sprint10+11: AI permission filter + API token scopes + merge check + owner transfer service + auto-transfer on deactivation

app/routes/contacts.py

@@ -23,6 +23,7 @@ from app.commands.contact_commands import (
     MergeContactsCommand,
 )
 from app.core.db import get_db
+from app.core.visibility import check_single_entity_access
 from app.deps import get_current_user, get_redis_dep, require_permission
 from app.schemas.contact import (
     ContactCreate,
@@ -276,6 +277,31 @@ async def merge_duplicate_contacts(
     current_user: dict = Depends(require_permission("contacts:write")),
 ):
     """Merge two contacts (source → target) via MergeContactsCommand."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
+    # Check write access on both contacts
+    try:
+        source_uuid = uuid.UUID(body.source_contact_id)
+        target_uuid = uuid.UUID(body.target_contact_id)
+    except (ValueError, TypeError):
+        raise HTTPException(status_code=400, detail="Invalid contact ID")
+
+    source_access = await check_single_entity_access(
+        db, "contact", source_uuid, user_id, tenant_id,
+        required_level="write", is_system_admin=is_admin,
+    )
+    if not source_access:
+        raise HTTPException(status_code=403, detail="No write access to source contact")
+
+    target_access = await check_single_entity_access(
+        db, "contact", target_uuid, user_id, tenant_id,
+        required_level="write", is_system_admin=is_admin,
+    )
+    if not target_access:
+        raise HTTPException(status_code=403, detail="No write access to target contact")
+
     cmd = MergeContactsCommand(
         source_contact_id=body.source_contact_id,
         target_contact_id=body.target_contact_id,