sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

app/routes/bank_accounts.py

@@ -22,7 +22,13 @@ async def list_bank_accounts(
 ):
     """List all bank accounts for the current tenant."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    return await bank_account_service.list_bank_accounts(db, tenant_id)
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
+    try:
+        return await bank_account_service.list_bank_accounts(db, tenant_id, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.post("", status_code=status.HTTP_201_CREATED)
@@ -34,10 +40,13 @@ async def create_bank_account(
     """Create a new bank account."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
     data = body.model_dump()
     try:
-        return await bank_account_service.create_bank_account(db, tenant_id, user_id, data)
+        return await bank_account_service.create_bank_account(db, tenant_id, user_id, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     except ValueError as exc:
         raise HTTPException(400, detail={"detail": str(exc), "code": "invalid_value"}) from exc
 
@@ -52,6 +61,7 @@ async def update_bank_account(
     """Update a bank account."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         aid = uuid.UUID(account_id)
@@ -59,7 +69,10 @@ async def update_bank_account(
         raise HTTPException(400, detail={"detail": "Invalid account_id", "code": "invalid_id"}) from None
 
     data = body.model_dump(exclude_unset=True)
-    result = await bank_account_service.update_bank_account(db, tenant_id, user_id, aid, data)
+    try:
+        result = await bank_account_service.update_bank_account(db, tenant_id, user_id, aid, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(404, detail={"detail": "Bank account not found", "code": "not_found"})
     return result
@@ -74,12 +87,16 @@ async def delete_bank_account(
     """Soft-delete a bank account."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         aid = uuid.UUID(account_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid account_id", "code": "invalid_id"}) from None
 
-    deleted = await bank_account_service.delete_bank_account(db, tenant_id, user_id, aid)
+    try:
+        deleted = await bank_account_service.delete_bank_account(db, tenant_id, user_id, aid, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if not deleted:
         raise HTTPException(404, detail={"detail": "Bank account not found", "code": "not_found"})