create employee table

go-api/internal/httpserver/workflows.go

@@ -86,7 +86,50 @@ func errUnregisteredResource(path string) error { return unregisteredResourceErr
 func (s *Server) routeWorkflows(mux *http.ServeMux) int {
 	mux.HandleFunc("POST /api/v1/job-applications/{id}/hire", s.handleHire)
 	mux.HandleFunc("POST /api/v1/job-postings/{id}/assignments", s.handleAssign)
-	return 2
+	mux.HandleFunc("POST /api/v1/worker-profiles/with-role", s.handleCreateWorkerWithRole)
+	return 3
+}
+
+// handleCreateWorkerWithRole records a NEW person and their first declared role
+// in one transaction.
+//
+// Under `worker-profiles` rather than `employee-roles` because the worker is
+// what the request creates; the role comes with it. A more specific literal
+// than the generated `POST /api/v1/worker-profiles`, so the mux prefers it and
+// neither route shadows the other.
+//
+// This is a CREATION flow. It takes a name and an email and never a worker id,
+// and nothing in it searches for an existing person — an organization may
+// employ many people who share a name, so a name cannot select anybody.
+// Recording a second role for someone who already exists is
+// POST /api/v1/employee-roles, unchanged.
+func (s *Server) handleCreateWorkerWithRole(w http.ResponseWriter, r *http.Request) {
+	ident, ok := s.authorizeAll(w, r,
+		requirement{"worker-profiles", domain.OpCreate},
+		requirement{"employee-roles", domain.OpCreate},
+	)
+	if !ok {
+		return
+	}
+
+	body, err := decodeBody(r)
+	if err != nil {
+		writeError(w, s.log, err)
+		return
+	}
+
+	result, err := s.workflows.CreateWorkerWithRole(r.Context(), ident, body)
+	if err != nil {
+		writeError(w, s.log, err)
+		return
+	}
+
+	/* The worker's identity is not logged: an email is the person, and §10 puts
+	   record content at DEBUG behind a per-tenant flag rather than at INFO. */
+	s.log.Info("worker recorded with a declared role", "user_id", ident.UserID,
+		"worker_profile_id", result.Worker["id"], "employee_role_id", result.Role["id"])
+
+	writeJSON(w, http.StatusCreated, envelope{Data: result})
 }
 
 // handleHire moves an application to `hired` and creates the staff record in