v1.3 - client and admin scaffolding

backend/app/api/products.py

@@ -2,6 +2,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
+from app.api.deps import AuthSession, require_client_session
 from app.db.session import get_db
 from app.models.mix import Mix
 from app.models.product import Product
@@ -33,16 +34,16 @@ def _serialize_product(product: Product) -> dict:
 
 
 @router.get("", response_model=list[ProductRead])
-def list_products(db: Session = Depends(get_db)):
-    products = db.scalars(select(Product).order_by(Product.name)).all()
+def list_products(session: AuthSession = Depends(require_client_session), db: Session = Depends(get_db)):
+    products = db.scalars(select(Product).where(Product.tenant_id == session.tenant_id).order_by(Product.name)).all()
     return [_serialize_product(product) for product in products]
 
 
 @router.post("", response_model=ProductRead, status_code=status.HTTP_201_CREATED)
-def create_product(payload: ProductCreate, db: Session = Depends(get_db)):
-    if db.scalar(select(Mix.id).where(Mix.id == payload.mix_id)) is None:
+def create_product(payload: ProductCreate, session: AuthSession = Depends(require_client_session), db: Session = Depends(get_db)):
+    if db.scalar(select(Mix.id).where(Mix.id == payload.mix_id, Mix.tenant_id == session.tenant_id)) is None:
         raise HTTPException(status_code=404, detail="Mix not found")
-    product = Product(**payload.model_dump())
+    product = Product(tenant_id=session.tenant_id, **payload.model_dump())
     db.add(product)
     db.commit()
     db.refresh(product)
@@ -50,19 +51,19 @@ def create_product(payload: ProductCreate, db: Session = Depends(get_db)):
 
 
 @router.get("/{product_id}", response_model=ProductRead)
-def get_product(product_id: int, db: Session = Depends(get_db)):
-    product = db.scalar(select(Product).where(Product.id == product_id))
+def get_product(product_id: int, session: AuthSession = Depends(require_client_session), db: Session = Depends(get_db)):
+    product = db.scalar(select(Product).where(Product.id == product_id, Product.tenant_id == session.tenant_id))
     if product is None:
         raise HTTPException(status_code=404, detail="Product not found")
     return _serialize_product(product)
 
 
 @router.patch("/{product_id}", response_model=ProductRead)
-def update_product(product_id: int, payload: ProductUpdate, db: Session = Depends(get_db)):
-    product = db.scalar(select(Product).where(Product.id == product_id))
+def update_product(product_id: int, payload: ProductUpdate, session: AuthSession = Depends(require_client_session), db: Session = Depends(get_db)):
+    product = db.scalar(select(Product).where(Product.id == product_id, Product.tenant_id == session.tenant_id))
     if product is None:
         raise HTTPException(status_code=404, detail="Product not found")
-    if payload.mix_id is not None and db.scalar(select(Mix.id).where(Mix.id == payload.mix_id)) is None:
+    if payload.mix_id is not None and db.scalar(select(Mix.id).where(Mix.id == payload.mix_id, Mix.tenant_id == session.tenant_id)) is None:
         raise HTTPException(status_code=404, detail="Mix not found")
     for field, value in payload.model_dump(exclude_unset=True).items():
         setattr(product, field, value)
@@ -72,7 +73,9 @@ def update_product(product_id: int, payload: ProductUpdate, db: Session = Depend
 
 
 @router.get("/{product_id}/cost-breakdown", response_model=ProductCostBreakdown)
-def get_product_cost_breakdown(product_id: int, db: Session = Depends(get_db)):
+def get_product_cost_breakdown(product_id: int, session: AuthSession = Depends(require_client_session), db: Session = Depends(get_db)):
+    if db.scalar(select(Product.id).where(Product.id == product_id, Product.tenant_id == session.tenant_id)) is None:
+        raise HTTPException(status_code=404, detail="Product not found")
     try:
         return calculate_product_cost(db, product_id)
     except ValueError as exc:
@@ -80,9 +83,10 @@ def get_product_cost_breakdown(product_id: int, db: Session = Depends(get_db)):
 
 
 @router.get("/{product_id}/price-output", response_model=ProductCostBreakdown)
-def get_product_price_output(product_id: int, db: Session = Depends(get_db)):
+def get_product_price_output(product_id: int, session: AuthSession = Depends(require_client_session), db: Session = Depends(get_db)):
+    if db.scalar(select(Product.id).where(Product.id == product_id, Product.tenant_id == session.tenant_id)) is None:
+        raise HTTPException(status_code=404, detail="Product not found")
     try:
         return calculate_product_cost(db, product_id)
     except ValueError as exc:
         raise HTTPException(status_code=404, detail=str(exc)) from exc
-