sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

app/services/address_service.py

@@ -11,6 +11,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.audit import log_audit
 from app.models.address import Address
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
 
 
 VALID_ENTITY_TYPES = {"contact"}
@@ -42,6 +43,8 @@ async def list_addresses(
     tenant_id: uuid.UUID,
     entity_type: str,
     entity_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """List all addresses for a given entity within a tenant."""
     q = (
@@ -54,6 +57,10 @@ async def list_addresses(
         )
         .order_by(Address.is_default.desc(), Address.label.asc())
     )
+    if user_id and not is_system_admin:
+        q = await apply_visibility_filter(
+            db, q, "address", Address, user_id, tenant_id, is_system_admin
+        )
     result = await db.execute(q)
     addresses = result.scalars().all()
     return {
@@ -104,6 +111,7 @@ async def create_address(
         state=data.get("state"),
         country=data.get("country"),
         is_default=data.get("is_default", False),
+        owner_id=user_id,
     )
     db.add(address)
     await db.flush()
@@ -121,6 +129,7 @@ async def update_address(
     user_id: uuid.UUID,
     address_id: uuid.UUID,
     data: dict[str, Any],
+    is_system_admin: bool = False,
 ) -> dict[str, Any] | None:
     """Update an address. If setting is_default=True, unset other defaults of same type first."""
     q = select(Address).where(
@@ -133,6 +142,13 @@ async def update_address(
     if address is None:
         return None
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "address", address.id, user_id, tenant_id, "write", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     if data.get("is_default") is True and not address.is_default:
         await db.execute(
             update(Address)
@@ -166,6 +182,7 @@ async def delete_address(
     tenant_id: uuid.UUID,
     user_id: uuid.UUID,
     address_id: uuid.UUID,
+    is_system_admin: bool = False,
 ) -> bool:
     """Soft-delete an address."""
     q = select(Address).where(
@@ -178,6 +195,13 @@ async def delete_address(
     if address is None:
         return False
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "address", address.id, user_id, tenant_id, "admin", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     address.deleted_at = datetime.now(UTC)
     await db.flush()
     await log_audit(