ui enhancement company

backend/app/routers/org.py

@@ -0,0 +1,39 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_postgres_session
+from app.deps.org_manager import require_org_manager
+from app.models import Account
+from app.schemas import OrgSecuritySettingsRead, OrgSecuritySettingsUpdate
+from app.services.org_security import read_security_settings, update_security_settings
+
+router = APIRouter(prefix="/org", tags=["organization"])
+
+
+@router.get("/security", response_model=OrgSecuritySettingsRead)
+async def get_org_security(
+    manager: Account = Depends(require_org_manager),
+    session: AsyncSession = Depends(get_postgres_session),
+) -> OrgSecuritySettingsRead:
+    return await read_security_settings(session, manager.company_domain)
+
+
+@router.patch("/security", response_model=OrgSecuritySettingsRead)
+async def patch_org_security(
+    payload: OrgSecuritySettingsUpdate,
+    manager: Account = Depends(require_org_manager),
+    session: AsyncSession = Depends(get_postgres_session),
+) -> OrgSecuritySettingsRead:
+    try:
+        settings = await update_security_settings(
+            session,
+            manager.company_domain,
+            payload,
+        )
+        await session.commit()
+        return settings
+    except ValueError as error:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=str(error),
+        ) from error

backend/app/routers/people.py

@@ -1,32 +1,29 @@
+from uuid import UUID
+
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.database import get_postgres_session
+from app.deps.domain_owner import require_domain_owner
 from app.models import Account
-from app.routers.auth import get_current_account, validate_password
-from app.schemas import OrgMemberCreate, OrgMemberListResponse, OrgMemberRead
+from app.routers.auth import validate_password
+from app.schemas import (
+    OrgMemberCreate,
+    OrgMemberListResponse,
+    OrgMemberRead,
+    OrgMemberRoleUpdate,
+)
 from app.services.org_members import (
-    can_manage_org_members,
     create_org_member,
     list_org_members,
+    update_org_member_role,
 )
+from app.deps.org_manager import require_org_manager
 
 router = APIRouter(prefix="/people", tags=["people"])
 
 
-async def require_org_manager(
-    account: Account = Depends(get_current_account),
-    session: AsyncSession = Depends(get_postgres_session),
-) -> Account:
-    if not await can_manage_org_members(session, account):
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="Only company admins can manage people.",
-        )
-    return account
-
-
 @router.get("", response_model=OrgMemberListResponse)
 async def get_people(
     manager: Account = Depends(require_org_manager),
@@ -64,3 +61,26 @@ async def add_person(
             status_code=status.HTTP_409_CONFLICT,
             detail="An account with those details already exists.",
         ) from error
+
+
+@router.patch("/{member_id}/role", response_model=OrgMemberRead)
+async def update_member_role(
+    member_id: UUID,
+    payload: OrgMemberRoleUpdate,
+    owner: Account = Depends(require_domain_owner),
+    session: AsyncSession = Depends(get_postgres_session),
+) -> OrgMemberRead:
+    try:
+        member = await update_org_member_role(
+            session,
+            manager=owner,
+            member_id=member_id,
+            org_role=payload.org_role,
+        )
+        await session.commit()
+        return member
+    except ValueError as error:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=str(error),
+        ) from error