justin
dffd05d303
Wires the data model through repository -> service -> API/v1. The privacy engine (app/services/privacy.py) is the single enforcement point: every read resolves visibility there (tree role, tree visibility, per-person override; living-person redaction is a marked Phase 2 TODO). All writes record an attributable AuditEntry.
Endpoints: POST /users (open dev bootstrap until auth), GET /users/me, POST/GET /trees, GET /trees/{id}, and POST/GET /trees/{id}/persons. Authn is a temporary X-User-Id header shim; authz is membership-based (owner/editor/viewer). Domain errors map to 401/403/404/409. Verified on the deploy target: private tree -> 403 for non-members, missing actor -> 401, audit log populated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>
44 lines
1.5 KiB
Python
44 lines
1.5 KiB
Python
import uuid
|
|
|
|
from fastapi import APIRouter, status
|
|
|
|
from app.api.deps import CurrentUser, SessionDep
|
|
from app.schemas.person import PersonCreate, PersonRead
|
|
from app.services import person_service, tree_service
|
|
|
|
# Persons are nested under their tree (the tenant boundary).
|
|
router = APIRouter(prefix="/trees", tags=["persons"])
|
|
|
|
|
|
@router.post(
|
|
"/{tree_id}/persons",
|
|
response_model=PersonRead,
|
|
status_code=status.HTTP_201_CREATED,
|
|
)
|
|
async def create_person(
|
|
tree_id: uuid.UUID, data: PersonCreate, session: SessionDep, current: CurrentUser
|
|
) -> PersonRead:
|
|
# get_tree enforces existence + view access; create_person enforces edit rights.
|
|
tree = await tree_service.get_tree(session, viewer_id=current.id, tree_id=tree_id)
|
|
person = await person_service.create_person(
|
|
session,
|
|
actor=current,
|
|
tree=tree,
|
|
given=data.given,
|
|
surname=data.surname,
|
|
gender=data.gender,
|
|
is_living=data.is_living,
|
|
privacy_setting=data.privacy,
|
|
notes=data.notes,
|
|
)
|
|
return PersonRead.model_validate(person)
|
|
|
|
|
|
@router.get("/{tree_id}/persons", response_model=list[PersonRead])
|
|
async def list_persons(
|
|
tree_id: uuid.UUID, session: SessionDep, current: CurrentUser
|
|
) -> list[PersonRead]:
|
|
tree = await tree_service.get_tree(session, viewer_id=current.id, tree_id=tree_id)
|
|
persons = await person_service.list_persons(session, viewer_id=current.id, tree=tree)
|
|
return [PersonRead.model_validate(p) for p in persons]
|