Harden RC7 API response contracts

backend/app/api/routes/projects.py

@@ -7,14 +7,15 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy.orm import Session
 
 from app.db.session import get_db
-from app.schemas.project import ProjectCreate, ProjectRead, ProjectUpdate
+from app.schemas import Envelope
+from app.schemas.project import ProjectCreate, ProjectDeleteResult, ProjectList, ProjectRead, ProjectUpdate
 from app.services.project_service import ProjectService
 from app.utils.response import envelope
 
 router = APIRouter(prefix="/projects", tags=["projects"])
 
 
-@router.get("", response_model=dict)
+@router.get("", response_model=Envelope[ProjectList])
 def list_projects(
     limit: int = Query(default=50, ge=1, le=200),
     offset: int = Query(default=0, ge=0),
@@ -32,13 +33,13 @@ def list_projects(
     return envelope({"items": [ProjectRead.model_validate(item).model_dump() for item in projects], "total": total, "limit": limit, "offset": offset})
 
 
-@router.post("", status_code=status.HTTP_201_CREATED, response_model=dict)
+@router.post("", status_code=status.HTTP_201_CREATED, response_model=Envelope[ProjectRead])
 def create_project(payload: ProjectCreate, db: Session = Depends(get_db)):
     project = ProjectService.create_project(db, payload)
     return envelope(ProjectRead.model_validate(project).model_dump())
 
 
-@router.get("/{project_id}", response_model=dict)
+@router.get("/{project_id}", response_model=Envelope[ProjectRead])
 def get_project(project_id: UUID, db: Session = Depends(get_db)):
     project = ProjectService.get_project(db, project_id)
     if not project:
@@ -46,7 +47,7 @@ def get_project(project_id: UUID, db: Session = Depends(get_db)):
     return envelope(ProjectRead.model_validate(project).model_dump())
 
 
-@router.patch("/{project_id}", response_model=dict)
+@router.patch("/{project_id}", response_model=Envelope[ProjectRead])
 def update_project(project_id: UUID, payload: ProjectUpdate, db: Session = Depends(get_db)):
     project = ProjectService.update_project(db, project_id, payload)
     if not project:
@@ -54,7 +55,11 @@ def update_project(project_id: UUID, payload: ProjectUpdate, db: Session = Depen
     return envelope(ProjectRead.model_validate(project).model_dump())
 
 
-@router.delete("/{project_id}", status_code=status.HTTP_200_OK, response_model=dict)
+@router.delete(
+    "/{project_id}",
+    status_code=status.HTTP_200_OK,
+    response_model=Envelope[ProjectDeleteResult],
+)
 def delete_project(project_id: UUID, db: Session = Depends(get_db)):
     if not ProjectService.delete_project(db, project_id):
         raise HTTPException(status_code=404, detail="Project not found")