fix(api): don't scope serializer querysets by AnonymousUser during schema generation

The Finding and import serializers scope their endpoint/location
PrimaryKeyRelatedField querysets to request.user. During OpenAPI schema
generation drf-spectacular instantiates serializers with an AnonymousUser
request, which is truthy, so the `if user` branch called
get_authorized_*(user=AnonymousUser); filtering a PK field by the AnonymousUser
instance raised "Field 'id' expected a number but got AnonymousUser".
drf-spectacular then ignored the affected views, producing an operationId
collision and a KeyError in the prefetch postprocessing hook.

Treat an unauthenticated user as no user so the field falls back to an empty
queryset, matching pre-existing behavior for anonymous/schema-time contexts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Maffooch

dojo/api_v2/serializers.py

@@ -518,6 +518,12 @@ def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         # Scope endpoint_to_add to the locations/endpoints the requesting user is authorized for.
         user = getattr(self.context.get("request"), "user", None)
+        # An unauthenticated user (e.g. AnonymousUser during OpenAPI schema
+        # generation, where the request has no real user) is truthy but cannot
+        # be authorization-scoped; treat it as no user so the field falls back to
+        # an empty queryset instead of raising on the AnonymousUser instance.
+        if user is not None and not user.is_authenticated:
+            user = None
         if not settings.V3_FEATURE_LOCATIONS:
             # TODO: why do we allow only existing endpoints?
             self.fields["endpoint_to_add"] = serializers.PrimaryKeyRelatedField(

dojo/finding/api/serializer.py

@@ -354,6 +354,12 @@ def __init__(self, *args, **kwargs):
         # Scope the endpoints field to the references the requesting user is authorized
         # for, mirroring the scoping the finding UI form already applies.
         user = getattr(self.context.get("request"), "user", None)
+        # An unauthenticated user (e.g. AnonymousUser during OpenAPI schema
+        # generation, where the request has no real user) is truthy but cannot
+        # be authorization-scoped; treat it as no user so the field falls back to
+        # an empty queryset instead of raising on the AnonymousUser instance.
+        if user is not None and not user.is_authenticated:
+            user = None
         if not settings.V3_FEATURE_LOCATIONS:
             self.fields["endpoints"] = serializers.PrimaryKeyRelatedField(
                 many=True, required=False,