sprint10+11: AI permission filter + API token scopes + merge check + owner transfer service + auto-transfer on deactivation

app/routes/contacts.py

@@ -23,6 +23,7 @@ from app.commands.contact_commands import (
     MergeContactsCommand,
 )
 from app.core.db import get_db
+from app.core.visibility import check_single_entity_access
 from app.deps import get_current_user, get_redis_dep, require_permission
 from app.schemas.contact import (
     ContactCreate,
@@ -276,6 +277,31 @@ async def merge_duplicate_contacts(
     current_user: dict = Depends(require_permission("contacts:write")),
 ):
     """Merge two contacts (source → target) via MergeContactsCommand."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
+    # Check write access on both contacts
+    try:
+        source_uuid = uuid.UUID(body.source_contact_id)
+        target_uuid = uuid.UUID(body.target_contact_id)
+    except (ValueError, TypeError):
+        raise HTTPException(status_code=400, detail="Invalid contact ID")
+
+    source_access = await check_single_entity_access(
+        db, "contact", source_uuid, user_id, tenant_id,
+        required_level="write", is_system_admin=is_admin,
+    )
+    if not source_access:
+        raise HTTPException(status_code=403, detail="No write access to source contact")
+
+    target_access = await check_single_entity_access(
+        db, "contact", target_uuid, user_id, tenant_id,
+        required_level="write", is_system_admin=is_admin,
+    )
+    if not target_access:
+        raise HTTPException(status_code=403, detail="No write access to target contact")
+
     cmd = MergeContactsCommand(
         source_contact_id=body.source_contact_id,
         target_contact_id=body.target_contact_id,

app/routes/owner_transfer.py

@@ -0,0 +1,58 @@
+"""Owner transfer routes — admin-only bulk ownership transfer."""
+
+from __future__ import annotations
+
+import uuid
+from typing import Any
+
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.db import get_db
+from app.deps import require_admin
+from app.services.owner_transfer_service import transfer_ownership
+
+router = APIRouter(prefix="/api/v1/ownership", tags=["ownership"])
+
+
+class TransferRequest(BaseModel):
+    from_user_id: str
+    to_user_id: str
+    entity_types: list[str] | None = None
+
+
+@router.post("/transfer")
+async def transfer_ownership_endpoint(
+    body: TransferRequest,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict[str, Any] = Depends(require_admin),
+):
+    """Bulk-transfer all records from one user to another.
+
+    Admin-only endpoint. If entity_types is None, all known entity types
+    are transferred.
+    """
+    try:
+        from_uid = uuid.UUID(body.from_user_id)
+        to_uid = uuid.UUID(body.to_user_id)
+    except ValueError:
+        raise HTTPException(
+            400,
+            detail={"detail": "Invalid user_id format", "code": "invalid_id"},
+        )
+
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+
+    results = await transfer_ownership(
+        db,
+        tenant_id,
+        from_uid,
+        to_uid,
+        body.entity_types,
+    )
+
+    return {
+        "message": "Ownership transfer completed",
+        "results": results,
+    }

app/routes/users.py

@@ -18,6 +18,7 @@ from app.deps import get_current_user, require_permission
 from app.models.user import User, UserTenant
 from app.schemas.user import UserCreate, UserUpdate, UserResponse, PaginatedUsers
 from app.services.user_service import user_service, _UNSET
+from app.services.owner_transfer_service import transfer_ownership
 
 router = APIRouter(prefix="/api/v1/users", tags=["users"])
 
@@ -235,6 +236,16 @@ async def update_user(
         raise HTTPException(404, detail={"detail": "User not found", "code": "not_found"})
 
     user, user_tenant = result
+
+    # Auto-transfer ownership when user is deactivated
+    if body.is_active is False:
+        await transfer_ownership(
+            db,
+            tenant_id,
+            from_user_id=uid,
+            to_user_id=acting_user_id,
+        )
+
     await log_audit(db, tenant_id, acting_user_id, "update", "user", uid, changes=changes)
 
     # Invalidate permission cache for the updated user