sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

app/routes/attachments.py

@@ -27,7 +27,7 @@ async def upload_attachment(
     """Upload a file attachment. Multipart form data."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         eid = uuid.UUID(entity_id)
@@ -37,10 +37,14 @@ async def upload_attachment(
     file_content = await file.read()
     mime_type = file.content_type or "application/octet-stream"
 
-    return await attachment_service.save_attachment(
-        db, tenant_id, user_id, entity_type, eid,
-        file.filename or "unknown", file_content, mime_type,
-    )
+    try:
+        return await attachment_service.save_attachment(
+            db, tenant_id, user_id, entity_type, eid,
+            file.filename or "unknown", file_content, mime_type,
+            is_system_admin=is_admin,
+        )
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.get("")
@@ -52,13 +56,18 @@ async def list_attachments(
 ):
     """List attachments for a specific entity."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         eid = uuid.UUID(entity_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid entity_id", "code": "invalid_id"}) from None
 
-    return await attachment_service.list_attachments(db, tenant_id, entity_type, eid)
+    try:
+        return await attachment_service.list_attachments(db, tenant_id, entity_type, eid, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.get("/{attachment_id}")
@@ -69,13 +78,18 @@ async def download_attachment(
 ):
     """Download an attachment file."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         aid = uuid.UUID(attachment_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid attachment_id", "code": "invalid_id"}) from None
 
-    data = await attachment_service.get_attachment(db, tenant_id, aid)
+    try:
+        data = await attachment_service.get_attachment(db, tenant_id, aid, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if data is None:
         raise HTTPException(404, detail={"detail": "Attachment not found", "code": "not_found"})
 
@@ -99,13 +113,16 @@ async def delete_attachment(
     """Delete an attachment."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         aid = uuid.UUID(attachment_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid attachment_id", "code": "invalid_id"}) from None
 
-    deleted = await attachment_service.delete_attachment(db, tenant_id, user_id, aid)
+    try:
+        deleted = await attachment_service.delete_attachment(db, tenant_id, user_id, aid, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if not deleted:
         raise HTTPException(404, detail={"detail": "Attachment not found", "code": "not_found"})