sprint4+5: field-level permissions complete + universal ShareDialog frontend

app/core/permissions.py

@@ -461,6 +461,7 @@ def filter_fields_by_permission(
     """Filter response fields based on field-level permissions.
 
     Removes fields marked as "hidden", keeps others.
+    Also filters custom_fields (JSONB dict) entries that are marked as hidden.
     """
     if resolved.get("is_system_admin"):
         return data
@@ -476,5 +477,17 @@ def filter_fields_by_permission(
         perm = module_perms.get(key)
         if perm == "hidden":
             continue
-        result[key] = value
+
+        # Special handling for custom_fields JSONB dict
+        if key == "custom_fields" and isinstance(value, dict):
+            filtered_custom = {}
+            for cf_key, cf_value in value.items():
+                cf_perm = module_perms.get(cf_key)
+                if cf_perm == "hidden":
+                    continue
+                filtered_custom[cf_key] = cf_value
+            result[key] = filtered_custom
+        else:
+            result[key] = value
+
     return result