sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

app/services/bank_account_service.py

@@ -11,6 +11,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.audit import log_audit
 from app.models.bank_account import BankAccount
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
 
 
 def _account_to_dict(a: BankAccount) -> dict[str, Any]:
@@ -31,6 +32,8 @@ def _account_to_dict(a: BankAccount) -> dict[str, Any]:
 async def list_bank_accounts(
     db: AsyncSession,
     tenant_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """List all bank accounts for a tenant."""
     q = (
@@ -41,6 +44,10 @@ async def list_bank_accounts(
         )
         .order_by(BankAccount.is_default.desc(), BankAccount.bank_name.asc())
     )
+    if user_id and not is_system_admin:
+        q = await apply_visibility_filter(
+            db, q, "bank_account", BankAccount, user_id, tenant_id, is_system_admin
+        )
     result = await db.execute(q)
     accounts = result.scalars().all()
     return {
@@ -75,6 +82,7 @@ async def create_bank_account(
         account_holder=data.get("account_holder"),
         default_tax=data.get("default_tax"),
         is_default=data.get("is_default", False),
+        owner_id=user_id,
     )
     db.add(account)
     await db.flush()
@@ -92,6 +100,7 @@ async def update_bank_account(
     user_id: uuid.UUID,
     account_id: uuid.UUID,
     data: dict[str, Any],
+    is_system_admin: bool = False,
 ) -> dict[str, Any] | None:
     """Update a bank account. If setting is_default=True, unset other defaults first."""
     q = select(BankAccount).where(
@@ -104,6 +113,13 @@ async def update_bank_account(
     if account is None:
         return None
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "bank_account", account.id, user_id, tenant_id, "write", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     if data.get("is_default") is True and not account.is_default:
         await db.execute(
             update(BankAccount)
@@ -134,6 +150,7 @@ async def delete_bank_account(
     tenant_id: uuid.UUID,
     user_id: uuid.UUID,
     account_id: uuid.UUID,
+    is_system_admin: bool = False,
 ) -> bool:
     """Soft-delete a bank account."""
     q = select(BankAccount).where(
@@ -146,6 +163,13 @@ async def delete_bank_account(
     if account is None:
         return False
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "bank_account", account.id, user_id, tenant_id, "admin", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     account.deleted_at = datetime.now(UTC)
     await db.flush()
     await log_audit(