sprint9: app visibility — sidebar permission filter + TopBar + ProtectedRoute + route guards

app/plugins/builtins/calendar/models.py

@@ -18,6 +18,7 @@ from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 
 from app.core.db import Base, TenantMixin
+from app.models.owned_mixin import OwnedMixin
 
 
 class Calendar(Base, TenantMixin):
@@ -37,7 +38,7 @@ class Calendar(Base, TenantMixin):
     deleted_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
 
 
-class CalendarEntry(Base, TenantMixin):
+class CalendarEntry(Base, TenantMixin, OwnedMixin):
     """Calendar entry — appointment or task, tenant-scoped, soft-deletable."""
 
     __tablename__ = "calendar_entries"
@@ -131,7 +132,7 @@ class UserCalendarVisibility(Base):
     visible: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
 
 
-class Subtask(Base, TenantMixin):
+class Subtask(Base, TenantMixin, OwnedMixin):
     """Subtask belonging to a calendar entry."""
 
     __tablename__ = "subtasks"

app/plugins/builtins/calendar/routes.py

@@ -22,6 +22,7 @@ from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
 from app.deps import get_current_user, require_admin, require_permission
 from app.plugins.builtins.calendar.ics_utils import (
     export_entries_to_ics,