feat(assign): let leads manually assign operators + sync Jira; send platform as Jira label

Adds GET /users/operators (leads+admin) and wires a lead-only assign
control into the test detail header, calling the existing but
previously unreachable POST /tests/{id}/assign endpoint. Manual
assignment now also pushes the Jira ticket assignee immediately
instead of waiting for the operator to start execution.

Also adds test.platform as a kebab-case label on Jira ticket creation.

backend/app/routers/tests.py

@@ -1282,18 +1282,21 @@ def assign_test_operators(
 ):
     """Assign red_tech and/or blue_tech operators to a test. Admin/leads only."""
     test = crud_get_test_or_raise(db, test_id)
+    newly_assigned: User | None = None
 
     if payload.red_tech_assignee is not None:
         u = db.query(User).filter(User.id == payload.red_tech_assignee).first()
         if not u or u.role not in ("red_tech", "red_lead", "admin"):
             raise HTTPException(status_code=400, detail="Invalid red tech assignee")
         test.red_tech_assignee = payload.red_tech_assignee
+        newly_assigned = u
 
     if payload.blue_tech_assignee is not None:
         u = db.query(User).filter(User.id == payload.blue_tech_assignee).first()
         if not u or u.role not in ("blue_tech", "blue_lead", "admin"):
             raise HTTPException(status_code=400, detail="Invalid blue tech assignee")
         test.blue_tech_assignee = payload.blue_tech_assignee
+        newly_assigned = u
 
     # Handle intentional null (clearing) — model_fields_set tracks which keys were sent
     if "red_tech_assignee" in payload.model_fields_set and payload.red_tech_assignee is None:
@@ -1307,6 +1310,15 @@ def assign_test_operators(
     })
     db.commit()
     db.refresh(test)
+
+    if newly_assigned is not None:
+        try:
+            from app.services.jira_service import push_assignee_update
+            push_assignee_update(db, test, newly_assigned)
+            db.commit()
+        except Exception:  # nosec B110
+            pass  # jira_service already logs warnings internally
+
     return test
 
 

backend/app/routers/users.py

@@ -13,7 +13,7 @@ from sqlalchemy.orm import Session
 from app.database import get_db
 
 # Import require_role from app.dependencies.auth
-from app.dependencies.auth import require_role
+from app.dependencies.auth import require_role, require_any_role
 
 # Import UnitOfWork from app.domain.unit_of_work
 from app.domain.unit_of_work import UnitOfWork
@@ -21,7 +21,7 @@ from app.domain.unit_of_work import UnitOfWork
 # Import User from app.models.user
 from app.models.user import User
 from app.dependencies.auth import get_current_user
-from app.schemas.user import UserCreate, UserUpdate, UserOut, UserPreferencesUpdate
+from app.schemas.user import UserCreate, UserUpdate, UserOut, UserPreferencesUpdate, UserOperatorOut
 from app.services.audit_service import log_action
 
 # Import  from app.services.user_service
@@ -148,6 +148,33 @@ def create_user_route(
     return user
 
 
+# ---------------------------------------------------------------------------
+# GET /users/operators  —  minimal operator/lead list for assignment pickers
+# ---------------------------------------------------------------------------
+
+
+@router.get("/operators", response_model=list[UserOperatorOut])
+def list_operators_route(
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_any_role("admin", "red_lead", "blue_lead")),
+) -> list[UserOperatorOut]:
+    """Return active red/blue operators and leads, for lead/admin assignment pickers.
+
+    Deliberately excludes viewers and managers, and returns only
+    id/username/role — no emails or tokens — since this is reachable by
+    non-admin leads.
+    """
+    return (
+        db.query(User)
+        .filter(
+            User.role.in_(["red_tech", "red_lead", "blue_tech", "blue_lead", "admin"]),
+            User.is_active.is_(True),
+        )
+        .order_by(User.username)
+        .all()
+    )
+
+
 # ---------------------------------------------------------------------------
 # GET /users/{id}  —  get a single user
 # ---------------------------------------------------------------------------