sprint1: set_user_context + RLS policies on contacts + folder ACL migration 0051+0052

app/deps.py

@@ -8,11 +8,12 @@ from typing import Any
 
 import redis.asyncio as aioredis
 from fastapi import Depends, HTTPException, Request, status
+from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.config import get_settings
 from app.core.auth import get_redis, get_session_data, refresh_session_ttl
-from app.core.db import get_db, set_tenant_context
+from app.core.db import get_db, set_tenant_context, set_user_context
 
 logger = logging.getLogger(__name__)
 
@@ -80,6 +81,18 @@ async def get_current_user(
     tenant_id = uuid.UUID(session_data["tenant_id"])
     await set_tenant_context(db, tenant_id)
 
+    # Set RLS user context for row-level security
+    user_id = uuid.UUID(session_data["user_id"])
+    from app.models.group import UserGroup
+    groups_q = await db.execute(
+        select(UserGroup.group_id)
+        .where(UserGroup.user_id == user_id)
+        .where(UserGroup.tenant_id == tenant_id)
+    )
+    group_ids = [row[0] for row in groups_q]
+    is_admin = session_data.get("is_system_admin", False)
+    await set_user_context(db, user_id, group_ids, is_admin)
+
     # Load resolved permissions from cache (or DB on miss)
     from app.core.permissions import get_cached_permissions