Add update (CRUD) for events and people; record the full-CRUD invariant

Events and people are now editable, not write-once: PATCH /events/{id} (type, structured date, place, notes) and PATCH /persons/{id} (vitals, privacy, and the primary name's given/surname). CLAUDE.md gains rule #8: every stored object must support full CRUD in API and UI — historical research is constant correction. Tests cover both updates.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

backend/app/services/event_service.py

@@ -122,6 +122,44 @@ async def list_events_for_person(
     return list((await session.execute(stmt)).scalars().all())
 
 
+async def update_event(
+    session: AsyncSession,
+    *,
+    actor: User,
+    tree: Tree,
+    event_id: uuid.UUID,
+    changes: dict,
+) -> Event:
+    if not await privacy.can_edit_tree(session, user_id=actor.id, tree=tree):
+        raise Forbidden("not an editor of this tree")
+    event = (
+        await session.execute(
+            select(Event).where(
+                Event.id == event_id, Event.tree_id == tree.id, Event.deleted_at.is_(None)
+            )
+        )
+    ).scalar_one_or_none()
+    if event is None:
+        raise NotFound("event not found")
+    if "place_id" in changes and changes["place_id"] is not None:
+        if not await _belongs_to_tree(session, Place, changes["place_id"], tree.id):
+            raise NotFound("place not found in this tree")
+    for key, value in changes.items():
+        setattr(event, key, value)
+    record_audit(
+        session,
+        action="update",
+        entity_type="Event",
+        entity_id=event.id,
+        tree_id=tree.id,
+        actor_user_id=actor.id,
+        after=changes,
+    )
+    await session.commit()
+    await session.refresh(event)
+    return event
+
+
 async def delete_event(
     session: AsyncSession, *, actor: User, tree: Tree, event_id: uuid.UUID
 ) -> None:

backend/app/services/person_service.py

@@ -95,6 +95,59 @@ async def create_person(
     return person
 
 
+_PERSON_FIELDS = {"gender", "is_living", "privacy", "notes"}
+
+
+async def update_person(
+    session: AsyncSession, *, actor: User, tree: Tree, person_id: uuid.UUID, changes: dict
+) -> Person:
+    if not await privacy.can_edit_tree(session, user_id=actor.id, tree=tree):
+        raise Forbidden("not an editor of this tree")
+    person = (
+        await session.execute(
+            select(Person).where(
+                Person.id == person_id, Person.tree_id == tree.id, Person.deleted_at.is_(None)
+            )
+        )
+    ).scalar_one_or_none()
+    if person is None:
+        raise NotFound("person not found")
+
+    for key in _PERSON_FIELDS & changes.keys():
+        setattr(person, key, changes[key])
+
+    if "given" in changes or "surname" in changes:
+        name = (
+            await session.execute(
+                select(Name)
+                .where(Name.person_id == person.id, Name.deleted_at.is_(None))
+                .order_by(Name.is_primary.desc(), Name.sort_order)
+            )
+        ).scalars().first()
+        if name is None:
+            name = Name(tree_id=tree.id, person_id=person.id, name_type="birth", is_primary=True)
+            session.add(name)
+        if "given" in changes:
+            name.given = changes["given"]
+        if "surname" in changes:
+            name.surname = changes["surname"]
+        name.display_name = None  # rebuild display from parts
+
+    record_audit(
+        session,
+        action="update",
+        entity_type="Person",
+        entity_id=person.id,
+        tree_id=tree.id,
+        actor_user_id=actor.id,
+        after=changes,
+    )
+    await session.commit()
+    await session.refresh(person)
+    await _attach_primary_name(session, person)
+    return person
+
+
 async def get_person(
     session: AsyncSession, *, viewer_id: uuid.UUID, tree: Tree, person_id: uuid.UUID
 ) -> Person: