sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

app/services/address_service.py

@@ -11,6 +11,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.audit import log_audit
 from app.models.address import Address
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
 
 
 VALID_ENTITY_TYPES = {"contact"}
@@ -42,6 +43,8 @@ async def list_addresses(
     tenant_id: uuid.UUID,
     entity_type: str,
     entity_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """List all addresses for a given entity within a tenant."""
     q = (
@@ -54,6 +57,10 @@ async def list_addresses(
         )
         .order_by(Address.is_default.desc(), Address.label.asc())
     )
+    if user_id and not is_system_admin:
+        q = await apply_visibility_filter(
+            db, q, "address", Address, user_id, tenant_id, is_system_admin
+        )
     result = await db.execute(q)
     addresses = result.scalars().all()
     return {
@@ -104,6 +111,7 @@ async def create_address(
         state=data.get("state"),
         country=data.get("country"),
         is_default=data.get("is_default", False),
+        owner_id=user_id,
     )
     db.add(address)
     await db.flush()
@@ -121,6 +129,7 @@ async def update_address(
     user_id: uuid.UUID,
     address_id: uuid.UUID,
     data: dict[str, Any],
+    is_system_admin: bool = False,
 ) -> dict[str, Any] | None:
     """Update an address. If setting is_default=True, unset other defaults of same type first."""
     q = select(Address).where(
@@ -133,6 +142,13 @@ async def update_address(
     if address is None:
         return None
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "address", address.id, user_id, tenant_id, "write", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     if data.get("is_default") is True and not address.is_default:
         await db.execute(
             update(Address)
@@ -166,6 +182,7 @@ async def delete_address(
     tenant_id: uuid.UUID,
     user_id: uuid.UUID,
     address_id: uuid.UUID,
+    is_system_admin: bool = False,
 ) -> bool:
     """Soft-delete an address."""
     q = select(Address).where(
@@ -178,6 +195,13 @@ async def delete_address(
     if address is None:
         return False
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "address", address.id, user_id, tenant_id, "admin", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     address.deleted_at = datetime.now(UTC)
     await db.flush()
     await log_audit(

app/services/attachment_service.py

@@ -13,6 +13,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.core.audit import log_audit
 from app.core.storage import get_storage_backend
 from app.models.attachment import Attachment
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
 
 
 def _attachment_to_dict(a: Attachment) -> dict[str, Any]:
@@ -68,6 +69,7 @@ async def save_attachment(
         mime_type=mime_type,
         file_size=file_size,
         uploaded_by=user_id,
+        owner_id=user_id,
     )
     db.add(attachment)
     await db.flush()
@@ -84,6 +86,8 @@ async def list_attachments(
     tenant_id: uuid.UUID,
     entity_type: str,
     entity_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """List attachments for a specific entity."""
     q = select(Attachment).where(
@@ -92,6 +96,10 @@ async def list_attachments(
         Attachment.entity_id == entity_id,
         Attachment.deleted_at.is_(None),
     ).order_by(Attachment.created_at.desc())
+    if user_id and not is_system_admin:
+        q = await apply_visibility_filter(
+            db, q, "attachment", Attachment, user_id, tenant_id, is_system_admin
+        )
     result = await db.execute(q)
     attachments = result.scalars().all()
     return {
@@ -104,6 +112,8 @@ async def get_attachment(
     db: AsyncSession,
     tenant_id: uuid.UUID,
     attachment_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any] | None:
     """Get a single attachment by ID."""
     q = select(Attachment).where(
@@ -115,6 +125,12 @@ async def get_attachment(
     attachment = result.scalar_one_or_none()
     if attachment is None:
         return None
+    if user_id and not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "attachment", attachment.id, user_id, tenant_id, "read", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
     return _attachment_to_dict(attachment)
 
 
@@ -123,6 +139,7 @@ async def delete_attachment(
     tenant_id: uuid.UUID,
     user_id: uuid.UUID,
     attachment_id: uuid.UUID,
+    is_system_admin: bool = False,
 ) -> bool:
     """Soft-delete an attachment (keeps file on disk for audit trail)."""
     q = select(Attachment).where(
@@ -135,6 +152,13 @@ async def delete_attachment(
     if attachment is None:
         return False
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "attachment", attachment.id, user_id, tenant_id, "admin", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     attachment.deleted_at = datetime.now(UTC)
     await db.flush()
     await log_audit(

app/services/bank_account_service.py

@@ -11,6 +11,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.audit import log_audit
 from app.models.bank_account import BankAccount
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
 
 
 def _account_to_dict(a: BankAccount) -> dict[str, Any]:
@@ -31,6 +32,8 @@ def _account_to_dict(a: BankAccount) -> dict[str, Any]:
 async def list_bank_accounts(
     db: AsyncSession,
     tenant_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """List all bank accounts for a tenant."""
     q = (
@@ -41,6 +44,10 @@ async def list_bank_accounts(
         )
         .order_by(BankAccount.is_default.desc(), BankAccount.bank_name.asc())
     )
+    if user_id and not is_system_admin:
+        q = await apply_visibility_filter(
+            db, q, "bank_account", BankAccount, user_id, tenant_id, is_system_admin
+        )
     result = await db.execute(q)
     accounts = result.scalars().all()
     return {
@@ -75,6 +82,7 @@ async def create_bank_account(
         account_holder=data.get("account_holder"),
         default_tax=data.get("default_tax"),
         is_default=data.get("is_default", False),
+        owner_id=user_id,
     )
     db.add(account)
     await db.flush()
@@ -92,6 +100,7 @@ async def update_bank_account(
     user_id: uuid.UUID,
     account_id: uuid.UUID,
     data: dict[str, Any],
+    is_system_admin: bool = False,
 ) -> dict[str, Any] | None:
     """Update a bank account. If setting is_default=True, unset other defaults first."""
     q = select(BankAccount).where(
@@ -104,6 +113,13 @@ async def update_bank_account(
     if account is None:
         return None
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "bank_account", account.id, user_id, tenant_id, "write", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     if data.get("is_default") is True and not account.is_default:
         await db.execute(
             update(BankAccount)
@@ -134,6 +150,7 @@ async def delete_bank_account(
     tenant_id: uuid.UUID,
     user_id: uuid.UUID,
     account_id: uuid.UUID,
+    is_system_admin: bool = False,
 ) -> bool:
     """Soft-delete a bank account."""
     q = select(BankAccount).where(
@@ -146,6 +163,13 @@ async def delete_bank_account(
     if account is None:
         return False
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "bank_account", account.id, user_id, tenant_id, "admin", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     account.deleted_at = datetime.now(UTC)
     await db.flush()
     await log_audit(

app/services/saved_filter_service.py

@@ -0,0 +1,162 @@
+"""SavedFilter service — CRUD with tenant isolation and visibility filter."""
+
+from __future__ import annotations
+
+import uuid
+from datetime import UTC, datetime
+from typing import Any
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
+from app.models.saved_filter import SavedFilter
+
+
+def _filter_to_dict(f: SavedFilter) -> dict[str, Any]:
+    """Serialize a SavedFilter ORM object to dict."""
+    return {
+        "id": str(f.id),
+        "name": f.name,
+        "entity_type": f.entity_type,
+        "filter_criteria": f.filter_criteria,
+        "user_id": str(f.user_id),
+        "created_at": f.created_at.isoformat() if f.created_at else None,
+        "updated_at": f.updated_at.isoformat() if f.updated_at else None,
+    }
+
+
+async def list_saved_filters(
+    db: AsyncSession,
+    tenant_id: uuid.UUID,
+    entity_type: str | None = None,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
+) -> list[dict[str, Any]]:
+    """List saved filters for a tenant, optionally filtered by entity_type."""
+    q = select(SavedFilter).where(
+        SavedFilter.tenant_id == tenant_id,
+        SavedFilter.deleted_at.is_(None),
+    )
+    if entity_type:
+        q = q.where(SavedFilter.entity_type == entity_type)
+    if user_id and not is_system_admin:
+        q = await apply_visibility_filter(
+            db, q, "saved_filter", SavedFilter, user_id, tenant_id, is_system_admin
+        )
+    q = q.order_by(SavedFilter.name)
+    result = await db.execute(q)
+    return [_filter_to_dict(f) for f in result.scalars().all()]
+
+
+async def get_saved_filter(
+    db: AsyncSession,
+    tenant_id: uuid.UUID,
+    filter_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
+) -> dict[str, Any] | None:
+    """Get a single saved filter by ID."""
+    q = select(SavedFilter).where(
+        SavedFilter.id == filter_id,
+        SavedFilter.tenant_id == tenant_id,
+        SavedFilter.deleted_at.is_(None),
+    )
+    result = await db.execute(q)
+    saved = result.scalar_one_or_none()
+    if saved is None:
+        return None
+    if user_id and not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "saved_filter", saved.id, user_id, tenant_id, "read", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+    return _filter_to_dict(saved)
+
+
+async def create_saved_filter(
+    db: AsyncSession,
+    tenant_id: uuid.UUID,
+    user_id: uuid.UUID,
+    data: dict[str, Any],
+) -> dict[str, Any]:
+    """Create a new saved filter."""
+    saved = SavedFilter(
+        tenant_id=tenant_id,
+        user_id=user_id,
+        name=data["name"],
+        entity_type=data["entity_type"],
+        filter_criteria=data.get("filter_criteria", {}),
+        owner_id=user_id,
+    )
+    db.add(saved)
+    await db.flush()
+    await db.refresh(saved)
+    return _filter_to_dict(saved)
+
+
+async def update_saved_filter(
+    db: AsyncSession,
+    tenant_id: uuid.UUID,
+    user_id: uuid.UUID,
+    filter_id: uuid.UUID,
+    data: dict[str, Any],
+    is_system_admin: bool = False,
+) -> dict[str, Any] | None:
+    """Update a saved filter."""
+    q = select(SavedFilter).where(
+        SavedFilter.id == filter_id,
+        SavedFilter.tenant_id == tenant_id,
+        SavedFilter.deleted_at.is_(None),
+    )
+    result = await db.execute(q)
+    saved = result.scalar_one_or_none()
+    if saved is None:
+        return None
+
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "saved_filter", saved.id, user_id, tenant_id, "write", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
+    if "name" in data and data["name"] is not None:
+        saved.name = data["name"]
+    if "filter_criteria" in data and data["filter_criteria"] is not None:
+        saved.filter_criteria = data["filter_criteria"]
+
+    await db.flush()
+    await db.refresh(saved)
+    return _filter_to_dict(saved)
+
+
+async def delete_saved_filter(
+    db: AsyncSession,
+    tenant_id: uuid.UUID,
+    user_id: uuid.UUID,
+    filter_id: uuid.UUID,
+    is_system_admin: bool = False,
+) -> bool:
+    """Soft-delete a saved filter."""
+    q = select(SavedFilter).where(
+        SavedFilter.id == filter_id,
+        SavedFilter.tenant_id == tenant_id,
+        SavedFilter.deleted_at.is_(None),
+    )
+    result = await db.execute(q)
+    saved = result.scalar_one_or_none()
+    if saved is None:
+        return False
+
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "saved_filter", saved.id, user_id, tenant_id, "admin", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
+    saved.deleted_at = datetime.now(UTC)
+    await db.flush()
+    return True

app/services/saved_view_service.py

@@ -0,0 +1,162 @@
+"""SavedView service — CRUD with tenant isolation and visibility filter."""
+
+from __future__ import annotations
+
+import uuid
+from datetime import UTC, datetime
+from typing import Any
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
+from app.models.saved_view import SavedView
+
+
+def _view_to_dict(v: SavedView) -> dict[str, Any]:
+    """Serialize a SavedView ORM object to dict."""
+    return {
+        "id": str(v.id),
+        "name": v.name,
+        "entity_type": v.entity_type,
+        "view_config": v.view_config,
+        "user_id": str(v.user_id),
+        "created_at": v.created_at.isoformat() if v.created_at else None,
+        "updated_at": v.updated_at.isoformat() if v.updated_at else None,
+    }
+
+
+async def list_saved_views(
+    db: AsyncSession,
+    tenant_id: uuid.UUID,
+    entity_type: str | None = None,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
+) -> list[dict[str, Any]]:
+    """List saved views for a tenant, optionally filtered by entity_type."""
+    q = select(SavedView).where(
+        SavedView.tenant_id == tenant_id,
+        SavedView.deleted_at.is_(None),
+    )
+    if entity_type:
+        q = q.where(SavedView.entity_type == entity_type)
+    if user_id and not is_system_admin:
+        q = await apply_visibility_filter(
+            db, q, "saved_view", SavedView, user_id, tenant_id, is_system_admin
+        )
+    q = q.order_by(SavedView.name)
+    result = await db.execute(q)
+    return [_view_to_dict(v) for v in result.scalars().all()]
+
+
+async def get_saved_view(
+    db: AsyncSession,
+    tenant_id: uuid.UUID,
+    view_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
+) -> dict[str, Any] | None:
+    """Get a single saved view by ID."""
+    q = select(SavedView).where(
+        SavedView.id == view_id,
+        SavedView.tenant_id == tenant_id,
+        SavedView.deleted_at.is_(None),
+    )
+    result = await db.execute(q)
+    saved = result.scalar_one_or_none()
+    if saved is None:
+        return None
+    if user_id and not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "saved_view", saved.id, user_id, tenant_id, "read", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+    return _view_to_dict(saved)
+
+
+async def create_saved_view(
+    db: AsyncSession,
+    tenant_id: uuid.UUID,
+    user_id: uuid.UUID,
+    data: dict[str, Any],
+) -> dict[str, Any]:
+    """Create a new saved view."""
+    saved = SavedView(
+        tenant_id=tenant_id,
+        user_id=user_id,
+        name=data["name"],
+        entity_type=data["entity_type"],
+        view_config=data.get("view_config", {}),
+        owner_id=user_id,
+    )
+    db.add(saved)
+    await db.flush()
+    await db.refresh(saved)
+    return _view_to_dict(saved)
+
+
+async def update_saved_view(
+    db: AsyncSession,
+    tenant_id: uuid.UUID,
+    user_id: uuid.UUID,
+    view_id: uuid.UUID,
+    data: dict[str, Any],
+    is_system_admin: bool = False,
+) -> dict[str, Any] | None:
+    """Update a saved view."""
+    q = select(SavedView).where(
+        SavedView.id == view_id,
+        SavedView.tenant_id == tenant_id,
+        SavedView.deleted_at.is_(None),
+    )
+    result = await db.execute(q)
+    saved = result.scalar_one_or_none()
+    if saved is None:
+        return None
+
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "saved_view", saved.id, user_id, tenant_id, "write", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
+    if "name" in data and data["name"] is not None:
+        saved.name = data["name"]
+    if "view_config" in data and data["view_config"] is not None:
+        saved.view_config = data["view_config"]
+
+    await db.flush()
+    await db.refresh(saved)
+    return _view_to_dict(saved)
+
+
+async def delete_saved_view(
+    db: AsyncSession,
+    tenant_id: uuid.UUID,
+    user_id: uuid.UUID,
+    view_id: uuid.UUID,
+    is_system_admin: bool = False,
+) -> bool:
+    """Soft-delete a saved view."""
+    q = select(SavedView).where(
+        SavedView.id == view_id,
+        SavedView.tenant_id == tenant_id,
+        SavedView.deleted_at.is_(None),
+    )
+    result = await db.execute(q)
+    saved = result.scalar_one_or_none()
+    if saved is None:
+        return False
+
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "saved_view", saved.id, user_id, tenant_id, "admin", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
+    saved.deleted_at = datetime.now(UTC)
+    await db.flush()
+    return True

app/services/sequence_service.py

@@ -11,6 +11,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.audit import log_audit
 from app.models.sequence import Sequence
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
 
 
 def _sequence_to_dict(s: Sequence) -> dict[str, Any]:
@@ -73,6 +74,7 @@ async def create_sequence(
         prefix=data.get("prefix", ""),
         next_number=1,
         padding=data.get("padding", 4),
+        owner_id=user_id,
     )
     db.add(sequence)
     await db.flush()
@@ -87,12 +89,18 @@ async def create_sequence(
 async def list_sequences(
     db: AsyncSession,
     tenant_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """List all sequences for a tenant."""
     q = select(Sequence).where(
         Sequence.tenant_id == tenant_id,
         Sequence.deleted_at.is_(None),
     ).order_by(Sequence.name.asc())
+    if user_id and not is_system_admin:
+        q = await apply_visibility_filter(
+            db, q, "sequence", Sequence, user_id, tenant_id, is_system_admin
+        )
     result = await db.execute(q)
     sequences = result.scalars().all()
     return {
@@ -107,6 +115,7 @@ async def update_sequence(
     user_id: uuid.UUID,
     sequence_id: uuid.UUID,
     data: dict[str, Any],
+    is_system_admin: bool = False,
 ) -> dict[str, Any] | None:
     """Update a sequence (name, prefix, padding only — NOT next_number)."""
     q = select(Sequence).where(
@@ -119,6 +128,13 @@ async def update_sequence(
     if sequence is None:
         return None
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "sequence", sequence.id, user_id, tenant_id, "write", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     changes: dict[str, Any] = {}
     for field in ("name", "prefix", "padding"):
         if field in data and data[field] is not None:
@@ -137,6 +153,7 @@ async def delete_sequence(
     tenant_id: uuid.UUID,
     user_id: uuid.UUID,
     sequence_id: uuid.UUID,
+    is_system_admin: bool = False,
 ) -> bool:
     """Soft-delete a sequence."""
     q = select(Sequence).where(
@@ -149,6 +166,13 @@ async def delete_sequence(
     if sequence is None:
         return False
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "sequence", sequence.id, user_id, tenant_id, "admin", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     sequence.deleted_at = datetime.now(UTC)
     await db.flush()
     await log_audit(

app/services/webhook_service.py

@@ -17,6 +17,7 @@ from sqlalchemy import select, delete
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.models.webhook import Webhook
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
 
 logger = logging.getLogger(__name__)
 
@@ -64,6 +65,8 @@ async def list_webhooks(
     db: AsyncSession,
     tenant_id: uuid.UUID,
     event: str | None = None,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> list[Webhook]:
     """List webhooks for a tenant, optionally filtered by event."""
     stmt = select(Webhook).where(
@@ -71,6 +74,10 @@ async def list_webhooks(
     )
     if event:
         stmt = stmt.where(Webhook.events.any(event))
+    if user_id and not is_system_admin:
+        stmt = await apply_visibility_filter(
+            db, stmt, "webhook", Webhook, user_id, tenant_id, is_system_admin
+        )
     stmt = stmt.order_by(Webhook.created_at.desc())
     result = await db.execute(stmt)
     return list(result.scalars().all())
@@ -80,6 +87,8 @@ async def get_webhook(
     db: AsyncSession,
     tenant_id: uuid.UUID,
     webhook_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> Webhook | None:
     """Get a single webhook by ID."""
     stmt = select(Webhook).where(
@@ -87,7 +96,16 @@ async def get_webhook(
         Webhook.tenant_id == tenant_id,
     )
     result = await db.execute(stmt)
-    return result.scalar_one_or_none()
+    webhook = result.scalar_one_or_none()
+    if webhook is None:
+        return None
+    if user_id and not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "webhook", webhook.id, user_id, tenant_id, "read", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+    return webhook
 
 
 async def create_webhook(
@@ -107,6 +125,7 @@ async def create_webhook(
         timeout_seconds=data.get("timeout_seconds", 30),
         created_by=user_id,
         updated_by=user_id,
+        owner_id=user_id,
     )
     db.add(webhook)
     await db.flush()
@@ -120,12 +139,20 @@ async def update_webhook(
     webhook_id: uuid.UUID,
     data: dict[str, Any],
     user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> Webhook | None:
     """Update an existing webhook subscription."""
     webhook = await get_webhook(db, tenant_id, webhook_id)
     if webhook is None:
         return None
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "webhook", webhook.id, user_id, tenant_id, "write", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     update_fields = ["url", "events", "secret", "is_active", "retry_count", "timeout_seconds"]
     for field in update_fields:
         if field in data:
@@ -143,6 +170,8 @@ async def delete_webhook(
     db: AsyncSession,
     tenant_id: uuid.UUID,
     webhook_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> bool:
     """Delete a webhook subscription."""
     stmt = select(Webhook).where(
@@ -153,6 +182,14 @@ async def delete_webhook(
     webhook = result.scalar_one_or_none()
     if webhook is None:
         return False
+
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "webhook", webhook.id, user_id, tenant_id, "admin", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     await db.delete(webhook)
     await db.flush()
     return True

app/services/workflow_service.py

@@ -12,6 +12,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.core.audit import log_audit
 from app.models.notification import Notification
 from app.models.workflow import Workflow, WorkflowInstance, WorkflowStepHistory
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
 
 
 def _safe_iso(dt) -> str | None:
@@ -135,6 +136,7 @@ async def create_workflow(
         steps=steps_json,
         is_active=data.get("is_active", True),
         created_by=user_id,
+        owner_id=user_id,
     )
     db.add(workflow)
     await db.flush()
@@ -158,6 +160,8 @@ async def list_workflows(
     page: int = 1,
     page_size: int = 20,
     is_active: bool | None = None,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """List workflows with pagination."""
     page = max(1, page)
@@ -167,6 +171,11 @@ async def list_workflows(
     if is_active is not None:
         base = base.where(Workflow.is_active == is_active)
 
+    if user_id and not is_system_admin:
+        base = await apply_visibility_filter(
+            db, base, "workflow", Workflow, user_id, tenant_id, is_system_admin
+        )
+
     count_q = select(func.count()).select_from(base.subquery())
     total_result = await db.execute(count_q)
     total = total_result.scalar_one()
@@ -188,6 +197,8 @@ async def get_workflow(
     db: AsyncSession,
     tenant_id: uuid.UUID,
     workflow_id: str,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any] | None:
     """Get a single workflow by ID."""
     wf_uuid = uuid.UUID(workflow_id)
@@ -200,6 +211,12 @@ async def get_workflow(
     workflow = result.scalar_one_or_none()
     if workflow is None:
         return None
+    if user_id and not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "workflow", workflow.id, user_id, tenant_id, "read", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
     return _workflow_to_dict(workflow)
 
 
@@ -209,6 +226,7 @@ async def update_workflow(
     user_id: uuid.UUID,
     workflow_id: str,
     data: dict[str, Any],
+    is_system_admin: bool = False,
 ) -> dict[str, Any] | None:
     """Update a workflow definition."""
     wf_uuid = uuid.UUID(workflow_id)
@@ -222,6 +240,13 @@ async def update_workflow(
     if workflow is None:
         return None
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "workflow", workflow.id, user_id, tenant_id, "write", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     if "name" in data:
         workflow.name = data["name"]
     if "description" in data:
@@ -254,6 +279,7 @@ async def delete_workflow(
     tenant_id: uuid.UUID,
     user_id: uuid.UUID,
     workflow_id: str,
+    is_system_admin: bool = False,
 ) -> bool:
     """Delete a workflow definition."""
     wf_uuid = uuid.UUID(workflow_id)
@@ -267,6 +293,13 @@ async def delete_workflow(
     if workflow is None:
         return False
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "workflow", workflow.id, user_id, tenant_id, "admin", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     await db.delete(workflow)
     await db.flush()