.

qwen/python/merchants_of_hope/api/v1/applications.py

@@ -1,7 +1,7 @@
 """
 Applications API routes
 """
-from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, status, Request
 from typing import List
 from pydantic import BaseModel
 from sqlalchemy.orm import Session
@@ -35,101 +35,107 @@ class ApplicationResponse(BaseModel):
         from_attributes = True
 
 @router.get("/", response_model=List[ApplicationResponse])
-async def get_applications(skip: int = 0, limit: int = 100):
-    """Get all applications"""
-    db = SessionLocal()
-    try:
-        applications = db.query(Application).offset(skip).limit(limit).all()
-        return applications
-    finally:
-        db.close()
+async def get_applications(skip: int = 0, limit: int = 100, db: Session = Depends(SessionLocal), request: Request = None):
+    """Get all applications for the current tenant"""
+    tenant_id = getattr(request.state, 'tenant_id', None)
+    if not tenant_id and settings.MULTI_TENANT_ENABLED:
+        raise HTTPException(status_code=400, detail="Tenant ID is required")
+    
+    # Get applications for jobs in the current tenant or applications by users in the current tenant
+    applications = db.query(Application).join(JobPosting).filter(
+        (JobPosting.tenant_id == tenant_id) | (Application.user_id.in_(
+            db.query(User.id).filter(User.tenant_id == tenant_id)
+        ))
+    ).offset(skip).limit(limit).all()
+    return applications
 
 @router.get("/{application_id}", response_model=ApplicationResponse)
-async def get_application(application_id: int):
+async def get_application(application_id: int, db: Session = Depends(SessionLocal), request: Request = None):
     """Get a specific application"""
-    db = SessionLocal()
-    try:
-        application = db.query(Application).filter(Application.id == application_id).first()
-        if not application:
-            raise HTTPException(status_code=404, detail="Application not found")
-        return application
-    finally:
-        db.close()
+    tenant_id = getattr(request.state, 'tenant_id', None)
+    if not tenant_id and settings.MULTI_TENANT_ENABLED:
+        raise HTTPException(status_code=400, detail="Tenant ID is required")
+    
+    application = db.query(Application).join(JobPosting).filter(
+        Application.id == application_id,
+        (JobPosting.tenant_id == tenant_id) | (Application.user_id.in_(
+            db.query(User.id).filter(User.tenant_id == tenant_id)
+        ))
+    ).first()
+    if not application:
+        raise HTTPException(status_code=404, detail="Application not found")
+    return application
 
 @router.post("/", response_model=ApplicationResponse)
-async def create_application(application: ApplicationCreate, user_id: int = 1):  # In real app, get from auth context
+async def create_application(application: ApplicationCreate, db: Session = Depends(SessionLocal), request: Request = None, user_id: int = 1):  # In real app, get from auth context
     """Create a new job application"""
-    db = SessionLocal()
-    try:
-        # Verify user exists and has permission to apply
-        user = db.query(User).filter(User.id == user_id).first()
-        if not user or user.role != "job_seeker":
-            raise HTTPException(
-                status_code=status.HTTP_403_FORBIDDEN,
-                detail="Only job seekers can apply for jobs"
-            )
-        
-        # Verify job posting exists and is active
-        job_posting = db.query(JobPosting).filter(
-            JobPosting.id == application.job_posting_id,
-            JobPosting.is_active == True
-        ).first()
-        if not job_posting:
-            raise HTTPException(status_code=404, detail="Job posting not found or inactive")
-        
-        # Verify resume exists and belongs to user
-        resume = db.query(Resume).filter(
-            Resume.id == application.resume_id,
-            Resume.user_id == user_id
-        ).first()
-        if not resume:
-            raise HTTPException(status_code=404, detail="Resume not found")
-        
-        db_application = Application(
-            user_id=user_id,
-            job_posting_id=application.job_posting_id,
-            resume_id=application.resume_id,
-            cover_letter=application.cover_letter
+    tenant_id = getattr(request.state, 'tenant_id', None)
+    if not tenant_id and settings.MULTI_TENANT_ENABLED:
+        raise HTTPException(status_code=400, detail="Tenant ID is required")
+    
+    # Verify user exists and has permission to apply
+    user = db.query(User).filter(
+        User.id == user_id,
+        User.tenant_id == tenant_id  # Make sure user belongs to current tenant
+    ).first()
+    if not user or user.role != "job_seeker":
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only job seekers can apply for jobs"
         )
-        db.add(db_application)
-        db.commit()
-        db.refresh(db_application)
-        return db_application
-    finally:
-        db.close()
+    
+    # Verify job posting exists and is active and belongs to the same tenant
+    job_posting = db.query(JobPosting).filter(
+        JobPosting.id == application.job_posting_id,
+        JobPosting.is_active == True,
+        JobPosting.tenant_id == tenant_id  # Ensure job belongs to current tenant
+    ).first()
+    if not job_posting:
+        raise HTTPException(status_code=404, detail="Job posting not found or inactive or not in your tenant")
+    
+    # Verify resume exists and belongs to user
+    resume = db.query(Resume).filter(
+        Resume.id == application.resume_id,
+        Resume.user_id == user_id
+    ).first()
+    if not resume:
+        raise HTTPException(status_code=404, detail="Resume not found")
+    
+    db_application = Application(
+        user_id=user_id,
+        job_posting_id=application.job_posting_id,
+        resume_id=application.resume_id,
+        cover_letter=application.cover_letter
+    )
+    db.add(db_application)
+    db.commit()
+    db.refresh(db_application)
+    return db_application
 
 @router.put("/{application_id}", response_model=ApplicationResponse)
-async def update_application(application_id: int, app_update: ApplicationUpdate):
+async def update_application(application_id: int, app_update: ApplicationUpdate, db: Session = Depends(SessionLocal)):
     """Update an application"""
-    db = SessionLocal()
-    try:
-        db_application = db.query(Application).filter(Application.id == application_id).first()
-        if not db_application:
-            raise HTTPException(status_code=404, detail="Application not found")
-        
-        # Update fields if provided
-        if app_update.status is not None:
-            db_application.status = app_update.status.value
-        if app_update.cover_letter is not None:
-            db_application.cover_letter = app_update.cover_letter
-        
-        db.commit()
-        db.refresh(db_application)
-        return db_application
-    finally:
-        db.close()
+    db_application = db.query(Application).filter(Application.id == application_id).first()
+    if not db_application:
+        raise HTTPException(status_code=404, detail="Application not found")
+    
+    # Update fields if provided
+    if app_update.status is not None:
+        db_application.status = app_update.status.value
+    if app_update.cover_letter is not None:
+        db_application.cover_letter = app_update.cover_letter
+    
+    db.commit()
+    db.refresh(db_application)
+    return db_application
 
 @router.delete("/{application_id}")
-async def delete_application(application_id: int):
+async def delete_application(application_id: int, db: Session = Depends(SessionLocal)):
     """Delete an application"""
-    db = SessionLocal()
-    try:
-        db_application = db.query(Application).filter(Application.id == application_id).first()
-        if not db_application:
-            raise HTTPException(status_code=404, detail="Application not found")
-        
-        db.delete(db_application)
-        db.commit()
-        return {"message": "Application deleted successfully"}
-    finally:
-        db.close()
+    db_application = db.query(Application).filter(Application.id == application_id).first()
+    if not db_application:
+        raise HTTPException(status_code=404, detail="Application not found")
+    
+    db.delete(db_application)
+    db.commit()
+    return {"message": "Application deleted successfully"}