fix(permissions): fix 10 high-priority permission system issues

P8: Invalidate all Redis sessions when is_system_admin changes
- Added is_system_admin to UserUpdate schema and UserResponse
- Added invalidate_all_user_sessions call in users.py route
- Added is_system_admin param to user_service.update_user

P9: Remove no-op permission resolution strategies
- Only highest_wins supported, others removed as no-ops
- Updated tenant.py CheckConstraint to only allow highest_wins
- Added KI-Kommentar in permissions.py

P10: Remove legacy check_permission from auth.py
- Removed duplicate check_permission and filter_fields_by_permission
- Fixed ai_copilot_service.py to use permissions.check_permission
- Updated ai_copilot route to pass resolved permissions dict

P11: Verified — no guest_users remnants found

P12: Migrate ContactFolderPermission to EntityPermission
- contact_folder_permission_service now delegates to entity_permission_service
- contact_folder_service uses EntityPermission queries
- Removed ContactFolderPermission from models/__init__.py
- Created migration 0114 to migrate data and drop table

P13: Added RLS migration history comment in alembic/env.py

P14: Verified — services already apply visibility_filter
- saved_filters/views filter by user_id (personal data)
- workspaces are UI context only
- notifications already filter by entity access

P15: Split entity_permission_service.py (932 lines) into 4 modules
- permission_resolver.py: get_effective_access, get_visible_ids, etc.
- permission_cache.py: Redis caching functions
- permission_audit.py: Audit logging helpers
- entity_permission_service.py: CRUD operations + re-exports

P16: Centralize PERM_RANK in permissions.py
- Single source: app.core.permissions.PERM_RANK
- Updated all services to import from permissions.py

P17: Fix MIGRATION_DATABASE_URL to use crm_migration
- docker-compose.yaml defaults changed from crm_user to crm_migration
- .env.docker.example updated
- prestart.sh comment updated

app/core/auth.py

@@ -297,38 +297,5 @@ async def update_session_tenant(
     return data
 
 
-def check_permission(
-    role_name: str, module: str, action: str, permissions: dict | None = None
-) -> bool:
-    """Check if a role has permission for a module+action.
-
-    ⚠️ Legacy Role Bypass entfernt — alle Admins müssen echte role_id haben
-    Built-in role strings (admin/editor/viewer) no longer grant permissions directly.
-    All permission checks must go through the RBAC system in app.core.permissions.
-    This function is kept for backward compatibility but no longer bypasses checks
-    based on role_name alone.
-    """
-    # Custom role — check permissions dict
-    if permissions:
-        module_perms = permissions.get(module, {})
-        return bool(module_perms.get(action, False))
-    return False
-
-
-def filter_fields_by_permission(
-    data: dict[str, Any],
-    field_permissions: dict[str, str],
-    role_name: str,
-) -> dict[str, Any]:
-    """Filter response fields based on field-level permissions.
-    field_permissions: {"annual_revenue": "hidden"} → removed for non-admin.
-    """
-    if role_name == "admin":
-        return data
-    result = {}
-    for key, value in data.items():
-        perm = field_permissions.get(key)
-        if perm == "hidden":
-            continue
-        result[key] = value
-    return result
+# ⚠️ Legacy check_permission and filter_fields_by_permission removed from auth.py.
+# Use app.core.permissions.check_permission and app.core.permissions.filter_fields_by_permission instead.

app/core/permissions.py

@@ -31,6 +31,10 @@ logger = logging.getLogger(__name__)
 CACHE_TTL = 300  # 5 minutes
 CACHE_PREFIX = "resolved"
 
+# Central permission rank — single source of truth for permission level ordering.
+# Used by entity_permission_service, bulk_permission_service, visibility, etc.
+PERM_RANK = {"none": 0, "read": 1, "write": 2, "admin": 3, "delete": 4, "owner": 5}
+
 # Severity ordering for field permissions: highest wins
 _FIELD_PERM_SEVERITY = {"hidden": 3, "readonly": 2, "read": 1}
 
@@ -284,25 +288,10 @@ async def resolve_permissions(
         tenant = tenant_result.scalar_one_or_none()
     resolution_strategy = tenant.resolution_strategy if tenant else "highest_wins"
 
-    # Apply resolution strategy
-    if resolution_strategy == "highest_wins":
-        # Default: allowed - denied (deny overrides allow at permission level)
-        resolved = allowed - denied
-    elif resolution_strategy == "deny_overrides_allow":
-        # Deny always wins: remove any allowed permission that is also denied
-        resolved = allowed - denied
-    elif resolution_strategy == "direct_overrides_group":
-        # Direct role permissions override group permissions
-        # Role permissions are loaded first, group permissions add but don't override
-        # Already implemented by loading order: role first, then group
-        resolved = allowed - denied
-    elif resolution_strategy == "most_restrictive_wins":
-        # Only permissions present in ALL sources (role AND groups) are kept
-        # This is intersection-based: only permissions granted by both role and groups
-        # For now, we keep the default behavior as intersection is complex with multiple groups
-        resolved = allowed - denied
-    else:
-        resolved = allowed - denied
+    # ⚠️ Only highest_wins strategy supported — other strategies removed as they were no-ops.
+    # All strategies previously produced the same result: resolved = allowed - denied.
+    # The strategy field is kept for backward compatibility but only highest_wins is honored.
+    resolved = allowed - denied
 
     return {
         "permissions": resolved,

app/core/visibility.py

@@ -39,8 +39,7 @@ from app.models.user import User, UserTenant
 
 logger = logging.getLogger(__name__)
 
-# Permission rank for comparison
-_PERM_RANK = {"none": 0, "read": 1, "write": 2, "admin": 3, "delete": 4, "owner": 5}
+from app.core.permissions import PERM_RANK as _PERM_RANK
 
 
 def _rank(level: str) -> int: