update: Add Global Search on Header, Add Global Audit log for all actions.

backend/builder/router.py

@@ -1,5 +1,6 @@
 from fastapi import APIRouter, Depends, HTTPException
 from fastapi.responses import FileResponse, PlainTextResponse
+from sqlalchemy.ext.asyncio import AsyncSession
 from auth.models import TokenPayload
 from auth.dependencies import require_permission
 from builder.models import (
@@ -9,6 +10,8 @@ from builder.models import (
     BuiltMelodyListResponse,
 )
 from builder import service
+from database.postgres import get_pg_session
+from shared.audit import log_action
 
 router = APIRouter(prefix="/api/builder/melodies", tags=["builder"])
 
@@ -54,8 +57,12 @@ async def get_built_melody(
 async def create_built_melody(
     body: BuiltMelodyCreate,
     _user: TokenPayload = Depends(require_permission("melodies", "edit")),
+    db: AsyncSession = Depends(get_pg_session),
 ):
-    return await service.create_built_melody(body)
+    melody = await service.create_built_melody(body)
+    await log_action(db, _user.sub, _user.name or _user.email, "CREATE", "archetype",
+                     str(melody.id), melody.name or str(melody.id))
+    return melody
 
 
 @router.put("/{melody_id}", response_model=BuiltMelodyInDB)
@@ -63,16 +70,31 @@ async def update_built_melody(
     melody_id: str,
     body: BuiltMelodyUpdate,
     _user: TokenPayload = Depends(require_permission("melodies", "edit")),
+    db: AsyncSession = Depends(get_pg_session),
 ):
-    return await service.update_built_melody(melody_id, body)
+    old = await service.get_built_melody(melody_id)
+    melody = await service.update_built_melody(melody_id, body)
+    _SKIP = {"updated_at", "id", "steps", "builtin_code"}
+    changes = {
+        k: {"old": getattr(old, k, None), "new": getattr(melody, k, None)}
+        for k in body.model_fields_set
+        if k not in _SKIP and getattr(old, k, None) != getattr(melody, k, None)
+    }
+    await log_action(db, _user.sub, _user.name or _user.email, "UPDATE", "archetype",
+                     melody_id, melody.name or melody_id, changes=changes or None)
+    return melody
 
 
 @router.delete("/{melody_id}", status_code=204)
 async def delete_built_melody(
     melody_id: str,
     _user: TokenPayload = Depends(require_permission("melodies", "delete")),
+    db: AsyncSession = Depends(get_pg_session),
 ):
+    melody = await service.get_built_melody(melody_id)
     await service.delete_built_melody(melody_id)
+    await log_action(db, _user.sub, _user.name or _user.email, "DELETE", "archetype",
+                     melody_id, melody.name if melody else melody_id)
 
 
 @router.post("/{melody_id}/toggle-builtin", response_model=BuiltMelodyInDB)