Harden auth and persist report schedules

app/models/__init__.py

@@ -7,6 +7,7 @@ Exports all SQLAlchemy ORM models for use in the application.
 from app.database import Base
 from app.models.ai_generation_run import AIGenerationRun
 from app.models.item import Item
+from app.models.report_schedule import ReportScheduleModel
 from app.models.session import Session
 from app.models.tryout import Tryout
 from app.models.tryout_import_snapshot import TryoutImportSnapshot
@@ -25,6 +26,7 @@ __all__ = [
     "TryoutImportSnapshot",
     "TryoutSnapshotQuestion",
     "Item",
+    "ReportScheduleModel",
     "Session",
     "UserAnswer",
     "TryoutStats",

app/models/report_schedule.py

@@ -0,0 +1,46 @@
+"""
+Persistent report schedule model.
+"""
+
+from datetime import datetime
+from typing import Optional
+
+from sqlalchemy import Boolean, DateTime, ForeignKey, Index, JSON, String, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.database import Base
+
+
+class ReportScheduleModel(Base):
+    """Database-backed report schedule configuration."""
+
+    __tablename__ = "report_schedules"
+
+    id: Mapped[int] = mapped_column(primary_key=True, autoincrement=True)
+    schedule_id: Mapped[str] = mapped_column(
+        String(36),
+        nullable=False,
+        unique=True,
+        index=True,
+        comment="Public schedule identifier",
+    )
+    report_type: Mapped[str] = mapped_column(String(50), nullable=False)
+    schedule: Mapped[str] = mapped_column(String(20), nullable=False)
+    tryout_ids: Mapped[list[str]] = mapped_column(JSON, nullable=False)
+    website_id: Mapped[int] = mapped_column(
+        ForeignKey("websites.id", ondelete="CASCADE", onupdate="CASCADE"),
+        nullable=False,
+        index=True,
+    )
+    recipients: Mapped[list[str]] = mapped_column(JSON, nullable=False)
+    format: Mapped[str] = mapped_column(String(10), nullable=False, default="xlsx")
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now()
+    )
+    last_run: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True), nullable=True)
+    next_run: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True), nullable=True)
+    is_active: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
+
+    __table_args__ = (
+        Index("ix_report_schedules_website_active", "website_id", "is_active"),
+    )