.schemas.user import UserCreate, UserUpdate
 from app.services.user_service import user_service, _UNSET
 
@@ -42,7 +42,7 @@ async def list_users(
     page_size: int = Query(25, ge=1, le=100),
     search: str | None = Query(None),
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("users:read")),
 ):
     """List users (admin only, paginated)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -53,7 +53,7 @@ async def list_users(
 async def create_user(
     body: UserCreate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("users:write")),
 ):
     """Create a new user (admin only)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -107,7 +107,7 @@ async def create_user(
 async def get_user(
     user_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("users:read")),
 ):
     """Get a single user."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -138,7 +138,7 @@ async def update_user(
     user_id: str,
     body: UserUpdate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("users:write")),
 ):
     """Update a user (admin only).
 
@@ -220,7 +220,7 @@ async def update_user(
 async def delete_user(
     user_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_admin),
+    current_user: dict = Depends(require_permission("users:write")),
 ):
     """Delete a user (admin only)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])