Follow-up from #59 / PR #66 (raised by the /simplify + /code-review passes).
Several handlers type path/query/body ids as str and coerce with uuid.UUID(...). After #66 a malformed id fails closed (403 via the authz helper) or 404, but a cleaner contract is to type these params as UUID so FastAPI returns a 422 with a clear validation error before the handler runs. Sites include practice.assign_practice/get_practice_summary (student_id), overrides (target_id), and others.
Orthogonal to access control; deferred from #66 because it touches request-validation behavior and possibly the Rails caller contract (error shape changes from 403/404 to 422). Sweep the handlers and retype consistently.
Follow-up from #59 / PR #66 (raised by the /simplify + /code-review passes).
Several handlers type path/query/body ids as
strand coerce withuuid.UUID(...). After #66 a malformed id fails closed (403 via the authz helper) or 404, but a cleaner contract is to type these params asUUIDso FastAPI returns a 422 with a clear validation error before the handler runs. Sites includepractice.assign_practice/get_practice_summary(student_id),overrides(target_id), and others.Orthogonal to access control; deferred from #66 because it touches request-validation behavior and possibly the Rails caller contract (error shape changes from 403/404 to 422). Sweep the handlers and retype consistently.