security(spp_api_v2_simulation): fix stale router import that breaks the API V2 app

[gonzalesedwin1123]

Problem

spp_api_v2_simulation/routers/aggregation.py was renamed to routers/analytics.py (which still exports
the aggregation_router symbol), but spp_api_v2_simulation/models/fastapi_endpoint.py was not updated —
_get_fastapi_routers() still ran from ..routers.aggregation import aggregation_router.

_get_fastapi_routers() runs during FastAPI app construction, which the dispatcher performs for a
request to the API root before endpoint-level OAuth/JWT checks. So the stale import raises
ModuleNotFoundError and aborts app creation: an unauthenticated request to the public API V2 route
can trigger it, and after a restart or cache miss the entire API V2 endpoint is effectively unavailable.

The broken import shipped in the released 2026.07 tag, and no existing test built the app
(test_router_coverage.py imports router helpers directly), so it went uncaught. Severity: medium
(unauthenticated availability/DoS of all of API V2).

Fix

One line: import aggregation_router from ..routers.analytics (the canonical current module) instead of
the removed ..routers.aggregation. The symbol name and /aggregation prefix are unchanged; no
compatibility-wrapper module (that would be cruft). No schema change → no migration.

Tests

Test-first (red → green). New tests/test_fastapi_router_inclusion.py fetches the api_v2
fastapi.endpoint, calls _get_fastapi_routers() (must not raise), and asserts the /aggregation router
is included. Before the fix it errored with
ModuleNotFoundError: No module named 'odoo.addons.spp_api_v2_simulation.routers.aggregation' (1 error of
179); after the fix ./spp t spp_api_v2_simulation → 0 failed of 179. No existing tests changed.

Notes

• Version bump 19.0.2.0.0 → 19.0.2.0.1; README.rst / static/description/index.html to be regenerated
  from CI's pinned generator.
• No sibling security branch or open PR touches spp_api_v2_simulation.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.25%. Comparing base (1caf794) to head (d2cfd03).
⚠️ Report is 3 commits behind head on 19.0.

Additional details and impacted files

@@            Coverage Diff             @@
##             19.0     #358      +/-   ##
==========================================
- Coverage   74.28%   68.25%   -6.04%     
==========================================
  Files         372      113     -259     
  Lines       25385     9305   -16080     
==========================================
- Hits        18857     6351   -12506     
+ Misses       6528     2954    -3574     

Flag	Coverage Δ
spp_analytics	?
spp_api_v2_cycles	?
spp_api_v2_entitlements	?
spp_api_v2_gis	?
spp_api_v2_programs	?
spp_api_v2_simulation	72.10% <100.00%> (+0.97%)	⬆️
spp_audit_programs	?
spp_base_common	91.07% <ø> (+0.80%)	⬆️
spp_case_demo	?
spp_case_entitlements	?
spp_case_programs	?
spp_cr_type_assign_program	?
spp_dci_compliance	?
spp_dci_demo	?
spp_dci_server_social	?
spp_demo	?
spp_demo_phl_luzon	?
spp_drims	?
spp_drims_sl	?
spp_drims_sl_demo	?
spp_farmer_registry_demo	?
spp_gis_report	?
spp_grm_demo	?
spp_indicator	?
spp_indicator_studio	?
spp_metric_service	?
spp_mis_demo_v2	?
spp_programs	65.27% <ø> (+<0.01%)	⬆️
spp_registry	86.94% <ø> (+0.10%)	⬆️
spp_security	69.56% <ø> (+2.89%)	⬆️
spp_simulation	?

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
spp_api_v2_simulation/models/fastapi_endpoint.py	100.00% <100.00%> (+56.25%)	⬆️

... and 259 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.