refactor(spp_dci_client_dr): route callback envelope unwrap through dr_parsing

The callback path duplicated `data.get("reg_records", [])` without the
type guards and WARN logging now centralized in `unwrap_search_data`.
A malformed `data` envelope was silently coerced to `{}` and skipped,
hiding spec drift from operators. Route through the shared helper so
both sync and callback paths get identical validation behavior.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: jeremi

spp_dci_client_dr/routers/callback.py

@@ -15,7 +15,7 @@
 from fastapi import APIRouter, Depends, HTTPException, Request, status
 
 from ..middleware.signature import verify_dr_signature
-from ..services.dr_parsing import extract_disability_data
+from ..services.dr_parsing import extract_disability_data, unwrap_search_data
 
 _logger = logging.getLogger(__name__)
 
@@ -151,8 +151,7 @@ def _process_dr_search_result(env: Environment, result: dict, source_registry: s
             )
             return
 
-        data = result.get("data", {})
-        reg_records = data.get("reg_records", [])
+        reg_records = unwrap_search_data(result.get("data"))
 
         for record in reg_records:
             # Extract identifiers to find matching partner

spp_dci_client_dr/tests/test_callback.py

@@ -166,6 +166,26 @@ def test_non_success_status_is_skipped(self):
         self.assertEqual(len(status), 0)
         mock_find.assert_not_called()
 
+    def test_malformed_envelope_warns_and_does_not_crash(self):
+        """`data` of an unexpected type is rejected by unwrap_search_data with a WARN
+        rather than crashing the callback or silently processing garbage."""
+        from odoo.addons.spp_dci_client_dr.routers.callback import _process_dr_search_result
+
+        result = {
+            "status": "succ",
+            "data": "not-an-envelope",
+        }
+
+        with (
+            patch(
+                "odoo.addons.spp_dci_client_dr.routers.callback._find_partner_by_identifier",
+            ) as mock_find,
+            self.assertLogs("odoo.addons.spp_dci_client_dr.services.dr_parsing", level="WARNING"),
+        ):
+            _process_dr_search_result(self.env, result, "test-source-registry")
+
+        mock_find.assert_not_called()
+
     def test_update_overwrites_existing_record(self):
         """Calling _process_dr_search_result twice updates the existing record."""
         from odoo.addons.spp_dci_client_dr.routers.callback import _process_dr_search_result