sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

app/services/sequence_service.py

@@ -11,6 +11,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.audit import log_audit
 from app.models.sequence import Sequence
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
 
 
 def _sequence_to_dict(s: Sequence) -> dict[str, Any]:
@@ -73,6 +74,7 @@ async def create_sequence(
         prefix=data.get("prefix", ""),
         next_number=1,
         padding=data.get("padding", 4),
+        owner_id=user_id,
     )
     db.add(sequence)
     await db.flush()
@@ -87,12 +89,18 @@ async def create_sequence(
 async def list_sequences(
     db: AsyncSession,
     tenant_id: uuid.UUID,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """List all sequences for a tenant."""
     q = select(Sequence).where(
         Sequence.tenant_id == tenant_id,
         Sequence.deleted_at.is_(None),
     ).order_by(Sequence.name.asc())
+    if user_id and not is_system_admin:
+        q = await apply_visibility_filter(
+            db, q, "sequence", Sequence, user_id, tenant_id, is_system_admin
+        )
     result = await db.execute(q)
     sequences = result.scalars().all()
     return {
@@ -107,6 +115,7 @@ async def update_sequence(
     user_id: uuid.UUID,
     sequence_id: uuid.UUID,
     data: dict[str, Any],
+    is_system_admin: bool = False,
 ) -> dict[str, Any] | None:
     """Update a sequence (name, prefix, padding only — NOT next_number)."""
     q = select(Sequence).where(
@@ -119,6 +128,13 @@ async def update_sequence(
     if sequence is None:
         return None
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "sequence", sequence.id, user_id, tenant_id, "write", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     changes: dict[str, Any] = {}
     for field in ("name", "prefix", "padding"):
         if field in data and data[field] is not None:
@@ -137,6 +153,7 @@ async def delete_sequence(
     tenant_id: uuid.UUID,
     user_id: uuid.UUID,
     sequence_id: uuid.UUID,
+    is_system_admin: bool = False,
 ) -> bool:
     """Soft-delete a sequence."""
     q = select(Sequence).where(
@@ -149,6 +166,13 @@ async def delete_sequence(
     if sequence is None:
         return False
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "sequence", sequence.id, user_id, tenant_id, "admin", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     sequence.deleted_at = datetime.now(UTC)
     await db.flush()
     await log_audit(