the middle of the idiots

qwen/python/merchants_of_hope/api/v1/applications.py

@@ -6,9 +6,9 @@ from typing import List
 from pydantic import BaseModel
 from sqlalchemy.orm import Session
 
-from ..database import SessionLocal
-from ..models import Application, ApplicationStatus, User, JobPosting, Resume
-from ..config.settings import settings
+from ...database import SessionLocal
+from ...models import Application, ApplicationStatus, User, JobPosting, Resume
+from ...config.settings import settings
 
 router = APIRouter()
 
@@ -33,6 +33,17 @@ class ApplicationResponse(BaseModel):
 
     class Config:
         from_attributes = True
+        json_schema_extra = {
+            "example": {
+                "id": 1,
+                "user_id": 1,
+                "job_posting_id": 1,
+                "resume_id": 1,
+                "cover_letter": "I am excited to apply for this position...",
+                "status": "submitted",
+                "created_at": "2023-10-24T10:00:00Z"
+            }
+        }
 
 @router.get("/", response_model=List[ApplicationResponse])
 async def get_applications(skip: int = 0, limit: int = 100, db: Session = Depends(SessionLocal), request: Request = None):
@@ -113,9 +124,18 @@ async def create_application(application: ApplicationCreate, db: Session = Depen
     return db_application
 
 @router.put("/{application_id}", response_model=ApplicationResponse)
-async def update_application(application_id: int, app_update: ApplicationUpdate, db: Session = Depends(SessionLocal)):
+async def update_application(application_id: int, app_update: ApplicationUpdate, db: Session = Depends(SessionLocal), request: Request = None):
     """Update an application"""
-    db_application = db.query(Application).filter(Application.id == application_id).first()
+    tenant_id = getattr(request.state, 'tenant_id', None)
+    if not tenant_id and settings.MULTI_TENANT_ENABLED:
+        raise HTTPException(status_code=400, detail="Tenant ID is required")
+    
+    db_application = db.query(Application).join(JobPosting).filter(
+        Application.id == application_id,
+        (JobPosting.tenant_id == tenant_id) | (Application.user_id.in_(
+            db.query(User.id).filter(User.tenant_id == tenant_id)
+        ))
+    ).first()
     if not db_application:
         raise HTTPException(status_code=404, detail="Application not found")
     
@@ -130,9 +150,18 @@ async def update_application(application_id: int, app_update: ApplicationUpdate,
     return db_application
 
 @router.delete("/{application_id}")
-async def delete_application(application_id: int, db: Session = Depends(SessionLocal)):
+async def delete_application(application_id: int, db: Session = Depends(SessionLocal), request: Request = None):
     """Delete an application"""
-    db_application = db.query(Application).filter(Application.id == application_id).first()
+    tenant_id = getattr(request.state, 'tenant_id', None)
+    if not tenant_id and settings.MULTI_TENANT_ENABLED:
+        raise HTTPException(status_code=400, detail="Tenant ID is required")
+    
+    db_application = db.query(Application).join(JobPosting).filter(
+        Application.id == application_id,
+        (JobPosting.tenant_id == tenant_id) | (Application.user_id.in_(
+            db.query(User.id).filter(User.tenant_id == tenant_id)
+        ))
+    ).first()
     if not db_application:
         raise HTTPException(status_code=404, detail="Application not found")