sprint14-19: ABAC UI rule editor + permission templates + bulk share + analytics + delegation + resolution strategies + migrations 0056-0058

app/routes/entity_permissions.py

@@ -15,7 +15,7 @@ from app.schemas.entity_permission import (
     EntityPermissionCreate,
     EntityPermissionUpdate,
 )
-from app.services import entity_permission_service
+from app.services import entity_permission_service, bulk_permission_service
 
 router = APIRouter(prefix="/api/v1/permissions", tags=["entity-permissions"])
 
@@ -184,3 +184,67 @@ async def list_entity_registry(
         {"entity_type": "ai_conversation", "label": "AI Konversationen", "table": "ai_conversations"},
     ]
     return {"items": entity_types, "total": len(entity_types)}
+
+
+@router.post("/bulk", status_code=status.HTTP_201_CREATED)
+@require_permission("settings:write")
+async def bulk_share_permissions(
+    body: dict,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Bulk share multiple entities with a principal."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    try:
+        result = await bulk_permission_service.bulk_share(
+            db,
+            tenant_id,
+            body["entity_type"],
+            body["entity_ids"],
+            body["principal_type"],
+            body["principal_id"],
+            body["level"],
+            created_by=user_id,
+        )
+        return result
+    except (ValueError, KeyError) as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+@router.post("/bulk/unshare", status_code=status.HTTP_200_OK)
+@require_permission("settings:write")
+async def bulk_unshare_permissions(
+    body: dict,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Bulk remove permissions for a principal from multiple entities."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    try:
+        result = await bulk_permission_service.bulk_unshare(
+            db,
+            tenant_id,
+            body["entity_type"],
+            body["entity_ids"],
+            body["principal_type"],
+            body["principal_id"],
+        )
+        return result
+    except (ValueError, KeyError) as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+@router.get("/analytics")
+@require_permission("settings:read")
+async def get_permission_analytics(
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Get permission analytics for the current tenant."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    try:
+        result = await entity_permission_service.get_permission_analytics(db, tenant_id)
+        return result
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))