AdamThomasandClaude Sonnet 5
ced922f785
- app/auth/ : jetons (lien magique aléatoire haché SHA-256, JWT HS256), dépendances get_current_account / current_account_in_edition / require_roles + require_coordinator / require_staff, et ensure_can_write_position/_shift - Endpoints app/api/auth.py : POST .../auth/magic-link (202 constant, pas de divulgation), POST .../auth/verify (JWT, jeton à usage unique), GET /auth/me - Envoi d'email stubé : le lien est journalisé (logger app.auth, identifiants seulement, aucune donnée nominative) - app/api/accounts.py : CRUD des comptes réservé à la COORDINATION - Rôles appliqués sur toute l'API : COORDINATION accès complet ; RÉFÉRENT lecture globale + écriture sur ses seuls postes/créneaux/affectations ; BÉNÉVOLE sa fiche et ses affectations, aucune écriture - imports.py aligné sur la dépendance get_edition (404 avant 403) - Secret JWT porté à >= 32 octets (config, .env.example, docker-compose) - seed : crée un compte VOLUNTEER pour chaque bénévole avec email (104 comptes) - conftest : fixtures make_account / coordinator / as_account / raw_client ; la suite existante s'exécute en COORDINATION - 13 tests d'authentification + de rôles ; 119 tests au total ; alembic check toujours vert (Account / MagicLinkToken déjà dans la migration 0001) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017uUsRg7XzopkCPWimwg9ZM
92 lines
2.8 KiB
Python
92 lines
2.8 KiB
Python
"""CRUD des postes."""
|
|
|
|
import uuid
|
|
|
|
from fastapi import APIRouter, Depends, Response, status
|
|
from sqlmodel import Session, select
|
|
|
|
from app.api._common import owned_or_404
|
|
from app.api.deps import get_edition
|
|
from app.api.schemas import PositionCreate, PositionRead, PositionUpdate
|
|
from app.auth.deps import (
|
|
current_account_in_edition,
|
|
ensure_can_write_position,
|
|
require_coordinator,
|
|
require_staff,
|
|
)
|
|
from app.db import get_session
|
|
from app.models import Account, Edition, Position
|
|
|
|
router = APIRouter(
|
|
prefix="/editions/{edition_id}/positions", tags=["positions"]
|
|
)
|
|
|
|
|
|
@router.post("", response_model=PositionRead, status_code=status.HTTP_201_CREATED)
|
|
def create_position(
|
|
payload: PositionCreate,
|
|
edition: Edition = Depends(get_edition),
|
|
_guard: Account = Depends(require_coordinator),
|
|
session: Session = Depends(get_session),
|
|
) -> Position:
|
|
position = Position(edition_id=edition.id, **payload.model_dump())
|
|
session.add(position)
|
|
session.commit()
|
|
session.refresh(position)
|
|
return position
|
|
|
|
|
|
@router.get("", response_model=list[PositionRead])
|
|
def list_positions(
|
|
edition: Edition = Depends(get_edition),
|
|
_guard: Account = Depends(require_staff),
|
|
session: Session = Depends(get_session),
|
|
) -> list[Position]:
|
|
return list(
|
|
session.exec(
|
|
select(Position)
|
|
.where(Position.edition_id == edition.id)
|
|
.order_by(Position.name)
|
|
)
|
|
)
|
|
|
|
|
|
@router.get("/{position_id}", response_model=PositionRead)
|
|
def get_position(
|
|
position_id: uuid.UUID,
|
|
edition: Edition = Depends(get_edition),
|
|
_guard: Account = Depends(require_staff),
|
|
session: Session = Depends(get_session),
|
|
) -> Position:
|
|
return owned_or_404(session.get(Position, position_id), edition.id)
|
|
|
|
|
|
@router.patch("/{position_id}", response_model=PositionRead)
|
|
def update_position(
|
|
position_id: uuid.UUID,
|
|
payload: PositionUpdate,
|
|
edition: Edition = Depends(get_edition),
|
|
account: Account = Depends(current_account_in_edition),
|
|
session: Session = Depends(get_session),
|
|
) -> Position:
|
|
position = owned_or_404(session.get(Position, position_id), edition.id)
|
|
ensure_can_write_position(account, position)
|
|
for field, value in payload.model_dump(exclude_unset=True).items():
|
|
setattr(position, field, value)
|
|
session.commit()
|
|
session.refresh(position)
|
|
return position
|
|
|
|
|
|
@router.delete("/{position_id}", status_code=status.HTTP_204_NO_CONTENT)
|
|
def delete_position(
|
|
position_id: uuid.UUID,
|
|
edition: Edition = Depends(get_edition),
|
|
_guard: Account = Depends(require_coordinator),
|
|
session: Session = Depends(get_session),
|
|
) -> Response:
|
|
position = owned_or_404(session.get(Position, position_id), edition.id)
|
|
session.delete(position)
|
|
session.commit()
|
|
return Response(status_code=status.HTTP_204_NO_CONTENT)
|