justin
dffd05d303
Wires the data model through repository -> service -> API/v1. The privacy engine (app/services/privacy.py) is the single enforcement point: every read resolves visibility there (tree role, tree visibility, per-person override; living-person redaction is a marked Phase 2 TODO). All writes record an attributable AuditEntry.
Endpoints: POST /users (open dev bootstrap until auth), GET /users/me, POST/GET /trees, GET /trees/{id}, and POST/GET /trees/{id}/persons. Authn is a temporary X-User-Id header shim; authz is membership-based (owner/editor/viewer). Domain errors map to 401/403/404/409. Verified on the deploy target: private tree -> 403 for non-members, missing actor -> 401, audit log populated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>
38 lines
1011 B
Python
38 lines
1011 B
Python
"""Audit logging. Every mutation records an append-only AuditEntry attributing
|
|
the change to a User (or the assistant principal acting for a User). Staged on
|
|
the session; the caller commits as part of its unit of work.
|
|
"""
|
|
|
|
import uuid
|
|
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.models.audit import AuditEntry
|
|
from app.models.enums import AuditActorType
|
|
|
|
|
|
def record_audit(
|
|
session: AsyncSession,
|
|
*,
|
|
action: str,
|
|
entity_type: str,
|
|
entity_id: uuid.UUID | None = None,
|
|
tree_id: uuid.UUID | None = None,
|
|
actor_user_id: uuid.UUID | None = None,
|
|
actor_type: AuditActorType = AuditActorType.user,
|
|
before: dict | None = None,
|
|
after: dict | None = None,
|
|
) -> AuditEntry:
|
|
entry = AuditEntry(
|
|
action=action,
|
|
entity_type=entity_type,
|
|
entity_id=entity_id,
|
|
tree_id=tree_id,
|
|
actor_user_id=actor_user_id,
|
|
actor_type=actor_type,
|
|
before=before,
|
|
after=after,
|
|
)
|
|
session.add(entry)
|
|
return entry
|