From bd9fc15418d37832bee5f5a8f75e4f50bf86d92e Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Mon, 3 Aug 2026 21:42:11 +0200 Subject: [PATCH] A1: Permission-Checks fuer delegations, policies, permission_templates, ai_copilot --- app/routes/ai_copilot.py | 8 ++++---- app/routes/delegations.py | 12 ++++++------ app/routes/permission_templates.py | 12 ++++++------ app/routes/policies.py | 10 +++++----- 4 files changed, 21 insertions(+), 21 deletions(-) diff --git a/app/routes/ai_copilot.py b/app/routes/ai_copilot.py index c5a40a0..254e8a0 100644 --- a/app/routes/ai_copilot.py +++ b/app/routes/ai_copilot.py @@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status from sqlalchemy.ext.asyncio import AsyncSession from app.core.db import get_db -from app.deps import get_current_user +from app.deps import get_current_user, require_permission from app.schemas.ai_copilot import ( CopilotExecuteRequest, CopilotQueryRequest, @@ -22,7 +22,7 @@ router = APIRouter(prefix="/api/v1/ai/copilot", tags=["ai-copilot"]) async def copilot_query( body: CopilotQueryRequest, db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("ai:write")), ): """Process a natural language query and return proposed actions. @@ -54,7 +54,7 @@ async def copilot_query( async def copilot_execute( body: CopilotExecuteRequest, db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("ai:write")), ): """Execute a proposed action after user confirmation. @@ -94,7 +94,7 @@ async def copilot_history( page: int = Query(1, ge=1), page_size: int = Query(20, ge=1, le=100), db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("ai:read")), ): """Get paginated conversation history for the current user.""" tenant_id = uuid.UUID(current_user["tenant_id"]) diff --git a/app/routes/delegations.py b/app/routes/delegations.py index 2ea4931..712159d 100644 --- a/app/routes/delegations.py +++ b/app/routes/delegations.py @@ -9,7 +9,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status from sqlalchemy.ext.asyncio import AsyncSession from app.core.db import get_db -from app.deps import get_current_user +from app.deps import get_current_user, require_permission from app.schemas.delegation import DelegationCreate, DelegationUpdate from app.services import delegation_service @@ -20,7 +20,7 @@ router = APIRouter(prefix="/api/v1/delegations", tags=["delegations"]) async def list_delegations( direction: str = Query("all", pattern="^(from|to|all)$"), db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("permissions:delegations:read")), ): """List delegations for the current user.""" tenant_id = uuid.UUID(current_user["tenant_id"]) @@ -33,7 +33,7 @@ async def list_delegations( async def create_delegation( body: DelegationCreate, db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("permissions:delegations:write")), ): """Create a new permission delegation.""" tenant_id = uuid.UUID(current_user["tenant_id"]) @@ -57,7 +57,7 @@ async def update_delegation( delegation_id: str, body: DelegationUpdate, db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("permissions:delegations:write")), ): """Update an existing delegation.""" tenant_id = uuid.UUID(current_user["tenant_id"]) @@ -79,7 +79,7 @@ async def update_delegation( async def delete_delegation( delegation_id: str, db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("permissions:delegations:write")), ): """Delete a delegation.""" tenant_id = uuid.UUID(current_user["tenant_id"]) @@ -92,7 +92,7 @@ async def delete_delegation( @router.get("/active") async def check_active_delegation( db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("permissions:delegations:read")), ): """Check if the current user has any active delegations.""" tenant_id = uuid.UUID(current_user["tenant_id"]) diff --git a/app/routes/permission_templates.py b/app/routes/permission_templates.py index e7e09de..557f391 100644 --- a/app/routes/permission_templates.py +++ b/app/routes/permission_templates.py @@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, HTTPException, status from sqlalchemy.ext.asyncio import AsyncSession from app.core.db import get_db -from app.deps import get_current_user +from app.deps import get_current_user, require_permission from app.schemas.permission_template import ( PermissionTemplateCreate, PermissionTemplateUpdate, @@ -23,7 +23,7 @@ router = APIRouter(prefix="/api/v1/permission-templates", tags=["permission-temp async def list_templates( entity_type: str | None = None, db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("permissions:templates:read")), ): """List all permission templates for the current tenant.""" tenant_id = uuid.UUID(current_user["tenant_id"]) @@ -35,7 +35,7 @@ async def list_templates( async def create_template( body: PermissionTemplateCreate, db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("permissions:templates:write")), ): """Create a new permission template.""" tenant_id = uuid.UUID(current_user["tenant_id"]) @@ -58,7 +58,7 @@ async def update_template( template_id: str, body: PermissionTemplateUpdate, db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("permissions:templates:write")), ): """Update an existing permission template.""" tenant_id = uuid.UUID(current_user["tenant_id"]) @@ -81,7 +81,7 @@ async def update_template( async def delete_template( template_id: str, db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("permissions:templates:write")), ): """Delete a permission template.""" tenant_id = uuid.UUID(current_user["tenant_id"]) @@ -95,7 +95,7 @@ async def delete_template( async def apply_template( body: PermissionTemplateApply, db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("permissions:templates:write")), ): """Apply a permission template to an entity, creating entity_permissions.""" tenant_id = uuid.UUID(current_user["tenant_id"]) diff --git a/app/routes/policies.py b/app/routes/policies.py index 9e88c56..1045991 100644 --- a/app/routes/policies.py +++ b/app/routes/policies.py @@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, HTTPException, status from sqlalchemy.ext.asyncio import AsyncSession from app.core.db import get_db -from app.deps import get_current_user +from app.deps import get_current_user, require_permission from app.schemas.policy import PolicyCreate, PolicyUpdate from app.services import policy_service @@ -19,7 +19,7 @@ router = APIRouter(prefix="/api/v1/policies", tags=["policies"]) async def list_policies( entity_type: str, db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("permissions:policies:read")), ): """List all ABAC policies for a given entity type.""" tenant_id = uuid.UUID(current_user["tenant_id"]) @@ -34,7 +34,7 @@ async def list_policies( async def create_policy( body: PolicyCreate, db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("permissions:policies:write")), ): """Create a new ABAC policy.""" tenant_id = uuid.UUID(current_user["tenant_id"]) @@ -59,7 +59,7 @@ async def update_policy( policy_id: str, body: PolicyUpdate, db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("permissions:policies:write")), ): """Update an existing ABAC policy.""" tenant_id = uuid.UUID(current_user["tenant_id"]) @@ -85,7 +85,7 @@ async def update_policy( async def delete_policy( policy_id: str, db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("permissions:policies:write")), ): """Delete an ABAC policy.""" tenant_id = uuid.UUID(current_user["tenant_id"])