Add HR agent onboarding model and actor enforcement

backend/app/api/org.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 from fastapi import APIRouter, Depends, HTTPException
 from sqlmodel import Session, select
 
-from app.api.utils import log_activity
+from app.api.utils import log_activity, get_actor_employee_id
 from app.db.session import get_session
 from app.models.org import Department, Employee
 from app.schemas.org import DepartmentCreate, DepartmentUpdate, EmployeeCreate, EmployeeUpdate
@@ -17,18 +17,18 @@ def list_departments(session: Session = Depends(get_session)):
 
 
 @router.post("/departments", response_model=Department)
-def create_department(payload: DepartmentCreate, session: Session = Depends(get_session)):
+def create_department(payload: DepartmentCreate, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
     dept = Department(name=payload.name, head_employee_id=payload.head_employee_id)
     session.add(dept)
     session.commit()
     session.refresh(dept)
-    log_activity(session, actor_employee_id=None, entity_type="department", entity_id=dept.id, verb="created", payload={"name": dept.name})
+    log_activity(session, actor_employee_id=actor_employee_id, entity_type="department", entity_id=dept.id, verb="created", payload={"name": dept.name})
     session.commit()
     return dept
 
 
 @router.patch("/departments/{department_id}", response_model=Department)
-def update_department(department_id: int, payload: DepartmentUpdate, session: Session = Depends(get_session)):
+def update_department(department_id: int, payload: DepartmentUpdate, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
     dept = session.get(Department, department_id)
     if not dept:
         raise HTTPException(status_code=404, detail="Department not found")
@@ -40,7 +40,7 @@ def update_department(department_id: int, payload: DepartmentUpdate, session: Se
     session.add(dept)
     session.commit()
     session.refresh(dept)
-    log_activity(session, actor_employee_id=None, entity_type="department", entity_id=dept.id, verb="updated", payload=data)
+    log_activity(session, actor_employee_id=actor_employee_id, entity_type="department", entity_id=dept.id, verb="updated", payload=data)
     session.commit()
     return dept
 
@@ -51,18 +51,18 @@ def list_employees(session: Session = Depends(get_session)):
 
 
 @router.post("/employees", response_model=Employee)
-def create_employee(payload: EmployeeCreate, session: Session = Depends(get_session)):
+def create_employee(payload: EmployeeCreate, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
     emp = Employee(**payload.model_dump())
     session.add(emp)
     session.commit()
     session.refresh(emp)
-    log_activity(session, actor_employee_id=None, entity_type="employee", entity_id=emp.id, verb="created", payload={"name": emp.name, "type": emp.employee_type})
+    log_activity(session, actor_employee_id=actor_employee_id, entity_type="employee", entity_id=emp.id, verb="created", payload={"name": emp.name, "type": emp.employee_type})
     session.commit()
     return emp
 
 
 @router.patch("/employees/{employee_id}", response_model=Employee)
-def update_employee(employee_id: int, payload: EmployeeUpdate, session: Session = Depends(get_session)):
+def update_employee(employee_id: int, payload: EmployeeUpdate, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
     emp = session.get(Employee, employee_id)
     if not emp:
         raise HTTPException(status_code=404, detail="Employee not found")
@@ -74,6 +74,6 @@ def update_employee(employee_id: int, payload: EmployeeUpdate, session: Session
     session.add(emp)
     session.commit()
     session.refresh(emp)
-    log_activity(session, actor_employee_id=None, entity_type="employee", entity_id=emp.id, verb="updated", payload=data)
+    log_activity(session, actor_employee_id=actor_employee_id, entity_type="employee", entity_id=emp.id, verb="updated", payload=data)
     session.commit()
     return emp