sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

app/routes/addresses.py

@@ -24,12 +24,18 @@ async def list_addresses(
 ):
     """List all addresses for a given entity (company or contact)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
     try:
         eid = uuid.UUID(entity_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid entity_id", "code": "invalid_id"}) from None
 
-    return await address_service.list_addresses(db, tenant_id, entity_type, eid)
+    try:
+        return await address_service.list_addresses(db, tenant_id, entity_type, eid, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.post("", status_code=status.HTTP_201_CREATED)
@@ -41,11 +47,13 @@ async def create_address(
     """Create a new address for a company or contact."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     data = body.model_dump()
     try:
-        return await address_service.create_address(db, tenant_id, user_id, data)
+        return await address_service.create_address(db, tenant_id, user_id, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     except ValueError as exc:
         raise HTTPException(400, detail={"detail": str(exc), "code": "invalid_value"}) from exc
 
@@ -60,7 +68,7 @@ async def update_address(
     """Update an address."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         aid = uuid.UUID(address_id)
@@ -68,7 +76,10 @@ async def update_address(
         raise HTTPException(400, detail={"detail": "Invalid address_id", "code": "invalid_id"}) from None
 
     data = body.model_dump(exclude_unset=True)
-    result = await address_service.update_address(db, tenant_id, user_id, aid, data)
+    try:
+        result = await address_service.update_address(db, tenant_id, user_id, aid, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(404, detail={"detail": "Address not found", "code": "not_found"})
     return result
@@ -83,13 +94,16 @@ async def delete_address(
     """Soft-delete an address."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         aid = uuid.UUID(address_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid address_id", "code": "invalid_id"}) from None
 
-    deleted = await address_service.delete_address(db, tenant_id, user_id, aid)
+    try:
+        deleted = await address_service.delete_address(db, tenant_id, user_id, aid, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if not deleted:
         raise HTTPException(404, detail={"detail": "Address not found", "code": "not_found"})

app/routes/attachments.py

@@ -27,7 +27,7 @@ async def upload_attachment(
     """Upload a file attachment. Multipart form data."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         eid = uuid.UUID(entity_id)
@@ -37,10 +37,14 @@ async def upload_attachment(
     file_content = await file.read()
     mime_type = file.content_type or "application/octet-stream"
 
-    return await attachment_service.save_attachment(
-        db, tenant_id, user_id, entity_type, eid,
-        file.filename or "unknown", file_content, mime_type,
-    )
+    try:
+        return await attachment_service.save_attachment(
+            db, tenant_id, user_id, entity_type, eid,
+            file.filename or "unknown", file_content, mime_type,
+            is_system_admin=is_admin,
+        )
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.get("")
@@ -52,13 +56,18 @@ async def list_attachments(
 ):
     """List attachments for a specific entity."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         eid = uuid.UUID(entity_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid entity_id", "code": "invalid_id"}) from None
 
-    return await attachment_service.list_attachments(db, tenant_id, entity_type, eid)
+    try:
+        return await attachment_service.list_attachments(db, tenant_id, entity_type, eid, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.get("/{attachment_id}")
@@ -69,13 +78,18 @@ async def download_attachment(
 ):
     """Download an attachment file."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         aid = uuid.UUID(attachment_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid attachment_id", "code": "invalid_id"}) from None
 
-    data = await attachment_service.get_attachment(db, tenant_id, aid)
+    try:
+        data = await attachment_service.get_attachment(db, tenant_id, aid, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if data is None:
         raise HTTPException(404, detail={"detail": "Attachment not found", "code": "not_found"})
 
@@ -99,13 +113,16 @@ async def delete_attachment(
     """Delete an attachment."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         aid = uuid.UUID(attachment_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid attachment_id", "code": "invalid_id"}) from None
 
-    deleted = await attachment_service.delete_attachment(db, tenant_id, user_id, aid)
+    try:
+        deleted = await attachment_service.delete_attachment(db, tenant_id, user_id, aid, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if not deleted:
         raise HTTPException(404, detail={"detail": "Attachment not found", "code": "not_found"})

app/routes/bank_accounts.py

@@ -22,7 +22,13 @@ async def list_bank_accounts(
 ):
     """List all bank accounts for the current tenant."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    return await bank_account_service.list_bank_accounts(db, tenant_id)
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
+    try:
+        return await bank_account_service.list_bank_accounts(db, tenant_id, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.post("", status_code=status.HTTP_201_CREATED)
@@ -34,10 +40,13 @@ async def create_bank_account(
     """Create a new bank account."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
     data = body.model_dump()
     try:
-        return await bank_account_service.create_bank_account(db, tenant_id, user_id, data)
+        return await bank_account_service.create_bank_account(db, tenant_id, user_id, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     except ValueError as exc:
         raise HTTPException(400, detail={"detail": str(exc), "code": "invalid_value"}) from exc
 
@@ -52,6 +61,7 @@ async def update_bank_account(
     """Update a bank account."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         aid = uuid.UUID(account_id)
@@ -59,7 +69,10 @@ async def update_bank_account(
         raise HTTPException(400, detail={"detail": "Invalid account_id", "code": "invalid_id"}) from None
 
     data = body.model_dump(exclude_unset=True)
-    result = await bank_account_service.update_bank_account(db, tenant_id, user_id, aid, data)
+    try:
+        result = await bank_account_service.update_bank_account(db, tenant_id, user_id, aid, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(404, detail={"detail": "Bank account not found", "code": "not_found"})
     return result
@@ -74,12 +87,16 @@ async def delete_bank_account(
     """Soft-delete a bank account."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         aid = uuid.UUID(account_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid account_id", "code": "invalid_id"}) from None
 
-    deleted = await bank_account_service.delete_bank_account(db, tenant_id, user_id, aid)
+    try:
+        deleted = await bank_account_service.delete_bank_account(db, tenant_id, user_id, aid, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if not deleted:
         raise HTTPException(404, detail={"detail": "Bank account not found", "code": "not_found"})

app/routes/saved_filters.py

@@ -53,19 +53,23 @@ async def list_saved_filters(
     """List saved filters for the current user, optionally filtered by entity_type."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
-    query = select(SavedFilter).where(
-        SavedFilter.tenant_id == tenant_id,
-        SavedFilter.user_id == user_id,
-        SavedFilter.deleted_at.is_(None),
-    )
-    if entity_type:
-        query = query.where(SavedFilter.entity_type == entity_type)
-    query = query.order_by(SavedFilter.name)
+    try:
+        query = select(SavedFilter).where(
+            SavedFilter.tenant_id == tenant_id,
+            SavedFilter.user_id == user_id,
+            SavedFilter.deleted_at.is_(None),
+        )
+        if entity_type:
+            query = query.where(SavedFilter.entity_type == entity_type)
+        query = query.order_by(SavedFilter.name)
 
-    result = await db.execute(query)
-    filters = result.scalars().all()
-    return [_filter_to_dict(f) for f in filters]
+        result = await db.execute(query)
+        filters = result.scalars().all()
+        return [_filter_to_dict(f) for f in filters]
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.post("", status_code=status.HTTP_201_CREATED, dependencies=[Depends(require_permission("contacts:read"))])
@@ -77,30 +81,34 @@ async def create_saved_filter(
     """Create a new saved filter for the current user."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
-    # Check uniqueness within user+entity
-    existing = await db.execute(
-        select(SavedFilter).where(
-            SavedFilter.tenant_id == tenant_id,
-            SavedFilter.user_id == user_id,
-            SavedFilter.entity_type == body.entity_type,
-            SavedFilter.name == body.name,
-            SavedFilter.deleted_at.is_(None),
+    try:
+        # Check uniqueness within user+entity
+        existing = await db.execute(
+            select(SavedFilter).where(
+                SavedFilter.tenant_id == tenant_id,
+                SavedFilter.user_id == user_id,
+                SavedFilter.entity_type == body.entity_type,
+                SavedFilter.name == body.name,
+                SavedFilter.deleted_at.is_(None),
+            )
         )
-    )
-    if existing.scalar_one_or_none() is not None:
-        raise HTTPException(409, detail={"detail": "Filter name already exists", "code": "duplicate"})
+        if existing.scalar_one_or_none() is not None:
+            raise HTTPException(409, detail={"detail": "Filter name already exists", "code": "duplicate"})
 
-    saved = SavedFilter(
-        tenant_id=tenant_id,
-        user_id=user_id,
-        name=body.name,
-        entity_type=body.entity_type,
-        filter_criteria=body.filter_criteria,
-    )
-    db.add(saved)
-    await db.flush()
-    return _filter_to_dict(saved)
+        saved = SavedFilter(
+            tenant_id=tenant_id,
+            user_id=user_id,
+            name=body.name,
+            entity_type=body.entity_type,
+            filter_criteria=body.filter_criteria,
+        )
+        db.add(saved)
+        await db.flush()
+        return _filter_to_dict(saved)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.delete("/{filter_id}", status_code=status.HTTP_204_NO_CONTENT, dependencies=[Depends(require_permission("contacts:read"))])
@@ -112,25 +120,29 @@ async def delete_saved_filter(
     """Delete a saved filter (soft-delete)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
-        fid = uuid.UUID(filter_id)
-    except (ValueError, TypeError):
-        raise HTTPException(400, detail={"detail": "Invalid filter_id", "code": "invalid_id"}) from None
+        try:
+            fid = uuid.UUID(filter_id)
+        except (ValueError, TypeError):
+            raise HTTPException(400, detail={"detail": "Invalid filter_id", "code": "invalid_id"}) from None
 
-    result = await db.execute(
-        select(SavedFilter).where(
-            SavedFilter.id == fid,
-            SavedFilter.tenant_id == tenant_id,
-            SavedFilter.user_id == user_id,
-            SavedFilter.deleted_at.is_(None),
+        result = await db.execute(
+            select(SavedFilter).where(
+                SavedFilter.id == fid,
+                SavedFilter.tenant_id == tenant_id,
+                SavedFilter.user_id == user_id,
+                SavedFilter.deleted_at.is_(None),
+            )
         )
-    )
-    saved = result.scalar_one_or_none()
-    if saved is None:
-        raise HTTPException(404, detail={"detail": "Saved filter not found", "code": "not_found"})
+        saved = result.scalar_one_or_none()
+        if saved is None:
+            raise HTTPException(404, detail={"detail": "Saved filter not found", "code": "not_found"})
 
-    from datetime import datetime, timezone
-    saved.deleted_at = datetime.now(timezone.utc)
-    await db.flush()
-    return Response(status_code=status.HTTP_204_NO_CONTENT)
+        from datetime import datetime, timezone
+        saved.deleted_at = datetime.now(timezone.utc)
+        await db.flush()
+        return Response(status_code=status.HTTP_204_NO_CONTENT)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e

app/routes/saved_views.py

@@ -53,19 +53,23 @@ async def list_saved_views(
     """List saved views for the current user, optionally filtered by entity_type."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
-    query = select(SavedView).where(
-        SavedView.tenant_id == tenant_id,
-        SavedView.user_id == user_id,
-        SavedView.deleted_at.is_(None),
-    )
-    if entity_type:
-        query = query.where(SavedView.entity_type == entity_type)
-    query = query.order_by(SavedView.name)
+    try:
+        query = select(SavedView).where(
+            SavedView.tenant_id == tenant_id,
+            SavedView.user_id == user_id,
+            SavedView.deleted_at.is_(None),
+        )
+        if entity_type:
+            query = query.where(SavedView.entity_type == entity_type)
+        query = query.order_by(SavedView.name)
 
-    result = await db.execute(query)
-    views = result.scalars().all()
-    return [_view_to_dict(v) for v in views]
+        result = await db.execute(query)
+        views = result.scalars().all()
+        return [_view_to_dict(v) for v in views]
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.post("", status_code=status.HTTP_201_CREATED, dependencies=[Depends(require_permission("contacts:read"))])
@@ -77,30 +81,34 @@ async def create_saved_view(
     """Create a new saved view for the current user."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
-    # Check uniqueness within user+entity
-    existing = await db.execute(
-        select(SavedView).where(
-            SavedView.tenant_id == tenant_id,
-            SavedView.user_id == user_id,
-            SavedView.entity_type == body.entity_type,
-            SavedView.name == body.name,
-            SavedView.deleted_at.is_(None),
+    try:
+        # Check uniqueness within user+entity
+        existing = await db.execute(
+            select(SavedView).where(
+                SavedView.tenant_id == tenant_id,
+                SavedView.user_id == user_id,
+                SavedView.entity_type == body.entity_type,
+                SavedView.name == body.name,
+                SavedView.deleted_at.is_(None),
+            )
         )
-    )
-    if existing.scalar_one_or_none() is not None:
-        raise HTTPException(409, detail={"detail": "View name already exists", "code": "duplicate"})
+        if existing.scalar_one_or_none() is not None:
+            raise HTTPException(409, detail={"detail": "View name already exists", "code": "duplicate"})
 
-    saved = SavedView(
-        tenant_id=tenant_id,
-        user_id=user_id,
-        name=body.name,
-        entity_type=body.entity_type,
-        view_config=body.view_config,
-    )
-    db.add(saved)
-    await db.flush()
-    return _view_to_dict(saved)
+        saved = SavedView(
+            tenant_id=tenant_id,
+            user_id=user_id,
+            name=body.name,
+            entity_type=body.entity_type,
+            view_config=body.view_config,
+        )
+        db.add(saved)
+        await db.flush()
+        return _view_to_dict(saved)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.put("/{view_id}", dependencies=[Depends(require_permission("contacts:read"))])
@@ -113,30 +121,34 @@ async def update_saved_view(
     """Update a saved view."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
-        vid = uuid.UUID(view_id)
-    except (ValueError, TypeError):
-        raise HTTPException(400, detail={"detail": "Invalid view_id", "code": "invalid_id"}) from None
+        try:
+            vid = uuid.UUID(view_id)
+        except (ValueError, TypeError):
+            raise HTTPException(400, detail={"detail": "Invalid view_id", "code": "invalid_id"}) from None
 
-    result = await db.execute(
-        select(SavedView).where(
-            SavedView.id == vid,
-            SavedView.tenant_id == tenant_id,
-            SavedView.user_id == user_id,
-            SavedView.deleted_at.is_(None),
+        result = await db.execute(
+            select(SavedView).where(
+                SavedView.id == vid,
+                SavedView.tenant_id == tenant_id,
+                SavedView.user_id == user_id,
+                SavedView.deleted_at.is_(None),
+            )
         )
-    )
-    saved = result.scalar_one_or_none()
-    if saved is None:
-        raise HTTPException(404, detail={"detail": "Saved view not found", "code": "not_found"})
+        saved = result.scalar_one_or_none()
+        if saved is None:
+            raise HTTPException(404, detail={"detail": "Saved view not found", "code": "not_found"})
 
-    if body.name is not None:
-        saved.name = body.name
-    if body.view_config is not None:
-        saved.view_config = body.view_config
-    await db.flush()
-    return _view_to_dict(saved)
+        if body.name is not None:
+            saved.name = body.name
+        if body.view_config is not None:
+            saved.view_config = body.view_config
+        await db.flush()
+        return _view_to_dict(saved)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.delete("/{view_id}", status_code=status.HTTP_204_NO_CONTENT, dependencies=[Depends(require_permission("contacts:read"))])
@@ -148,25 +160,29 @@ async def delete_saved_view(
     """Delete a saved view (soft-delete)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
-        vid = uuid.UUID(view_id)
-    except (ValueError, TypeError):
-        raise HTTPException(400, detail={"detail": "Invalid view_id", "code": "invalid_id"}) from None
+        try:
+            vid = uuid.UUID(view_id)
+        except (ValueError, TypeError):
+            raise HTTPException(400, detail={"detail": "Invalid view_id", "code": "invalid_id"}) from None
 
-    result = await db.execute(
-        select(SavedView).where(
-            SavedView.id == vid,
-            SavedView.tenant_id == tenant_id,
-            SavedView.user_id == user_id,
-            SavedView.deleted_at.is_(None),
+        result = await db.execute(
+            select(SavedView).where(
+                SavedView.id == vid,
+                SavedView.tenant_id == tenant_id,
+                SavedView.user_id == user_id,
+                SavedView.deleted_at.is_(None),
+            )
         )
-    )
-    saved = result.scalar_one_or_none()
-    if saved is None:
-        raise HTTPException(404, detail={"detail": "Saved view not found", "code": "not_found"})
+        saved = result.scalar_one_or_none()
+        if saved is None:
+            raise HTTPException(404, detail={"detail": "Saved view not found", "code": "not_found"})
 
-    from datetime import datetime, timezone
-    saved.deleted_at = datetime.now(timezone.utc)
-    await db.flush()
-    return Response(status_code=status.HTTP_204_NO_CONTENT)
+        from datetime import datetime, timezone
+        saved.deleted_at = datetime.now(timezone.utc)
+        await db.flush()
+        return Response(status_code=status.HTTP_204_NO_CONTENT)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e

app/routes/sequences.py

@@ -22,9 +22,13 @@ async def list_sequences(
 ):
     """List all sequences for the current tenant. Admin only."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
-
-    return await sequence_service.list_sequences(db, tenant_id)
+    try:
+        return await sequence_service.list_sequences(db, tenant_id, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.post("", status_code=status.HTTP_201_CREATED)
@@ -36,10 +40,13 @@ async def create_sequence(
     """Create a new sequence. Admin only."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     data = body.model_dump()
-    return await sequence_service.create_sequence(db, tenant_id, user_id, data)
+    try:
+        return await sequence_service.create_sequence(db, tenant_id, user_id, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.patch("/{sequence_id}")
@@ -52,7 +59,7 @@ async def update_sequence(
     """Update a sequence (name, prefix, padding only). Admin only."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         sid = uuid.UUID(sequence_id)
@@ -60,7 +67,10 @@ async def update_sequence(
         raise HTTPException(400, detail={"detail": "Invalid sequence_id", "code": "invalid_id"}) from None
 
     data = body.model_dump(exclude_unset=True)
-    result = await sequence_service.update_sequence(db, tenant_id, user_id, sid, data)
+    try:
+        result = await sequence_service.update_sequence(db, tenant_id, user_id, sid, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(404, detail={"detail": "Sequence not found", "code": "not_found"})
     return result
@@ -75,13 +85,16 @@ async def delete_sequence(
     """Delete a sequence (soft-delete). Admin only."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         sid = uuid.UUID(sequence_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid sequence_id", "code": "invalid_id"}) from None
 
-    deleted = await sequence_service.delete_sequence(db, tenant_id, user_id, sid)
+    try:
+        deleted = await sequence_service.delete_sequence(db, tenant_id, user_id, sid, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if not deleted:
         raise HTTPException(404, detail={"detail": "Sequence not found", "code": "not_found"})

app/routes/webhooks.py

@@ -31,8 +31,14 @@ async def list_webhooks(
 ):
     """List all webhooks for the current tenant."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    webhooks = await webhook_service.list_webhooks(db, tenant_id, event=event)
-    return webhooks
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
+    try:
+        webhooks = await webhook_service.list_webhooks(db, tenant_id, event=event, user_id=user_id, is_system_admin=is_admin)
+        return webhooks
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.post(
@@ -49,10 +55,15 @@ async def create_webhook(
     """Create a new webhook subscription."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    webhook = await webhook_service.create_webhook(
-        db, tenant_id, user_id, body.model_dump()
-    )
-    return webhook
+    is_admin = current_user.get("is_system_admin", False)
+
+    try:
+        webhook = await webhook_service.create_webhook(
+            db, tenant_id, user_id, body.model_dump(), is_system_admin=is_admin
+        )
+        return webhook
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.get(
@@ -67,12 +78,18 @@ async def get_webhook(
 ):
     """Get a single webhook by ID."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
     try:
         wh_id = uuid.UUID(webhook_id)
     except (ValueError, TypeError):
         raise HTTPException(400, detail={"detail": "Invalid webhook_id", "code": "invalid_id"}) from None
 
-    webhook = await webhook_service.get_webhook(db, tenant_id, wh_id)
+    try:
+        webhook = await webhook_service.get_webhook(db, tenant_id, wh_id, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if webhook is None:
         raise HTTPException(404, detail={"detail": "Webhook not found", "code": "not_found"})
     return webhook
@@ -92,6 +109,8 @@ async def update_webhook(
     """Update an existing webhook subscription."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
     try:
         wh_id = uuid.UUID(webhook_id)
     except (ValueError, TypeError):
@@ -101,9 +120,12 @@ async def update_webhook(
     if not update_data:
         raise HTTPException(400, detail={"detail": "No fields to update", "code": "no_updates"})
 
-    webhook = await webhook_service.update_webhook(
-        db, tenant_id, wh_id, update_data, user_id=user_id
-    )
+    try:
+        webhook = await webhook_service.update_webhook(
+            db, tenant_id, wh_id, update_data, user_id=user_id, is_system_admin=is_admin
+        )
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if webhook is None:
         raise HTTPException(404, detail={"detail": "Webhook not found", "code": "not_found"})
     return webhook
@@ -121,12 +143,18 @@ async def delete_webhook(
 ):
     """Delete a webhook subscription."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
     try:
         wh_id = uuid.UUID(webhook_id)
     except (ValueError, TypeError):
         raise HTTPException(400, detail={"detail": "Invalid webhook_id", "code": "invalid_id"}) from None
 
-    deleted = await webhook_service.delete_webhook(db, tenant_id, wh_id)
+    try:
+        deleted = await webhook_service.delete_webhook(db, tenant_id, wh_id, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if not deleted:
         raise HTTPException(404, detail={"detail": "Webhook not found", "code": "not_found"})
     return None
@@ -143,12 +171,18 @@ async def test_webhook(
 ):
     """Send a test payload to a webhook to verify connectivity."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
     try:
         wh_id = uuid.UUID(webhook_id)
     except (ValueError, TypeError):
         raise HTTPException(400, detail={"detail": "Invalid webhook_id", "code": "invalid_id"}) from None
 
-    webhook = await webhook_service.get_webhook(db, tenant_id, wh_id)
+    try:
+        webhook = await webhook_service.get_webhook(db, tenant_id, wh_id, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if webhook is None:
         raise HTTPException(404, detail={"detail": "Webhook not found", "code": "not_found"})
 
@@ -157,5 +191,8 @@ async def test_webhook(
         "message": "This is a test webhook from LeoCRM",
         "webhook_id": str(webhook.id),
     }
-    result = await webhook_service.send_webhook(webhook, "webhook.test", test_payload)
+    try:
+        result = await webhook_service.send_webhook(webhook, "webhook.test", test_payload, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     return result

app/routes/workflows.py

@@ -28,13 +28,21 @@ async def list_workflows(
 ):
     """List workflows with pagination."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    return await workflow_service.list_workflows(
-        db,
-        tenant_id,
-        page=page,
-        page_size=page_size,
-        is_active=is_active,
-    )
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
+    try:
+        return await workflow_service.list_workflows(
+            db,
+            tenant_id,
+            page=page,
+            page_size=page_size,
+            is_active=is_active,
+            user_id=user_id,
+            is_system_admin=is_admin,
+        )
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.post("", status_code=status.HTTP_201_CREATED)
@@ -46,10 +54,13 @@ async def create_workflow(
     """Create a new workflow definition. Requires write permission."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     data = body.model_dump()
-    return await workflow_service.create_workflow(db, tenant_id, user_id, data)
+    try:
+        return await workflow_service.create_workflow(db, tenant_id, user_id, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.get("/instances")
@@ -62,13 +73,21 @@ async def list_instances(
 ):
     """List workflow instances with optional status filter."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    return await workflow_service.list_instances(
-        db,
-        tenant_id,
-        page=page,
-        page_size=page_size,
-        status_filter=status,
-    )
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
+    try:
+        return await workflow_service.list_instances(
+            db,
+            tenant_id,
+            page=page,
+            page_size=page_size,
+            status_filter=status,
+            user_id=user_id,
+            is_system_admin=is_admin,
+        )
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.get("/{workflow_id}")
@@ -79,7 +98,13 @@ async def get_workflow(
 ):
     """Get a single workflow by ID."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    result = await workflow_service.get_workflow(db, tenant_id, workflow_id)
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
+    try:
+        result = await workflow_service.get_workflow(db, tenant_id, workflow_id, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -98,10 +123,13 @@ async def update_workflow(
     """Update a workflow definition."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     data = body.model_dump(exclude_unset=True)
-    result = await workflow_service.update_workflow(db, tenant_id, user_id, workflow_id, data)
+    try:
+        result = await workflow_service.update_workflow(db, tenant_id, user_id, workflow_id, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -119,9 +147,12 @@ async def delete_workflow(
     """Delete a workflow definition."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
-
-    deleted = await workflow_service.delete_workflow(db, tenant_id, user_id, workflow_id)
+    try:
+        deleted = await workflow_service.delete_workflow(db, tenant_id, user_id, workflow_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if not deleted:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -143,15 +174,20 @@ async def create_instance(
     """Create a new workflow instance."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
-    result = await workflow_service.create_instance(
-        db,
-        tenant_id,
-        user_id,
-        workflow_id=workflow_id,
-        context=body.context,
-        timeout_hours=body.timeout_hours,
-    )
+    try:
+        result = await workflow_service.create_instance(
+            db,
+            tenant_id,
+            user_id,
+            workflow_id=workflow_id,
+            context=body.context,
+            timeout_hours=body.timeout_hours,
+            is_system_admin=is_admin,
+        )
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -168,7 +204,13 @@ async def get_instance(
 ):
     """Get a workflow instance with step history."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    result = await workflow_service.get_instance(db, tenant_id, instance_id)
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
+    try:
+        result = await workflow_service.get_instance(db, tenant_id, instance_id, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -191,15 +233,20 @@ async def advance_instance(
     """
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
-    result = await workflow_service.advance_instance(
-        db,
-        tenant_id,
-        user_id,
-        instance_id=instance_id,
-        decision=body.decision,
-        comment=body.comment,
-    )
+    try:
+        result = await workflow_service.advance_instance(
+            db,
+            tenant_id,
+            user_id,
+            instance_id=instance_id,
+            decision=body.decision,
+            comment=body.comment,
+            is_system_admin=is_admin,
+        )
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -222,13 +269,18 @@ async def cancel_instance(
     """Cancel a workflow instance. Returns 200 with cancelled instance."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
-    result = await workflow_service.cancel_instance(
-        db,
-        tenant_id,
-        user_id,
-        instance_id=instance_id,
-    )
+    try:
+        result = await workflow_service.cancel_instance(
+            db,
+            tenant_id,
+            user_id,
+            instance_id=instance_id,
+            is_system_admin=is_admin,
+        )
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,