Full-CRUD sweep: update endpoints for tree, source, citation, relationship, media

Closes the rule #8 gap at the API layer: PATCH endpoints + service updates for Tree (name/description/visibility), Source, Citation (page/detail/confidence), Relationship (qualifier/notes), and Media (title/attachment) — editor-gated and audited. Every core entity now has create/read/update/delete. Edit UIs for these land in the frontend batch. 37 tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

backend/app/api/v1/citations.py

@@ -3,7 +3,7 @@ import uuid
 from fastapi import APIRouter, status
 
 from app.api.deps import CurrentUser, SessionDep
-from app.schemas.source import CitationCreate, CitationRead
+from app.schemas.source import CitationCreate, CitationRead, CitationUpdate
 from app.services import citation_service, tree_service
 
 router = APIRouter(prefix="/trees", tags=["citations"])
@@ -31,6 +31,25 @@ async def list_citations(
     return [CitationRead.model_validate(c) for c in citations]
 
 
+@router.patch("/{tree_id}/citations/{citation_id}", response_model=CitationRead)
+async def update_citation(
+    tree_id: uuid.UUID,
+    citation_id: uuid.UUID,
+    data: CitationUpdate,
+    session: SessionDep,
+    current: CurrentUser,
+) -> CitationRead:
+    tree = await tree_service.get_tree(session, viewer_id=current.id, tree_id=tree_id)
+    citation = await citation_service.update_citation(
+        session,
+        actor=current,
+        tree=tree,
+        citation_id=citation_id,
+        changes=data.model_dump(exclude_unset=True),
+    )
+    return CitationRead.model_validate(citation)
+
+
 @router.delete("/{tree_id}/citations/{citation_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_citation(
     tree_id: uuid.UUID, citation_id: uuid.UUID, session: SessionDep, current: CurrentUser

backend/app/api/v1/media.py

@@ -3,7 +3,7 @@ import uuid
 from fastapi import APIRouter, File, Form, Response, UploadFile, status
 
 from app.api.deps import CurrentUser, ObjectStoreDep, SessionDep
-from app.schemas.media import MediaRead
+from app.schemas.media import MediaRead, MediaUpdate
 from app.services import media_service, tree_service
 
 
@@ -81,6 +81,26 @@ async def media_content(
     )
 
 
+@router.patch("/{tree_id}/media/{media_id}", response_model=MediaRead)
+async def update_media(
+    tree_id: uuid.UUID,
+    media_id: uuid.UUID,
+    data: MediaUpdate,
+    session: SessionDep,
+    current: CurrentUser,
+    store: ObjectStoreDep,
+) -> MediaRead:
+    tree = await tree_service.get_tree(session, viewer_id=current.id, tree_id=tree_id)
+    media = await media_service.update_media(
+        session,
+        actor=current,
+        tree=tree,
+        media_id=media_id,
+        changes=data.model_dump(exclude_unset=True),
+    )
+    return _read(media)
+
+
 @router.delete("/{tree_id}/media/{media_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_media(
     tree_id: uuid.UUID, media_id: uuid.UUID, session: SessionDep, current: CurrentUser

backend/app/api/v1/relationships.py

@@ -3,7 +3,7 @@ import uuid
 from fastapi import APIRouter, status
 
 from app.api.deps import CurrentUser, SessionDep
-from app.schemas.relationship import RelationshipCreate, RelationshipRead
+from app.schemas.relationship import RelationshipCreate, RelationshipRead, RelationshipUpdate
 from app.services import relationship_service, tree_service
 
 router = APIRouter(prefix="/trees", tags=["relationships"])
@@ -47,6 +47,25 @@ async def list_person_relationships(
     return [RelationshipRead.model_validate(r) for r in rels]
 
 
+@router.patch("/{tree_id}/relationships/{relationship_id}", response_model=RelationshipRead)
+async def update_relationship(
+    tree_id: uuid.UUID,
+    relationship_id: uuid.UUID,
+    data: RelationshipUpdate,
+    session: SessionDep,
+    current: CurrentUser,
+) -> RelationshipRead:
+    tree = await tree_service.get_tree(session, viewer_id=current.id, tree_id=tree_id)
+    rel = await relationship_service.update_relationship(
+        session,
+        actor=current,
+        tree=tree,
+        relationship_id=relationship_id,
+        changes=data.model_dump(exclude_unset=True),
+    )
+    return RelationshipRead.model_validate(rel)
+
+
 @router.delete(
     "/{tree_id}/relationships/{relationship_id}", status_code=status.HTTP_204_NO_CONTENT
 )

backend/app/api/v1/sources.py

@@ -3,7 +3,7 @@ import uuid
 from fastapi import APIRouter, status
 
 from app.api.deps import CurrentUser, SessionDep
-from app.schemas.source import SourceCreate, SourceRead
+from app.schemas.source import SourceCreate, SourceRead, SourceUpdate
 from app.services import source_service, tree_service
 
 router = APIRouter(prefix="/trees", tags=["sources"])
@@ -40,6 +40,25 @@ async def get_source(
     return SourceRead.model_validate(source)
 
 
+@router.patch("/{tree_id}/sources/{source_id}", response_model=SourceRead)
+async def update_source(
+    tree_id: uuid.UUID,
+    source_id: uuid.UUID,
+    data: SourceUpdate,
+    session: SessionDep,
+    current: CurrentUser,
+) -> SourceRead:
+    tree = await tree_service.get_tree(session, viewer_id=current.id, tree_id=tree_id)
+    source = await source_service.update_source(
+        session,
+        actor=current,
+        tree=tree,
+        source_id=source_id,
+        changes=data.model_dump(exclude_unset=True),
+    )
+    return SourceRead.model_validate(source)
+
+
 @router.delete("/{tree_id}/sources/{source_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_source(
     tree_id: uuid.UUID, source_id: uuid.UUID, session: SessionDep, current: CurrentUser

backend/app/api/v1/trees.py

@@ -3,7 +3,7 @@ import uuid
 from fastapi import APIRouter, status
 
 from app.api.deps import CurrentUser, SessionDep
-from app.schemas.tree import TreeCreate, TreeRead
+from app.schemas.tree import TreeCreate, TreeRead, TreeUpdate
 from app.services import tree_service
 
 router = APIRouter(prefix="/trees", tags=["trees"])
@@ -38,6 +38,16 @@ async def get_tree(tree_id: uuid.UUID, session: SessionDep, current: CurrentUser
     return TreeRead.model_validate(tree)
 
 
+@router.patch("/{tree_id}", response_model=TreeRead)
+async def update_tree(
+    tree_id: uuid.UUID, data: TreeUpdate, session: SessionDep, current: CurrentUser
+) -> TreeRead:
+    tree = await tree_service.update_tree(
+        session, actor=current, tree_id=tree_id, changes=data.model_dump(exclude_unset=True)
+    )
+    return TreeRead.model_validate(tree)
+
+
 @router.delete("/{tree_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_tree(tree_id: uuid.UUID, session: SessionDep, current: CurrentUser) -> None:
     await tree_service.delete_tree(session, actor=current, tree_id=tree_id)