A1: Permission-Checks fuer delegations, policies, permission_templates, ai_copilot

app/routes/ai_copilot.py

@@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.deps import get_current_user
+from app.deps import get_current_user, require_permission
 from app.schemas.ai_copilot import (
     CopilotExecuteRequest,
     CopilotQueryRequest,
@@ -22,7 +22,7 @@ router = APIRouter(prefix="/api/v1/ai/copilot", tags=["ai-copilot"])
 async def copilot_query(
     body: CopilotQueryRequest,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("ai:write")),
 ):
     """Process a natural language query and return proposed actions.
 
@@ -54,7 +54,7 @@ async def copilot_query(
 async def copilot_execute(
     body: CopilotExecuteRequest,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("ai:write")),
 ):
     """Execute a proposed action after user confirmation.
 
@@ -94,7 +94,7 @@ async def copilot_history(
     page: int = Query(1, ge=1),
     page_size: int = Query(20, ge=1, le=100),
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("ai:read")),
 ):
     """Get paginated conversation history for the current user."""
     tenant_id = uuid.UUID(current_user["tenant_id"])

app/routes/delegations.py

@@ -9,7 +9,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.deps import get_current_user
+from app.deps import get_current_user, require_permission
 from app.schemas.delegation import DelegationCreate, DelegationUpdate
 from app.services import delegation_service
 
@@ -20,7 +20,7 @@ router = APIRouter(prefix="/api/v1/delegations", tags=["delegations"])
 async def list_delegations(
     direction: str = Query("all", pattern="^(from|to|all)$"),
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:delegations:read")),
 ):
     """List delegations for the current user."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -33,7 +33,7 @@ async def list_delegations(
 async def create_delegation(
     body: DelegationCreate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:delegations:write")),
 ):
     """Create a new permission delegation."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -57,7 +57,7 @@ async def update_delegation(
     delegation_id: str,
     body: DelegationUpdate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:delegations:write")),
 ):
     """Update an existing delegation."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -79,7 +79,7 @@ async def update_delegation(
 async def delete_delegation(
     delegation_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:delegations:write")),
 ):
     """Delete a delegation."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -92,7 +92,7 @@ async def delete_delegation(
 @router.get("/active")
 async def check_active_delegation(
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:delegations:read")),
 ):
     """Check if the current user has any active delegations."""
     tenant_id = uuid.UUID(current_user["tenant_id"])

app/routes/permission_templates.py

@@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.deps import get_current_user
+from app.deps import get_current_user, require_permission
 from app.schemas.permission_template import (
     PermissionTemplateCreate,
     PermissionTemplateUpdate,
@@ -23,7 +23,7 @@ router = APIRouter(prefix="/api/v1/permission-templates", tags=["permission-temp
 async def list_templates(
     entity_type: str | None = None,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:templates:read")),
 ):
     """List all permission templates for the current tenant."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -35,7 +35,7 @@ async def list_templates(
 async def create_template(
     body: PermissionTemplateCreate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:templates:write")),
 ):
     """Create a new permission template."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -58,7 +58,7 @@ async def update_template(
     template_id: str,
     body: PermissionTemplateUpdate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:templates:write")),
 ):
     """Update an existing permission template."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -81,7 +81,7 @@ async def update_template(
 async def delete_template(
     template_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:templates:write")),
 ):
     """Delete a permission template."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -95,7 +95,7 @@ async def delete_template(
 async def apply_template(
     body: PermissionTemplateApply,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:templates:write")),
 ):
     """Apply a permission template to an entity, creating entity_permissions."""
     tenant_id = uuid.UUID(current_user["tenant_id"])

app/routes/policies.py

@@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.deps import get_current_user
+from app.deps import get_current_user, require_permission
 from app.schemas.policy import PolicyCreate, PolicyUpdate
 from app.services import policy_service
 
@@ -19,7 +19,7 @@ router = APIRouter(prefix="/api/v1/policies", tags=["policies"])
 async def list_policies(
     entity_type: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:policies:read")),
 ):
     """List all ABAC policies for a given entity type."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -34,7 +34,7 @@ async def list_policies(
 async def create_policy(
     body: PolicyCreate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:policies:write")),
 ):
     """Create a new ABAC policy."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -59,7 +59,7 @@ async def update_policy(
     policy_id: str,
     body: PolicyUpdate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:policies:write")),
 ):
     """Update an existing ABAC policy."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -85,7 +85,7 @@ async def update_policy(
 async def delete_policy(
     policy_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("permissions:policies:write")),
 ):
     """Delete an ABAC policy."""
     tenant_id = uuid.UUID(current_user["tenant_id"])