update: Add Global Search on Header, Add Global Audit log for all actions.

backend/crm/router.py

@@ -3,11 +3,14 @@ from fastapi.responses import FileResponse
 from typing import Optional
 import os
 import shutil
+from sqlalchemy.ext.asyncio import AsyncSession
 
 from auth.models import TokenPayload
 from auth.dependencies import require_permission
 from crm.models import ProductCreate, ProductUpdate, ProductInDB, ProductListResponse
 from crm import service
+from database.postgres import get_pg_session
+from shared.audit import log_action
 
 router = APIRouter(prefix="/api/crm/products", tags=["crm-products"])
 
@@ -35,28 +38,47 @@ def get_product(
 
 
 @router.post("", response_model=ProductInDB, status_code=201)
-def create_product(
+async def create_product(
     body: ProductCreate,
     _user: TokenPayload = Depends(require_permission("crm", "edit")),
+    db: AsyncSession = Depends(get_pg_session),
 ):
-    return service.create_product(body)
+    product = service.create_product(body)
+    await log_action(db, _user.sub, _user.name or _user.email, "CREATE", "product",
+                     product.id, product.name)
+    return product
 
 
 @router.put("/{product_id}", response_model=ProductInDB)
-def update_product(
+async def update_product(
     product_id: str,
     body: ProductUpdate,
     _user: TokenPayload = Depends(require_permission("crm", "edit")),
+    db: AsyncSession = Depends(get_pg_session),
 ):
-    return service.update_product(product_id, body)
+    old = service.get_product(product_id)
+    product = service.update_product(product_id, body)
+    _SKIP = {"updated_at", "id", "photo_url"}
+    changes = {
+        k: {"old": getattr(old, k, None), "new": getattr(product, k, None)}
+        for k in body.model_fields_set
+        if k not in _SKIP and getattr(old, k, None) != getattr(product, k, None)
+    }
+    await log_action(db, _user.sub, _user.name or _user.email, "UPDATE", "product",
+                     product_id, product.name, changes=changes or None)
+    return product
 
 
 @router.delete("/{product_id}", status_code=204)
-def delete_product(
+async def delete_product(
     product_id: str,
     _user: TokenPayload = Depends(require_permission("crm", "edit")),
+    db: AsyncSession = Depends(get_pg_session),
 ):
+    product = service.get_product(product_id)
     service.delete_product(product_id)
+    await log_action(db, _user.sub, _user.name or _user.email, "DELETE", "product",
+                     product_id, product.name)
 
 
 @router.post("/{product_id}/photo", response_model=ProductInDB)