fix(): business logic fixes and code refactoring

src/backend/api/v1/decision/schemas.py

@@ -1,9 +1,11 @@
+from typing import Any
+
 from ninja import Field, Schema
 
 
 class DecisionIn(Schema):
     subject_id: str
-    subject_attributes: dict[str, str | int | float | bool] = Field(
+    subject_attributes: dict[str, Any] = Field(
         default_factory=dict,
     )
     flags: list[str] = Field(

src/backend/api/v1/events/endpoints.py

@@ -45,6 +45,7 @@ def create_event_type(
         name=payload.name,
         display_name=payload.display_name,
         description=payload.description,
+        is_exposure=payload.is_exposure,
         requires_exposure=payload.requires_exposure,
         required_fields=payload.required_fields,
     )
@@ -95,7 +96,7 @@ def update_event_type(
     et = event_type_get(event_type_id)
     if not et:
         raise Http404
-    fields = payload.dict(exclude_unset=True)
+    fields = payload.model_dump(exclude_unset=True)
     updated = event_type_update(event_type=et, **fields)
     return HTTPStatus.OK, EventTypeOut.model_validate(updated)
 
@@ -115,7 +116,7 @@ def ingest_events(
     request: HttpRequest,
     payload: EventsBatchIn,
 ) -> tuple[int, EventsBatchOut]:
-    events_data = [e.dict() for e in payload.events]
+    events_data = [e.model_dump() for e in payload.events]
     batch = process_events_batch(events_data)
     EVENTS_INGESTED.labels(status="accepted").inc(batch.accepted)
     EVENTS_INGESTED.labels(status="duplicate").inc(batch.duplicates)

src/backend/api/v1/guardrails/endpoints.py

@@ -153,7 +153,7 @@ def update_guardrail(
         raise Http404 from Guardrail.DoesNotExist
     g = guardrail_update(
         guardrail=g,
-        **payload.dict(exclude_unset=True),
+        **payload.model_dump(exclude_unset=True),
     )
     g = Guardrail.objects.select_related("metric").get(pk=g.pk)
     return HTTPStatus.OK, GuardrailOut.from_guardrail(g)

src/backend/api/v1/learnings/endpoints.py

@@ -110,7 +110,7 @@ def update_learning(
     learning = learning_update(
         learning=learning,
         user=request.auth,
-        **payload.dict(exclude_unset=True),
+        **payload.model_dump(exclude_unset=True),
     )
     learning = learning_get(learning.pk)
     return HTTPStatus.OK, LearningOut.from_learning(learning)

src/backend/api/v1/metrics/endpoints.py

@@ -91,7 +91,7 @@ def update_metric(
         raise Http404
     metric = metric_definition_update(
         metric=metric,
-        **payload.dict(exclude_unset=True),
+        **payload.model_dump(exclude_unset=True),
     )
     return HTTPStatus.OK, MetricDefinitionOut.model_validate(metric)
 

src/backend/api/v1/notifications/endpoints.py

@@ -93,7 +93,7 @@ def update_channel(
         raise Http404
     ch = channel_update(
         channel=ch,
-        **payload.dict(exclude_unset=True),
+        **payload.model_dump(exclude_unset=True),
     )
     return HTTPStatus.OK, ChannelOut.model_validate(ch)
 
@@ -178,7 +178,7 @@ def update_rule(
         raise Http404 from NotificationRule.DoesNotExist
     r = rule_update(
         rule=r,
-        **payload.dict(exclude_unset=True),
+        **payload.model_dump(exclude_unset=True),
     )
     r = NotificationRule.objects.select_related("channel", "experiment").get(
         pk=r.pk

src/backend/api/v1/reports/endpoints.py

@@ -5,11 +5,12 @@ from django.http import Http404, HttpRequest
 from django.utils.dateparse import parse_datetime
 from ninja import Router
 
+from api.v1.auth.endpoints import jwt_bearer
 from api.v1.reports.schemas import ExperimentReportOut
 from apps.experiments.models import Experiment
 from apps.reports.services import build_experiment_report
 
-router = Router(tags=["reports"])
+router = Router(tags=["reports"], auth=jwt_bearer)
 
 
 @router.get(
@@ -26,10 +27,18 @@ def get_experiment_report(
     try:
         experiment = Experiment.objects.get(pk=experiment_id)
     except Experiment.DoesNotExist:
-        raise Http404 from Experiment.DoesNotExist
+        raise Http404 from None
 
-    parsed_start = parse_datetime(start_date) if start_date else None
-    parsed_end = parse_datetime(end_date) if end_date else None
+    parsed_start = None
+    parsed_end = None
+    if start_date:
+        parsed_start = parse_datetime(start_date)
+        if parsed_start is None:
+            raise Http404
+    if end_date:
+        parsed_end = parse_datetime(end_date)
+        if parsed_end is None:
+            raise Http404
 
     report_data = build_experiment_report(
         experiment=experiment,

src/backend/api/v1/reports/tests/test_reports_api.py

@@ -13,11 +13,14 @@ from apps.metrics.services import (
     experiment_metric_add,
     metric_definition_create,
 )
+from apps.users.tests.helpers import auth_header, make_user
 
 
 class ExperimentReportAPITest(TestCase):
     @override
     def setUp(self) -> None:
+        self.user = make_user(username="rapi_user", email="rapi@test.local")
+        self.auth = auth_header(self.user)
         self.client = Client()
         self.exposure_type = make_exposure_type()
         self.click_type = make_event_type(
@@ -75,14 +78,14 @@ class ExperimentReportAPITest(TestCase):
             ]
         )
 
-    def test_get_report_no_auth_required(self) -> None:
+    def test_report_requires_auth(self) -> None:
         resp = self.client.get(
             reverse(
                 "api-1:get_experiment_report",
                 args=[self.experiment.pk],
             ),
         )
-        self.assertEqual(resp.status_code, 200)
+        self.assertEqual(resp.status_code, 401)
 
     def test_report_structure(self) -> None:
         self._create_data()
@@ -91,6 +94,7 @@ class ExperimentReportAPITest(TestCase):
                 "api-1:get_experiment_report",
                 args=[self.experiment.pk],
             ),
+            HTTP_AUTHORIZATION=self.auth,
         )
         self.assertEqual(resp.status_code, 200)
         data = resp.json()
@@ -113,6 +117,7 @@ class ExperimentReportAPITest(TestCase):
                 "api-1:get_experiment_report",
                 args=[self.experiment.pk],
             ),
+            HTTP_AUTHORIZATION=self.auth,
         )
         data = resp.json()
         treatment = next(
@@ -138,6 +143,7 @@ class ExperimentReportAPITest(TestCase):
                 args=[self.experiment.pk],
             ),
             {"start_date": start, "end_date": end},
+            HTTP_AUTHORIZATION=self.auth,
         )
         self.assertEqual(resp.status_code, 200)
         data = resp.json()
@@ -150,5 +156,6 @@ class ExperimentReportAPITest(TestCase):
                 "api-1:get_experiment_report",
                 args=[uuid.uuid4()],
             ),
+            HTTP_AUTHORIZATION=self.auth,
         )
         self.assertEqual(resp.status_code, 404)