sprint2+3: remaining services visibility filter + search provider permission-aware + dashboard route

app/services/custom_field_service.py

@@ -8,6 +8,7 @@ from typing import Any
 from sqlalchemy import select, delete
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
 from app.models.custom_field_definition import CustomFieldDefinition
 
 
@@ -15,6 +16,8 @@ async def list_definitions(
     db: AsyncSession,
     tenant_id: uuid.UUID,
     entity: str | None = None,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> list[CustomFieldDefinition]:
     """List custom field definitions for a tenant, optionally filtered by entity."""
     stmt = select(CustomFieldDefinition).where(
@@ -23,6 +26,10 @@ async def list_definitions(
     )
     if entity:
         stmt = stmt.where(CustomFieldDefinition.entity == entity)
+    if user_id and not is_system_admin:
+        stmt = await apply_visibility_filter(
+            db, stmt, "custom_field_definition", CustomFieldDefinition, user_id, tenant_id, is_system_admin
+        )
     stmt = stmt.order_by(CustomFieldDefinition.sort_order, CustomFieldDefinition.name)
     result = await db.execute(stmt)
     return list(result.scalars().all())
@@ -32,6 +39,8 @@ async def get_definition(
     db: AsyncSession,
     tenant_id: uuid.UUID,
     definition_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> CustomFieldDefinition | None:
     """Get a single custom field definition by ID."""
     stmt = select(CustomFieldDefinition).where(
@@ -39,7 +48,16 @@ async def get_definition(
         CustomFieldDefinition.tenant_id == tenant_id,
     )
     result = await db.execute(stmt)
-    return result.scalar_one_or_none()
+    definition = result.scalar_one_or_none()
+    if definition is None:
+        return None
+    if user_id and not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "custom_field_definition", definition.id, user_id, tenant_id, "read", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+    return definition
 
 
 async def create_definition(
@@ -62,6 +80,7 @@ async def create_definition(
         sort_order=data.get("sort_order", 0),
         created_by=user_id,
         updated_by=user_id,
+        owner_id=user_id,
     )
     db.add(definition)
     await db.flush()
@@ -75,12 +94,20 @@ async def update_definition(
     definition_id: uuid.UUID,
     data: dict[str, Any],
     user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> CustomFieldDefinition | None:
     """Update an existing custom field definition."""
-    definition = await get_definition(db, tenant_id, definition_id)
+    definition = await get_definition(db, tenant_id, definition_id, user_id, is_system_admin)
     if definition is None:
         return None
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "custom_field_definition", definition.id, user_id, tenant_id, "write", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     update_fields = ["label", "field_type", "options", "default_value", "required", "is_active", "sort_order"]
     for field in update_fields:
         if field in data:
@@ -98,6 +125,8 @@ async def delete_definition(
     db: AsyncSession,
     tenant_id: uuid.UUID,
     definition_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> bool:
     """Delete a custom field definition."""
     stmt = select(CustomFieldDefinition).where(
@@ -108,6 +137,14 @@ async def delete_definition(
     definition = result.scalar_one_or_none()
     if definition is None:
         return False
+
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "custom_field_definition", definition.id, user_id, tenant_id, "admin", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     await db.delete(definition)
     await db.flush()
     return True