Fix test failures and workload/websocket behavior

backend/app/api/projects/router.py

@@ -4,7 +4,7 @@ from fastapi import APIRouter, Depends, HTTPException, status, Request
 from sqlalchemy.orm import Session
 
 from app.core.database import get_db
-from app.models import User, Space, Project, TaskStatus, AuditAction, ProjectMember
+from app.models import User, Space, Project, TaskStatus, AuditAction, ProjectMember, ProjectTemplate, CustomField
 from app.models.task_status import DEFAULT_STATUSES
 from app.schemas.project import ProjectCreate, ProjectUpdate, ProjectResponse, ProjectWithDetails
 from app.schemas.task_status import TaskStatusResponse
@@ -36,6 +36,17 @@ def create_default_statuses(db: Session, project_id: str):
         db.add(status)
 
 
+def can_view_template(user: User, template: ProjectTemplate) -> bool:
+    """Check if a user can view a template."""
+    if template.is_public:
+        return True
+    if template.owner_id == user.id:
+        return True
+    if user.is_system_admin:
+        return True
+    return False
+
+
 @router.get("/api/spaces/{space_id}/projects", response_model=List[ProjectWithDetails])
 async def list_projects_in_space(
     space_id: str,
@@ -115,6 +126,27 @@ async def create_project(
             detail="Access denied",
         )
 
+    template = None
+    if project_data.template_id:
+        template = db.query(ProjectTemplate).filter(
+            ProjectTemplate.id == project_data.template_id,
+            ProjectTemplate.is_active == True,
+        ).first()
+        if not template:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Template not found",
+            )
+        if not can_view_template(current_user, template):
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Access denied to template",
+            )
+
+    security_level = project_data.security_level.value if project_data.security_level else "department"
+    if template and template.default_security_level:
+        security_level = template.default_security_level
+
     project = Project(
         id=str(uuid.uuid4()),
         space_id=space_id,
@@ -124,17 +156,47 @@ async def create_project(
         budget=project_data.budget,
         start_date=project_data.start_date,
         end_date=project_data.end_date,
-        security_level=project_data.security_level.value if project_data.security_level else "department",
+        security_level=security_level,
         department_id=project_data.department_id or current_user.department_id,
     )
 
     db.add(project)
     db.flush()  # Get the project ID
 
-    # Create default task statuses
-    create_default_statuses(db, project.id)
+    # Create task statuses (from template if provided, otherwise defaults)
+    if template and template.task_statuses:
+        for status_data in template.task_statuses:
+            status = TaskStatus(
+                id=str(uuid.uuid4()),
+                project_id=project.id,
+                name=status_data.get("name", "Unnamed"),
+                color=status_data.get("color", "#808080"),
+                position=status_data.get("position", 0),
+                is_done=status_data.get("is_done", False),
+            )
+            db.add(status)
+    else:
+        create_default_statuses(db, project.id)
+
+    # Create custom fields from template if provided
+    if template and template.custom_fields:
+        for field_data in template.custom_fields:
+            custom_field = CustomField(
+                id=str(uuid.uuid4()),
+                project_id=project.id,
+                name=field_data.get("name", "Unnamed"),
+                field_type=field_data.get("field_type", "text"),
+                options=field_data.get("options"),
+                formula=field_data.get("formula"),
+                is_required=field_data.get("is_required", False),
+                position=field_data.get("position", 0),
+            )
+            db.add(custom_field)
 
     # Audit log
+    changes = [{"field": "title", "old_value": None, "new_value": project.title}]
+    if template:
+        changes.append({"field": "template_id", "old_value": None, "new_value": template.id})
     AuditService.log_event(
         db=db,
         event_type="project.create",
@@ -142,7 +204,7 @@ async def create_project(
         action=AuditAction.CREATE,
         user_id=current_user.id,
         resource_id=project.id,
-        changes=[{"field": "title", "old_value": None, "new_value": project.title}],
+        changes=changes,
         request_metadata=get_audit_metadata(request),
     )