sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

app/routes/addresses.py

@@ -24,12 +24,18 @@ async def list_addresses(
 ):
     """List all addresses for a given entity (company or contact)."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
     try:
         eid = uuid.UUID(entity_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid entity_id", "code": "invalid_id"}) from None
 
-    return await address_service.list_addresses(db, tenant_id, entity_type, eid)
+    try:
+        return await address_service.list_addresses(db, tenant_id, entity_type, eid, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.post("", status_code=status.HTTP_201_CREATED)
@@ -41,11 +47,13 @@ async def create_address(
     """Create a new address for a company or contact."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     data = body.model_dump()
     try:
-        return await address_service.create_address(db, tenant_id, user_id, data)
+        return await address_service.create_address(db, tenant_id, user_id, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     except ValueError as exc:
         raise HTTPException(400, detail={"detail": str(exc), "code": "invalid_value"}) from exc
 
@@ -60,7 +68,7 @@ async def update_address(
     """Update an address."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         aid = uuid.UUID(address_id)
@@ -68,7 +76,10 @@ async def update_address(
         raise HTTPException(400, detail={"detail": "Invalid address_id", "code": "invalid_id"}) from None
 
     data = body.model_dump(exclude_unset=True)
-    result = await address_service.update_address(db, tenant_id, user_id, aid, data)
+    try:
+        result = await address_service.update_address(db, tenant_id, user_id, aid, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(404, detail={"detail": "Address not found", "code": "not_found"})
     return result
@@ -83,13 +94,16 @@ async def delete_address(
     """Soft-delete an address."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         aid = uuid.UUID(address_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid address_id", "code": "invalid_id"}) from None
 
-    deleted = await address_service.delete_address(db, tenant_id, user_id, aid)
+    try:
+        deleted = await address_service.delete_address(db, tenant_id, user_id, aid, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if not deleted:
         raise HTTPException(404, detail={"detail": "Address not found", "code": "not_found"})