""" FastAPI routes for Organizational Compliance Roles. Manages the 7 standard compliance roles (DSB, GF, IT-Leiter, etc.) and the document-to-role mapping that determines who reviews which documents. Endpoints: GET /org-roles — list roles for tenant/project POST /org-roles — create/upsert a role PUT /org-roles/{id} — update role details DELETE /org-roles/{id} — remove a role GET /org-roles/defaults — 7 standard role definitions POST /org-roles/seed — seed default roles for a project POST /org-roles/{id}/send-test — send test email to role GET /org-roles/mapping — document-to-role mapping PUT /org-roles/mapping — update mapping """ import logging from typing import Optional, List from fastapi import APIRouter, Depends, HTTPException, Query from pydantic import BaseModel from sqlalchemy import text from sqlalchemy.orm import Session from classroom_engine.database import get_db from .tenant_utils import get_tenant_id as _get_tenant_id from .db_utils import row_to_dict as _row_to_dict logger = logging.getLogger(__name__) router = APIRouter(prefix="/org-roles", tags=["org-roles"]) # ============================================================================= # Standard role definitions # ============================================================================= DEFAULT_ROLES = [ {"role_key": "dsb", "role_label": "Datenschutzbeauftragter (DSB)"}, {"role_key": "gf", "role_label": "Geschaeftsfuehrung"}, {"role_key": "it_leiter", "role_label": "IT-Leiter / CISO"}, {"role_key": "hr_leitung", "role_label": "HR-Leitung"}, {"role_key": "marketing_leitung", "role_label": "Marketing-Leitung"}, {"role_key": "compliance_beauftragter", "role_label": "Compliance-Beauftragter"}, {"role_key": "einkauf", "role_label": "Einkauf / Vendor Management"}, ] # ============================================================================= # Schemas # ============================================================================= class OrgRoleCreate(BaseModel): role_key: str role_label: str person_name: Optional[str] = None person_email: Optional[str] = None department: Optional[str] = None project_id: Optional[str] = None class OrgRoleUpdate(BaseModel): role_label: Optional[str] = None person_name: Optional[str] = None person_email: Optional[str] = None department: Optional[str] = None is_active: Optional[bool] = None class MappingEntry(BaseModel): document_type: str role_key: str is_primary: bool = True class MappingUpdate(BaseModel): entries: List[MappingEntry] # ============================================================================= # Routes # ============================================================================= @router.get("") def list_roles( project_id: Optional[str] = Query(None), db: Session = Depends(get_db), tenant_id: str = Depends(_get_tenant_id), ): q = text(""" SELECT * FROM compliance_org_roles WHERE tenant_id = :tid AND (project_id = :pid OR (:pid IS NULL AND project_id IS NULL)) ORDER BY role_key """) rows = db.execute(q, {"tid": tenant_id, "pid": project_id}).fetchall() return [_row_to_dict(r) for r in rows] @router.get("/defaults") def get_defaults(): return DEFAULT_ROLES @router.post("") def create_role( body: OrgRoleCreate, db: Session = Depends(get_db), tenant_id: str = Depends(_get_tenant_id), ): q = text(""" INSERT INTO compliance_org_roles (tenant_id, project_id, role_key, role_label, person_name, person_email, department) VALUES (:tid, :pid, :rk, :rl, :pn, :pe, :dept) ON CONFLICT (tenant_id, project_id, role_key) DO UPDATE SET role_label = EXCLUDED.role_label, person_name = COALESCE(EXCLUDED.person_name, compliance_org_roles.person_name), person_email = COALESCE(EXCLUDED.person_email, compliance_org_roles.person_email), department = COALESCE(EXCLUDED.department, compliance_org_roles.department), updated_at = NOW() RETURNING * """) row = db.execute(q, { "tid": tenant_id, "pid": body.project_id, "rk": body.role_key, "rl": body.role_label, "pn": body.person_name, "pe": body.person_email, "dept": body.department, }).fetchone() db.commit() return _row_to_dict(row) @router.put("/{role_id}") def update_role( role_id: str, body: OrgRoleUpdate, db: Session = Depends(get_db), tenant_id: str = Depends(_get_tenant_id), ): sets, params = [], {"rid": role_id, "tid": tenant_id} for field in ["role_label", "person_name", "person_email", "department", "is_active"]: val = getattr(body, field, None) if val is not None: sets.append(f"{field} = :{field}") params[field] = val if not sets: raise HTTPException(400, "No fields to update") sets.append("updated_at = NOW()") q = text(f"UPDATE compliance_org_roles SET {', '.join(sets)} WHERE id = :rid AND tenant_id = :tid RETURNING *") row = db.execute(q, params).fetchone() if not row: raise HTTPException(404, "Role not found") db.commit() return _row_to_dict(row) @router.delete("/{role_id}") def delete_role( role_id: str, db: Session = Depends(get_db), tenant_id: str = Depends(_get_tenant_id), ): q = text("DELETE FROM compliance_org_roles WHERE id = :rid AND tenant_id = :tid") result = db.execute(q, {"rid": role_id, "tid": tenant_id}) db.commit() if result.rowcount == 0: raise HTTPException(404, "Role not found") return {"deleted": True} @router.post("/seed") def seed_roles( project_id: Optional[str] = Query(None), db: Session = Depends(get_db), tenant_id: str = Depends(_get_tenant_id), ): created = 0 for role in DEFAULT_ROLES: q = text(""" INSERT INTO compliance_org_roles (tenant_id, project_id, role_key, role_label) VALUES (:tid, :pid, :rk, :rl) ON CONFLICT (tenant_id, project_id, role_key) DO NOTHING """) result = db.execute(q, {"tid": tenant_id, "pid": project_id, "rk": role["role_key"], "rl": role["role_label"]}) created += result.rowcount db.commit() return {"seeded": created, "total": len(DEFAULT_ROLES)} @router.post("/{role_id}/send-test") def send_test_email( role_id: str, db: Session = Depends(get_db), tenant_id: str = Depends(_get_tenant_id), ): q = text("SELECT * FROM compliance_org_roles WHERE id = :rid AND tenant_id = :tid") role = db.execute(q, {"rid": role_id, "tid": tenant_id}).fetchone() if not role: raise HTTPException(404, "Role not found") role_dict = _row_to_dict(role) if not role_dict.get("person_email"): raise HTTPException(400, "No email configured for this role") try: from compliance.services.smtp_sender import send_email result = send_email( recipient=role_dict["person_email"], subject=f"[BreakPilot] Test-E-Mail fuer {role_dict['role_label']}", body_html=f"""

Test-E-Mail

Diese E-Mail bestaetigt, dass die Zustellung an die Rolle {role_dict['role_label']} funktioniert.

Empfaenger: {role_dict['person_name'] or 'N/A'} ({role_dict['person_email']})

Gesendet von BreakPilot Compliance SDK

""", ) return {"sent": True, "email": role_dict["person_email"], "result": result} except Exception as e: logger.error("Failed to send test email: %s", e) raise HTTPException(500, f"Email sending failed: {e}") # ============================================================================= # Document-to-Role Mapping # ============================================================================= @router.get("/mapping") def get_mapping( db: Session = Depends(get_db), tenant_id: str = Depends(_get_tenant_id), ): q = text(""" SELECT * FROM compliance_document_role_mapping WHERE tenant_id = :tid ORDER BY document_type, role_key """) rows = db.execute(q, {"tid": tenant_id}).fetchall() return [_row_to_dict(r) for r in rows] @router.put("/mapping") def update_mapping( body: MappingUpdate, db: Session = Depends(get_db), tenant_id: str = Depends(_get_tenant_id), ): for entry in body.entries: q = text(""" INSERT INTO compliance_document_role_mapping (tenant_id, document_type, role_key, is_primary) VALUES (:tid, :dt, :rk, :ip) ON CONFLICT (tenant_id, document_type, role_key) DO UPDATE SET is_primary = EXCLUDED.is_primary """) db.execute(q, {"tid": tenant_id, "dt": entry.document_type, "rk": entry.role_key, "ip": entry.is_primary}) db.commit() return {"updated": len(body.entries)}