fix: allow admins to downoad all reports

[Fidelisaboke]

User description

Description

• This also changes non-ready report response to error 403 instead of 404

---

PR Type

Bug fix, Enhancement

---

Description

• Allow admins to download all reports, not just their own

• Change non-ready report error from 404 to 403

• Make download_report endpoint async for better performance

---

Diagram Walkthrough

flowchart LR
  A["Download Report Request"] --> B{"Is Admin?"}
  B -->|Yes| C["Allow Download"]
  B -->|No| D{"Owner Check"}
  D -->|Pass| E{"Report Ready?"}
  D -->|Fail| F["403 Forbidden"]
  E -->|Yes| C
  E -->|No| G["403 Forbidden"]
  C --> H["Stream CSV File"]

Loading

File Walkthrough

	Relevant files
Bug fix	reports.py Admin report download and error code fixes                              backend/api/routers/reports.py Modified download_report function to be async Updated security check to allow admins to download any report Changed error status code from 404 to 403 for non-ready reports Improved comment to clarify admin exception in ownership check +4/-4

---

The managed version of the open source project PR-Agent is sunsetting on the 1st December 2025. The commercial version of this project will remain available and free to use as a hosted service. Install Qodo.

[codiumai-pr-agent-free]

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢	No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Passed
🔴	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Missing Audit Logging: The download_report function lacks audit logging for the critical action of downloading reports, especially for admin access to others' reports. Referred Code async def download_report( report_id: int, current_user: User = Depends(get_current_active_user), report_service: ReportService = Depends(get_report_service), ): """ Downloads the generated report file if it's ready. 1. Checks if the report belongs to the user. 2. Checks if the report status is 'READY'. 3. Streams the CSV file to the user. """ report = report_service.get_report(report_id) # Security check: User can only download their own reports, unless they are admin if not current_user.is_admin and report.owner_id != current_user.id: raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not your report") if report.status != ReportStatus.READY: raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Report is not ready or has failed") if not report.file_path or not os.path.exists(report.file_path): ... (clipped 3 lines)
⚪	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Absent Logging Implementation: The download_report function doesn't implement any logging for admin access to reports, which may be required for security auditing. Referred Code if not current_user.is_admin and report.owner_id != current_user.id: raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not your report")

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

The managed version of the open source project PR-Agent is sunsetting on the 1st December 2025. The commercial version of this project will remain available and free to use as a hosted service. Install Qodo.

[codiumai-pr-agent-free]

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢	No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Passed
🔴	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Missing Audit Logging: The download_report function lacks audit logging for the critical action of downloading reports, especially for admin users accessing others' reports. Referred Code # Security check: User can only download their own reports, unless they are admin if not current_user.is_admin and report.owner_id != current_user.id: raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not your report")
⚪	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: No Logging Implementation: The code lacks any logging implementation for report downloads, especially for admin access to others' reports which should be audited. Referred Code # Security check: User can only download their own reports, unless they are admin if not current_user.is_admin and report.owner_id != current_user.id: raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not your report")

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

The managed version of the open source project PR-Agent is sunsetting on the 1st December 2025. The commercial version of this project will remain available and free to use as a hosted service. Install Qodo.

[codiumai-pr-agent-free]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Handle cases where report is not found Add a check to ensure the report exists after fetching it, and raise a 404 error if it's not found to prevent a potential server error. backend/api/routers/reports.py [92-96] report = report_service.get_report(report_id) +if not report: + raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Report not found") # Security check: User can only download their own reports, unless they are admin if not current_user.is_admin and report.owner_id != current_user.id: raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not your report") Apply / Chat Suggestion importance[1-10]: 8 __ Why: The suggestion correctly identifies a potential AttributeError if report_service.get_report returns None, preventing a 500 server error by adding a necessary null check.	Medium
More

The managed version of the open source project PR-Agent is sunsetting on the 1st December 2025. The commercial version of this project will remain available and free to use as a hosted service. Install Qodo.