sprint10+11: AI permission filter + API token scopes + merge check + owner transfer service + auto-transfer on deactivation

app/services/ai_copilot_service.py

@@ -12,6 +12,8 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.ai.llm_client import get_llm_client
 from app.core.audit import log_audit
 from app.core.auth import check_permission
+from app.core.visibility import apply_visibility_filter
+from app.core.visibility import check_single_entity_access
 from app.models.ai_conversation import AIConversation, AIMessage
 from app.models.contact import Contact
 from app.models.contact import Contact
@@ -64,6 +66,7 @@ async def process_query(
     query: str,
     conversation_id: str | None = None,
     context: dict[str, Any] | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """Process a natural language query and return proposed actions.
 
@@ -159,6 +162,7 @@ async def execute_action(
     role: str,
     conversation_id: str,
     action: dict[str, Any],
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """Execute a proposed action with RBAC enforcement.
 
@@ -195,9 +199,31 @@ async def execute_action(
             "success": False,
         }
 
+    # Check single entity access for write operations
+    if method in ("POST", "PATCH", "DELETE"):
+        parts = path.replace("/api/v1/", "").strip("/").split("/")
+        entity_type = parts[0] if parts else ""
+        entity_id = parts[1] if len(parts) > 1 else None
+        if entity_id:
+            try:
+                entity_uuid = uuid.UUID(entity_id)
+            except (ValueError, TypeError):
+                entity_uuid = None
+            if entity_uuid:
+                has_access = await check_single_entity_access(
+                    db, entity_type, entity_uuid, user_id, tenant_id,
+                    required_level="write", is_system_admin=is_system_admin,
+                )
+                if not has_access:
+                    return {
+                        "error": "Insufficient access to this entity",
+                        "status_code": 403,
+                        "success": False,
+                    }
+
     # Execute the action
     try:
-        exec_result = await _execute_api_action(db, tenant_id, user_id, method, path, body)
+        exec_result = await _execute_api_action(db, tenant_id, user_id, method, path, body, is_system_admin=is_system_admin)
     except Exception as exc:
         exec_result = {"error": str(exc), "status_code": 500}
 
@@ -303,6 +329,7 @@ async def _execute_api_action(
     method: str,
     path: str,
     body: dict[str, Any],
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """Execute an API action directly against the database.
 
@@ -314,9 +341,9 @@ async def _execute_api_action(
     entity_id = parts[1] if len(parts) > 1 else None
 
     if entity in ("companies", "contacts"):
-        return await _exec_contacts(db, tenant_id, user_id, method, entity_id, body)
+        return await _exec_contacts(db, tenant_id, user_id, method, entity_id, body, is_system_admin=is_system_admin)
     elif entity == "workflows":
-        return await _exec_workflows(db, tenant_id, user_id, method, entity_id, body)
+        return await _exec_workflows(db, tenant_id, user_id, method, entity_id, body, is_system_admin=is_system_admin)
     else:
         return {"error": f"Unsupported entity: {entity}", "status_code": 400, "success": False}
 
@@ -328,15 +355,18 @@ async def _exec_contacts(
     method: str,
     entity_id: str | None,
     body: dict[str, Any],
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """Execute contact operations (unified: company + person)."""
     if method == "GET":
-        result = await db.execute(
-            select(Contact).where(
-                Contact.tenant_id == tenant_id,
-                Contact.deleted_at.is_(None),
-            )
+        query = select(Contact).where(
+            Contact.tenant_id == tenant_id,
+            Contact.deleted_at.is_(None),
         )
+        query = await apply_visibility_filter(
+            db, query, "contact", Contact, user_id, tenant_id, is_system_admin=is_system_admin
+        )
+        result = await db.execute(query)
         contacts = result.scalars().all()
         return {
             "success": True,
@@ -372,6 +402,7 @@ async def _exec_workflows(
     method: str,
     entity_id: str | None,
     body: dict[str, Any],
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """Execute workflow operations."""
     if method == "GET":