[Feature] : API ENDPOINTS PR 5 : Result Data and Baseline Approval

[pulk17]

[FEATURE]

In raising this pull request, I confirm the following (please check boxes):

• I have read and understood the contributors guide.
• I have checked that another pull request for this purpose does not exist.
• I have considered, and confirmed that this submission will be valuable to others.
• I accept that this submission may not be used, and the pull request closed at the will of the maintainer.
• I give this submission freely, and claim no ownership to its content.

My familiarity with the project is as follows (check one):

• I have never used the project.
• I have used the project briefly.
• I have used the project extensively, but have not contributed previously.
• I am an active contributor to the project.

---

Overview

Fifth PR of the CI API stack (#1130 → #1141, merge bottom-up). Access to the actual output artifacts behind a result — expected files, produced files, diffs — plus the admin workflow for accepting a changed output as the new baseline.

Endpoints

• GET /runs/{id}/samples/{sid}/regression-tests/{rid}/outputs/{oid}/expected
• GET .../outputs/{oid}/actual
• GET .../outputs/{oid}/diff
• POST /runs/{id}/samples/{sid}/baseline-approval

File content semantics

• Content is returned inline as utf-8 or base64 (?format), truncated at 1 MiB. The sha256 field always covers the complete file even when content is truncated, so clients can verify a full download against it. Truncated responses include a download_url (signed GCS URL when available); storage_status distinguishes ok/degraded/missing.
• When the produced output matched the baseline (got IS NULL, i.e. nothing was stored separately), /actual responds with a relative 303 to /expected. Relative on purpose: HTTP clients only resend the Authorization header on same-origin redirects, and an absolute URL would also break behind a reverse proxy.
• Diffs come as structured hunks (line numbers on both sides, context/added/removed kinds) or classic unified text via ?format=unified.
• All file paths are resolved through safe_resolve, which rejects traversal attempts — covered by tests.

Baseline approval

POST .../baseline-approval (admin role + baselines:write) repoints the RegressionTestOutput baseline at the produced output's hash, optionally deleting variant files (remove_variants). Guardrails, each tested:

• 422 if the output already matches (nothing to approve)
• 422 if the produced file is missing from storage (never approve what can't be verified)
• 422 for dummy rows (test produced no output at all)
• 404 if the regression test doesn't belong to the sample in the URL

Because this mutates a global baseline (affecting every future run), every approval is audit-logged with the approving user, run, regression test, and output ids.

Testing

24 new tests; 164 total at this layer. Content encodings, truncation + sha256 semantics, the 303 redirect round-trip, structured and unified diffs, approval happy path + every rejection path, role/scope boundaries (contributor with baselines:write still 403s), and path traversal.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud