Files
benevoles/backend/app/api/shifts.py
T
AdamThomasandClaude Sonnet 5 ced922f785 Étape 7 : authentification par lien magique + JWT + rôles
- app/auth/ : jetons (lien magique aléatoire haché SHA-256, JWT HS256),
  dépendances get_current_account / current_account_in_edition / require_roles
  + require_coordinator / require_staff, et ensure_can_write_position/_shift
- Endpoints app/api/auth.py : POST .../auth/magic-link (202 constant, pas de
  divulgation), POST .../auth/verify (JWT, jeton à usage unique), GET /auth/me
- Envoi d'email stubé : le lien est journalisé (logger app.auth, identifiants
  seulement, aucune donnée nominative)
- app/api/accounts.py : CRUD des comptes réservé à la COORDINATION
- Rôles appliqués sur toute l'API :
  COORDINATION accès complet ; RÉFÉRENT lecture globale + écriture sur ses
  seuls postes/créneaux/affectations ; BÉNÉVOLE sa fiche et ses affectations,
  aucune écriture
- imports.py aligné sur la dépendance get_edition (404 avant 403)
- Secret JWT porté à >= 32 octets (config, .env.example, docker-compose)
- seed : crée un compte VOLUNTEER pour chaque bénévole avec email (104 comptes)
- conftest : fixtures make_account / coordinator / as_account / raw_client ;
  la suite existante s'exécute en COORDINATION
- 13 tests d'authentification + de rôles ; 119 tests au total ; alembic check
  toujours vert (Account / MagicLinkToken déjà dans la migration 0001)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uUsRg7XzopkCPWimwg9ZM
2026-09-09 23:22:35 +02:00

164 lines
5.1 KiB
Python

"""CRUD des créneaux."""
import uuid
from fastapi import APIRouter, Depends, HTTPException, Response, status
from sqlmodel import Session, select
from app.api._common import owned_or_404, replace_links, resolve_skills
from app.api.deps import get_edition
from app.api.schemas import ShiftCreate, ShiftRead, ShiftUpdate
from app.auth.deps import (
current_account_in_edition,
ensure_can_write_position,
ensure_can_write_shift,
require_staff,
)
from app.db import get_session
from app.models import (
Account,
Edition,
Position,
Shift,
ShiftRequiredSkill,
Skill,
)
router = APIRouter(prefix="/editions/{edition_id}/shifts", tags=["shifts"])
def _skill_codes(session: Session, shift_id: uuid.UUID) -> list[str]:
return sorted(
session.exec(
select(Skill.code)
.join(ShiftRequiredSkill, ShiftRequiredSkill.skill_id == Skill.id)
.where(ShiftRequiredSkill.shift_id == shift_id)
)
)
def _read(session: Session, shift: Shift) -> ShiftRead:
return ShiftRead(
**shift.model_dump(),
required_skill_codes=_skill_codes(session, shift.id),
)
def _set_skills(session: Session, shift: Shift, codes: list[str]) -> None:
skills = resolve_skills(session, shift.edition_id, codes)
replace_links(
session,
ShiftRequiredSkill,
filter_column=ShiftRequiredSkill.shift_id,
filter_value=shift.id,
pairs=[{"shift_id": shift.id, "skill_id": s.id} for s in skills],
)
def _check_range(starts_at, ends_at) -> None:
if ends_at <= starts_at:
raise HTTPException(
status_code=422,
detail={"code": "shift.ends_not_after_starts"},
)
def _require_position(
session: Session, position_id: uuid.UUID, edition_id: uuid.UUID
) -> Position:
position = session.get(Position, position_id)
if position is None or position.edition_id != edition_id:
raise HTTPException(
status_code=422, detail={"code": "shift.position_wrong_edition"}
)
return position
@router.post("", response_model=ShiftRead, status_code=status.HTTP_201_CREATED)
def create_shift(
payload: ShiftCreate,
edition: Edition = Depends(get_edition),
account: Account = Depends(current_account_in_edition),
session: Session = Depends(get_session),
) -> ShiftRead:
_check_range(payload.starts_at, payload.ends_at)
position = _require_position(session, payload.position_id, edition.id)
ensure_can_write_position(account, position)
shift = Shift(
edition_id=edition.id,
**payload.model_dump(exclude={"required_skill_codes"}),
)
session.add(shift)
session.flush()
_set_skills(session, shift, payload.required_skill_codes)
session.commit()
session.refresh(shift)
return _read(session, shift)
@router.get("", response_model=list[ShiftRead])
def list_shifts(
position_id: uuid.UUID | None = None,
edition: Edition = Depends(get_edition),
_guard: Account = Depends(require_staff),
session: Session = Depends(get_session),
) -> list[ShiftRead]:
stmt = (
select(Shift)
.where(Shift.edition_id == edition.id)
.order_by(Shift.starts_at)
)
if position_id is not None:
stmt = stmt.where(Shift.position_id == position_id)
return [_read(session, s) for s in session.exec(stmt)]
@router.get("/{shift_id}", response_model=ShiftRead)
def get_shift(
shift_id: uuid.UUID,
edition: Edition = Depends(get_edition),
_guard: Account = Depends(require_staff),
session: Session = Depends(get_session),
) -> ShiftRead:
shift = owned_or_404(session.get(Shift, shift_id), edition.id)
return _read(session, shift)
@router.patch("/{shift_id}", response_model=ShiftRead)
def update_shift(
shift_id: uuid.UUID,
payload: ShiftUpdate,
edition: Edition = Depends(get_edition),
account: Account = Depends(current_account_in_edition),
session: Session = Depends(get_session),
) -> ShiftRead:
shift = owned_or_404(session.get(Shift, shift_id), edition.id)
ensure_can_write_shift(account, session, shift)
changes = payload.model_dump(exclude_unset=True)
skill_codes = changes.pop("required_skill_codes", None)
if "position_id" in changes:
target = _require_position(session, changes["position_id"], edition.id)
ensure_can_write_position(account, target)
for field, value in changes.items():
setattr(shift, field, value)
_check_range(shift.starts_at, shift.ends_at)
if skill_codes is not None:
_set_skills(session, shift, skill_codes)
session.commit()
session.refresh(shift)
return _read(session, shift)
@router.delete("/{shift_id}", status_code=status.HTTP_204_NO_CONTENT)
def delete_shift(
shift_id: uuid.UUID,
edition: Edition = Depends(get_edition),
account: Account = Depends(current_account_in_edition),
session: Session = Depends(get_session),
) -> Response:
shift = owned_or_404(session.get(Shift, shift_id), edition.id)
ensure_can_write_shift(account, session, shift)
session.delete(shift)
session.commit()
return Response(status_code=status.HTTP_204_NO_CONTENT)