sprint2: 8 services + 8 routes visibility filter + BaseSearchProvider + owned_mixin on models

app/services/workflow_service.py

@@ -12,6 +12,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.core.audit import log_audit
 from app.models.notification import Notification
 from app.models.workflow import Workflow, WorkflowInstance, WorkflowStepHistory
+from app.core.visibility import apply_visibility_filter, check_single_entity_access
 
 
 def _safe_iso(dt) -> str | None:
@@ -135,6 +136,7 @@ async def create_workflow(
         steps=steps_json,
         is_active=data.get("is_active", True),
         created_by=user_id,
+        owner_id=user_id,
     )
     db.add(workflow)
     await db.flush()
@@ -158,6 +160,8 @@ async def list_workflows(
     page: int = 1,
     page_size: int = 20,
     is_active: bool | None = None,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """List workflows with pagination."""
     page = max(1, page)
@@ -167,6 +171,11 @@ async def list_workflows(
     if is_active is not None:
         base = base.where(Workflow.is_active == is_active)
 
+    if user_id and not is_system_admin:
+        base = await apply_visibility_filter(
+            db, base, "workflow", Workflow, user_id, tenant_id, is_system_admin
+        )
+
     count_q = select(func.count()).select_from(base.subquery())
     total_result = await db.execute(count_q)
     total = total_result.scalar_one()
@@ -188,6 +197,8 @@ async def get_workflow(
     db: AsyncSession,
     tenant_id: uuid.UUID,
     workflow_id: str,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any] | None:
     """Get a single workflow by ID."""
     wf_uuid = uuid.UUID(workflow_id)
@@ -200,6 +211,12 @@ async def get_workflow(
     workflow = result.scalar_one_or_none()
     if workflow is None:
         return None
+    if user_id and not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "workflow", workflow.id, user_id, tenant_id, "read", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
     return _workflow_to_dict(workflow)
 
 
@@ -209,6 +226,7 @@ async def update_workflow(
     user_id: uuid.UUID,
     workflow_id: str,
     data: dict[str, Any],
+    is_system_admin: bool = False,
 ) -> dict[str, Any] | None:
     """Update a workflow definition."""
     wf_uuid = uuid.UUID(workflow_id)
@@ -222,6 +240,13 @@ async def update_workflow(
     if workflow is None:
         return None
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "workflow", workflow.id, user_id, tenant_id, "write", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     if "name" in data:
         workflow.name = data["name"]
     if "description" in data:
@@ -254,6 +279,7 @@ async def delete_workflow(
     tenant_id: uuid.UUID,
     user_id: uuid.UUID,
     workflow_id: str,
+    is_system_admin: bool = False,
 ) -> bool:
     """Delete a workflow definition."""
     wf_uuid = uuid.UUID(workflow_id)
@@ -267,6 +293,13 @@ async def delete_workflow(
     if workflow is None:
         return False
 
+    if not is_system_admin:
+        has_access = await check_single_entity_access(
+            db, "workflow", workflow.id, user_id, tenant_id, "admin", is_system_admin
+        )
+        if not has_access:
+            raise PermissionError("No access")
+
     await db.delete(workflow)
     await db.flush()