sprint10+11: AI permission filter + API token scopes + merge check + owner transfer service + auto-transfer on deactivation

app/routes/owner_transfer.py

@@ -0,0 +1,58 @@
+"""Owner transfer routes — admin-only bulk ownership transfer."""
+
+from __future__ import annotations
+
+import uuid
+from typing import Any
+
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.db import get_db
+from app.deps import require_admin
+from app.services.owner_transfer_service import transfer_ownership
+
+router = APIRouter(prefix="/api/v1/ownership", tags=["ownership"])
+
+
+class TransferRequest(BaseModel):
+    from_user_id: str
+    to_user_id: str
+    entity_types: list[str] | None = None
+
+
+@router.post("/transfer")
+async def transfer_ownership_endpoint(
+    body: TransferRequest,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict[str, Any] = Depends(require_admin),
+):
+    """Bulk-transfer all records from one user to another.
+
+    Admin-only endpoint. If entity_types is None, all known entity types
+    are transferred.
+    """
+    try:
+        from_uid = uuid.UUID(body.from_user_id)
+        to_uid = uuid.UUID(body.to_user_id)
+    except ValueError:
+        raise HTTPException(
+            400,
+            detail={"detail": "Invalid user_id format", "code": "invalid_id"},
+        )
+
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+
+    results = await transfer_ownership(
+        db,
+        tenant_id,
+        from_uid,
+        to_uid,
+        body.entity_types,
+    )
+
+    return {
+        "message": "Ownership transfer completed",
+        "results": results,
+    }