pal-e-docs

Validation: basketball-api#432 — GET /api/jersey-public-orders admin endpoint

validation-432-2026-04-11 Doc

validation pass
Project

Validation: basketball-api#432 — GET /api/jersey-public-orders admin endpoint

Verdict: PASS — 2026-04-11. PR #451 merged via squash. T5 of System B production rollout.

Acceptance criteria

  • ✅ Auth: require_admin = require_role("admin"), Depends(require_admin) on endpoint. Unauth → 401, non-admin → 403, admin → 200.
  • ✅ T3's POST handler byte-identical (only import-line expansions in diff)
  • ✅ Inline Pydantic v2 schemas JerseyPublicOrderListItem + JerseyPublicOrderListResponse
  • ✅ Response includes submitter_keycloak_sub, excludes submission_ip
  • ✅ Hard cap at 500 via min(limit, 500) + negative-input clamp
  • ✅ Stable ordering: created_at DESC, id DESC
  • ✅ total count after filters but before offset/limit
  • ✅ Status filter validates against ('pending','reviewed','fulfilled','cancelled') → 400 on invalid
  • ✅ Date filter accepts ISO YYYY-MM-DD via FastAPI date type
  • ✅ status_filter rename + Query(alias="status") avoids shadowing fastapi.status import while preserving public API contract
  • ✅ Files NOT touched: checkout.py, jersey.py, models.py, main.py, auth.py, alembic/*
  • ✅ 37 tests pass (24 T3 + 13 new T5)
  • ✅ Tests mock auth via dependency_overrides
  • ✅ Ruff clean

Production verification still needed

After basketball-api ArgoCD reconciles, verify GET /api/jersey-public-orders with admin JWT returns 200 + list. Without auth → 401. With non-admin JWT → 403.

Nits captured for plan Epilogue per `feedback_nits_to_epilogue.md`

  • Limit-clamp test only seeds 5 rows — can't actually prove 501+ gets clamped to 500
  • to_date uses <= with a date type, so ?to_date=2026-04-05 excludes rows after midnight on April 5. Half-open range may surprise admin users — document or coerce +1 day
  • Test file has mid-file imports (# noqa: E402) — cleaner at top
  • _seed_order commits per row — fine at current scale

What this unblocks

  • T6 (#951, westside-landing #244) — admin jersey-orders page can now query this endpoint
  • End-to-end admin review flow for System B
  • arch-jersey-intake
  • story:WS-S31
  • validation-430-2026-04-11 — sister POST endpoint validation