Backend manufacturer.
DSL in. Production FastAPI out.

# A slice of the manifest — entities, RLS, billing, audit log
version: 1
name: acme-crm

entities:
  - name: Customer
    soft_delete: true
    audit: true
    fields:
      id:        { type: uuid, primary: true }
      org_id:    { type: uuid, tenant: true }
      email:     { type: email, unique: true }
      created_at:{ type: timestamp, auto: now }
    policies:
      - org_isolation           # RLS: tenant by org_id
      - role:admin can delete

modules:
  - auth.email_link
  - auth.passkey
  - billing.stripe
  - realtime.cdc

# Auto-generated from the manifest above. Apache 2.0 on eject.
from fastapi import APIRouter, Depends
from .schemas import CustomerCreate, CustomerRead
from .service import CustomerService
from qiloback_runtime.auth import require_role
from qiloback_runtime.audit import audit_log

router = APIRouter(prefix="/customers", tags=["customers"])


@router.post("/", response_model=CustomerRead, status_code=201)
@audit_log("customer.create")
async def create_customer(
    payload: CustomerCreate,
    svc: CustomerService = Depends(),
    actor = Depends(require_role(["member", "admin"])),
) -> CustomerRead:
    # RLS enforces org_isolation at the DB layer.
    return await svc.create(payload, actor=actor)