Wire case-level access control into dashboard, entities routers + case activity endpoint #68

New issue

Closed

opened 2026-05-23 01:35:34 +00:00 by Mark · 0 comments

Mark commented

2026-05-23 01:35:34 +00:00

Owner

Parent Issue: #36 (Case-level access control) / #53

Scope

Wire require_case_access dependency into dashboard and entities routers. Also add a GET /cases/{case_id}/activity endpoint for case-scoped audit history.

Background

Dashboard router aggregates data by case_id query param
Entities router searches across orgs/people by case_id
Audit router is global (admin-only) — no case_id, but case-scoped activity would be useful

Acceptance Criteria

GET /dashboard/?case_id=X — requires viewer case access
GET /entities/search?case_id=X — requires viewer case access
New endpoint: GET /cases/{case_id}/activity — returns audit events for a case (requires viewer)
Admin bypass works for all endpoints
Existing tests updated

Dependencies

#64 (cases router + membership management endpoints must exist first)

Implementation Notes

Dashboard and entities are read-only — viewer access is sufficient
Case-scoped audit could filter AuditEvent by entities belonging to a case (evidence, orgs, people etc.)
Alternatively, add case_id field to AuditEvent for direct filtering

## Parent Issue: #36 (Case-level access control) / #53 ## Scope Wire `require_case_access` dependency into **dashboard and entities routers**. Also add a `GET /cases/{case_id}/activity` endpoint for case-scoped audit history. ## Background - Dashboard router aggregates data by `case_id` query param - Entities router searches across orgs/people by `case_id` - Audit router is global (admin-only) — no case_id, but case-scoped activity would be useful ## Acceptance Criteria - [ ] `GET /dashboard/?case_id=X` — requires `viewer` case access - [ ] `GET /entities/search?case_id=X` — requires `viewer` case access - [ ] New endpoint: `GET /cases/{case_id}/activity` — returns audit events for a case (requires `viewer`) - [ ] Admin bypass works for all endpoints - [ ] Existing tests updated ## Dependencies - #64 (cases router + membership management endpoints must exist first) ## Implementation Notes - Dashboard and entities are read-only — `viewer` access is sufficient - Case-scoped audit could filter AuditEvent by entities belonging to a case (evidence, orgs, people etc.) - Alternatively, add `case_id` field to AuditEvent for direct filtering