fix: redis cache invalidation in permission service + permission check in entity_permissions route + upsert cache invalidation + remove TopBar quick-create

app/routes/entity_permissions.py

@@ -49,10 +49,19 @@ async def create_entity_permission(
     body: EntityPermissionCreate,
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(get_current_user),
+    redis = Depends(get_redis_dep),
 ):
     """Grant or update a permission on any entity for a user, group, role, or guest."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_system_admin = current_user.get("is_system_admin", False)
+    # Permission check: only owner/admin/system_admin can manage permissions
+    if not is_system_admin:
+        access = await entity_permission_service.get_effective_access(
+            db, tenant_id, user_id, entity_type, uuid.UUID(entity_id)
+        )
+        if access not in ("owner", "admin", "delete"):
+            raise HTTPException(status_code=403, detail="Sie benötigen Admin-Rechte auf diesen Datensatz, um Berechtigungen zu verwalten")
     # Rate limit: max 50 permission changes per minute per user
     await check_rate_limit(
         f"perm_change:{user_id}",
@@ -60,7 +69,7 @@ async def create_entity_permission(
         _PERM_RATE_LIMIT_WINDOW,
     )
     try:
-        return await entity_permission_service.create_permission(
+        result = await entity_permission_service.create_permission(
             db,
             tenant_id,
             entity_type,
@@ -70,7 +79,9 @@ async def create_entity_permission(
             body.permission_level,
             body.expires_at,
             created_by=user_id,
+            redis=redis,
         )
+        return result
     except ValueError as e:
         raise HTTPException(status_code=400, detail=str(e))