saas_backend/app/routes/auth/user.py

from fastapi import APIRouter, Depends, status, Query, BackgroundTasks, Request
from sqlalchemy.orm import Session
from typing import List, Optional
import uuid
from app.config.database import get_db
from app.controllers.auth.user_controller import UserController
from app.schemas.auth.user_schema import UserCreate, UserUpdate, UserResponse, UserPaginatedResponse
from app.middleware.auth_middleware import get_current_user, require_access
from app.models.auth.user_model import User
from app.services.system.audit_log_service import AuditLogService
from app.helper.helpers import get_client_ip

router = APIRouter()
                                  
@router.post("/create", response_model=UserResponse, status_code=status.HTTP_201_CREATED)
def create_user(
    request: Request,
    user_data: UserCreate,
    background_tasks: BackgroundTasks,
    db: Session = Depends(get_db),
    current_user: User = Depends(get_current_user),
    _ = Depends(require_access("admin.user.create"))
):
    result = UserController.create_user(db, user_data, current_user, background_tasks)

    AuditLogService.log(
        db=db,
        module_name="Users",
        action_type="CREATE",
        entity_id=str(result.id),
        entity_name=result.email,
        description=f"User '{result.email}' created",
        performed_by_id=str(current_user.id),
        performed_by_email=current_user.email,
        ip_address=get_client_ip(request),
        new_values={
            "email": result.email,
            "tenant_id": str(result.tenant_id) if result.tenant_id else None,
        }
    )
    return result

@router.get("/get", response_model=List[UserResponse])
def get_all_users(
    db: Session = Depends(get_db),
    current_user: User = Depends(get_current_user),
    _ = Depends(require_access("admin.user.read"))
):
    return UserController.get_all_users(db, current_user)

@router.get("/get/{user_id}", response_model=UserResponse)
def get_user(
    user_id: uuid.UUID,
    db: Session = Depends(get_db),
    current_user: User = Depends(get_current_user),
    _ = Depends(require_access("admin.user.read"))
):
    return UserController.get_user_by_id(db, user_id, current_user)

@router.put("/update/{user_id}", response_model=UserResponse)
def update_user(
    request: Request,
    user_id: uuid.UUID,
    user_data: UserUpdate,
    background_tasks: BackgroundTasks,
    db: Session = Depends(get_db),
    current_user: User = Depends(get_current_user),
    _ = Depends(require_access("admin.user.update"))
):

    existing = UserController.get_user_by_id(db, user_id, current_user)
    old_values = {"email": existing.email}

    result = UserController.update_user(db, user_id, user_data, current_user, background_tasks)

    AuditLogService.log(
        db=db,
        module_name="Users",
        action_type="UPDATE",
        entity_id=str(user_id),
        entity_name=result.email,
        description=f"User '{result.email}' updated",
        performed_by_id=str(current_user.id),
        performed_by_email=current_user.email,
        ip_address=get_client_ip(request),
        old_values=old_values,
        new_values=user_data.model_dump(mode='json', exclude_unset=True)
    )
    return result

@router.delete("/delete/{user_id}")
def delete_user(
    request: Request,
    user_id: uuid.UUID,
    db: Session = Depends(get_db),
    current_user: User = Depends(get_current_user),
    _ = Depends(require_access("admin.user.delete"))
):

    existing = UserController.get_user_by_id(db, user_id, current_user)
    user_email = existing.email

    result = UserController.delete_user(db, user_id, current_user)

    AuditLogService.log(
        db=db,
        module_name="Users",
        action_type="DELETE",
        entity_id=str(user_id),
        entity_name=user_email,
        description=f"User '{user_email}' deleted",
        performed_by_id=str(current_user.id),
        performed_by_email=current_user.email,
        ip_address=get_client_ip(request),
        old_values={"email": user_email}
    )
    return result

@router.get("/list", response_model=UserPaginatedResponse)
def list_users(
    page: int = Query(1, ge=1, description="Page number"),
    page_size: int = Query(10, ge=1, le=100, description="Items per page"),
    search: Optional[str] = Query(None, description="Search in email, name, phone, or ID"),
    filter_names: Optional[List[str]] = Query(None, description="Filter by full names"),
    filter_emails: Optional[List[str]] = Query(None, description="Filter by emails"),
    statuses: Optional[List[str]] = Query(None, description="Filter by user statuses"),
    filter_tenant_ids: Optional[List[uuid.UUID]] = Query(None, description="Filter by tenant IDs"),
    filter_role_ids: Optional[List[uuid.UUID]] = Query(None, description="Filter by role IDs"),
    sort_by: Optional[str] = Query(None, description="Sort by name, email, status, tenant, or role"),
    sort_order: Optional[str] = Query(None, description="Sort order: asc or desc"),
    db: Session = Depends(get_db),
    current_user: User = Depends(get_current_user),
    _ = Depends(require_access("admin.user.read")),
):
    return UserController.get_users_paginated(
        db=db,
        current_user=current_user,
        page=page,
        page_size=page_size,
        search=search,
        filter_names=filter_names,
        filter_emails=filter_emails,
        statuses=statuses,
        filter_tenant_ids=filter_tenant_ids,
        filter_role_ids=filter_role_ids,
        sort_by=sort_by,
        sort_order=sort_order,
    )