sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

app/routes/sequences.py

@@ -22,9 +22,13 @@ async def list_sequences(
 ):
     """List all sequences for the current tenant. Admin only."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
-
-    return await sequence_service.list_sequences(db, tenant_id)
+    try:
+        return await sequence_service.list_sequences(db, tenant_id, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.post("", status_code=status.HTTP_201_CREATED)
@@ -36,10 +40,13 @@ async def create_sequence(
     """Create a new sequence. Admin only."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     data = body.model_dump()
-    return await sequence_service.create_sequence(db, tenant_id, user_id, data)
+    try:
+        return await sequence_service.create_sequence(db, tenant_id, user_id, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.patch("/{sequence_id}")
@@ -52,7 +59,7 @@ async def update_sequence(
     """Update a sequence (name, prefix, padding only). Admin only."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         sid = uuid.UUID(sequence_id)
@@ -60,7 +67,10 @@ async def update_sequence(
         raise HTTPException(400, detail={"detail": "Invalid sequence_id", "code": "invalid_id"}) from None
 
     data = body.model_dump(exclude_unset=True)
-    result = await sequence_service.update_sequence(db, tenant_id, user_id, sid, data)
+    try:
+        result = await sequence_service.update_sequence(db, tenant_id, user_id, sid, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(404, detail={"detail": "Sequence not found", "code": "not_found"})
     return result
@@ -75,13 +85,16 @@ async def delete_sequence(
     """Delete a sequence (soft-delete). Admin only."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     try:
         sid = uuid.UUID(sequence_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid sequence_id", "code": "invalid_id"}) from None
 
-    deleted = await sequence_service.delete_sequence(db, tenant_id, user_id, sid)
+    try:
+        deleted = await sequence_service.delete_sequence(db, tenant_id, user_id, sid, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if not deleted:
         raise HTTPException(404, detail={"detail": "Sequence not found", "code": "not_found"})