fix(): business logic fixes and code refactoring

src/backend/api/v1/reports/endpoints.py

@@ -5,11 +5,12 @@ from django.http import Http404, HttpRequest
 from django.utils.dateparse import parse_datetime
 from ninja import Router
 
+from api.v1.auth.endpoints import jwt_bearer
 from api.v1.reports.schemas import ExperimentReportOut
 from apps.experiments.models import Experiment
 from apps.reports.services import build_experiment_report
 
-router = Router(tags=["reports"])
+router = Router(tags=["reports"], auth=jwt_bearer)
 
 
 @router.get(
@@ -26,10 +27,18 @@ def get_experiment_report(
     try:
         experiment = Experiment.objects.get(pk=experiment_id)
     except Experiment.DoesNotExist:
-        raise Http404 from Experiment.DoesNotExist
+        raise Http404 from None
 
-    parsed_start = parse_datetime(start_date) if start_date else None
-    parsed_end = parse_datetime(end_date) if end_date else None
+    parsed_start = None
+    parsed_end = None
+    if start_date:
+        parsed_start = parse_datetime(start_date)
+        if parsed_start is None:
+            raise Http404
+    if end_date:
+        parsed_end = parse_datetime(end_date)
+        if parsed_end is None:
+            raise Http404
 
     report_data = build_experiment_report(
         experiment=experiment,

src/backend/api/v1/reports/tests/test_reports_api.py

@@ -13,11 +13,14 @@ from apps.metrics.services import (
     experiment_metric_add,
     metric_definition_create,
 )
+from apps.users.tests.helpers import auth_header, make_user
 
 
 class ExperimentReportAPITest(TestCase):
     @override
     def setUp(self) -> None:
+        self.user = make_user(username="rapi_user", email="rapi@test.local")
+        self.auth = auth_header(self.user)
         self.client = Client()
         self.exposure_type = make_exposure_type()
         self.click_type = make_event_type(
@@ -75,14 +78,14 @@ class ExperimentReportAPITest(TestCase):
             ]
         )
 
-    def test_get_report_no_auth_required(self) -> None:
+    def test_report_requires_auth(self) -> None:
         resp = self.client.get(
             reverse(
                 "api-1:get_experiment_report",
                 args=[self.experiment.pk],
             ),
         )
-        self.assertEqual(resp.status_code, 200)
+        self.assertEqual(resp.status_code, 401)
 
     def test_report_structure(self) -> None:
         self._create_data()
@@ -91,6 +94,7 @@ class ExperimentReportAPITest(TestCase):
                 "api-1:get_experiment_report",
                 args=[self.experiment.pk],
             ),
+            HTTP_AUTHORIZATION=self.auth,
         )
         self.assertEqual(resp.status_code, 200)
         data = resp.json()
@@ -113,6 +117,7 @@ class ExperimentReportAPITest(TestCase):
                 "api-1:get_experiment_report",
                 args=[self.experiment.pk],
             ),
+            HTTP_AUTHORIZATION=self.auth,
         )
         data = resp.json()
         treatment = next(
@@ -138,6 +143,7 @@ class ExperimentReportAPITest(TestCase):
                 args=[self.experiment.pk],
             ),
             {"start_date": start, "end_date": end},
+            HTTP_AUTHORIZATION=self.auth,
         )
         self.assertEqual(resp.status_code, 200)
         data = resp.json()
@@ -150,5 +156,6 @@ class ExperimentReportAPITest(TestCase):
                 "api-1:get_experiment_report",
                 args=[uuid.uuid4()],
             ),
+            HTTP_AUTHORIZATION=self.auth,
         )
         self.assertEqual(resp.status_code, 404)