implement patches

app/routes/folders.py

@@ -1,11 +1,17 @@
 from flask import Blueprint, request, jsonify, g
 from app import db
 from app.models.folder import Folder
+from app.models.audit_log import AuditLog
 from app.services.auth_service import require_jwt
 
 folders_bp = Blueprint('folders', __name__)
 
 
+def _client_ip():
+    from flask import request as _req
+    return _req.headers.get('X-Forwarded-For', _req.remote_addr or '').split(',')[0].strip()
+
+
 @folders_bp.route('', methods=['GET'])
 @require_jwt
 def list_folders():
@@ -23,6 +29,15 @@ def create_folder():
 
     folder = Folder(user_id=g.current_user_id, name=name)
     db.session.add(folder)
+    db.session.flush()  # populate folder.id before logging
+    AuditLog.log(
+        user_id=g.current_user_id,
+        action='folder.create',
+        resource_type='folder',
+        resource_id=folder.id,
+        detail=f'Created folder: "{name}"',
+        ip_address=_client_ip(),
+    )
     db.session.commit()
     return jsonify(folder.to_dict()), 201
 
@@ -38,7 +53,16 @@ def update_folder(folder_id):
     name = (data.get('name') or '').strip()
     if not name:
         return jsonify({'error': 'name is required'}), 400
+    old_name = folder.name
     folder.name = name
+    AuditLog.log(
+        user_id=g.current_user_id,
+        action='folder.update',
+        resource_type='folder',
+        resource_id=folder.id,
+        detail=f'Renamed folder: "{old_name}" → "{name}"',
+        ip_address=_client_ip(),
+    )
     db.session.commit()
     return jsonify(folder.to_dict()), 200
 
@@ -49,6 +73,17 @@ def delete_folder(folder_id):
     folder = Folder.query.filter_by(id=folder_id, user_id=g.current_user_id).first()
     if not folder:
         return jsonify({'error': 'Folder not found'}), 404
+    folder_name = folder.name
+    folder_id = folder.id
     db.session.delete(folder)
+    db.session.flush()
+    AuditLog.log(
+        user_id=g.current_user_id,
+        action='folder.delete',
+        resource_type='folder',
+        resource_id=folder_id,
+        detail=f'Deleted folder: "{folder_name}"',
+        ip_address=_client_ip(),
+    )
     db.session.commit()
     return jsonify({'message': 'Folder deleted'}), 200