M39: harden application and acceptance gates

backend/app/api/routers/audit.py

@@ -44,6 +44,13 @@ _ROUTE_TEMPLATES: dict[str, str] = {
 }
 
 
+def _as_utc(value: datetime | None) -> datetime | None:
+    """Treat naive query datetimes as UTC so they compare safely with aware values."""
+    if value is None:
+        return None
+    return value if value.tzinfo is not None else value.replace(tzinfo=UTC)
+
+
 @router.get("/export.csv")
 def export_audit_csv(
     occurred_from: datetime | None = Query(default=None),
@@ -51,8 +58,8 @@ def export_audit_csv(
     db: Session = Depends(get_db),
     actor: CurrentUser = Depends(require_operations_manager),
 ) -> Response:
-    end = occurred_to or datetime.now(UTC)
-    start = occurred_from or end - timedelta(days=30)
+    end = _as_utc(occurred_to) or datetime.now(UTC)
+    start = _as_utc(occurred_from) or end - timedelta(days=30)
     if end <= start or end - start > timedelta(days=90):
         raise HTTPException(status_code=422, detail="Audit export range must be 1 to 90 days")
     events = db.scalars(
@@ -133,7 +140,7 @@ def list_audit_events(
     action: str | None = Query(default=None),
     entity_type: str | None = Query(default=None),
     entity_ref: str | None = Query(default=None, min_length=1, max_length=100),
-    correlation_id: str | None = Query(default=None),
+    correlation_id: uuid.UUID | None = Query(default=None),
     occurred_from: datetime | None = Query(default=None),
     occurred_to: datetime | None = Query(default=None),
     page: int | None = Query(default=None, ge=1),