sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

app/routes/workflows.py

@@ -28,13 +28,21 @@ async def list_workflows(
 ):
     """List workflows with pagination."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    return await workflow_service.list_workflows(
-        db,
-        tenant_id,
-        page=page,
-        page_size=page_size,
-        is_active=is_active,
-    )
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
+    try:
+        return await workflow_service.list_workflows(
+            db,
+            tenant_id,
+            page=page,
+            page_size=page_size,
+            is_active=is_active,
+            user_id=user_id,
+            is_system_admin=is_admin,
+        )
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.post("", status_code=status.HTTP_201_CREATED)
@@ -46,10 +54,13 @@ async def create_workflow(
     """Create a new workflow definition. Requires write permission."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     data = body.model_dump()
-    return await workflow_service.create_workflow(db, tenant_id, user_id, data)
+    try:
+        return await workflow_service.create_workflow(db, tenant_id, user_id, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.get("/instances")
@@ -62,13 +73,21 @@ async def list_instances(
 ):
     """List workflow instances with optional status filter."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    return await workflow_service.list_instances(
-        db,
-        tenant_id,
-        page=page,
-        page_size=page_size,
-        status_filter=status,
-    )
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
+    try:
+        return await workflow_service.list_instances(
+            db,
+            tenant_id,
+            page=page,
+            page_size=page_size,
+            status_filter=status,
+            user_id=user_id,
+            is_system_admin=is_admin,
+        )
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.get("/{workflow_id}")
@@ -79,7 +98,13 @@ async def get_workflow(
 ):
     """Get a single workflow by ID."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    result = await workflow_service.get_workflow(db, tenant_id, workflow_id)
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
+    try:
+        result = await workflow_service.get_workflow(db, tenant_id, workflow_id, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -98,10 +123,13 @@ async def update_workflow(
     """Update a workflow definition."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
-
+    is_admin = current_user.get("is_system_admin", False)
 
     data = body.model_dump(exclude_unset=True)
-    result = await workflow_service.update_workflow(db, tenant_id, user_id, workflow_id, data)
+    try:
+        result = await workflow_service.update_workflow(db, tenant_id, user_id, workflow_id, data, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -119,9 +147,12 @@ async def delete_workflow(
     """Delete a workflow definition."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
-
-    deleted = await workflow_service.delete_workflow(db, tenant_id, user_id, workflow_id)
+    try:
+        deleted = await workflow_service.delete_workflow(db, tenant_id, user_id, workflow_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if not deleted:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -143,15 +174,20 @@ async def create_instance(
     """Create a new workflow instance."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
-    result = await workflow_service.create_instance(
-        db,
-        tenant_id,
-        user_id,
-        workflow_id=workflow_id,
-        context=body.context,
-        timeout_hours=body.timeout_hours,
-    )
+    try:
+        result = await workflow_service.create_instance(
+            db,
+            tenant_id,
+            user_id,
+            workflow_id=workflow_id,
+            context=body.context,
+            timeout_hours=body.timeout_hours,
+            is_system_admin=is_admin,
+        )
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -168,7 +204,13 @@ async def get_instance(
 ):
     """Get a workflow instance with step history."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    result = await workflow_service.get_instance(db, tenant_id, instance_id)
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+
+    try:
+        result = await workflow_service.get_instance(db, tenant_id, instance_id, user_id=user_id, is_system_admin=is_admin)
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -191,15 +233,20 @@ async def advance_instance(
     """
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
-    result = await workflow_service.advance_instance(
-        db,
-        tenant_id,
-        user_id,
-        instance_id=instance_id,
-        decision=body.decision,
-        comment=body.comment,
-    )
+    try:
+        result = await workflow_service.advance_instance(
+            db,
+            tenant_id,
+            user_id,
+            instance_id=instance_id,
+            decision=body.decision,
+            comment=body.comment,
+            is_system_admin=is_admin,
+        )
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -222,13 +269,18 @@ async def cancel_instance(
     """Cancel a workflow instance. Returns 200 with cancelled instance."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
 
-    result = await workflow_service.cancel_instance(
-        db,
-        tenant_id,
-        user_id,
-        instance_id=instance_id,
-    )
+    try:
+        result = await workflow_service.cancel_instance(
+            db,
+            tenant_id,
+            user_id,
+            instance_id=instance_id,
+            is_system_admin=is_admin,
+        )
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e)) from e
     if result is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,