A1: Permission-Checks fuer delegations, policies, permission_templates, ai_copilot

app/routes/policies.py

@@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.deps import get_current_user
+from app.deps import get_current_user, require_permission
 from app.schemas.policy import PolicyCreate, PolicyUpdate
 from app.services import policy_service
 
@@ -19,7 +19,7 @@ router = APIRouter(prefix="/api/v1/policies", tags=["policies"])
 async def list_policies(
     entity_type: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:policies:read")),
 ):
     """List all ABAC policies for a given entity type."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -34,7 +34,7 @@ async def list_policies(
 async def create_policy(
     body: PolicyCreate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:policies:write")),
 ):
     """Create a new ABAC policy."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -59,7 +59,7 @@ async def update_policy(
     policy_id: str,
     body: PolicyUpdate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:policies:write")),
 ):
     """Update an existing ABAC policy."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -85,7 +85,7 @@ async def update_policy(
 async def delete_policy(
     policy_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:policies:write")),
 ):
     """Delete an ABAC policy."""
     tenant_id = uuid.UUID(current_user["tenant_id"])