sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

app/services/attachment_service.py

@@ -13,6 +13,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.core.audit import log_audit
 from app.core.storage import get_storage_backend
 from app.models.attachment import Attachment
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
 
 
 def _attachment_to_dict(a: Attachment) -> dict[str, Any]:
@@ -68,6 +69,7 @@ async def save_attachment(
         mime_type=mime_type,
         file_size=file_size,
         uploaded_by=user_id,
+        owner_id=user_id,
     )
     db.add(attachment)
     await db.flush()
@@ -84,6 +86,8 @@ async def list_attachments(
     tenant_id: uuid.UUID,
     entity_type: str,
     entity_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """List attachments for a specific entity."""
     q = select(Attachment).where(
@@ -92,6 +96,10 @@ async def list_attachments(
         Attachment.entity_id == entity_id,
         Attachment.deleted_at.is_(None),
     ).order_by(Attachment.created_at.desc())
+    if user_id and not is_system_admin:
+        q = await apply_visibility_filter(
+            db, q, "attachment", Attachment, user_id, tenant_id, is_system_admin
+        )
     result = await db.execute(q)
     attachments = result.scalars().all()
     return {
@@ -104,6 +112,8 @@ async def get_attachment(
     db: AsyncSession,
     tenant_id: uuid.UUID,
     attachment_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any] | None:
     """Get a single attachment by ID."""
     q = select(Attachment).where(
@@ -115,6 +125,12 @@ async def get_attachment(
     attachment = result.scalar_one_or_none()
     if attachment is None:
         return None
+    if user_id and not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "attachment", attachment.id, user_id, tenant_id, "read", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
     return _attachment_to_dict(attachment)
 
 
@@ -123,6 +139,7 @@ async def delete_attachment(
     tenant_id: uuid.UUID,
     user_id: uuid.UUID,
     attachment_id: uuid.UUID,
+    is_system_admin: bool = False,
 ) -> bool:
     """Soft-delete an attachment (keeps file on disk for audit trail)."""
     q = select(Attachment).where(
@@ -135,6 +152,13 @@ async def delete_attachment(
     if attachment is None:
         return False
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "attachment", attachment.id, user_id, tenant_id, "admin", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     attachment.deleted_at = datetime.now(UTC)
     await db.flush()
     await log_audit(