sprint6+7: permission notifications + audit trail + notification entity filter + mail account permissions + migration 0053

app/routes/notifications.py

@@ -16,10 +16,12 @@ from app.core.notifications import (
 )
 from app.deps import require_permission
 from app.models.notification import (
+    Notification,
     NotificationPreference,
     NotificationType,
 )
 from app.schemas.common import NotificationPreferenceUpdate, UnreadCountResponse
+from app.services import entity_permission_service
 
 router = APIRouter(prefix="/api/v1/notifications", tags=["notifications"])
 
@@ -31,10 +33,30 @@ async def list_notifications_endpoint(
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(require_permission("notifications:read")),
 ):
-    """List notifications (unread first)."""
+    """List notifications (unread first), filtered by entity access."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    return await list_notifications(db, tenant_id, user_id, page, page_size)
+    result = await list_notifications(db, tenant_id, user_id, page, page_size)
+    # Filter out notifications referencing entities the user cannot access
+    filtered_items = []
+    for item in result.get("items", []):
+        entity_type = item.get("entity_type")
+        entity_id_str = item.get("entity_id")
+        if entity_type and entity_id_str:
+            try:
+                eid = uuid.UUID(entity_id_str)
+                has_access = await entity_permission_service.check_entity_access(
+                    db, tenant_id, user_id, entity_type, eid, required_level="read"
+                )
+                if not has_access:
+                    continue
+            except (ValueError, Exception):
+                # If entity doesn't exist or error, skip this notification
+                continue
+        filtered_items.append(item)
+    result["items"] = filtered_items
+    result["total"] = len(filtered_items)
+    return result
 
 
 @router.patch("/{notification_id}/read")