refactor(b3): dynamic entity registry, custom_fields permissions decoupled from contacts, write perms generated from registry

app/deps.py

@@ -17,8 +17,9 @@ from app.core.db import get_db, set_tenant_context, set_user_context
 
 logger = logging.getLogger(__name__)
 
-# Known write-permission modules — used by require_write() to check
-# specific permissions instead of broad wildcards like *:write
+# Legacy fallback list — used by require_write() only when the permission
+# registry is not initialized. The live source of truth is generated from
+# the registry (see _get_write_permissions, ARCH-022).
 _WRITE_PERMISSIONS = [
     "users:write",
     "roles:write",
@@ -35,6 +36,30 @@ _WRITE_PERMISSIONS = [
 ]
 
 
+def _get_write_permissions() -> list[str]:
+    """Return all known ``module:write`` permission keys (ARCH-022).
+
+    Generated from the permission registry so plugin write permissions are
+    picked up automatically without touching this file. Falls back to the
+    static legacy list when the registry is unavailable/uninitialized.
+    """
+    try:
+        from app.core.permission_registry import get_permission_registry
+
+        registry = get_permission_registry()
+        if getattr(registry, "_initialized", False):
+            perms = [
+                entry["key"]
+                for entry in registry.get_all()
+                if entry["key"].endswith(":write")
+            ]
+            if perms:
+                return sorted(perms)
+    except Exception:
+        pass
+    return list(_WRITE_PERMISSIONS)
+
+
 async def get_redis_dep() -> aioredis.Redis:
     """FastAPI dependency for Redis client."""
     return get_redis()
@@ -261,7 +286,7 @@ async def require_write(
     # Check via permission system for specific write permissions
     from app.core.permissions import check_permission
 
-    for perm in _WRITE_PERMISSIONS:
+    for perm in _get_write_permissions():
         if check_permission(current_user, perm):
             return current_user