Add HR agent onboarding model and actor enforcement

backend/app/api/work.py

@@ -5,7 +5,7 @@ from datetime import datetime
 from fastapi import APIRouter, Depends, HTTPException
 from sqlmodel import Session, select
 
-from app.api.utils import log_activity
+from app.api.utils import log_activity, get_actor_employee_id
 from app.db.session import get_session
 from app.models.work import Task, TaskComment
 from app.schemas.work import TaskCommentCreate, TaskCreate, TaskUpdate
@@ -24,7 +24,9 @@ def list_tasks(project_id: int | None = None, session: Session = Depends(get_ses
 
 
 @router.post("/tasks", response_model=Task)
-def create_task(payload: TaskCreate, session: Session = Depends(get_session)):
+def create_task(payload: TaskCreate, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
+    if payload.created_by_employee_id is None:
+        payload = TaskCreate(**{**payload.model_dump(), "created_by_employee_id": actor_employee_id})
     task = Task(**payload.model_dump())
     if task.status not in ALLOWED_STATUSES:
         raise HTTPException(status_code=400, detail="Invalid status")
@@ -34,7 +36,7 @@ def create_task(payload: TaskCreate, session: Session = Depends(get_session)):
     session.refresh(task)
     log_activity(
         session,
-        actor_employee_id=task.created_by_employee_id,
+        actor_employee_id=actor_employee_id,
         entity_type="task",
         entity_id=task.id,
         verb="created",
@@ -45,7 +47,7 @@ def create_task(payload: TaskCreate, session: Session = Depends(get_session)):
 
 
 @router.patch("/tasks/{task_id}", response_model=Task)
-def update_task(task_id: int, payload: TaskUpdate, session: Session = Depends(get_session)):
+def update_task(task_id: int, payload: TaskUpdate, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
     task = session.get(Task, task_id)
     if not task:
         raise HTTPException(status_code=404, detail="Task not found")
@@ -60,19 +62,19 @@ def update_task(task_id: int, payload: TaskUpdate, session: Session = Depends(ge
     session.add(task)
     session.commit()
     session.refresh(task)
-    log_activity(session, actor_employee_id=None, entity_type="task", entity_id=task.id, verb="updated", payload=data)
+    log_activity(session, actor_employee_id=actor_employee_id, entity_type="task", entity_id=task.id, verb="updated", payload=data)
     session.commit()
     return task
 
 
 @router.delete("/tasks/{task_id}")
-def delete_task(task_id: int, session: Session = Depends(get_session)):
+def delete_task(task_id: int, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
     task = session.get(Task, task_id)
     if not task:
         raise HTTPException(status_code=404, detail="Task not found")
     session.delete(task)
     session.commit()
-    log_activity(session, actor_employee_id=None, entity_type="task", entity_id=task_id, verb="deleted")
+    log_activity(session, actor_employee_id=actor_employee_id, entity_type="task", entity_id=task_id, verb="deleted")
     session.commit()
     return {"ok": True}
 
@@ -83,11 +85,13 @@ def list_task_comments(task_id: int, session: Session = Depends(get_session)):
 
 
 @router.post("/task-comments", response_model=TaskComment)
-def create_task_comment(payload: TaskCommentCreate, session: Session = Depends(get_session)):
+def create_task_comment(payload: TaskCommentCreate, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
+    if payload.author_employee_id is None:
+        payload = TaskCommentCreate(**{**payload.model_dump(), "author_employee_id": actor_employee_id})
     c = TaskComment(**payload.model_dump())
     session.add(c)
     session.commit()
     session.refresh(c)
-    log_activity(session, actor_employee_id=c.author_employee_id, entity_type="task", entity_id=c.task_id, verb="commented")
+    log_activity(session, actor_employee_id=actor_employee_id, entity_type="task", entity_id=c.task_id, verb="commented")
     session.commit()
     return c