update: Add Global Search on Header, Add Global Audit log for all actions.

backend/melodies/router.py

@@ -1,11 +1,14 @@
 from fastapi import APIRouter, Depends, UploadFile, File, Query, HTTPException, Response
 from typing import Optional
+from sqlalchemy.ext.asyncio import AsyncSession
 from auth.models import TokenPayload
 from auth.dependencies import require_permission
 from melodies.models import (
     MelodyCreate, MelodyUpdate, MelodyInDB, MelodyListResponse, MelodyInfo,
 )
 from melodies import service
+from database.postgres import get_pg_session
+from shared.audit import log_action
 
 router = APIRouter(prefix="/api/melodies", tags=["melodies"])
 
@@ -42,8 +45,12 @@ async def create_melody(
     body: MelodyCreate,
     publish: bool = Query(False),
     _user: TokenPayload = Depends(require_permission("melodies", "add")),
+    db: AsyncSession = Depends(get_pg_session),
 ):
-    return await service.create_melody(body, publish=publish, actor_name=_user.name)
+    melody = await service.create_melody(body, publish=publish, actor_name=_user.name)
+    await log_action(db, _user.sub, _user.name or _user.email, "CREATE", "melody",
+                     melody.id, melody.information.name if melody.information else melody.id)
+    return melody
 
 
 @router.put("/{melody_id}", response_model=MelodyInDB)
@@ -51,32 +58,61 @@ async def update_melody(
     melody_id: str,
     body: MelodyUpdate,
     _user: TokenPayload = Depends(require_permission("melodies", "edit")),
+    db: AsyncSession = Depends(get_pg_session),
 ):
-    return await service.update_melody(melody_id, body, actor_name=_user.name)
+    old = await service.get_melody(melody_id)
+    melody = await service.update_melody(melody_id, body, actor_name=_user.name)
+    _SKIP = {"updated_at", "id", "metadata", "information", "noteAssignments"}
+    changes = {
+        k: {"old": getattr(old, k, None), "new": getattr(melody, k, None)}
+        for k in body.model_fields_set
+        if k not in _SKIP and getattr(old, k, None) != getattr(melody, k, None)
+    }
+    # Surface the name change from inside the information sub-object
+    old_name = old.information.name if old.information else None
+    new_name = melody.information.name if melody.information else None
+    if old_name != new_name:
+        changes["name"] = {"old": old_name, "new": new_name}
+    await log_action(db, _user.sub, _user.name or _user.email, "UPDATE", "melody",
+                     melody_id, new_name or melody_id, changes=changes or None)
+    return melody
 
 
 @router.delete("/{melody_id}", status_code=204)
 async def delete_melody(
     melody_id: str,
     _user: TokenPayload = Depends(require_permission("melodies", "delete")),
+    db: AsyncSession = Depends(get_pg_session),
 ):
+    melody = await service.get_melody(melody_id)
+    label = melody.information.name if melody.information else melody_id
     await service.delete_melody(melody_id)
+    await log_action(db, _user.sub, _user.name or _user.email, "DELETE", "melody",
+                     melody_id, label)
 
 
 @router.post("/{melody_id}/publish", response_model=MelodyInDB)
 async def publish_melody(
     melody_id: str,
     _user: TokenPayload = Depends(require_permission("melodies", "edit")),
+    db: AsyncSession = Depends(get_pg_session),
 ):
-    return await service.publish_melody(melody_id)
+    melody = await service.publish_melody(melody_id)
+    await log_action(db, _user.sub, _user.name or _user.email, "PUBLISH", "melody",
+                     melody_id, melody.information.name if melody.information else melody_id)
+    return melody
 
 
 @router.post("/{melody_id}/unpublish", response_model=MelodyInDB)
 async def unpublish_melody(
     melody_id: str,
     _user: TokenPayload = Depends(require_permission("melodies", "edit")),
+    db: AsyncSession = Depends(get_pg_session),
 ):
-    return await service.unpublish_melody(melody_id)
+    melody = await service.unpublish_melody(melody_id)
+    await log_action(db, _user.sub, _user.name or _user.email, "UNPUBLISH", "melody",
+                     melody_id, melody.information.name if melody.information else melody_id)
+    return melody
 
 
 @router.post("/{melody_id}/upload/{file_type}")