justin
dffd05d303
Wires the data model through repository -> service -> API/v1. The privacy engine (app/services/privacy.py) is the single enforcement point: every read resolves visibility there (tree role, tree visibility, per-person override; living-person redaction is a marked Phase 2 TODO). All writes record an attributable AuditEntry.
Endpoints: POST /users (open dev bootstrap until auth), GET /users/me, POST/GET /trees, GET /trees/{id}, and POST/GET /trees/{id}/persons. Authn is a temporary X-User-Id header shim; authz is membership-based (owner/editor/viewer). Domain errors map to 401/403/404/409. Verified on the deploy target: private tree -> 403 for non-members, missing actor -> 401, audit log populated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>
34 lines
1.2 KiB
Python
34 lines
1.2 KiB
Python
import uuid
|
|
|
|
from fastapi import APIRouter, status
|
|
|
|
from app.api.deps import CurrentUser, SessionDep
|
|
from app.schemas.tree import TreeCreate, TreeRead
|
|
from app.services import tree_service
|
|
|
|
router = APIRouter(prefix="/trees", tags=["trees"])
|
|
|
|
|
|
@router.post("", response_model=TreeRead, status_code=status.HTTP_201_CREATED)
|
|
async def create_tree(data: TreeCreate, session: SessionDep, current: CurrentUser) -> TreeRead:
|
|
tree = await tree_service.create_tree(
|
|
session,
|
|
owner=current,
|
|
name=data.name,
|
|
description=data.description,
|
|
visibility=data.visibility,
|
|
)
|
|
return TreeRead.model_validate(tree)
|
|
|
|
|
|
@router.get("", response_model=list[TreeRead])
|
|
async def list_my_trees(session: SessionDep, current: CurrentUser) -> list[TreeRead]:
|
|
trees = await tree_service.list_trees_for_user(session, user=current)
|
|
return [TreeRead.model_validate(t) for t in trees]
|
|
|
|
|
|
@router.get("/{tree_id}", response_model=TreeRead)
|
|
async def get_tree(tree_id: uuid.UUID, session: SessionDep, current: CurrentUser) -> TreeRead:
|
|
tree = await tree_service.get_tree(session, viewer_id=current.id, tree_id=tree_id)
|
|
return TreeRead.model_validate(tree)
|