feat: phase 3 - field-level permissions with plugin field definitions, service-layer filtering, 20 core field definitions

app/routes/companies.py

@@ -37,6 +37,7 @@ async def list_companies(
         industry=industry,
         sort_by=sort_by,
         sort_order=sort_order,
+        resolved_perms=current_user,
     )
     return result
 
@@ -159,7 +160,7 @@ async def get_company(
             400, detail={"detail": "Invalid company_id", "code": "invalid_id"}
         ) from None
 
-    data = await company_service.get_company_detail(db, tenant_id, cid)
+    data = await company_service.get_company_detail(db, tenant_id, cid, resolved_perms=current_user)
     if data is None:
         raise HTTPException(404, detail={"detail": "Company not found", "code": "not_found"})
     return data

app/routes/contacts.py

@@ -43,6 +43,7 @@ async def list_contacts(
         search=search,
         sort_by=sort_by,
         sort_order=sort_order,
+        resolved_perms=current_user,
     )
     return result
 
@@ -173,7 +174,7 @@ async def get_contact(
             400, detail={"detail": "Invalid contact_id", "code": "invalid_id"}
         ) from None
 
-    data = await contact_service.get_contact_detail(db, tenant_id, cid)
+    data = await contact_service.get_contact_detail(db, tenant_id, cid, resolved_perms=current_user)
     if data is None:
         raise HTTPException(404, detail={"detail": "Contact not found", "code": "not_found"})
     return data

app/routes/roles.py

@@ -12,6 +12,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.core.audit import log_audit
 from app.core.auth import get_redis
 from app.core.db import get_db
+from app.core.permission_registry import get_permission_registry
 from app.core.permissions import invalidate_all_user_permissions
 from app.deps import require_permission
 from app.models.plugin import Plugin as PluginModel
@@ -108,6 +109,7 @@ async def list_permissions(
         "system": SYSTEM_PERMISSIONS,
         "plugins": plugin_perms,
         "all": SYSTEM_PERMISSIONS + plugin_perms,
+        "field_definitions": get_permission_registry().get_all_field_definitions(),
     }