sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

app/routes/webhooks.py

@@ -31,8 +31,14 @@ async def list_webhooks(
 ):
     """List all webhooks for the current tenant."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    webhooks = await webhook_service.list_webhooks(db, tenant_id, event=event)
-    return webhooks
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
+    try:
+        webhooks = await webhook_service.list_webhooks(db, tenant_id, event=event, user_id=user_id, is_system_admin=is_admin)
+        return webhooks
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.post(
@@ -49,10 +55,15 @@ async def create_webhook(
     """Create a new webhook subscription."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-    webhook = await webhook_service.create_webhook(
-        db, tenant_id, user_id, body.model_dump()
-    )
-    return webhook
+    is_admin = current_user.get("is_system_admin", False)
+
+    try:
+        webhook = await webhook_service.create_webhook(
+            db, tenant_id, user_id, body.model_dump(), is_system_admin=is_admin
+        )
+        return webhook
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.get(
@@ -67,12 +78,18 @@ async def get_webhook(
 ):
     """Get a single webhook by ID."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
     try:
         wh_id = uuid.UUID(webhook_id)
     except (ValueError, TypeError):
         raise HTTPException(400, detail={"detail": "Invalid webhook_id", "code": "invalid_id"}) from None
 
-    webhook = await webhook_service.get_webhook(db, tenant_id, wh_id)
+    try:
+        webhook = await webhook_service.get_webhook(db, tenant_id, wh_id, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if webhook is None:
         raise HTTPException(404, detail={"detail": "Webhook not found", "code": "not_found"})
     return webhook
@@ -92,6 +109,8 @@ async def update_webhook(
     """Update an existing webhook subscription."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
     try:
         wh_id = uuid.UUID(webhook_id)
     except (ValueError, TypeError):
@@ -101,9 +120,12 @@ async def update_webhook(
     if not update_data:
         raise HTTPException(400, detail={"detail": "No fields to update", "code": "no_updates"})
 
-    webhook = await webhook_service.update_webhook(
-        db, tenant_id, wh_id, update_data, user_id=user_id
-    )
+    try:
+        webhook = await webhook_service.update_webhook(
+            db, tenant_id, wh_id, update_data, user_id=user_id, is_system_admin=is_admin
+        )
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if webhook is None:
         raise HTTPException(404, detail={"detail": "Webhook not found", "code": "not_found"})
     return webhook
@@ -121,12 +143,18 @@ async def delete_webhook(
 ):
     """Delete a webhook subscription."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
     try:
         wh_id = uuid.UUID(webhook_id)
     except (ValueError, TypeError):
         raise HTTPException(400, detail={"detail": "Invalid webhook_id", "code": "invalid_id"}) from None
 
-    deleted = await webhook_service.delete_webhook(db, tenant_id, wh_id)
+    try:
+        deleted = await webhook_service.delete_webhook(db, tenant_id, wh_id, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if not deleted:
         raise HTTPException(404, detail={"detail": "Webhook not found", "code": "not_found"})
     return None
@@ -143,12 +171,18 @@ async def test_webhook(
 ):
     """Send a test payload to a webhook to verify connectivity."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
     try:
         wh_id = uuid.UUID(webhook_id)
     except (ValueError, TypeError):
         raise HTTPException(400, detail={"detail": "Invalid webhook_id", "code": "invalid_id"}) from None
 
-    webhook = await webhook_service.get_webhook(db, tenant_id, wh_id)
+    try:
+        webhook = await webhook_service.get_webhook(db, tenant_id, wh_id, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if webhook is None:
         raise HTTPException(404, detail={"detail": "Webhook not found", "code": "not_found"})
 
@@ -157,5 +191,8 @@ async def test_webhook(
         "message": "This is a test webhook from LeoCRM",
         "webhook_id": str(webhook.id),
     }
-    result = await webhook_service.send_webhook(webhook, "webhook.test", test_payload)
+    try:
+        result = await webhook_service.send_webhook(webhook, "webhook.test", test_payload, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     return result