feat: phase 3 - field-level permissions with plugin field definitions, service-layer filtering, 20 core field definitions

app/plugins/base.py

@@ -82,6 +82,15 @@ class BasePlugin(ABC):
         """
         return []
 
+    # ─── Field Definitions ───
+
+    def get_field_definitions(self) -> list[dict[str, str]]:
+        """Return field definitions from manifest."""
+        return [
+            {"module": fd.module, "field": fd.field, "label": fd.label, "sensitivity": fd.sensitivity}
+            for fd in self.manifest.field_definitions
+        ]
+
     # ─── Route Registration ───
 
     def get_routes(self) -> list[APIRouter]:

app/plugins/manifest.py

@@ -15,6 +15,15 @@ class PluginRouteDef(BaseModel):
     )
 
 
+class FieldDefinition(BaseModel):
+    """Field definition for field-level permissions."""
+
+    module: str = Field(..., description="Module name (e.g. 'companies', 'contacts')")
+    field: str = Field(..., description="Field name (e.g. 'annual_revenue')")
+    label: str = Field(..., description="Human-readable label")
+    sensitivity: str = Field(default="normal", description="normal|sensitive|critical")
+
+
 class PluginManifest(BaseModel):
     """Manifest describing a plugin's metadata, dependencies, and capabilities."""
 
@@ -42,6 +51,9 @@ class PluginManifest(BaseModel):
     is_core: bool = Field(
         default=False, description="Whether this is a core plugin that cannot be deactivated"
     )
+    field_definitions: list[FieldDefinition] = Field(
+        default_factory=list, description="Field definitions for field-level permissions"
+    )
 
     @field_validator("name")
     @classmethod