feat: add Campaign/Compliance domain entities and extract users/audit/data_sources to services (LP-2 through LP-6)

backend/app/routers/users.py

@@ -2,20 +2,24 @@
 
 import uuid
 
-from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi import APIRouter, Depends, status
 from sqlalchemy.orm import Session
 
 from app.database import get_db
 from app.dependencies.auth import require_role
+from app.domain.unit_of_work import UnitOfWork
 from app.models.user import User
 from app.schemas.user import UserCreate, UserUpdate, UserOut
-from app.auth import hash_password
 from app.services.audit_service import log_action
+from app.services.user_service import (
+    create_user,
+    get_user_or_raise,
+    list_users,
+    update_user,
+)
 
 router = APIRouter(prefix="/users", tags=["users"])
 
-VALID_ROLES = {"admin", "red_tech", "blue_tech", "red_lead", "blue_lead", "viewer"}
-
 
 # ---------------------------------------------------------------------------
 # GET /users  —  list all users
@@ -23,12 +27,12 @@ VALID_ROLES = {"admin", "red_tech", "blue_tech", "red_lead", "blue_lead", "viewe
 
 
 @router.get("", response_model=list[UserOut])
-def list_users(
+def list_users_route(
     db: Session = Depends(get_db),
     current_user: User = Depends(require_role("admin")),
 ):
     """Return a list of all users. **Requires admin role.**"""
-    return db.query(User).order_by(User.username).all()
+    return list_users(db)
 
 
 # ---------------------------------------------------------------------------
@@ -37,38 +41,23 @@ def list_users(
 
 
 @router.post("", response_model=UserOut, status_code=status.HTTP_201_CREATED)
-def create_user(
+def create_user_route(
     payload: UserCreate,
     db: Session = Depends(get_db),
     current_user: User = Depends(require_role("admin")),
 ):
     """Create a new user. **Requires admin role.**"""
-    
-    # Check if username already exists
-    existing = db.query(User).filter(User.username == payload.username).first()
-    if existing:
-        raise HTTPException(
-            status_code=status.HTTP_409_CONFLICT,
-            detail=f"Username '{payload.username}' already exists",
-        )
-    
-    # Validate role
-    if payload.role not in VALID_ROLES:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"Invalid role '{payload.role}'. Must be one of: {', '.join(sorted(VALID_ROLES))}",
-        )
-    
-    user = User(
+    user = create_user(
+        db,
         username=payload.username,
         email=payload.email,
-        hashed_password=hash_password(payload.password),
+        password=payload.password,
         role=payload.role,
     )
-    db.add(user)
-    db.commit()
+    with UnitOfWork(db) as uow:
+        uow.commit()
     db.refresh(user)
-    
+
     log_action(
         db,
         user_id=current_user.id,
@@ -77,7 +66,7 @@ def create_user(
         entity_id=user.id,
         details={"username": user.username, "role": user.role},
     )
-    
+
     return user
 
 
@@ -93,13 +82,7 @@ def get_user(
     current_user: User = Depends(require_role("admin")),
 ):
     """Return a single user by ID. **Requires admin role.**"""
-    user = db.query(User).filter(User.id == user_id).first()
-    if user is None:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail="User not found",
-        )
-    return user
+    return get_user_or_raise(db, user_id)
 
 
 # ---------------------------------------------------------------------------
@@ -108,46 +91,26 @@ def get_user(
 
 
 @router.patch("/{user_id}", response_model=UserOut)
-def update_user(
+def update_user_route(
     user_id: uuid.UUID,
     payload: UserUpdate,
     db: Session = Depends(get_db),
     current_user: User = Depends(require_role("admin")),
 ):
     """Update one or more fields of an existing user. **Requires admin role.**"""
-    user = db.query(User).filter(User.id == user_id).first()
-    if user is None:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail="User not found",
-        )
-    
     update_data = payload.model_dump(exclude_unset=True)
-    
-    # Validate role if being updated
-    if "role" in update_data and update_data["role"] not in VALID_ROLES:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"Invalid role '{update_data['role']}'. Must be one of: {', '.join(sorted(VALID_ROLES))}",
-        )
-    
-    # Hash password if being updated
-    if "password" in update_data:
-        update_data["hashed_password"] = hash_password(update_data.pop("password"))
-    
-    for field, value in update_data.items():
-        setattr(user, field, value)
-    
-    db.commit()
+    user = update_user(db, user_id, **update_data)
+    with UnitOfWork(db) as uow:
+        uow.commit()
     db.refresh(user)
-    
+
     log_action(
         db,
         user_id=current_user.id,
         action="update_user",
         entity_type="user",
         entity_id=user.id,
-        details={"updated_fields": list(payload.model_dump(exclude_unset=True).keys())},
+        details={"updated_fields": list(update_data.keys())},
     )
-    
+
     return user